netdev - Re: [PATCH net-next 3/3] openvswitch: set IPS_CONFIRMED in tmpl status only when commit is set in conntrack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20240709054950.GA29568@breakpoint.cc>
Date: Tue, 9 Jul 2024 07:49:50 +0200
From: Florian Westphal <fw@...len.de>
To: Xin Long <lucien.xin@...il.com>
Cc: Florian Westphal <fw@...len.de>, Ilya Maximets <i.maximets@....org>,
	network dev <netdev@...r.kernel.org>, dev@...nvswitch.org,
	Marcelo Ricardo Leitner <marcelo.leitner@...il.com>,
	Jiri Pirko <jiri@...nulli.us>, Davide Caratti <dcaratti@...hat.com>,
	Jamal Hadi Salim <jhs@...atatu.com>,
	Eric Dumazet <edumazet@...gle.com>,
	Cong Wang <xiyou.wangcong@...il.com>, kuba@...nel.org,
	Paolo Abeni <pabeni@...hat.com>, davem@...emloft.net,
	Pablo Neira Ayuso <pablo@...filter.org>,
	Aaron Conole <aconole@...hat.com>
Subject: Re: [PATCH net-next 3/3] openvswitch: set IPS_CONFIRMED in tmpl
 status only when commit is set in conntrack

Xin Long <lucien.xin@...il.com> wrote:
> > Xin Long <lucien.xin@...il.com> wrote:
> > > I can avoid this warning by not allocating ext for commit ct in ovs:
> > >
> > > @@ -426,7 +426,7 @@ static int ovs_ct_set_labels(struct nf_conn *ct,
> > > struct sw_flow_key *key,
> > >         struct nf_conn_labels *cl;
> > >         int err;
> > >
> > > -       cl = ovs_ct_get_conn_labels(ct);
> > > +       cl = nf_ct_labels_find(ct);
> > >         if (!cl)
> > >                 return -ENOSPC;
> ovs_ct_get_conn_labels() must be replaced with nf_ct_labels_find() in here
> anyway, thinking that the confirmed ct without labels was created in other
> places (not by OVS conntrack), the warning may still be triggered when
> trying to set labels in OVS after.

Right.

> > Then ovs_ct_limit_init() and nf_connlabels_get() need to be called
> > once on the first conntrack operatation, regardless if labels are asked
> > for or not.
> >
> > Not nice but still better than current state.
> Right, not nice, it undermines the bits check against NF_CT_LABELS_MAX_SIZE.

Yes, but OTOH this bit check isn't used anymore, it comes from days when
label area was dynamically sized, today is hardcoded to 128 anyway.