netdev - Re: [PATCH v2.50 2/6] ofp-actions: Account for OF version when enforcing action consistency

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 15 Nov 2013 14:34:14 -0800
From:	Ben Pfaff <blp@...ira.com>
To:	Simon Horman <horms@...ge.net.au>
Cc:	dev@...nvswitch.org, netdev@...r.kernel.org,
	Jesse Gross <jesse@...ira.com>,
	Pravin B Shelar <pshelar@...ira.com>,
	Ravi K <rkerur@...il.com>, Joe Stringer <joe@...d.net.nz>
Subject: Re: [PATCH v2.50 2/6] ofp-actions: Account for OF version when
 enforcing action consistency

On Fri, Nov 15, 2013 at 06:10:19PM +0900, Simon Horman wrote:
> The aim of this patch is to provide infrastructure to differentiate
> between OpenFlow1.1 - 1.2 and OpenFlow1.3+ consistency checking. It
> also provides enhanced OpenFlow1.0 consistency checking.
> 
> Some different versions of OpenFlow require different consistency
> checking.
> 
> 1. OpenFlow1.0
> 
>    This variant implicitly pushes a VLAN tag if one doesn't exist
>    and an action to modify a VLAN tag is encountered.
> 
>    MPLS push is supported as a Nicira extension whose behaviour is
>    the same as OpenFlow1.1 - 1.2.
> 
>    In practice Open vSwitch allows inconsistent OpenFlow 1.0 actions so
>    this portion of the change is just for completeness. I do not believe it
>    has any run-time affect. And I would not be opposed to folding this case
>    into the handling of OpenFlow1.1 - 1.2.
> 
> 2. OpenFlow1.1 - 1.2
> 
>    This does not have the implicit VLAN tag push behaviour of OpenFlow1.0.
> 
>    An MPLS push action pushes an MPLS LSE after any VLAN tags that are
>    present. This is pre-OpenFlow1.3 tag ordering.
> 
> 3. OpenFlow1.3+
> 
>    This does not have the implicit VLAN tag push behaviour of OpenFlow1.0.
> 
>    An MPLS push action pushes an MPLS LSE before any VLAN tags that are
>    present. This is OpenFlow1.3+ tag ordering. Its implication
>    is that after an MPLS push action a packet is no longer a VLAN
>    packet as there are no longer any VLAN tags immediately after
>    the ethernet header: there is now an MPLS LSE there.
> 
>    Currently Open vSwitch does not implement OpenFlow1.3+ tag ordering
>    so this patch uses the same consistency checking for OpenFlow1.3+
>    as for OpenFlow1.1 - 1.2.
> 
>    A subsequent patch, which implements OpenFlow1.3+ tag ordering,
>    makes use of the infrastructure provided by this patch to check
>    actions accordingly.
> 
> Unfortunately ofpact_get_SET_VLAN_VID(a)->push_vlan_if_needed and similar
> devices can't be used in order to implement logic as they are not set when
> when ofpact_check__() is called via parse_ofp_str().
> 
> Instead this patch takes the approach of adding an OpenFlow version
> parameter to ofpact_check__().
> 
> A new function ofpact_check_usable_protocols() allows trimming the
> usable_protocols based on action checking.
> 
> The net effect of this change on run-time is only to increase logging under
> some circumstances as ofpacts_check() may now be called up to four times
> instead of up to twice for each invocation of parse_ofp_str__()
> 
> Signed-off-by: Simon Horman <horms@...ge.net.au>

I think I have a better way.  I posted patches:
        http://openvswitch.org/pipermail/dev/2013-November/033968.html
        http://openvswitch.org/pipermail/dev/2013-November/033967.html
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html