netdev - Re: [net-next, RFC PATCH] net: sched: cls_range: Introduce Range classifier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM_iQpVHGSHvpaf5KpBFa8pU=wWQt1mpptn+uKwAOpVzcxbrXQ@mail.gmail.com>
Date:   Fri, 14 Sep 2018 14:06:48 -0700
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     amritha.nambiar@...el.com
Cc:     Linux Kernel Network Developers <netdev@...r.kernel.org>,
        David Miller <davem@...emloft.net>,
        Alexander Duyck <alexander.h.duyck@...el.com>,
        Jakub Kicinski <jakub.kicinski@...ronome.com>,
        sridhar.samudrala@...el.com, Jamal Hadi Salim <jhs@...atatu.com>,
        Jesse Brandeburg <jesse.brandeburg@...el.com>,
        Jiri Pirko <jiri@...nulli.us>
Subject: Re: [net-next, RFC PATCH] net: sched: cls_range: Introduce Range classifier

On Thu, Sep 13, 2018 at 6:53 PM Amritha Nambiar
<amritha.nambiar@...el.com> wrote:
>
> This patch introduces a range classifier to support filtering based
> on ranges. Only port-range filters are supported currently. This can
> be combined with flower classifier to support filters that are a
> combination of port-ranges and other parameters based on existing
> fields supported by cls_flower.

Why should we have a special-purpose filter just for ports here?

We have achieved almost the same goal with u32 filter:

https://github.com/apache/mesos/blob/master/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp

There is a large overlap with other general purpose filters.

I don't see you provide any justification for the purpose of it. If
it is just for convenience, can't we just make it on top of other
general purpose header-matching filters?