netdev - Re: [PATCH net-next 3/3] net/mlx5: Support GRE conntrack offload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <cd58c021-40e3-8c9d-30f4-fc499e77a65@nvidia.com>
Date:   Thu, 10 Feb 2022 14:44:14 +0200
From:   Paul Blakey <paulb@...dia.com>
To:     Toshiaki Makita <toshiaki.makita1@...il.com>
CC:     "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Saeed Mahameed <saeedm@...dia.com>,
        Jamal Hadi Salim <jhs@...atatu.com>,
        "Cong Wang" <xiyou.wangcong@...il.com>,
        Jiri Pirko <jiri@...nulli.us>,
        "Pablo Neira Ayuso" <pablo@...filter.org>,
        Jozsef Kadlecsik <kadlec@...filter.org>,
        "Florian Westphal" <fw@...len.de>, <netdev@...r.kernel.org>,
        <netfilter-devel@...r.kernel.org>, <coreteam@...filter.org>
Subject: Re: [PATCH net-next 3/3] net/mlx5: Support GRE conntrack offload



On Thu, 3 Feb 2022, Toshiaki Makita wrote:

> Support GREv0 without NAT.
> 
> Signed-off-by: Toshiaki Makita <toshiaki.makita1@...il.com>
> ---
>  drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 21 +++++++++++++++------
>  1 file changed, 15 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
> index 0f4d3b9d..465643c 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
> @@ -258,7 +258,8 @@ struct mlx5_ct_entry {
>  			return -EOPNOTSUPP;
>  		}
>  	} else {
> -		return -EOPNOTSUPP;
> +		if (tuple->ip_proto != IPPROTO_GRE)
> +			return -EOPNOTSUPP;
>  	}
>  
>  	return 0;
> @@ -807,7 +808,11 @@ struct mlx5_ct_entry {
>  	attr->dest_chain = 0;
>  	attr->dest_ft = mlx5e_tc_post_act_get_ft(ct_priv->post_act);
>  	attr->ft = nat ? ct_priv->ct_nat : ct_priv->ct;
> -	attr->outer_match_level = MLX5_MATCH_L4;
> +	if (entry->tuple.ip_proto == IPPROTO_TCP ||
> +	    entry->tuple.ip_proto == IPPROTO_UDP)
> +		attr->outer_match_level = MLX5_MATCH_L4;
> +	else
> +		attr->outer_match_level = MLX5_MATCH_L3;
>  	attr->counter = entry->counter->counter;
>  	attr->flags |= MLX5_ATTR_FLAG_NO_IN_PORT;
>  	if (ct_priv->ns_type == MLX5_FLOW_NAMESPACE_FDB)
> @@ -1224,16 +1229,20 @@ static void mlx5_tc_ct_entry_del_work(struct work_struct *work)
>  	struct flow_keys flow_keys;
>  
>  	skb_reset_network_header(skb);
> -	skb_flow_dissect_flow_keys(skb, &flow_keys, 0);
> +	skb_flow_dissect_flow_keys(skb, &flow_keys, FLOW_DISSECTOR_F_STOP_BEFORE_ENCAP);
>  
>  	tuple->zone = zone;
>  
>  	if (flow_keys.basic.ip_proto != IPPROTO_TCP &&
> -	    flow_keys.basic.ip_proto != IPPROTO_UDP)
> +	    flow_keys.basic.ip_proto != IPPROTO_UDP &&
> +	    flow_keys.basic.ip_proto != IPPROTO_GRE)
>  		return false;
>  
> -	tuple->port.src = flow_keys.ports.src;
> -	tuple->port.dst = flow_keys.ports.dst;
> +	if (flow_keys.basic.ip_proto == IPPROTO_TCP ||
> +	    flow_keys.basic.ip_proto == IPPROTO_UDP) {
> +		tuple->port.src = flow_keys.ports.src;
> +		tuple->port.dst = flow_keys.ports.dst;
> +	}
>  	tuple->n_proto = flow_keys.basic.n_proto;
>  	tuple->ip_proto = flow_keys.basic.ip_proto;
>  
> -- 
> 1.8.3.1
> 
> 

Acked-by: Paul Blakey <paulb@...dia.com>

Looks good to me.
Thanks.