netdev - Re: [PATCH iwl-net] ice: Fix checking for unsupported keys on non-tunnel device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f3ea9bd1-8f92-4c23-bd24-3415e40bf066@intel.com>
Date: Tue, 9 Apr 2024 17:05:20 -0700
From: Jacob Keller <jacob.e.keller@...el.com>
To: Marcin Szycik <marcin.szycik@...ux.intel.com>,
	<intel-wired-lan@...ts.osuosl.org>
CC: <netdev@...r.kernel.org>, Michal Swiatkowski
	<michal.swiatkowski@...ux.intel.com>
Subject: Re: [PATCH iwl-net] ice: Fix checking for unsupported keys on
 non-tunnel device



On 4/9/2024 8:45 AM, Marcin Szycik wrote:
> Add missing FLOW_DISSECTOR_KEY_ENC_* checks to TC flower filter parsing.
> Without these checks, it would be possible to add filters with tunnel
> options on non-tunnel devices. enc_* options are only valid for tunnel
> devices.
> 
> Example:
>   devlink dev eswitch set $PF1_PCI mode switchdev
>   echo 1 > /sys/class/net/$PF1/device/sriov_numvfs
>   tc qdisc add dev $VF1_PR ingress
>   ethtool -K $PF1 hw-tc-offload on
>   tc filter add dev $VF1_PR ingress flower enc_ttl 12 skip_sw action drop
> 
> Fixes: 9e300987d4a8 ("ice: VXLAN and Geneve TC support")
> Reviewed-by: Michal Swiatkowski <michal.swiatkowski@...ux.intel.com>
> Signed-off-by: Marcin Szycik <marcin.szycik@...ux.intel.com>

Reviewed-by: Jacob Keller <jacob.e.keller@...el.com>

> ---
>  drivers/net/ethernet/intel/ice/ice_tc_lib.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.c b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
> index f8df93e1a9de..b49aa6554024 100644
> --- a/drivers/net/ethernet/intel/ice/ice_tc_lib.c
> +++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
> @@ -1489,7 +1489,10 @@ ice_parse_cls_flower(struct net_device *filter_dev, struct ice_vsi *vsi,
>  		  (BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS) |
>  		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS) |
>  		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_KEYID) |
> -		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_PORTS))) {
> +		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_PORTS) |
> +		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IP) |
> +		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_OPTS) |
> +		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_CONTROL))) {
>  		NL_SET_ERR_MSG_MOD(fltr->extack, "Tunnel key used, but device isn't a tunnel");
>  		return -EOPNOTSUPP;
>  	} else {