netdev - Re: [ovs-dev] [RFC PATCH net v2 2/2] openvswitch: Only set mark and labels with a commit flag.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAPWQB7GorwL3dWQxLv6ZkJKPA6Vy6aKucR_Er9CjF9vvH5ZPZg@mail.gmail.com>
Date:	Tue, 21 Jun 2016 17:25:28 -0700
From:	Joe Stringer <joe@....org>
To:	Jarno Rajahalme <jarno@....org>
Cc:	netdev <netdev@...r.kernel.org>, ovs dev <dev@...nvswitch.org>
Subject: Re: [ovs-dev] [RFC PATCH net v2 2/2] openvswitch: Only set mark and
 labels with a commit flag.

On 21 June 2016 at 14:59, Jarno Rajahalme <jarno@....org> wrote:
> Only set conntrack mark or labels when the commit flag is specified.
> This makes sure we can not set them before the connection has been
> persisted, as in that case the mark and labels would be lost in an
> event of an userspace upcall.
>
> OVS userspace already requires the commit flag to accept setting
> ct_mark and/or ct_labels.  Validate for this in the kernel API.
>
> Signed-off-by: Jarno Rajahalme <jarno@....org>

As this is walling off an inconsistent corner of the ct action, and
OVS userspace already enforces this constraint, this looks OK to me.