netdev - [PATCH net-next,v4 0/4] flow_offload: update mangle action representation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20191014220027.7500-1-pablo@netfilter.org>
Date:   Tue, 15 Oct 2019 00:00:23 +0200
From:   Pablo Neira Ayuso <pablo@...filter.org>
To:     netfilter-devel@...r.kernel.org
Cc:     davem@...emloft.net, netdev@...r.kernel.org,
        jakub.kicinski@...ronome.com, jiri@...nulli.us,
        saeedm@...lanox.com, vishal@...lsio.com, vladbu@...lanox.com,
        ecree@...arflare.com
Subject: [PATCH net-next,v4 0/4] flow_offload: update mangle action representation

This patch updates the mangle action representation:

Patch 1) Undo bitwise NOT operation on the mangle mask (coming from tc
         pedit userspace).

Patch 2) mangle value &= mask from the front-end side.

Patch 3) adjust offset, length and coalesce consecutive pedit keys into
         one single action. Calculate header field based on the offset
	 and mask.

Patch 4) add support for payload mangling for netfilter.

After this patchset:

* Offset to payload does not need to be on the 32-bits boundaries anymore.
  This patchset adds front-end code to adjust the offset and length coming
  from the tc pedit representation, so drivers get an exact header field
  offset and length.

* This new front-end code coalesces consecutive pedit action composed of
  several keys into one single action, so drivers can mangle IPv6 and
  ethernet address fields in one go, instead of updating 32-bit word at
  a time.

As a result, driver codebase to deal with payload mangling gets simplified.

Changes since v4:

* Use header field definitions to calculate the header field from the
  u32 offset and the mask. This allows for mangling a few bytes of a
  multi-byte field, eg. offset=0 mask=0x00ff to mangle one single byte
  of a source port. --Edward Cree

Please, apply.

Pablo Neira Ayuso (4):
  net: flow_offload: bitwise AND on mangle action value field
  net: flow_offload: mangle action at byte level
  netfilter: nft_payload: packet mangling offload support
  net: flow_offload: add flow_rule_print()

 .../net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c   | 163 ++++----------
 .../net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.h   |  40 +---
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c    |  80 +++----
 drivers/net/ethernet/netronome/nfp/flower/action.c | 212 +++++++-----------
 include/net/flow_offload.h                         |  10 +-
 net/core/flow_offload.c                            |  85 +++++++
 net/netfilter/nf_tables_offload.c                  |   6 +-
 net/netfilter/nft_payload.c                        |  73 +++++++
 net/sched/cls_api.c                                | 243 +++++++++++++++++++--
 net/sched/cls_flower.c                             |   4 +
 10 files changed, 566 insertions(+), 350 deletions(-)

-- 
2.11.0