From: Jamal Hadi Salim <jhs@mojatatu.com>
To: Simon Horman <simon.horman@netronome.com>,
Jiri Pirko <jiri@mellanox.com>,
Cong Wang <xiyou.wangcong@gmail.com>
Cc: Dinan Gunawardena <dinan.gunawardena@netronome.com>,
netdev@vger.kernel.org, oss-drivers@netronome.com,
Benjamin LaHaise <benjamin.lahaise@netronome.com>
Subject: Re: [PATCH/RFC net-next v2 3/4] net/sched: cls_flower: do not match if dissection fails
Date: Mon, 8 May 2017 07:26:31 -0400 [thread overview]
Message-ID: <20bc02eb-ea99-652e-7205-fa6131964446@mojatatu.com> (raw)
In-Reply-To: <1493988426-22854-4-git-send-email-simon.horman@netronome.com>
On 17-05-05 08:47 AM, Simon Horman wrote:
> If the flow skb_flow_dissect() returns an error it indicates that
> dissection was incomplete for some reason. Matching using the result of an
> incomplete dissection may cause unexpected results. For example:
>
> * A match on zero layer 4 ports will also match packets truncated at
> the end of the IP header; that is packets where ports are missing are
> treated the same way as packets with zero ports.
> * Likewise, a match on zero ICMP code or type will also match packets
> truncated at the end of the IP header; that is packets where the ICMP
> type and code are missing will be treated the same way as packets with
> zero ICMP code and type.
>
> Separate patches to the flow dissector are required in order for it to
> return errors in the above cases.
>
> Fixes: 77b9900ef53a ("tc: introduce Flower classifier")
> Signed-off-by: Simon Horman <simon.horman@netronome.com>
> Reviewed-by: Benjamin LaHaise <benjamin.lahaise@netronome.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
cheers,
jamal
next prev parent reply other threads:[~2017-05-08 11:26 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-05-05 12:47 [PATCH/RFC net-next v2 0/4] net/sched: cls_flower: avoid false matching of truncated packets Simon Horman
2017-05-05 12:47 ` [PATCH/RFC net-next v2 1/4] flow dissector: return error on port dissection under-run Simon Horman
2017-05-08 11:21 ` Jamal Hadi Salim
2017-05-05 12:47 ` [PATCH/RFC net-next v2 2/4] flow dissector: return error on icmp " Simon Horman
2017-05-08 11:21 ` Jamal Hadi Salim
2017-05-05 12:47 ` [PATCH/RFC net-next v2 3/4] net/sched: cls_flower: do not match if dissection fails Simon Horman
2017-05-08 11:26 ` Jamal Hadi Salim [this message]
2017-05-05 12:47 ` [PATCH/RFC net-next v2 4/4] net/sched: cls_flower: allow control of tree traversal on packet parse errors Simon Horman
2017-05-05 22:44 ` Cong Wang
2017-05-08 11:32 ` Jamal Hadi Salim
2017-05-08 11:54 ` Simon Horman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20bc02eb-ea99-652e-7205-fa6131964446@mojatatu.com \
--to=jhs@mojatatu.com \
--cc=benjamin.lahaise@netronome.com \
--cc=dinan.gunawardena@netronome.com \
--cc=jiri@mellanox.com \
--cc=netdev@vger.kernel.org \
--cc=oss-drivers@netronome.com \
--cc=simon.horman@netronome.com \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.