From: Stefano Brivio <sbrivio@redhat.com>
To: Florian Westphal <fw@strlen.de>
Cc: "Pablo Neira Ayuso" <pablo@netfilter.org>,
netfilter-devel@vger.kernel.org,
"Kadlecsik József" <kadlec@blackhole.kfki.hu>,
"Eric Garver" <eric@garver.life>, "Phil Sutter" <phil@nwl.cc>,
"Sabrina Dubroca" <sd@queasysnail.net>,
"Jay Ligatti" <ligatti@usf.edu>,
"Ori Rottenstreich" <or@cs.technion.ac.il>,
"Kirill Kogan" <kirill.kogan@gmail.com>
Subject: Re: [PATCH nf-next 3/8] nf_tables: Add set type for arbitrary concatenation of ranges
Date: Thu, 21 Nov 2019 22:00:46 +0100 [thread overview]
Message-ID: <20191121220046.0517c87d@redhat.com> (raw)
In-Reply-To: <20191121204113.GL20235@breakpoint.cc>
On Thu, 21 Nov 2019 21:41:13 +0100
Florian Westphal <fw@strlen.de> wrote:
> Yes, exactly, we should only reject what either
> 1. would crash kernel
> 2. makes obviously no sense (missing or contradiction attributes).
>
> anything more than that isn't needed.
>
> > We could opt to be stricter indeed, by checking that a single netlink
> > batch contains a corresponding number of start and end elements. This
> > can't be done by the insert function though, we don't have enough
> > context there.
>
> Yes. If such 'single element with no end interval' can't happen or
> won't cause any problems then no action is needed.
Yeah, I don't expect that to cause any problem. I don't have a
kselftest or nft test for it, because that would require nft to send
invalid elements, so I only tested those two cases manually. The
nastiest thing I could come up with was start > end, and it's now
covered by:
if (memcmp(start, end,
f->groups / NFT_PIPAPO_GROUPS_PER_BYTE) > 0)
return -EINVAL;
while:
- start == end is allowed, explicitly handled below
- end without any previous start (somewhat) correctly maps to < 0 > to
end
- start without end won't trigger any insertion
--
Stefano
next prev parent reply other threads:[~2019-11-21 21:01 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-19 1:06 [PATCH nf-next 0/8] nftables: Set implementation for arbitrary concatenation of ranges Stefano Brivio
2019-11-19 1:06 ` [PATCH nf-next 1/8] nf_tables: Support for subkeys, set with multiple ranged fields Stefano Brivio
2019-11-19 1:06 ` [PATCH nf-next 2/8] bitmap: Introduce bitmap_cut(): cut bits and shift remaining Stefano Brivio
2019-11-19 1:06 ` [PATCH nf-next 3/8] nf_tables: Add set type for arbitrary concatenation of ranges Stefano Brivio
2019-11-20 15:06 ` Florian Westphal
2019-11-21 19:54 ` Stefano Brivio
2019-11-21 20:41 ` Florian Westphal
2019-11-21 21:00 ` Stefano Brivio [this message]
2019-11-22 13:39 ` Stefano Brivio
2019-11-19 1:06 ` [PATCH nf-next 4/8] selftests: netfilter: Introduce tests for sets with range concatenation Stefano Brivio
2019-11-19 1:06 ` [PATCH nf-next 5/8] nft_set_pipapo: Provide unrolled lookup loops for common field sizes Stefano Brivio
2019-11-19 1:06 ` [PATCH nf-next 6/8] nft_set_pipapo: Prepare for vectorised implementation: alignment Stefano Brivio
2019-11-19 1:06 ` [PATCH nf-next 7/8] nft_set_pipapo: Prepare for vectorised implementation: helpers Stefano Brivio
2019-11-19 1:06 ` [PATCH nf-next 8/8] nft_set_pipapo: Introduce AVX2-based lookup implementation Stefano Brivio
2019-11-20 15:16 ` Florian Westphal
2019-11-20 16:08 ` Phil Sutter
2019-11-21 19:55 ` Stefano Brivio
2019-11-21 20:22 ` Pablo Neira Ayuso
2019-11-21 20:46 ` Florian Westphal
2019-11-21 20:54 ` Pablo Neira Ayuso
2019-11-21 20:56 ` Pablo Neira Ayuso
2019-11-21 20:51 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191121220046.0517c87d@redhat.com \
--to=sbrivio@redhat.com \
--cc=eric@garver.life \
--cc=fw@strlen.de \
--cc=kadlec@blackhole.kfki.hu \
--cc=kirill.kogan@gmail.com \
--cc=ligatti@usf.edu \
--cc=netfilter-devel@vger.kernel.org \
--cc=or@cs.technion.ac.il \
--cc=pablo@netfilter.org \
--cc=phil@nwl.cc \
--cc=sd@queasysnail.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).