netdev - Re: [PATCH net] bnxt_en: ethtool: Fix ip[6] ntuple rule verification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <zdshp6klnjjexwxpx6e5k62jej6xmxiubmkegkk3tixt2jk5t2@poolzxiibn3n>
Date: Fri, 1 Nov 2024 16:42:03 -0600
From: Daniel Xu <dxu@...uu.xyz>
To: Michael Chan <michael.chan@...adcom.com>
Cc: davem@...emloft.net, edumazet@...gle.com, andrew+netdev@...n.ch, 
	kuba@...nel.org, vikas.gupta@...adcom.com, andrew.gospodarek@...adcom.com, 
	pabeni@...hat.com, pavan.chebbi@...adcom.com, martin.lau@...ux.dev, 
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org, kernel-team@...a.com
Subject: Re: [PATCH net] bnxt_en: ethtool: Fix ip[6] ntuple rule verification

Hi Michael,

Thanks for taking a look.

On Fri, Nov 01, 2024 at 12:20:44PM GMT, Michael Chan wrote:
> On Thu, Oct 31, 2024 at 9:59 PM Daniel Xu <dxu@...uu.xyz> wrote:
> >
> > Previously, trying to insert an ip or ip6 only rule would get rejected
> > with -EOPNOTSUPP. For example, the following would fail:
> >
> >     ethtool -N eth0 flow-type ip6 dst-ip $IP6 context 1
> >
> > The reason was that all the l4proto validation was being run despite the
> > l4proto mask being set to 0x0.  Fix by only running l4proto validation
> > when mask is set.
> >
> > Fixes: 9ba0e56199e3 ("bnxt_en: Enhance ethtool ntuple support for ip flows besides TCP/UDP")
> > Signed-off-by: Daniel Xu <dxu@...uu.xyz>
> 
> Thanks for the patch.  I think the original author Vikas intended the
> user to do this for ip only filters:
> 
> ethtool -N eth0 flow-type ip6 dst-ip $IP6 l4_proto 0xff context 1
> 
> But your patch makes sense and simplifies the usage for the user.  I
> just need to check that FW can accept 0 for the ip_protocol field to
> mean wildcard when it receives the FW message to create the filter.
> 
> I will reply when I get the answer from the FW team.  If FW requires
> 0xff, then we just need to make a small change to your patch.

FWIW at least my HW/FW seems to behave correctly with my patch. I did
some quick tracing last night w/ a UDP traffic generator running to
confirm redirection occurs.

I tested on:

    driver: bnxt_en
    version: 6.9.5-<redacted>
    firmware-version: 229.0.154.1/pkg 229.1.123.1
    expansion-rom-version:
    bus-info: 0000:01:00.0
    supports-statistics: yes
    supports-test: yes
    supports-eeprom-access: yes
    supports-register-dump: yes
    supports-priv-flags: no

By the way, I noticed after I sent this patch that the get codepath
needs to be correspondingly updated. I will send a v2 with it.

Thanks,
Daniel