netdev - Re: [PATCH net] cls_flower: Fix the behavior using port ranges with hw-offload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20191203.115830.1630044375757536670.davem@davemloft.net>
Date:   Tue, 03 Dec 2019 11:58:30 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     komachi.yoshiki@...il.com
Cc:     jhs@...atatu.com, xiyou.wangcong@...il.com, jiri@...nulli.us,
        netdev@...r.kernel.org
Subject: Re: [PATCH net] cls_flower: Fix the behavior using port ranges
 with hw-offload

From: Yoshiki Komachi <komachi.yoshiki@...il.com>
Date: Tue,  3 Dec 2019 19:40:12 +0900

> The recent commit 5c72299fba9d ("net: sched: cls_flower: Classify
> packets using port ranges") had added filtering based on port ranges
> to tc flower. However the commit missed necessary changes in hw-offload
> code, so the feature gave rise to generating incorrect offloaded flow
> keys in NIC.
> 
> One more detailed example is below:
> 
> $ tc qdisc add dev eth0 ingress
> $ tc filter add dev eth0 ingress protocol ip flower ip_proto tcp \
>   dst_port 100-200 action drop
> 
> With the setup above, an exact match filter with dst_port == 0 will be
> installed in NIC by hw-offload. IOW, the NIC will have a rule which is
> equivalent to the following one.
> 
> $ tc qdisc add dev eth0 ingress
> $ tc filter add dev eth0 ingress protocol ip flower ip_proto tcp \
>   dst_port 0 action drop
> 
> The behavior was caused by the flow dissector which extracts packet
> data into the flow key in the tc flower. More specifically, regardless
> of exact match or specified port ranges, fl_init_dissector() set the
> FLOW_DISSECTOR_KEY_PORTS flag in struct flow_dissector to extract port
> numbers from skb in skb_flow_dissect() called by fl_classify(). Note
> that device drivers received the same struct flow_dissector object as
> used in skb_flow_dissect(). Thus, offloaded drivers could not identify
> which of these is used because the FLOW_DISSECTOR_KEY_PORTS flag was
> set to struct flow_dissector in either case.
> 
> This patch adds the new FLOW_DISSECTOR_KEY_PORTS_RANGE flag and the new
> tp_range field in struct fl_flow_key to recognize which filters are applied
> to offloaded drivers. At this point, when filters based on port ranges
> passed to drivers, drivers return the EOPNOTSUPP error because they do
> not support the feature (the newly created FLOW_DISSECTOR_KEY_PORTS_RANGE
> flag).
> 
> Fixes: 5c72299fba9d ("net: sched: cls_flower: Classify packets using port ranges")
> Signed-off-by: Yoshiki Komachi <komachi.yoshiki@...il.com>

Applied and queued up for -stable, thank you.