netdev - Re: [PATCH net-next v11 09/12] virtio_net: Implement IPv4 ethtool flow rules

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6b812cc4-8e36-49d6-9a90-8295c0bfd67c@nvidia.com>
Date: Wed, 19 Nov 2025 10:59:22 -0600
From: Dan Jurgens <danielj@...dia.com>
To: "Michael S. Tsirkin" <mst@...hat.com>
Cc: netdev@...r.kernel.org, jasowang@...hat.com, pabeni@...hat.com,
 virtualization@...ts.linux.dev, parav@...dia.com, shshitrit@...dia.com,
 yohadt@...dia.com, xuanzhuo@...ux.alibaba.com, eperezma@...hat.com,
 jgg@...pe.ca, kevin.tian@...el.com, kuba@...nel.org, andrew+netdev@...n.ch,
 edumazet@...gle.com
Subject: Re: [PATCH net-next v11 09/12] virtio_net: Implement IPv4 ethtool
 flow rules

On 11/19/25 10:51 AM, Michael S. Tsirkin wrote:
> On Wed, Nov 19, 2025 at 10:33:31AM -0600, Dan Jurgens wrote:
>> On 11/19/25 3:18 AM, Michael S. Tsirkin wrote:
>>> On Tue, Nov 18, 2025 at 04:31:09PM -0500, Michael S. Tsirkin wrote:
>>>>> +static int setup_ip_key_mask(struct virtio_net_ff_selector *selector,
>>>>> +			     u8 *key,
>>>>> +			     const struct ethtool_rx_flow_spec *fs)
>>>>> +{
>>>>> +	struct iphdr *v4_m = (struct iphdr *)&selector->mask;
>>>>> +	struct iphdr *v4_k = (struct iphdr *)key;
>>>>> +
>>>>> +	selector->type = VIRTIO_NET_FF_MASK_TYPE_IPV4;
>>>>> +	selector->length = sizeof(struct iphdr);
>>>>> +
>>>>> +	if (fs->h_u.usr_ip4_spec.l4_4_bytes ||
>>>>> +	    fs->h_u.usr_ip4_spec.tos ||
>>>>> +	    fs->h_u.usr_ip4_spec.ip_ver != ETH_RX_NFC_IP4)
>>>>> +		return -EOPNOTSUPP;
>>>>
>>>> So include/uapi/linux/ethtool.h says:
>>>>
>>>>  * struct ethtool_usrip4_spec - general flow specification for IPv4
>>>>  * @ip4src: Source host
>>>>  * @ip4dst: Destination host
>>>>  * @l4_4_bytes: First 4 bytes of transport (layer 4) header
>>>>  * @tos: Type-of-service
>>>>  * @ip_ver: Value must be %ETH_RX_NFC_IP4; mask must be 0
>>>>  * @proto: Transport protocol number; mask must be 0
>>>>
>>>> I guess this ETH_RX_NFC_IP4 check validates that userspace follows this
>>>> documentation? But then shouldn't you check the mask
>>>> as well? and mask for proto?
>>>>
>>>>
>>>>
>>>
>>> in fact, what if e.g. tos is 0 but mask is non-zero? should not
>>> this be rejected, too?
>>>
>>
>> Actually the tos check should be removed, there's no guidance it should
>> be 0, like the other fields. Our hardware doesn't support it, but this
>> will be caught in validate_classifier_selectors.
> 
> same question for l4_4_bytes then.
> 
I guess it's reasonable to assert that. An ip only rule would fail to
match if the mask were set.