netdev - Re: [PATCH net v2 2/3] net/sched: flow_dissector: Fix matching on zone id for invalid conns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM_iQpWtwwj1pMWQbPTV6Rctd_0hcjeEyXywSj-h=94p3MZUiw@mail.gmail.com>
Date:   Sat, 11 Dec 2021 16:47:56 -0800
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     Paul Blakey <paulb@...dia.com>, dev@...nvswitch.org,
        Linux Kernel Network Developers <netdev@...r.kernel.org>,
        Saeed Mahameed <saeedm@...dia.com>,
        Jamal Hadi Salim <jhs@...atatu.com>,
        Pravin B Shelar <pshelar@....org>,
        David Miller <davem@...emloft.net>,
        Jiri Pirko <jiri@...dia.com>, wenxu <wenxu@...oud.cn>,
        Marcelo Ricardo Leitner <marcelo.leitner@...il.com>,
        Oz Shlomo <ozsh@...dia.com>, Vlad Buslov <vladbu@...dia.com>,
        Roi Dayan <roid@...dia.com>
Subject: Re: [PATCH net v2 2/3] net/sched: flow_dissector: Fix matching on
 zone id for invalid conns

On Fri, Dec 10, 2021 at 8:52 PM Jakub Kicinski <kuba@...nel.org> wrote:
>
> On Thu, 9 Dec 2021 09:57:33 +0200 Paul Blakey wrote:
> > @@ -238,10 +239,12 @@ void
> >  skb_flow_dissect_ct(const struct sk_buff *skb,
> >                   struct flow_dissector *flow_dissector,
> >                   void *target_container, u16 *ctinfo_map,
> > -                 size_t mapsize, bool post_ct)
> > +                 size_t mapsize)
> >  {
> >  #if IS_ENABLED(CONFIG_NF_CONNTRACK)
> > +     bool post_ct = tc_skb_cb(skb)->post_ct;
> >       struct flow_dissector_key_ct *key;
> > +     u16 zone = tc_skb_cb(skb)->zone;
> >       enum ip_conntrack_info ctinfo;
> >       struct nf_conn_labels *cl;
> >       struct nf_conn *ct;
> > @@ -260,6 +263,7 @@ skb_flow_dissect_ct(const struct sk_buff *skb,
> >       if (!ct) {
> >               key->ct_state = TCA_FLOWER_KEY_CT_FLAGS_TRACKED |
> >                               TCA_FLOWER_KEY_CT_FLAGS_INVALID;
> > +             key->ct_zone = zone;
> >               return;
> >       }
> >
>
> Why is flow dissector expecting skb cb to be TC now?
> Please keep the appropriate abstractions intact.

Probably because only fl_classify() calls it, but I agree with you
on this point, this function is supposed to be TC independent.

Thanks.