netdev - Re: [PATCH net-next] net/mlx5e: Allow dropping specific tunnel packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190801.124851.1301999897687804145.davem@davemloft.net>
Date:   Thu, 01 Aug 2019 12:48:51 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     xiangxia.m.yue@...il.com
Cc:     roid@...lanox.com, saeedm@...lanox.com, netdev@...r.kernel.org
Subject: Re: [PATCH net-next] net/mlx5e: Allow dropping specific tunnel
 packets

From: xiangxia.m.yue@...il.com
Date: Thu,  1 Aug 2019 16:40:59 +0800

> From: Tonghao Zhang <xiangxia.m.yue@...il.com>
> 
> In some case, we don't want to allow specific tunnel packets
> to host that can avoid to take up high CPU (e.g network attacks).
> But other tunnel packets which not matched in hardware will be
> sent to host too.
> 
>     $ tc filter add dev vxlan_sys_4789 \
> 	    protocol ip chain 0 parent ffff: prio 1 handle 1 \
> 	    flower dst_ip 1.1.1.100 ip_proto tcp dst_port 80 \
> 	    enc_dst_ip 2.2.2.100 enc_key_id 100 enc_dst_port 4789 \
> 	    action tunnel_key unset pipe action drop
> 
> Signed-off-by: Tonghao Zhang <xiangxia.m.yue@...il.com>

Saeed, please pick this up.

Thank you.