lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 22 Jan 2020 15:52:55 +0200 From: Paul Blakey <paulb@...lanox.com> To: Paul Blakey <paulb@...lanox.com>, Saeed Mahameed <saeedm@...lanox.com>, Oz Shlomo <ozsh@...lanox.com>, Jakub Kicinski <jakub.kicinski@...ronome.com>, Vlad Buslov <vladbu@...lanox.com>, David Miller <davem@...emloft.net>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>, Jiri Pirko <jiri@...nulli.us>, Roi Dayan <roid@...lanox.com> Subject: [PATCH net-next-mlx5 v2 10/13] net/mlx5e: Disallow inserting vxlan/vlan egress rules without decap/pop Currently, rules on tunnel devices can be offloaded without decap action when a vlan pop action exists. Similarly, the driver will offload rules on vlan interfaces with no pop action when a decap action exists. Disallow the faulty behavior by checking that vlan egress rules do pop or drop and vxlan egress rules do decap, as intended. Signed-off-by: Paul Blakey <paulb@...lanox.com> Reviewed-by: Oz Shlomo <ozsh@...lanox.com> Reviewed-by: Mark Bloch <markb@...lanox.com> --- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c index 71c4e78..af7c917 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c @@ -2636,6 +2636,8 @@ static bool actions_match_supported(struct mlx5e_priv *priv, struct mlx5e_tc_flow *flow, struct netlink_ext_ack *extack) { + struct net_device *filter_dev = parse_attr->filter_dev; + bool drop_action, decap_action, pop_action; u32 actions; if (mlx5e_is_eswitch_flow(flow)) @@ -2643,11 +2645,19 @@ static bool actions_match_supported(struct mlx5e_priv *priv, else actions = flow->nic_attr->action; - if (flow_flag_test(flow, EGRESS) && - !((actions & MLX5_FLOW_CONTEXT_ACTION_DECAP) || - (actions & MLX5_FLOW_CONTEXT_ACTION_VLAN_POP) || - (actions & MLX5_FLOW_CONTEXT_ACTION_DROP))) - return false; + drop_action = actions & MLX5_FLOW_CONTEXT_ACTION_DROP; + decap_action = actions & MLX5_FLOW_CONTEXT_ACTION_DECAP; + pop_action = actions & MLX5_FLOW_CONTEXT_ACTION_VLAN_POP; + + if (flow_flag_test(flow, EGRESS) && !drop_action) { + /* If no drop, we must decap (vxlan) or pop (vlan) */ + if (mlx5e_get_tc_tun(filter_dev) && !decap_action) + return false; + else if (is_vlan_dev(filter_dev) && !pop_action) + return false; + else + return false; /* Sanity */ + } if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR) return modify_header_match_supported(&parse_attr->spec, -- 1.8.3.1
Powered by blists - more mailing lists