netdev - Re: [PATCH net-next 3/3] openvswitch: set IPS_CONFIRMED in tmpl status only when commit is set in conntrack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 19 Jun 2024 22:19:59 +0200
From: Florian Westphal <fw@...len.de>
To: Xin Long <lucien.xin@...il.com>
Cc: Ilya Maximets <i.maximets@....org>, Florian Westphal <fw@...len.de>,
	network dev <netdev@...r.kernel.org>, dev@...nvswitch.org,
	Marcelo Ricardo Leitner <marcelo.leitner@...il.com>,
	Jiri Pirko <jiri@...nulli.us>, Davide Caratti <dcaratti@...hat.com>,
	Jamal Hadi Salim <jhs@...atatu.com>,
	Eric Dumazet <edumazet@...gle.com>,
	Cong Wang <xiyou.wangcong@...il.com>, kuba@...nel.org,
	Paolo Abeni <pabeni@...hat.com>, davem@...emloft.net,
	Pablo Neira Ayuso <pablo@...filter.org>,
	Aaron Conole <aconole@...hat.com>
Subject: Re: [PATCH net-next 3/3] openvswitch: set IPS_CONFIRMED in tmpl
 status only when commit is set in conntrack

Xin Long <lucien.xin@...il.com> wrote:
> > master connection only if it is not yet confirmed.  Users may commit different
> > labels for the related connection.  This should be more in line with the
> > previous behavior.
> >
> > What do you think?
> >
> You're right.
> Also, I noticed the related ct->mark is set to master ct->mark in
> init_conntrack() as well as secmark when creating the related ct.
> 
> Hi, Florian,
> 
> Any reason why the labels are not set to master ct's in there?

The intent was to have lables be set only via ctnetlink (userspace)
or ruleset.

The original use case was for tagging connections based on
observed behaviour/properties at a later time, not at start of flow.