netdev - Re: [PATCH nf,v2] netfilter: nf_tables: map basechain priority to hardware priority

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 31 Jul 2019 15:57:46 -0700
From:   Jakub Kicinski <jakub.kicinski@...ronome.com>
To:     Pablo Neira Ayuso <pablo@...filter.org>
Cc:     netfilter-devel@...r.kernel.org, marcelo.leitner@...il.com,
        wenxu@...oud.cn, jiri@...nulli.us, saeedm@...lanox.com,
        gerlitz.or@...il.com, paulb@...lanox.com, netdev@...r.kernel.org
Subject: Re: [PATCH nf,v2] netfilter: nf_tables: map basechain priority to
 hardware priority

On Wed, 31 Jul 2019 14:16:56 +0200, Pablo Neira Ayuso wrote:
> This patch adds initial support for offloading basechains using the
> priority range from -8192 to 8191.
> 
> The software priority -8192 is mapped to the hardware priority
> 0xC000 + 1. tcf_auto_prio() uses 0xC000 if the user specifies no
> priority, then it subtracts 1 for each new tcf_proto object. This patch
> reserves the hardware priority range from 0xC000 to 0xFFFF for
> netfilter.
> 
> The software to hardware priority mapping is not exposed to userspace,
> so it should be possible to update this / extend the range of supported
> priorities later on.
> 
> Signed-off-by: Pablo Neira Ayuso <pablo@...filter.org>

I don't know the nft code, so perhaps my question on v1
was nonsensical, nonetheless I'd appreciate a response.
NFT referring to tcf_auto_prio() is a bit of a red flag.