netdev - Re: [PATCH net-next v2 2/2] cxgb4: add TC-MATCHALL classifier ingress offload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 14 Nov 2019 10:20:37 -0800
From:   Jakub Kicinski <jakub.kicinski@...ronome.com>
To:     Rahul Lakkireddy <rahul.lakkireddy@...lsio.com>
Cc:     netdev@...r.kernel.org, davem@...emloft.net, nirranjan@...lsio.com,
        vishal@...lsio.com, dt@...lsio.com
Subject: Re: [PATCH net-next v2 2/2] cxgb4: add TC-MATCHALL classifier
 ingress offload

On Thu, 14 Nov 2019 21:04:05 +0530, Rahul Lakkireddy wrote:
> Add TC-MATCHALL classifier ingress offload support. The same actions
> supported by existing TC-FLOWER offload can be applied to all incoming
> traffic on the underlying interface.
> 
> Only 1 ingress matchall rule can be active at a time on the underlying
> interface.
> 
> Signed-off-by: Rahul Lakkireddy <rahul.lakkireddy@...lsio.com>
> ---
> v2:
> - Removed logic to fetch free index from end of TCAM. Must maintain
>   same ordering as in kernel.

The ordering in the kernel is by filter priority/pref. Not the order of
addition (which AFAIK you're intending to preserve here?).

Since you're only offloading the policer presumably you want to limit
the port speed. The simplest way to make sure the rule ordering is right
is to only accept the policer as the highest prio rule. I believe OvS
installs it always with prio 1.