lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <BN9PR18MB42515532FEB4A498D39AB073DB779@BN9PR18MB4251.namprd18.prod.outlook.com> Date: Wed, 10 May 2023 09:57:36 +0000 From: Elad Nachman <enachman@...vell.com> To: Ido Schimmel <idosch@...dia.com>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>, "bridge@...ts.linux-foundation.org" <bridge@...ts.linux-foundation.org> CC: "davem@...emloft.net" <davem@...emloft.net>, "kuba@...nel.org" <kuba@...nel.org>, "pabeni@...hat.com" <pabeni@...hat.com>, "edumazet@...gle.com" <edumazet@...gle.com>, "razor@...ckwall.org" <razor@...ckwall.org>, "roopa@...dia.com" <roopa@...dia.com>, "jhs@...atatu.com" <jhs@...atatu.com>, "xiyou.wangcong@...il.com" <xiyou.wangcong@...il.com>, "jiri@...nulli.us" <jiri@...nulli.us>, "petrm@...dia.com" <petrm@...dia.com>, "taspelund@...dia.com" <taspelund@...dia.com> Subject: RE: [EXT] [RFC PATCH net-next 3/5] flow_offload: Reject matching on layer 2 miss > -----Original Message----- > From: Ido Schimmel <idosch@...dia.com> > Sent: Tuesday, May 9, 2023 10:05 AM > To: netdev@...r.kernel.org; bridge@...ts.linux-foundation.org > Cc: davem@...emloft.net; kuba@...nel.org; pabeni@...hat.com; > edumazet@...gle.com; razor@...ckwall.org; roopa@...dia.com; > jhs@...atatu.com; xiyou.wangcong@...il.com; jiri@...nulli.us; > petrm@...dia.com; taspelund@...dia.com; Ido Schimmel > <idosch@...dia.com> > Subject: [EXT] [RFC PATCH net-next 3/5] flow_offload: Reject matching on > layer 2 miss > > External Email > > ---------------------------------------------------------------------- > Adjust drivers that support the 'FLOW_DISSECTOR_KEY_META' key to reject > filters that try to match on the newly added layer 2 miss option. Add an > extack message to clearly communicate the failure reason to user space. > > Example: > > # tc filter add dev swp1 egress pref 1 proto all flower skip_sw l2_miss true > action drop > Error: mlxsw_spectrum: Can't match on "l2_miss". > We have an error talking to the kernel > > Signed-off-by: Ido Schimmel <idosch@...dia.com> > --- > .../net/ethernet/marvell/prestera/prestera_flower.c | 6 ++++++ > drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 ++++++ > drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c | 6 ++++++ > drivers/net/ethernet/mscc/ocelot_flower.c | 10 ++++++++++ > 4 files changed, 28 insertions(+) > > diff --git a/drivers/net/ethernet/marvell/prestera/prestera_flower.c > b/drivers/net/ethernet/marvell/prestera/prestera_flower.c > index 91a478b75cbf..3e20e71b0f81 100644 > --- a/drivers/net/ethernet/marvell/prestera/prestera_flower.c > +++ b/drivers/net/ethernet/marvell/prestera/prestera_flower.c > @@ -148,6 +148,12 @@ static int prestera_flower_parse_meta(struct > prestera_acl_rule *rule, > __be16 key, mask; > > flow_rule_match_meta(f_rule, &match); > + > + if (match.mask->l2_miss) { > + NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on > \"l2_miss\""); > + return -EOPNOTSUPP; > + } > + > if (match.mask->ingress_ifindex != 0xFFFFFFFF) { > NL_SET_ERR_MSG_MOD(f->common.extack, > "Unsupported ingress ifindex mask"); diff -- > git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c > b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c > index 728b82ce4031..516653568330 100644 > --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c > @@ -2586,6 +2586,12 @@ static int mlx5e_flower_parse_meta(struct > net_device *filter_dev, > return 0; > > flow_rule_match_meta(rule, &match); > + > + if (match.mask->l2_miss) { > + NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on > \"l2_miss\""); > + return -EOPNOTSUPP; > + } > + > if (!match.mask->ingress_ifindex) > return 0; > > diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c > b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c > index 594cdcb90b3d..6fec9223250b 100644 > --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c > +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c > @@ -294,6 +294,12 @@ static int mlxsw_sp_flower_parse_meta(struct > mlxsw_sp_acl_rule_info *rulei, > return 0; > > flow_rule_match_meta(rule, &match); > + > + if (match.mask->l2_miss) { > + NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on > \"l2_miss\""); > + return -EOPNOTSUPP; > + } > + > if (match.mask->ingress_ifindex != 0xFFFFFFFF) { > NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported > ingress ifindex mask"); > return -EINVAL; > diff --git a/drivers/net/ethernet/mscc/ocelot_flower.c > b/drivers/net/ethernet/mscc/ocelot_flower.c > index ee052404eb55..e0916afcddfb 100644 > --- a/drivers/net/ethernet/mscc/ocelot_flower.c > +++ b/drivers/net/ethernet/mscc/ocelot_flower.c > @@ -592,6 +592,16 @@ ocelot_flower_parse_key(struct ocelot *ocelot, int > port, bool ingress, > return -EOPNOTSUPP; > } > > + if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META)) { > + struct flow_match_meta match; > + > + flow_rule_match_meta(rule, &match); > + if (match.mask->l2_miss) { > + NL_SET_ERR_MSG_MOD(extack, "Can't match on > \"l2_miss\""); > + return -EOPNOTSUPP; > + } > + } > + > /* For VCAP ES0 (egress rewriter) we can match on the ingress port > */ > if (!ingress) { > ret = ocelot_flower_parse_indev(ocelot, port, f, filter); > -- > 2.40.1 > I have reviewed the prestera part. Looks straightforward enough. Acked-by: Elad Nachman <enachman@...vell.com>
Powered by blists - more mailing lists