| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAM0EoMkE3kzL28jg-nZiwQ0HnrFtm9HNBJwU1SJk7Z++yHzrMw@mail.gmail.com>
Date: Wed, 31 Jan 2024 16:13:25 -0500
From: Jamal Hadi Salim <jhs@...atatu.com>
To: Davide Caratti <dcaratti@...hat.com>
Cc: Cong Wang <xiyou.wangcong@...il.com>, Jiri Pirko <jiri@...nulli.us>,
"David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org,
Marcelo Ricardo Leitner <marcelo.leitner@...il.com>, Xin Long <lucien.xin@...il.com>,
Ilya Maximets <i.maximets@....org>
Subject: Re: [PATCH net-next 2/2] net/sched: cls_flower: add support for
matching tunnel control flags
On Wed, Jan 31, 2024 at 11:16 AM Davide Caratti <dcaratti@...hat.com> wrote:
>
> extend cls_flower to match flags belonging to 'TUNNEL_FLAGS_PRESENT' mask
> inside skb tunnel metadata.
>
> Suggested-by: Ilya Maximets <i.maximets@....org>
> Signed-off-by: Davide Caratti <dcaratti@...hat.com>
> ---
> include/uapi/linux/pkt_cls.h | 3 +++
> net/sched/cls_flower.c | 45 ++++++++++++++++++++++++++++++++++++
> 2 files changed, 48 insertions(+)
>
> diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
> index ea277039f89d..e3394f9d06b7 100644
> --- a/include/uapi/linux/pkt_cls.h
> +++ b/include/uapi/linux/pkt_cls.h
> @@ -554,6 +554,9 @@ enum {
> TCA_FLOWER_KEY_SPI, /* be32 */
> TCA_FLOWER_KEY_SPI_MASK, /* be32 */
>
> + TCA_FLOWER_KEY_ENC_FLAGS, /* be16 */
> + TCA_FLOWER_KEY_ENC_FLAGS_MASK, /* be16 */
> +
> __TCA_FLOWER_MAX,
> };
>
> diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
> index efb9d2811b73..d244169c8471 100644
> --- a/net/sched/cls_flower.c
> +++ b/net/sched/cls_flower.c
> @@ -74,6 +74,7 @@ struct fl_flow_key {
> struct flow_dissector_key_l2tpv3 l2tpv3;
> struct flow_dissector_key_ipsec ipsec;
> struct flow_dissector_key_cfm cfm;
> + struct flow_dissector_key_enc_flags enc_flags;
> } __aligned(BITS_PER_LONG / 8); /* Ensure that we can do comparisons as longs. */
>
> struct fl_flow_mask_range {
> @@ -731,6 +732,10 @@ static const struct nla_policy fl_policy[TCA_FLOWER_MAX + 1] = {
> [TCA_FLOWER_KEY_SPI_MASK] = { .type = NLA_U32 },
> [TCA_FLOWER_L2_MISS] = NLA_POLICY_MAX(NLA_U8, 1),
> [TCA_FLOWER_KEY_CFM] = { .type = NLA_NESTED },
> + [TCA_FLOWER_KEY_ENC_FLAGS] = NLA_POLICY_MASK(NLA_BE16,
> + TUNNEL_FLAGS_PRESENT),
> + [TCA_FLOWER_KEY_ENC_FLAGS_MASK] = NLA_POLICY_MASK(NLA_BE16,
> + TUNNEL_FLAGS_PRESENT),
> };
>
> static const struct nla_policy
> @@ -1748,6 +1753,21 @@ static int fl_set_key_cfm(struct nlattr **tb,
> return 0;
> }
>
> +static int fl_set_key_enc_flags(struct nlattr **tb, __be16 *flags_key,
> + __be16 *flags_mask, struct netlink_ext_ack *extack)
> +{
> + /* mask is mandatory for flags */
> + if (!tb[TCA_FLOWER_KEY_ENC_FLAGS_MASK]) {
if (NL_REQ_ATTR_CHECK(extack,...))
> + NL_SET_ERR_MSG(extack, "missing enc_flags mask");
> + return -EINVAL;
> + }
> +
> + *flags_key = nla_get_be16(tb[TCA_FLOWER_KEY_ENC_FLAGS]);
> + *flags_mask = nla_get_be16(tb[TCA_FLOWER_KEY_ENC_FLAGS_MASK]);
> +
> + return 0;
> +}
> +
> static int fl_set_key(struct net *net, struct nlattr **tb,
> struct fl_flow_key *key, struct fl_flow_key *mask,
> struct netlink_ext_ack *extack)
> @@ -1986,6 +2006,10 @@ static int fl_set_key(struct net *net, struct nlattr **tb,
> ret = fl_set_key_flags(tb, &key->control.flags,
> &mask->control.flags, extack);
>
> + if (tb[TCA_FLOWER_KEY_ENC_FLAGS])
And here..
cheers,
jamal
> + ret = fl_set_key_enc_flags(tb, &key->enc_flags.flags,
> + &mask->enc_flags.flags, extack);
> +
> return ret;
> }
>
> @@ -2098,6 +2122,8 @@ static void fl_init_dissector(struct flow_dissector *dissector,
> FLOW_DISSECTOR_KEY_IPSEC, ipsec);
> FL_KEY_SET_IF_MASKED(mask, keys, cnt,
> FLOW_DISSECTOR_KEY_CFM, cfm);
> + FL_KEY_SET_IF_MASKED(mask, keys, cnt,
> + FLOW_DISSECTOR_KEY_ENC_FLAGS, enc_flags);
>
> skb_flow_dissector_init(dissector, keys, cnt);
> }
> @@ -3185,6 +3211,22 @@ static int fl_dump_key_cfm(struct sk_buff *skb,
> return err;
> }
>
> +static int fl_dump_key_enc_flags(struct sk_buff *skb,
> + struct flow_dissector_key_enc_flags *key,
> + struct flow_dissector_key_enc_flags *mask)
> +{
> + if (!memchr_inv(mask, 0, sizeof(*mask)))
> + return 0;
> +
> + if (nla_put_be16(skb, TCA_FLOWER_KEY_ENC_FLAGS, key->flags))
> + return -EMSGSIZE;
> +
> + if (nla_put_be16(skb, TCA_FLOWER_KEY_ENC_FLAGS_MASK, mask->flags))
> + return -EMSGSIZE;
> +
> + return 0;
> +}
> +
> static int fl_dump_key_options(struct sk_buff *skb, int enc_opt_type,
> struct flow_dissector_key_enc_opts *enc_opts)
> {
> @@ -3481,6 +3523,9 @@ static int fl_dump_key(struct sk_buff *skb, struct net *net,
> if (fl_dump_key_cfm(skb, &key->cfm, &mask->cfm))
> goto nla_put_failure;
>
> + if (fl_dump_key_enc_flags(skb, &key->enc_flags, &mask->enc_flags))
> + goto nla_put_failure;
> +
> return 0;
>
> nla_put_failure:
> --
> 2.43.0
>
Powered by blists - more mailing lists