netdev - Re: [PATCH net v4] net/sched: cls_flower: Reject invalid ct

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210208112148.2d8d6d7d@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Date:   Mon, 8 Feb 2021 11:21:48 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     Marcelo Ricardo Leitner <mleitner@...hat.com>
Cc:     wenxu@...oud.cn, jhs@...atatu.com, netdev@...r.kernel.org
Subject: Re: [PATCH net v4] net/sched: cls_flower: Reject invalid ct_state
 flags rules

On Mon, 8 Feb 2021 15:57:05 -0300 Marcelo Ricardo Leitner wrote:
> On Sun, Feb 07, 2021 at 01:13:23PM +0800, wenxu@...oud.cn wrote:
> > --- a/net/sched/cls_flower.c
> > +++ b/net/sched/cls_flower.c
> > @@ -30,6 +30,11 @@
> >  
> >  #include <uapi/linux/netfilter/nf_conntrack_common.h>
> >  
> > +#define TCA_FLOWER_KEY_CT_FLAGS_MASK (TCA_FLOWER_KEY_CT_FLAGS_NEW | \
> > +				      TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED | \
> > +				      TCA_FLOWER_KEY_CT_FLAGS_RELATED | \
> > +				      TCA_FLOWER_KEY_CT_FLAGS_TRACKED)
> > +  
> 
> I know Jakub had said the calculations for _MASK were complicated, but
> seeing this, they seem worth, otherwise we have to manually maintain
> this duplicated list of entries here.
> 
> Maybe add just the __TCA_FLOWER_KEY_CT_FLAGS_MAX to the enum, and do
> the calcs here? (to avoid having them in uapi)

IDK, MAX feels rather weird for a bitfield. Someone would have to do no
testing at all to miss extending the mask.

If you strongly prefer to keep the MAX definition let's at least move
the mask definition out of the uAPI.

> >  struct fl_flow_key {
> >  	struct flow_dissector_key_meta meta;
> >  	struct flow_dissector_key_control control;