netdev - Re: [PATCH iproute2-next] tc: flower: add tc conntrack inv ct

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 19 Jan 2021 17:08:46 -0300
From:   Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
To:     wenxu@...oud.cn
Cc:     dsahern@...il.com, netdev@...r.kernel.org
Subject: Re: [PATCH iproute2-next] tc: flower: add tc conntrack inv ct_state
 support

On Tue, Jan 19, 2021 at 04:34:59PM +0800, wenxu@...oud.cn wrote:
> --- a/man/man8/tc-flower.8
> +++ b/man/man8/tc-flower.8
> @@ -387,6 +387,8 @@ new - New connection.
>  .TP
>  est - Established connection.
>  .TP
> +inv - The packet is associated with no known connection.

This is not accurate. Please write it after OVS' description of it, on
ovs-fields.7 (not saying to copy it):

inv (0x10)
       The  state is invalid, meaning that the connection tracker couldn’t iden‐
       tify the connection. This flag is a catch-all for problems in the connec‐
       tion or the connection tracker, such as:

       •      L3/L4  protocol  handler is not loaded/unavailable. With the Linux
              kernel datapath, this  may  mean  that  the  nf_conntrack_ipv4  or
              nf_conntrack_ipv6 modules are not loaded.

       •      L3/L4 protocol handler determines that the packet is malformed.

       •      Packets are unexpected length for protocol.

Something like: The packet couldn't be associated to a connection.

> +.TP
>  Example: +trk+est
>  .RE
>  .TP

Thanks,
Marcelo