netdev - Re: [PATCH net-next v2 8/8] nfp: flower-ct: add tc merge functionality

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 1 Jun 2021 15:43:25 +0200
From:   Louis Peens <louis.peens@...igine.com>
To:     Marcelo Ricardo Leitner <mleitner@...hat.com>,
        Simon Horman <simon.horman@...igine.com>
Cc:     David Miller <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, netdev@...r.kernel.org,
        oss-drivers@...igine.com, Yinjun Zhang <yinjun.zhang@...igine.com>
Subject: Re: [PATCH net-next v2 8/8] nfp: flower-ct: add tc merge
 functionality



On 2021/05/31 20:24, Marcelo Ricardo Leitner wrote:
> On Mon, May 31, 2021 at 02:46:07PM +0200, Simon Horman wrote:
>> +static int nfp_ct_do_tc_merge(struct nfp_fl_ct_zone_entry *zt,
>> +			      struct nfp_fl_ct_flow_entry *ct_entry1,
>> +			      struct nfp_fl_ct_flow_entry *ct_entry2)
>> +{
>> +	struct nfp_fl_ct_flow_entry *post_ct_entry, *pre_ct_entry;
>> +	struct nfp_fl_ct_tc_merge *m_entry;
>> +	unsigned long new_cookie[2];
>> +	int err;
>> +
>> +	if (ct_entry1->type == CT_TYPE_PRE_CT) {
>> +		pre_ct_entry = ct_entry1;
>> +		post_ct_entry = ct_entry2;
>> +	} else {
>> +		post_ct_entry = ct_entry1;
>> +		pre_ct_entry = ct_entry2;
>> +	}
>> +
>> +	if (post_ct_entry->netdev != pre_ct_entry->netdev)
>> +		return -EINVAL;
>> +	if (post_ct_entry->chain_index != pre_ct_entry->chain_index)
>> +		return -EINVAL;
> 
> I would expect this to always fail with OVS/OVN offload, as it always
> jump to a new chain after an action:ct call.
Ah, I can see that this may look confusing, I will considering adding
a short comment here for future me as well. The origin for the chain_index
is different for pre_ct and post_ct. For pre_ct the chain_index is populated from
the GOTO action, and for post_ct it is from the match. This checks that the
chain in the action matches the chain in the filter of the next
flow.

The assignment happens in the nfp_fl_ct_handle_pre_ct and nfp_fl_ct_handle_post_ct
functions of [PATCH net-next v2 5/8] nfp: flower-ct: add nfp_fl_ct_flow_entries
> 
>   Marcelo
>