netdev - Re: [PATCH net-next] mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z1gO3ewMq07er0TN@mev-dev.igk.intel.com>
Date: Tue, 10 Dec 2024 10:50:21 +0100
From: Michal Swiatkowski <michal.swiatkowski@...ux.intel.com>
To: Petr Machata <petrm@...dia.com>
Cc: "David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Andrew Lunn <andrew+netdev@...n.ch>, netdev@...r.kernel.org,
	Ido Schimmel <idosch@...dia.com>, mlxsw@...dia.com,
	Vladyslav Mykhaliuk <vmykhaliuk@...dia.com>,
	Amit Cohen <amcohen@...dia.com>, Jiri Pirko <jiri@...dia.com>
Subject: Re: [PATCH net-next] mlxsw: spectrum_flower: Do not allow mixing
 sample and mirror actions

On Tue, Dec 10, 2024 at 10:45:37AM +0100, Petr Machata wrote:
> From: Ido Schimmel <idosch@...dia.com>
> 
> The device does not support multiple mirror actions per rule and the
> driver rejects such configuration:
> 
>  # tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw action mirred egress mirror dev swp2 action mirred egress mirror dev swp3
>  Error: mlxsw_spectrum: Multiple mirror actions per rule are not supported.
>  We have an error talking to the kernel
> 
> Internally, the sample action is implemented by the device by mirroring
> to the CPU port. Therefore, mixing sample and mirror actions in a single
> rule does not work correctly and results in the last action effect.
> 
> Solve by rejecting such misconfiguration:
> 
>  # tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw action mirred egress mirror dev swp2 action sample rate 100 group 1
>  Error: mlxsw_spectrum: Sample action after mirror action is not supported.
>  We have an error talking to the kernel
> 
>  # tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw action sample rate 100 group 1 action mirred egress mirror dev swp2
>  Error: mlxsw_spectrum: Mirror action after sample action is not supported.
>  We have an error talking to the kernel
> 
> Reported-by: Vladyslav Mykhaliuk <vmykhaliuk@...dia.com>
> Signed-off-by: Ido Schimmel <idosch@...dia.com>
> Reviewed-by: Amit Cohen <amcohen@...dia.com>
> Reviewed-by: Jiri Pirko <jiri@...dia.com>
> Signed-off-by: Petr Machata <petrm@...dia.com>
> ---
>  drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
> index f07955b5439f..6a4a81c63451 100644
> --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
> +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
> @@ -192,6 +192,11 @@ static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
>  				return -EOPNOTSUPP;
>  			}
>  
> +			if (sample_act_count) {
> +				NL_SET_ERR_MSG_MOD(extack, "Mirror action after sample action is not supported");
> +				return -EOPNOTSUPP;
> +			}
> +
>  			err = mlxsw_sp_acl_rulei_act_mirror(mlxsw_sp, rulei,
>  							    block, out_dev,
>  							    extack);
> @@ -265,6 +270,11 @@ static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
>  				return -EOPNOTSUPP;
>  			}
>  
> +			if (mirror_act_count) {
> +				NL_SET_ERR_MSG_MOD(extack, "Sample action after mirror action is not supported");
> +				return -EOPNOTSUPP;
> +			}
> +
>  			err = mlxsw_sp_acl_rulei_act_sample(mlxsw_sp, rulei,
>  							    block,
>  							    act->sample.psample_group,
> -- 
> 2.47.0

Reviewed-by: Michal Swiatkowski <michal.swiatkowski@...ux.intel.com>

Thanks