netdev - Re: [PATCH net-next v2] net: flow_offload: simplify hw stats check handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <981c02e9-6152-feed-2607-9607e58b760c@solarflare.com>
Date:   Wed, 20 May 2020 16:18:37 +0100
From:   Edward Cree <ecree@...arflare.com>
To:     Pablo Neira Ayuso <pablo@...filter.org>
CC:     <davem@...emloft.net>, <netdev@...r.kernel.org>,
        <netfilter-devel@...r.kernel.org>, <jiri@...nulli.us>,
        <kuba@...nel.org>
Subject: Re: [PATCH net-next v2] net: flow_offload: simplify hw stats check
 handling

On 20/05/2020 15:33, Pablo Neira Ayuso wrote:
> #1 Drivers calling flow_action_hw_stats_check() fall within the
> second branch (check_allow_bit is set on).
>
>         } else if (check_allow_bit &&         <------ HERE
>
> These drivers are not honoring the _DONT_CARE bit,
> __flow_action_hw_stats_check() with check_allow_bit set on does not
> honor the _DONT_CARE bit.
I don't understand.  There isn't a _DONT_CARE bit; _DONT_CARE isa
 bitmask of *all* the bits: BIT(FLOW_ACTION_HW_STATS_NUM_BITS) - 1.
So if allow_bit < FLOW_ACTION_HW_STATS_NUM_BITS, then
 BIT(allow_bit) & FLOW_ACTION_HW_STATS_DONT_CARE is nonzero, and
 thus the function returns true.

> #2 Your patch needs to update Netfilter to set hw_stats to
>    FLOW_ACTION_HW_STATS_DONT_CARE explicitly.
Ahh, naïvely I had assumed that you would have done that in the
 patch that added _DONT_CARE; I should have checked that.  Will
 fix that for the next version.

Thank you for being specific.
And you'll be pleased to know that I've managed to bodge a working
 nft binary onto my test system, so hopefully I'll be able to test
 with netfilter offload.  Am I right in thinking that an ingress
 chain on the netdev table is the thing I want?

-ed