Re: [PATCH net] cls_flower: Fix the behavior using port ranges with hw-offload

[David Miller <davem@davemloft.net>]

From: Yoshiki Komachi <komachi.yoshiki@gmail.com>
Date: Tue,  3 Dec 2019 19:40:12 +0900

> The recent commit 5c72299fba9d ("net: sched: cls_flower: Classify
> packets using port ranges") had added filtering based on port ranges
> to tc flower. However the commit missed necessary changes in hw-offload
> code, so the feature gave rise to generating incorrect offloaded flow
> keys in NIC.
> 
> One more detailed example is below:
> 
> $ tc qdisc add dev eth0 ingress
> $ tc filter add dev eth0 ingress protocol ip flower ip_proto tcp \
>   dst_port 100-200 action drop
> 
> With the setup above, an exact match filter with dst_port == 0 will be
> installed in NIC by hw-offload. IOW, the NIC will have a rule which is
> equivalent to the following one.
> 
> $ tc qdisc add dev eth0 ingress
> $ tc filter add dev eth0 ingress protocol ip flower ip_proto tcp \
>   dst_port 0 action drop
> 
> The behavior was caused by the flow dissector which extracts packet
> data into the flow key in the tc flower. More specifically, regardless
> of exact match or specified port ranges, fl_init_dissector() set the
> FLOW_DISSECTOR_KEY_PORTS flag in struct flow_dissector to extract port
> numbers from skb in skb_flow_dissect() called by fl_classify(). Note
> that device drivers received the same struct flow_dissector object as
> used in skb_flow_dissect(). Thus, offloaded drivers could not identify
> which of these is used because the FLOW_DISSECTOR_KEY_PORTS flag was
> set to struct flow_dissector in either case.
> 
> This patch adds the new FLOW_DISSECTOR_KEY_PORTS_RANGE flag and the new
> tp_range field in struct fl_flow_key to recognize which filters are applied
> to offloaded drivers. At this point, when filters based on port ranges
> passed to drivers, drivers return the EOPNOTSUPP error because they do
> not support the feature (the newly created FLOW_DISSECTOR_KEY_PORTS_RANGE
> flag).
> 
> Fixes: 5c72299fba9d ("net: sched: cls_flower: Classify packets using port ranges")
> Signed-off-by: Yoshiki Komachi <komachi.yoshiki@gmail.com>

Applied and queued up for -stable, thank you.