netdev - Re: [PATCH iproute2 v3 2/2] tc: pedit: add decrement operation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 25 Jun 2021 19:21:41 +0000
From:   Asbjørn Sloth Tønnesen <asbjorn@...jorn.st>
To:     Jamal Hadi Salim <jhs@...atatu.com>,
        David Ahern <dsahern@...il.com>, netdev@...r.kernel.org,
        Cong Wang <xiyou.wangcong@...il.com>
Cc:     Stephen Hemminger <stephen@...workplumber.org>,
        Jiri Pirko <jiri@...dia.com>, Amir Vadai <amir@...ai.me>
Subject: Re: [PATCH iproute2 v3 2/2] tc: pedit: add decrement operation

Hi Jamal,

Thank you for your review.

On 6/24/21 8:24 PM, Jamal Hadi Salim wrote:
> So you "add" essentially one's complement of the value you are trying to
> decrement with?

Almost (off by one), it's basically decrement by overflowing it, which
is safe since the operation is masked. One should however have another
rule, that matches on TTL == 1. so it can get a proper ICMP error.

Decrementing TTL by one was actually the prime example presented
when Amir Vadai introduced TCA_PEDIT_KEY_EX_CMD_ADD.

kernel   853a14ba net/act_pedit: Introduce 'add' operation     [1]
iproute2 8d193d96 tc/pedit: p_ip: introduce editing ttl header [2]

[1] https://git.kernel.org/torvalds/c/853a14ba
[2] https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=8d193d96


>>> This feature was suggested by some pseudo tc examples in Mellanox's
>>> documentation[1], but wasn't present in neither their mlnx-iproute2
>>> nor iproute2.
>>>
>>> Tested with skip_sw on Mellanox ConnectX-6 Dx.
>>>
>>> [1] https://docs.mellanox.com/pages/viewpage.action?pageId=47033989
> 
> 
> I didnt see an example which showed using "dec" but what you described
> above makes sense.

It is indeed a large document, so to be more specific:

https://docs.mellanox.com/pages/viewpage.action?pageId=47033989#highlighter_159101
 > Using TC rules:
 > IPv4:
 > tc filter add [..] munge ip ttl dec [..]
 > IPv6:
 > tc filter add [..] munge ipv6 hlimit dec [..]

"ipv6 hlimit" should obviously be "ip6 hoplimit".


-- 
Best regards
Asbjørn Sloth Tønnesen