netdev - Re: [PATCH nf] netfilter: nf_tables: map basechain priority to hardware priority

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 30 Jul 2019 13:19:44 +0200
From:   Pablo Neira Ayuso <pablo@...filter.org>
To:     netfilter-devel@...r.kernel.org
Cc:     wenxu@...oud.cn, jiri@...nulli.us, marcelo.leitner@...il.com,
        saeedm@...lanox.com, gerlitz.or@...il.com, paulb@...lanox.com,
        netdev@...r.kernel.org
Subject: Re: [PATCH nf] netfilter: nf_tables: map basechain priority to
 hardware priority

On Tue, Jul 30, 2019 at 01:18:00PM +0200, Pablo Neira Ayuso wrote:
> On Tue, Jul 30, 2019 at 12:54:17PM +0200, Pablo Neira Ayuso wrote:
> [...]
> > @@ -180,6 +181,29 @@ static int nft_setup_cb_call(struct nft_base_chain *basechain,
> >  	return 0;
> >  }
> >  
> > +/* Available priorities for hardware offload range: -8192..8191 */
> > +#define NFT_BASECHAIN_OFFLOAD_PRIO_MAX		(SHRT_MAX / 4)
> > +#define NFT_BASECHAIN_OFFLOAD_PRIO_MIN		(SHRT_MIN / 4)
> > +#define NFT_BASECHAIN_OFFLOAD_PRIO_RANGE	(USHRT_MAX / 4)
> > +/* tcf_auto_prio() uses 0xC000 as base, then subtract one for each new chain. */
> > +#define NFT_BASECHAIN_OFFLOAD_HW_PRIO_BASE	(0xC000 + 1)
> > +
> > +u16 nft_chain_offload_priority(struct nft_base_chain *basechain)
> > +{
> > +	u16 prio;
> > +
> > +	if (basechain->ops.priority < NFT_BASECHAIN_OFFLOAD_PRIO_MIN ||
> > +	    basechain->ops.priority > NFT_BASECHAIN_OFFLOAD_PRIO_MAX)
> > +		return 0;
> > +
> > +	/* map netfilter chain priority to hardware priority. */
> > +	prio = basechain->ops.priority +
> > +		NFT_BASECHAIN_OFFLOAD_PRIO_MAX +
> > +			NFT_BASECHAIN_OFFLOAD_HW_PRIO_BASE;
> > +
> > +	return prio;
> 
> This function should actually return:
> 
>         return prio << 16;

Better shift it from here:

static void nft_flow_offload_common_init(struct flow_cls_common_offload *common,
                                         __be16 proto, int priority,
                                         struct netlink_ext_ack *extack)
{
        common->protocol = proto;
        common->prio = priority << 16;
        common->extack = extack;
}

Drivers assume tc handle format.