netdev - Re: [PATCH net-next 2/5] sfc: handle enc keys in efx_tc_flower_parse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZBGJdWyXZSlXwN96@localhost.localdomain>
Date:   Wed, 15 Mar 2023 10:01:41 +0100
From:   Michal Swiatkowski <michal.swiatkowski@...ux.intel.com>
To:     edward.cree@....com
Cc:     linux-net-drivers@....com, davem@...emloft.net, kuba@...nel.org,
        pabeni@...hat.com, edumazet@...gle.com,
        Edward Cree <ecree.xilinx@...il.com>, netdev@...r.kernel.org,
        habetsm.xilinx@...il.com
Subject: Re: [PATCH net-next 2/5] sfc: handle enc keys in
 efx_tc_flower_parse_match()

On Tue, Mar 14, 2023 at 05:35:22PM +0000, edward.cree@....com wrote:
> From: Edward Cree <ecree.xilinx@...il.com>
> 
> Translate the fields from flow dissector into struct efx_tc_match.
> In efx_tc_flower_replace(), reject filters that match on them, because
>  only 'foreign' filters (i.e. those for which the ingress dev is not
>  the sfc netdev or any of its representors, e.g. a tunnel netdev) can
>  use them.
> 
> Signed-off-by: Edward Cree <ecree.xilinx@...il.com>
> ---
>  drivers/net/ethernet/sfc/tc.c | 65 +++++++++++++++++++++++++++++++++++
>  1 file changed, 65 insertions(+)
> 
> diff --git a/drivers/net/ethernet/sfc/tc.c b/drivers/net/ethernet/sfc/tc.c
> index 2b07bb2fd735..d683665a8d87 100644
> --- a/drivers/net/ethernet/sfc/tc.c
> +++ b/drivers/net/ethernet/sfc/tc.c
> @@ -193,6 +193,11 @@ static int efx_tc_flower_parse_match(struct efx_nic *efx,
>  	      BIT(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
>  	      BIT(FLOW_DISSECTOR_KEY_IPV6_ADDRS) |
>  	      BIT(FLOW_DISSECTOR_KEY_PORTS) |
> +	      BIT(FLOW_DISSECTOR_KEY_ENC_KEYID) |
> +	      BIT(FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS) |
> +	      BIT(FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS) |
> +	      BIT(FLOW_DISSECTOR_KEY_ENC_PORTS) |
> +	      BIT(FLOW_DISSECTOR_KEY_ENC_CONTROL) |
>  	      BIT(FLOW_DISSECTOR_KEY_TCP) |
>  	      BIT(FLOW_DISSECTOR_KEY_IP))) {
>  		NL_SET_ERR_MSG_FMT_MOD(extack, "Unsupported flower keys %#x",
> @@ -280,6 +285,61 @@ static int efx_tc_flower_parse_match(struct efx_nic *efx,
>  	MAP_KEY_AND_MASK(PORTS, ports, src, l4_sport);
>  	MAP_KEY_AND_MASK(PORTS, ports, dst, l4_dport);
>  	MAP_KEY_AND_MASK(TCP, tcp, flags, tcp_flags);
> +	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_CONTROL)) {
> +		struct flow_match_control fm;
> +
> +		flow_rule_match_enc_control(rule, &fm);
> +		if (fm.mask->flags) {
> +			NL_SET_ERR_MSG_FMT_MOD(extack, "Unsupported match on enc_control.flags %#x",
> +					       fm.mask->flags);
> +			return -EOPNOTSUPP;
> +		}
> +		if (!IS_ALL_ONES(fm.mask->addr_type)) {
> +			NL_SET_ERR_MSG_FMT_MOD(extack, "Unsupported enc addr_type mask %u (key %u)",
> +					       fm.mask->addr_type,
> +					       fm.key->addr_type);
> +			return -EOPNOTSUPP;
> +		}
> +		switch (fm.key->addr_type) {
> +		case FLOW_DISSECTOR_KEY_IPV4_ADDRS:
> +			MAP_ENC_KEY_AND_MASK(IPV4_ADDRS, ipv4_addrs, enc_ipv4_addrs,
> +					     src, enc_src_ip);
> +			MAP_ENC_KEY_AND_MASK(IPV4_ADDRS, ipv4_addrs, enc_ipv4_addrs,
> +					     dst, enc_dst_ip);
> +			break;
> +#ifdef CONFIG_IPV6
> +		case FLOW_DISSECTOR_KEY_IPV6_ADDRS:
> +			MAP_ENC_KEY_AND_MASK(IPV6_ADDRS, ipv6_addrs, enc_ipv6_addrs,
> +					     src, enc_src_ip6);
> +			MAP_ENC_KEY_AND_MASK(IPV6_ADDRS, ipv6_addrs, enc_ipv6_addrs,
> +					     dst, enc_dst_ip6);
> +			break;
> +#endif
> +		default:
> +			NL_SET_ERR_MSG_FMT_MOD(extack,
> +					       "Unsupported enc addr_type %u (supported are IPv4, IPv6)",
> +					       fm.key->addr_type);
> +			return -EOPNOTSUPP;
> +		}
> +#if !defined(EFX_USE_KCOMPAT) || defined(EFX_HAVE_FLOW_DISSECTOR_KEY_ENC_IP)
Are these defines already in kernel, or You want to add it to kconfig?
I can't find it in tree, aren't they some kind of OOT driver defines?

> +		MAP_ENC_KEY_AND_MASK(IP, ip, enc_ip, tos, enc_ip_tos);
> +		MAP_ENC_KEY_AND_MASK(IP, ip, enc_ip, ttl, enc_ip_ttl);
> +#endif
> +		MAP_ENC_KEY_AND_MASK(PORTS, ports, enc_ports, src, enc_sport);
> +		MAP_ENC_KEY_AND_MASK(PORTS, ports, enc_ports, dst, enc_dport);
> +		MAP_ENC_KEY_AND_MASK(KEYID, enc_keyid, enc_keyid, keyid, enc_keyid);
> +	} else if (dissector->used_keys &
> +		   (BIT(FLOW_DISSECTOR_KEY_ENC_KEYID) |
> +		    BIT(FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS) |
> +		    BIT(FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS) |
> +#if !defined(EFX_USE_KCOMPAT) || defined(EFX_HAVE_FLOW_DISSECTOR_KEY_ENC_IP)
> +		    BIT(FLOW_DISSECTOR_KEY_ENC_IP) |
> +#endif
> +		    BIT(FLOW_DISSECTOR_KEY_ENC_PORTS))) {
> +		NL_SET_ERR_MSG_FMT_MOD(extack, "Flower enc keys require enc_control (keys: %#x)",
> +				       dissector->used_keys);
> +		return -EOPNOTSUPP;
> +	}
>  
>  	return 0;
>  }
> @@ -373,6 +433,11 @@ static int efx_tc_flower_replace(struct efx_nic *efx,
>  	rc = efx_tc_flower_parse_match(efx, fr, &match, extack);
>  	if (rc)
>  		return rc;
> +	if (efx_tc_match_is_encap(&match.mask)) {
> +		NL_SET_ERR_MSG_MOD(extack, "Ingress enc_key matches not supported");
> +		rc = -EOPNOTSUPP;
> +		goto release;
> +	}
>  
>  	if (tc->common.chain_index) {
>  		NL_SET_ERR_MSG_MOD(extack, "No support for nonzero chain_index");