d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

net/ice: fix perfect match for ACL rule

Browse Source 
A rule with an imperfect match (wildcarding) will be routed through
ACL. A perfect match should be rejected by ACL.

Fixes: 40d466fa9f ("net/ice: support ACL filter in DCF")

Signed-off-by: Simei Su <simei.su@intel.com>
Acked-by: Qi Zhang <qi.z.zhang@intel.com>
This commit is contained in:
Simei Su 2020-11-11 19:30:05 +08:00 committed by Ferruh Yigit
parent 470b5c23ad
commit d827f610d3
1 changed files with 44 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
drivers/net/ice/ice_acl_filter.c
View File

@ -664,6 +664,14 @@ ice_acl_parse_pattern(__rte_unused struct ice_adapter *ad,
eth_mask = item->mask;
if (eth_spec && eth_mask) {
if (rte_is_broadcast_ether_addr(&eth_mask->src) ||
rte_is_broadcast_ether_addr(&eth_mask->dst)) {
rte_flow_error_set(error, EINVAL,
RTE_FLOW_ERROR_TYPE_ITEM,
item, "Invalid mac addr mask");
return -rte_errno;
}
if (!rte_is_zero_ether_addr(&eth_spec->src) &&
!rte_is_zero_ether_addr(&eth_mask->src)) {
input_set |= ICE_INSET_SMAC;
@ -710,6 +718,15 @@ ice_acl_parse_pattern(__rte_unused struct ice_adapter *ad,
return -rte_errno;
}
if (ipv4_mask->hdr.src_addr == UINT32_MAX ||
ipv4_mask->hdr.dst_addr == UINT32_MAX) {
rte_flow_error_set(error, EINVAL,
RTE_FLOW_ERROR_TYPE_ITEM,
item,
"Invalid IPv4 mask.");
return -rte_errno;
}
if (ipv4_mask->hdr.src_addr) {
filter->input.ip.v4.src_ip =
ipv4_spec->hdr.src_addr;
@ -754,6 +771,15 @@ ice_acl_parse_pattern(__rte_unused struct ice_adapter *ad,
return -rte_errno;
}
if (tcp_mask->hdr.src_port == UINT16_MAX ||
tcp_mask->hdr.dst_port == UINT16_MAX) {
rte_flow_error_set(error, EINVAL,
RTE_FLOW_ERROR_TYPE_ITEM,
item,
"Invalid TCP mask");
return -rte_errno;
}
if (l3 == RTE_FLOW_ITEM_TYPE_IPV4 &&
tcp_mask->hdr.src_port) {
input_set |= ICE_INSET_TCP_SRC_PORT;
@ -791,6 +817,15 @@ ice_acl_parse_pattern(__rte_unused struct ice_adapter *ad,
return -rte_errno;
}
if (udp_mask->hdr.src_port == UINT16_MAX ||
udp_mask->hdr.dst_port == UINT16_MAX) {
rte_flow_error_set(error, EINVAL,
RTE_FLOW_ERROR_TYPE_ITEM,
item,
"Invalid UDP mask");
return -rte_errno;
}
if (l3 == RTE_FLOW_ITEM_TYPE_IPV4 &&
udp_mask->hdr.src_port) {
input_set |= ICE_INSET_UDP_SRC_PORT;
@ -818,6 +853,15 @@ ice_acl_parse_pattern(__rte_unused struct ice_adapter *ad,
flow_type = ICE_FLTR_PTYPE_NONF_IPV4_SCTP;
if (sctp_spec && sctp_mask) {
if (sctp_mask->hdr.src_port == UINT16_MAX ||
sctp_mask->hdr.dst_port == UINT16_MAX) {
rte_flow_error_set(error, EINVAL,
RTE_FLOW_ERROR_TYPE_ITEM,
item,
"Invalid SCTP mask");
return -rte_errno;
}
if (l3 == RTE_FLOW_ITEM_TYPE_IPV4 &&
sctp_mask->hdr.src_port) {
input_set |= ICE_INSET_SCTP_SRC_PORT;