netdev - Re: [Patch net] net_sched: avoid generating same handle for u32 filters

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <53CAEC2F.4050808@mojatatu.com>
Date:	Sat, 19 Jul 2014 18:07:43 -0400
From:	Jamal Hadi Salim <jhs@...atatu.com>
To:	Cong Wang <xiyou.wangcong@...il.com>, netdev@...r.kernel.org
CC:	"David S. Miller" <davem@...emloft.net>,
	Cong Wang <cwang@...pensource.com>
Subject: Re: [Patch net] net_sched: avoid generating same handle for u32 filters

On 07/17/14 20:34, Cong Wang wrote:
> From: Cong Wang <cwang@...pensource.com>
>
> When kernel generates a handle for a u32 filter, it tries to start
> from the max in the bucket. So when we have a filter with the max (fff)
> handle, it will cause kernel always generates the same handle for new
> filters. This can be shown by the following command:
>
> 	tc qdisc add dev eth0 ingress
> 	tc filter add dev eth0 parent ffff: protocol ip pref 770 handle 800::fff u32 match ip protocol 1 0xff
> 	tc filter add dev eth0 parent ffff: protocol ip pref 770 u32 match ip protocol 1 0xff
> 	...
>
> we will get some u32 filters with same handle:
>
>   # tc filter show dev eth0 parent ffff:
> filter protocol ip pref 770 u32
> filter protocol ip pref 770 u32 fh 800: ht divisor 1
> filter protocol ip pref 770 u32 fh 800::fff order 4095 key ht 800 bkt 0
>    match 00010000/00ff0000 at 8
> filter protocol ip pref 770 u32 fh 800::fff order 4095 key ht 800 bkt 0
>    match 00010000/00ff0000 at 8
> filter protocol ip pref 770 u32 fh 800::fff order 4095 key ht 800 bkt 0
>    match 00010000/00ff0000 at 8
> filter protocol ip pref 770 u32 fh 800::fff order 4095 key ht 800 bkt 0
>    match 00010000/00ff0000 at 8
>
> handles should be unique. This patch fixes it by looking up a bitmap,
> so that can guarantee the handle is as unique as possible. For compatibility,
> we still start from 0x800.
>

No fundamental objection - question though: What happens if i was to 
specify the handle when i provision the filter?
Side note: these handles + other info are used to "route" around
hash trees for filters.

I apologize in advance if i am slow in responding; i am on travel mode.

cheers,
jamal
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html