netdev - RE: [EXT] [RFC PATCH net-next 3/5] flow_offload: Reject matching on layer 2 miss

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 10 May 2023 09:57:36 +0000
From: Elad Nachman <enachman@...vell.com>
To: Ido Schimmel <idosch@...dia.com>,
        "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>,
        "bridge@...ts.linux-foundation.org"
	<bridge@...ts.linux-foundation.org>
CC: "davem@...emloft.net" <davem@...emloft.net>,
        "kuba@...nel.org"
	<kuba@...nel.org>,
        "pabeni@...hat.com" <pabeni@...hat.com>,
        "edumazet@...gle.com" <edumazet@...gle.com>,
        "razor@...ckwall.org"
	<razor@...ckwall.org>,
        "roopa@...dia.com" <roopa@...dia.com>,
        "jhs@...atatu.com" <jhs@...atatu.com>,
        "xiyou.wangcong@...il.com"
	<xiyou.wangcong@...il.com>,
        "jiri@...nulli.us" <jiri@...nulli.us>,
        "petrm@...dia.com" <petrm@...dia.com>,
        "taspelund@...dia.com"
	<taspelund@...dia.com>
Subject: RE: [EXT] [RFC PATCH net-next 3/5] flow_offload: Reject matching on
 layer 2 miss



> -----Original Message-----
> From: Ido Schimmel <idosch@...dia.com>
> Sent: Tuesday, May 9, 2023 10:05 AM
> To: netdev@...r.kernel.org; bridge@...ts.linux-foundation.org
> Cc: davem@...emloft.net; kuba@...nel.org; pabeni@...hat.com;
> edumazet@...gle.com; razor@...ckwall.org; roopa@...dia.com;
> jhs@...atatu.com; xiyou.wangcong@...il.com; jiri@...nulli.us;
> petrm@...dia.com; taspelund@...dia.com; Ido Schimmel
> <idosch@...dia.com>
> Subject: [EXT] [RFC PATCH net-next 3/5] flow_offload: Reject matching on
> layer 2 miss
> 
> External Email
> 
> ----------------------------------------------------------------------
> Adjust drivers that support the 'FLOW_DISSECTOR_KEY_META' key to reject
> filters that try to match on the newly added layer 2 miss option. Add an
> extack message to clearly communicate the failure reason to user space.
> 
> Example:
> 
>  # tc filter add dev swp1 egress pref 1 proto all flower skip_sw l2_miss true
> action drop
>  Error: mlxsw_spectrum: Can't match on "l2_miss".
>  We have an error talking to the kernel
> 
> Signed-off-by: Ido Schimmel <idosch@...dia.com>
> ---
>  .../net/ethernet/marvell/prestera/prestera_flower.c    |  6 ++++++
>  drivers/net/ethernet/mellanox/mlx5/core/en_tc.c        |  6 ++++++
>  drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c  |  6 ++++++
>  drivers/net/ethernet/mscc/ocelot_flower.c              | 10 ++++++++++
>  4 files changed, 28 insertions(+)
> 
> diff --git a/drivers/net/ethernet/marvell/prestera/prestera_flower.c
> b/drivers/net/ethernet/marvell/prestera/prestera_flower.c
> index 91a478b75cbf..3e20e71b0f81 100644
> --- a/drivers/net/ethernet/marvell/prestera/prestera_flower.c
> +++ b/drivers/net/ethernet/marvell/prestera/prestera_flower.c
> @@ -148,6 +148,12 @@ static int prestera_flower_parse_meta(struct
> prestera_acl_rule *rule,
>  	__be16 key, mask;
> 
>  	flow_rule_match_meta(f_rule, &match);
> +
> +	if (match.mask->l2_miss) {
> +		NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on
> \"l2_miss\"");
> +		return -EOPNOTSUPP;
> +	}
> +
>  	if (match.mask->ingress_ifindex != 0xFFFFFFFF) {
>  		NL_SET_ERR_MSG_MOD(f->common.extack,
>  				   "Unsupported ingress ifindex mask"); diff --
> git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> index 728b82ce4031..516653568330 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> @@ -2586,6 +2586,12 @@ static int mlx5e_flower_parse_meta(struct
> net_device *filter_dev,
>  		return 0;
> 
>  	flow_rule_match_meta(rule, &match);
> +
> +	if (match.mask->l2_miss) {
> +		NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on
> \"l2_miss\"");
> +		return -EOPNOTSUPP;
> +	}
> +
>  	if (!match.mask->ingress_ifindex)
>  		return 0;
> 
> diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
> b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
> index 594cdcb90b3d..6fec9223250b 100644
> --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
> +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
> @@ -294,6 +294,12 @@ static int mlxsw_sp_flower_parse_meta(struct
> mlxsw_sp_acl_rule_info *rulei,
>  		return 0;
> 
>  	flow_rule_match_meta(rule, &match);
> +
> +	if (match.mask->l2_miss) {
> +		NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on
> \"l2_miss\"");
> +		return -EOPNOTSUPP;
> +	}
> +
>  	if (match.mask->ingress_ifindex != 0xFFFFFFFF) {
>  		NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported
> ingress ifindex mask");
>  		return -EINVAL;
> diff --git a/drivers/net/ethernet/mscc/ocelot_flower.c
> b/drivers/net/ethernet/mscc/ocelot_flower.c
> index ee052404eb55..e0916afcddfb 100644
> --- a/drivers/net/ethernet/mscc/ocelot_flower.c
> +++ b/drivers/net/ethernet/mscc/ocelot_flower.c
> @@ -592,6 +592,16 @@ ocelot_flower_parse_key(struct ocelot *ocelot, int
> port, bool ingress,
>  		return -EOPNOTSUPP;
>  	}
> 
> +	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META)) {
> +		struct flow_match_meta match;
> +
> +		flow_rule_match_meta(rule, &match);
> +		if (match.mask->l2_miss) {
> +			NL_SET_ERR_MSG_MOD(extack, "Can't match on
> \"l2_miss\"");
> +			return -EOPNOTSUPP;
> +		}
> +	}
> +
>  	/* For VCAP ES0 (egress rewriter) we can match on the ingress port
> */
>  	if (!ingress) {
>  		ret = ocelot_flower_parse_indev(ocelot, port, f, filter);
> --
> 2.40.1
> 

I have reviewed the prestera part. Looks straightforward enough.

Acked-by: Elad Nachman <enachman@...vell.com>