netdev - Re: [PATCH nf-next] netfilter: nf_tables_offload: allow ethernet interface type only

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 29 Oct 2019 17:10:05 +0000
From:   Edward Cree <ecree@...arflare.com>
To:     Pablo Neira Ayuso <pablo@...filter.org>,
        <netfilter-devel@...r.kernel.org>
CC:     <jiri@...nulli.us>, <netdev@...r.kernel.org>
Subject: Re: [PATCH nf-next] netfilter: nf_tables_offload: allow ethernet
 interface type only

On 29/10/2019 10:40, Pablo Neira Ayuso wrote:
> Hardware offload support at this stage assumes an ethernet device in
> place. The flow dissector provides the intermediate representation to
> express this selector, so extend it to allow to store the interface
> type. Flower does not uses this, so skb_flow_dissect_meta() is not
> extended to allow to match on this new field.
>
> Signed-off-by: Pablo Neira Ayuso <pablo@...filter.org>
> ---
> @Jiri: flower ignores this when checking for the ingress device, probably
>        that should restricted there too?
>
>  include/net/flow_dissector.h | 2 ++
>  net/netfilter/nft_cmp.c      | 7 +++++++
>  net/netfilter/nft_meta.c     | 4 ++++
>  3 files changed, 13 insertions(+)
>
> diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h
> index 5cd12276ae21..7d804db85442 100644
> --- a/include/net/flow_dissector.h
> +++ b/include/net/flow_dissector.h
> @@ -204,9 +204,11 @@ struct flow_dissector_key_ip {
>  /**
>   * struct flow_dissector_key_meta:
>   * @ingress_ifindex: ingress ifindex
> + * @iiftype: interface type
>   */
>  struct flow_dissector_key_meta {
>  	int ingress_ifindex;
> +	u16 ingress_iftype;
>  };
Comment does not match code wrt name of this new member.