linux-kernel - Re: [PATCH net-next v2 2/3] net: ethernet: ti: am65-cpsw: enable bc/mc storm prevention support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 3 Nov 2021 16:07:42 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Grygorii Strashko <grygorii.strashko@...com>
Cc:     "David S. Miller" <davem@...emloft.net>, <netdev@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>,
        Kishon Vijay Abraham I <kishon@...com>,
        Vignesh Raghavendra <vigneshr@...com>,
        <linux-omap@...r.kernel.org>, Tony Lindgren <tony@...mide.com>,
        Andrew Lunn <andrew@...n.ch>,
        Vladimir Oltean <vladimir.oltean@....com>
Subject: Re: [PATCH net-next v2 2/3] net: ethernet: ti: am65-cpsw: enable
 bc/mc storm prevention support

On Thu, 4 Nov 2021 00:20:30 +0200 Grygorii Strashko wrote:
> On 03/11/2021 02:38, Jakub Kicinski wrote:
> > On Mon, 1 Nov 2021 19:01:21 +0200 Grygorii Strashko wrote:  
> >>   - 01:00:00:00:00:00 fixed value has to be used for MC packets rate
> >>     limiting (exact match)  
> > 
> > This looks like a stretch, why not use a mask? You can require users to
> > always install both BC and MC rules if you want to make sure the masked
> > rule does not match BC.
> >   
> 
> Those matching rules are hard coded in HW for packet rate limiting and SW only
> enables them and sets requested pps limit.
> - 1:BC: HW does exact match on BC MAC address
> - 2:MC: HW does match on MC bit (the least-significant bit of the first octet)
> 
> Therefore the exact match done in this patch for above dst_mac's with
> is_broadcast_ether_addr() and ether_addr_equal().

Right but flower supports masked matches for dest address, as far as I
can tell. So you should check the mask is what you expect as well, not
just look at the key. Mask should be equal to key in your case IIUC, so:

	if (is_broadcast_ether_addr(match.key->dst) &&
	    is_broadcast_ether_addr(match.mask->dst))

and

	if (!memcmp(match.key->dst, mc_mac, ETH_ALEN) &&
	    !memcmp(match.mask->dst, mc_mac, ETH_ALEN))

I think you should also test that the mask, not the key of source addr
is zero.

Note that ether_addr_equal() assumes the mac address is alinged to 2,
which I'm not sure is the case here.

Also you can make mc_mac a static const.

> The K3 cpsw also supports number configurable policiers (bit rate limit) in
> ALE for which supports is to be added, and for them MC mask (sort of, it uses
> number of ignored bits, like FF-FF-FF-00-00-00) can be used.