netdev - Re: [iproute2-next PATCH v3 2/2] man: tc-flower: Add explanation for range option

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 20 Nov 2018 21:46:34 -0700
From:   David Ahern <dsahern@...il.com>
To:     "Nambiar, Amritha" <amritha.nambiar@...el.com>,
        stephen@...workplumber.org, netdev@...r.kernel.org
Cc:     jakub.kicinski@...ronome.com, sridhar.samudrala@...el.com,
        jhs@...atatu.com, xiyou.wangcong@...il.com, jiri@...nulli.us
Subject: Re: [iproute2-next PATCH v3 2/2] man: tc-flower: Add explanation for
 range option

On 11/20/18 9:44 PM, Nambiar, Amritha wrote:
> On 11/20/2018 2:56 PM, David Ahern wrote:
>> On 11/15/18 5:55 PM, Amritha Nambiar wrote:
>>> Add details explaining filtering based on port ranges.
>>>
>>> Signed-off-by: Amritha Nambiar <amritha.nambiar@...el.com>
>>> ---
>>>  man/man8/tc-flower.8 |   12 ++++++++++--
>>>  1 file changed, 10 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/man/man8/tc-flower.8 b/man/man8/tc-flower.8
>>> index 8be8882..768bfa1 100644
>>> --- a/man/man8/tc-flower.8
>>> +++ b/man/man8/tc-flower.8
>>> @@ -56,8 +56,10 @@ flower \- flow based traffic control filter
>>>  .IR MASKED_IP_TTL " | { "
>>>  .BR dst_ip " | " src_ip " } "
>>>  .IR PREFIX " | { "
>>> -.BR dst_port " | " src_port " } "
>>> -.IR port_number " } | "
>>> +.BR dst_port " | " src_port " } { "
>>> +.IR port_number " | "
>>> +.B range
>>> +.IR min_port_number-max_port_number " } | "
>>>  .B tcp_flags
>>>  .IR MASKED_TCP_FLAGS " | "
>>>  .B type
>>> @@ -227,6 +229,12 @@ Match on layer 4 protocol source or destination port number. Only available for
>>>  .BR ip_proto " values " udp ", " tcp  " and " sctp
>>>  which have to be specified in beforehand.
>>>  .TP
>>> +.BI range " MIN_VALUE-MAX_VALUE"
>>> +Match on a range of layer 4 protocol source or destination port number. Only
>>> +available for
>>> +.BR ip_proto " values " udp ", " tcp  " and " sctp
>>> +which have to be specified in beforehand.
>>> +.TP
>>>  .BI tcp_flags " MASKED_TCP_FLAGS"
>>>  Match on TCP flags represented as 12bit bitfield in in hexadecimal format.
>>>  A mask may be optionally provided to limit the bits which are matched. A mask
>>>
>>
>> This prints as:
>>
>> dst_port NUMBER
>> src_port NUMBER
>>       Match  on  layer  4  protocol source or destination port number.
>>       Only available for ip_proto values udp, tcp and sctp which  have
>>       to be specified in beforehand.
>>
>> range MIN_VALUE-MAX_VALUE
>>       Match  on a range of layer 4 protocol source or destination port
>>       number. Only available for ip_proto values  udp,  tcp  and  sctp
>>       which have to be specified in beforehand.
>>
>> ###
>>
>> That makes it look like range is a standalone option - independent of
>> dst_port/src_port.
>>
>> It seems to me the dst_port / src_port should be updated to:
>>
>> dst_port {NUMBER | range MIN_VALUE-MAX_VALUE}
>>
>> with the description updated for both options and indented under
>> dst_port / src_port
>>
> 
> Okay, will do.
> 

Thinking about this perhaps the 'range' keyword can just be dropped. We
do not use it in other places -- e.g., ip rule.