netdev - broken behaviour of TC filter delete

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 23 Aug 2018 17:39:22 -0400
From:   Roman Mashak <mrv@...atatu.com>
To:     netdev@...r.kernel.org
Cc:     jiri@...lanox.com, Jamal Hadi Salim <jhs@...atatu.com>
Subject: broken behaviour of TC filter delete

It appears that the following commit changed the behaviour of scenario where a
filter is deleted twice:

commit f71e0ca4db187af7c44987e9d21e9042c3046070
Author: Jiri Pirko <jiri@...lanox.com>
Date:   Mon Jul 23 09:23:05 2018 +0200

    net: sched: Avoid implicit chain 0 creation

Steps to reproduce :

1) create dummy device
   $ ip link add dev dummy0 type dummy

2) create qdisc
   $ tc qdisc add dev dummy0 ingress

3) create simple u32 filter with action attached
   $ tc filter add dev dummy0 parent ffff: protocol ip prio 1 u32 match ip src 10.10.10.1/32 action ok

4) list the filter
   $ tc filter ls dev dummy0 parent ffff:

5) delete the filter with the given protocol and priority
   $ tc filter del dev dummy0 parent ffff: protocol ip prio 1

6) repeat step 5, this will return -ENOENT ("Error: Filter with specified priority/protocol not found.")
However, before the change at step 6 we would get -EINVAL (Error: Cannot find specified filter chain.)
and that makes sense.

The change breaks a number of our internal TC tests.