netdev - Re: [PATCH net-next] mlxsw: spectrum_flower: validate control flags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZiABPNMbOOYGiHCq@shredder>
Date: Wed, 17 Apr 2024 20:05:00 +0300
From: Ido Schimmel <idosch@...dia.com>
To: Asbjørn Sloth Tønnesen <ast@...erby.net>
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Petr Machata <petrm@...dia.com>
Subject: Re: [PATCH net-next] mlxsw: spectrum_flower: validate control flags

On Wed, Apr 17, 2024 at 01:51:20PM +0000, Asbjørn Sloth Tønnesen wrote:
> This driver currently doesn't support any control flags.
> 
> Use flow_rule_has_control_flags() to check for control flags,
> such as can be set through `tc flower ... ip_flags frag`.
> 
> In case any control flags are masked, flow_rule_has_control_flags()
> sets a NL extended error message, and we return -EOPNOTSUPP.
> 
> Only compile-tested.
> 
> Signed-off-by: Asbjørn Sloth Tønnesen <ast@...erby.net>

Reviewed-by: Ido Schimmel <idosch@...dia.com>
Tested-by: Ido Schimmel <idosch@...dia.com>

Without patch:

+ tc qdisc add dev swp1 clsact
+ tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags frag action drop
+ tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags nofrag action drop
+ tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags firstfrag action drop
+ tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags nofirstfrag action drop

With patch:

+ tc qdisc add dev swp1 clsact
+ tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags frag action drop
Error: mlxsw_spectrum: Unsupported match on control.flags 0x1.
We have an error talking to the kernel
+ tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags nofrag action drop
Error: mlxsw_spectrum: Unsupported match on control.flags 0x1.
We have an error talking to the kernel
+ tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags firstfrag action drop
Error: mlxsw_spectrum: Unsupported match on control.flags 0x2.
We have an error talking to the kernel
+ tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags nofirstfrag action drop
Error: mlxsw_spectrum: Unsupported match on control.flags 0x2.
We have an error talking to the kernel

Thanks!