netdev - Re: [PATCH net-next] openvswitch: Make metadata_dst tunnel work in IP_TUNNEL_INFO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 23 Mar 2019 18:01:12 +0800
From:   wenxu <wenxu@...oud.cn>
To:     Pravin Shelar <pshelar@....org>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Linux Kernel Network Developers <netdev@...r.kernel.org>,
        ovs dev <dev@...nvswitch.org>
Subject: Re: [PATCH net-next] openvswitch: Make metadata_dst tunnel work in
 IP_TUNNEL_INFO_BRIDGE mode

On 2019/3/23 下午3:50, Pravin Shelar wrote:
>
>> diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
>> index 691da85..033df5c 100644
>> --- a/net/openvswitch/flow_netlink.c
>> +++ b/net/openvswitch/flow_netlink.c
>> @@ -403,6 +403,7 @@ size_t ovs_key_attr_size(void)
>>         [OVS_TUNNEL_KEY_ATTR_IPV6_SRC]      = { .len = sizeof(struct in6_addr) },
>>         [OVS_TUNNEL_KEY_ATTR_IPV6_DST]      = { .len = sizeof(struct in6_addr) },
>>         [OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS]   = { .len = OVS_ATTR_VARIABLE },
>> +       [OVS_TUNNEL_KEY_ATTR_NO_IPV4_DST]   = { .len = 0 },
>>  };
>>
>>  static const struct ovs_len_tbl
>> @@ -663,7 +664,7 @@ static int erspan_tun_opt_from_nlattr(const struct nlattr *a,
>>
>>  static int ip_tun_from_nlattr(const struct nlattr *attr,
>>                               struct sw_flow_match *match, bool is_mask,
>> -                             bool log)
>> +                             bool log, bool *no_ipv4_dst)
>>  {
>>         bool ttl = false, ipv4 = false, ipv6 = false;
>>         __be16 tun_flags = 0;
>> @@ -671,6 +672,9 @@ static int ip_tun_from_nlattr(const struct nlattr *attr,
>>         struct nlattr *a;
>>         int rem;
>>
>> +       if (no_ipv4_dst)
>> +               *no_ipv4_dst = false;
>> +
>>         nla_for_each_nested(a, attr, rem) {
>>                 int type = nla_type(a);
>>                 int err;
>> @@ -782,6 +786,12 @@ static int ip_tun_from_nlattr(const struct nlattr *attr,
>>                         tun_flags |= TUNNEL_ERSPAN_OPT;
>>                         opts_type = type;
>>                         break;
>> +               case OVS_TUNNEL_KEY_ATTR_NO_IPV4_DST:
>> +                       if (no_ipv4_dst) {
>> +                               *no_ipv4_dst = true;
>> +                               ipv4 = true;
>> +                       }
>> +                       break;
>>                 default:
>>                         OVS_NLERR(log, "Unknown IP tunnel attribute %d",
>>                                   type);
>> @@ -812,9 +822,16 @@ static int ip_tun_from_nlattr(const struct nlattr *attr,
>>                         OVS_NLERR(log, "IP tunnel dst address not specified");
>>                         return -EINVAL;
>>                 }
>> -               if (ipv4 && !match->key->tun_key.u.ipv4.dst) {
>> -                       OVS_NLERR(log, "IPv4 tunnel dst address is zero");
>> -                       return -EINVAL;
>> +               if (ipv4) {
>> +                       bool no_dst = no_ipv4_dst ? *no_ipv4_dst : false;
>> +
>> +                       if (no_dst && match->key->tun_key.u.ipv4.dst) {
>> +                               OVS_NLERR(log, "IPv4 tunnel dst address is not zero");
>> +                               return -EINVAL;
>> +                       } else if (!no_dst && !match->key->tun_key.u.ipv4.dst) {
>> +                               OVS_NLERR(log, "IPv4 tunnel dst address is zero");
>> +                               return -EINVAL;
>> +                       }
>>                 }
>>                 if (ipv6 && ipv6_addr_any(&match->key->tun_key.u.ipv6.dst)) {
>>                         OVS_NLERR(log, "IPv6 tunnel dst address is zero");
>> @@ -1178,7 +1195,7 @@ static int metadata_from_nlattrs(struct net *net, struct sw_flow_match *match,
>>         }
>>         if (*attrs & (1 << OVS_KEY_ATTR_TUNNEL)) {
>>                 if (ip_tun_from_nlattr(a[OVS_KEY_ATTR_TUNNEL], match,
>> -                                      is_mask, log) < 0)
>> +                                      is_mask, log, NULL) < 0)
> Please pass non-null value here to have complete validation of tunnel
> parameters.
>
The new attr OVS_TUNNEL_KEY_ATTR_NO_IPV4_DST is only care in the OVS_KEY_ATTR_TUNNE of action.

It should not care in the  OVS_KEY_ATTR_TUNNELof match. So we pass the NULL keep the original algorithm