netdev - Re: [PATCH] net: mlx5: allow default ip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 17 Jan 2019 14:58:31 +0200
From:   Or Gerlitz <gerlitz.or@...il.com>
To:     xiangxia.m.yue@...il.com
Cc:     Or Gerlitz <ogerlitz@...lanox.com>,
        Saeed Mahameed <saeedm@...lanox.com>,
        Leon Romanovsky <leonro@...lanox.com>,
        Linux Netdev List <netdev@...r.kernel.org>
Subject: Re: [PATCH] net: mlx5: allow default ip_proto to offload

On Thu, Jan 17, 2019 at 11:28 AM <xiangxia.m.yue@...il.com> wrote:
> From: Tonghao Zhang <xiangxia.m.yue@...il.com>

with the current code, if a modification of the ip header is required
and the ip protocol is not one of tcp, udp or icmp - we err

This is done in purpose, and we don't want to allow offloading
this header re-write for unknown ip protocol

> Allow default ip_proto to offload, so icmp, tcp, and udp
> will match the flow as show below, otherwise we must type the
> ip_proto for icmp, tcp and udp respectively.
>
> $ tc filter add dev netdev01_rep parent ffff: protocol ip prio 1 \
>         flower skip_sw dst_ip 3.3.3.3 \
>         action pedit ex munge ip dst set 192.168.1.100 pipe \
>         action csum ip pipe \
>         action mirred egress redirect dev netdev02_rep

this flow specify the ip protocol (1 which is icmp)

> Signed-off-by: Tonghao Zhang <xiangxia.m.yue@...il.com>
> ---
>  drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> index 2ee377a..2a29428 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> @@ -2219,7 +2219,7 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
>         }
>
>         ip_proto = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ip_protocol);
> -       if (modify_ip_header && ip_proto != IPPROTO_TCP &&
> +       if (modify_ip_header && ip_proto != 0 && ip_proto != IPPROTO_TCP &&
>             ip_proto != IPPROTO_UDP && ip_proto != IPPROTO_ICMP) {
>                 NL_SET_ERR_MSG_MOD(extack,
>                                    "can't offload re-write of non TCP/UDP");

but under your patch we will not err for unknown ip protocol

I have lost you

BTW - I plan to change the polarity of the check here with the below
patch - please see if it helps your use-case:

commit 09b972083266fa8cfe2f24e1c264905d5cd021ed
Author: Or Gerlitz <ogerlitz@...lanox.com>
Date:   Wed Oct 31 18:42:21 2018 +0200

    net/mlx5e: Allow TC offload of IP header re-write for more protocols

    So far we allowed re-writing of IP header only for three protocols
    (tcp, udp and icmpv4). This is too limiting, e.g for cases where
    users want to apply offloading of NAT.

    Take a complimentary approach and allow this for wider set of IP
    protocols -- all of them except for three (icmpv6, sctp and udp-lite).
    For these protos the current HW isn't capable to properly adjust the
    l4 checksum while doing the modification <--- UPDATE - we probably
can do icmpv6

    Signed-off-by: Or Gerlitz <ogerlitz@...lanox.com>


diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 608025ca5c04..affb523e0e35 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -2167,11 +2167,11 @@ static bool
modify_header_match_supported(struct mlx5_flow_spec *spec,
        }

        ip_proto = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ip_protocol);
-       if (modify_ip_header && ip_proto != IPPROTO_TCP &&
-           ip_proto != IPPROTO_UDP && ip_proto != IPPROTO_ICMP) {
+       if (modify_ip_header && (ip_proto == IPPROTO_ICMPV6 ||
+           ip_proto == IPPROTO_SCTP || ip_proto == IPPROTO_UDPLITE)) {
                NL_SET_ERR_MSG_MOD(extack,
-                                  "can't offload re-write of non TCP/UDP");
-               pr_info("can't offload re-write of ip proto %d\n", ip_proto);
+                                  "can't offload this re-write of IP
addresses");
+               pr_info("can't offload re-write of IP addrs for ip
proto %d\n", ip_proto);
                return false;
        }