netdev - Re: [iproute2-next PATCH v6] tc: flower: Classify packets based port ranges

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 3 Dec 2018 15:58:32 -0800
From:   "Nambiar, Amritha" <amritha.nambiar@...el.com>
To:     David Ahern <dsahern@...il.com>, stephen@...workplumber.org,
        netdev@...r.kernel.org
Cc:     jakub.kicinski@...ronome.com, sridhar.samudrala@...el.com,
        jhs@...atatu.com, xiyou.wangcong@...il.com, jiri@...nulli.us
Subject: Re: [iproute2-next PATCH v6] tc: flower: Classify packets based port
 ranges

On 12/3/2018 3:52 PM, David Ahern wrote:
> On 11/27/18 3:40 PM, Amritha Nambiar wrote:
>> Added support for filtering based on port ranges.
>> UAPI changes have been accepted into net-next.
>>
>> Example:
>> 1. Match on a port range:
>> -------------------------
>> $ tc filter add dev enp4s0 protocol ip parent ffff:\
>>   prio 1 flower ip_proto tcp dst_port 20-30 skip_hw\
>>   action drop
>>
>> $ tc -s filter show dev enp4s0 parent ffff:
>> filter protocol ip pref 1 flower chain 0
>> filter protocol ip pref 1 flower chain 0 handle 0x1
>>   eth_type ipv4
>>   ip_proto tcp
>>   dst_port 20-30
>>   skip_hw
>>   not_in_hw
>>         action order 1: gact action drop
>>          random type none pass val 0
>>          index 1 ref 1 bind 1 installed 85 sec used 3 sec
>>         Action statistics:
>>         Sent 460 bytes 10 pkt (dropped 10, overlimits 0 requeues 0)
>>         backlog 0b 0p requeues 0
>>
>> 2. Match on IP address and port range:
>> --------------------------------------
>> $ tc filter add dev enp4s0 protocol ip parent ffff:\
>>   prio 1 flower dst_ip 192.168.1.1 ip_proto tcp dst_port 100-200\
>>   skip_hw action drop
>>
>> $ tc -s filter show dev enp4s0 parent ffff:
>> filter protocol ip pref 1 flower chain 0 handle 0x2
>>   eth_type ipv4
>>   ip_proto tcp
>>   dst_ip 192.168.1.1
>>   dst_port 100-200
>>   skip_hw
>>   not_in_hw
>>         action order 1: gact action drop
>>          random type none pass val 0
>>          index 2 ref 1 bind 1 installed 58 sec used 2 sec
>>         Action statistics:
>>         Sent 920 bytes 20 pkt (dropped 20, overlimits 0 requeues 0)
>>         backlog 0b 0p requeues 0
>>
>> v6:
>> Modified to change json output format as object for sport/dport.
>>
>>  "dst_port":{
>>            "start":2000,
>>            "end":6000
>>  },
>>  "src_port":{
>>            "start":50,
>>            "end":60
>>  }
>>
>> v5:
>> Simplified some code and used 'sscanf' for parsing. Removed
>> space in output format.
>>
>> v4:
>> Added man updates explaining filtering based on port ranges.
>> Removed 'range' keyword.
>>
>> v3:
>> Modified flower_port_range_attr_type calls.
>>
>> v2:
>> Addressed Jiri's comment to sync output format with input
>>
>> Signed-off-by: Amritha Nambiar <amritha.nambiar@...el.com>
>> ---
>>  man/man8/tc-flower.8 |   13 +++++---
>>  tc/f_flower.c        |   85 +++++++++++++++++++++++++++++++++++++++++++++-----
>>  2 files changed, 84 insertions(+), 14 deletions(-)
>>
> 
> sorry for the delay; fell through the cracks. It no longer applies to
> net-next. Please update. Thanks,
> 

A previous version v3 of this patch was already applied to iproute2-next.
https://patchwork.ozlabs.org/patch/998644/

I think that needs to be reverted for this v6 to apply clean.