netdev - Re: [PATCH net-next 7/7] selftests: openvswitch: add explicit drop testcase

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f7t8rb5l5zy.fsf@redhat.com>
Date: Mon, 24 Jul 2023 10:49:05 -0400
From: Aaron Conole <aconole@...hat.com>
To: Adrian Moreno <amorenoz@...hat.com>
Cc: netdev@...r.kernel.org,  dev@...nvswitch.org,  i.maximets@....org,
  eric@...ver.life
Subject: Re: [PATCH net-next 7/7] selftests: openvswitch: add explicit drop
 testcase

Adrian Moreno <amorenoz@...hat.com> writes:

> Make ovs-dpctl.py support explicit drops as:
> "drop" -> implicit empty-action drop
> "drop(0)" -> explicit non-error action drop
> "drop(42)" -> explicit error action drop
>
> Signed-off-by: Adrian Moreno <amorenoz@...hat.com>
> ---
>  .../selftests/net/openvswitch/openvswitch.sh  | 25 +++++++++++++++++++
>  .../selftests/net/openvswitch/ovs-dpctl.py    | 18 ++++++++++---
>  2 files changed, 39 insertions(+), 4 deletions(-)
>
> diff --git a/tools/testing/selftests/net/openvswitch/openvswitch.sh b/tools/testing/selftests/net/openvswitch/openvswitch.sh
> index a10c345f40ef..398a69f1c923 100755
> --- a/tools/testing/selftests/net/openvswitch/openvswitch.sh
> +++ b/tools/testing/selftests/net/openvswitch/openvswitch.sh
> @@ -217,6 +217,31 @@ test_drop_reason() {
>  		return 1
>  	fi
>  
> +	# Drop UDP 6000 traffic with an explicit action and an error code.
> +	ovs_add_flow "test_drop_reason" dropreason \
> +		"in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=6000)" \
> +                'drop(42)'
> +	# Drop UDP 7000 traffic with an explicit action with no error code.
> +	ovs_add_flow "test_drop_reason" dropreason \
> +		"in_port(1),eth(),eth_type(0x0800),ipv4(src=172.31.110.10,proto=17),udp(dst=7000)" \
> +                'drop(0)'
> +
> +	ovs_drop_record_and_run \
> +            "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 6000
> +	ovs_drop_reason_count 0x30003 # OVS_DROP_EXPLICIT_ACTION_ERROR
> +	if [[ "$?" -ne "1" ]]; then
> +		info "Did not detect expected explicit error drops: $?"
> +		return 1
> +	fi
> +
> +	ovs_drop_record_and_run \
> +            "test_drop_reason" ip netns exec client nc -i 1 -zuv 172.31.110.20 7000
> +	ovs_drop_reason_count 0x30002 # OVS_DROP_EXPLICIT_ACTION
> +	if [[ "$?" -ne "1" ]]; then
> +		info "Did not detect expected explicit drops: $?"
> +		return 1
> +	fi
> +
>  	return 0
>  }
>  
> diff --git a/tools/testing/selftests/net/openvswitch/ovs-dpctl.py b/tools/testing/selftests/net/openvswitch/ovs-dpctl.py
> index 0bc944f36e02..de6db59ab115 100644
> --- a/tools/testing/selftests/net/openvswitch/ovs-dpctl.py
> +++ b/tools/testing/selftests/net/openvswitch/ovs-dpctl.py
> @@ -448,7 +448,7 @@ class ovsactions(nla):
>                  elif field[0] == "OVS_ACTION_ATTR_TRUNC":
>                      print_str += "trunc(%d)" % int(self.get_attr(field[0]))
>                  elif field[0] == "OVS_ACTION_ATTR_DROP":
> -                    print_str += "drop"
> +                    print_str += "drop(%d)" % int(self.get_attr(field[0]))
>              elif field[1] == "flag":
>                  if field[0] == "OVS_ACTION_ATTR_CT_CLEAR":
>                      print_str += "ct_clear"
> @@ -470,9 +470,19 @@ class ovsactions(nla):
>          parsed = False
>          while len(actstr) != 0:
>              if actstr.startswith("drop"):
> -                # for now, drops have no explicit action, so we
> -                # don't need to set any attributes.  The final
> -                # act of the processing chain will just drop the packet
> +                # If no reason is provided, the implicit drop is used (i.e no
> +                # action). If some reason is given, an explicit action is used.
> +                actstr, reason = parse_extract_field(
> +                    actstr,
> +                    "drop(",
> +                    "([0-9]+)",
> +                    lambda x: int(x, 0),
> +                    False,
> +                    None,
> +                )
> +                if reason is not None:
> +                    self["attrs"].append(["OVS_ACTION_ATTR_DROP", reason])
> +
>                  return

If we decide to validate that drop() action is the last one, we can
probably also remove this return.

>  
>              elif parse_starts_block(actstr, "^(\d+)", False, True):