diff mbox series

[v2,11/11] net/mlx5: enforce limitation on IPv6 next proto

Message ID 5a25973431babe75cf681df7827ee69942297446.1601586564.git.dekelp@nvidia.com (mailing list archive)
State Superseded, archived
Delegated to: Raslan Darawsheh
Headers
Series support match on L3 fragmented packets |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation success Compilation OK
ci/iol-broadcom-Functional success Functional Testing PASS
ci/iol-broadcom-Performance success Performance Testing PASS
ci/iol-intel-Functional success Functional Testing PASS
ci/iol-testing fail Testing issues
ci/iol-intel-Performance success Performance Testing PASS
ci/iol-mellanox-Performance success Performance Testing PASS

Commit Message

Dekel Peled Oct. 1, 2020, 9:15 p.m. UTC 
  Due to PRM requirement, the IPv6 header item 'proto' field, indicating
the next header protocol, should not be set as extension header.
This patch adds the relevant validation, and documents the limitation.

Signed-off-by: Dekel Peled <dekelp@nvidia.com>
---
 doc/guides/nics/mlx5.rst     |  7 +++++++
 drivers/net/mlx5/mlx5_flow.c | 14 ++++++++++++--
 2 files changed, 19 insertions(+), 2 deletions(-)

Comments

Ori Kam Oct. 4, 2020, 1:55 p.m. UTC | #1 
Hi

> -----Original Message-----
> From: Dekel Peled <dekelp@nvidia.com>
> Sent: Friday, October 2, 2020 12:15 AM
> Subject: [PATCH v2 11/11] net/mlx5: enforce limitation on IPv6 next proto
> 
> Due to PRM requirement, the IPv6 header item 'proto' field, indicating
> the next header protocol, should not be set as extension header.
> This patch adds the relevant validation, and documents the limitation.
> 
> Signed-off-by: Dekel Peled <dekelp@nvidia.com>
> ---
>  doc/guides/nics/mlx5.rst     |  7 +++++++
>  drivers/net/mlx5/mlx5_flow.c | 14 ++++++++++++--
>  2 files changed, 19 insertions(+), 2 deletions(-)
> 
> diff --git a/doc/guides/nics/mlx5.rst b/doc/guides/nics/mlx5.rst
> index 211c0c5..e6ca5e1 100644
> --- a/doc/guides/nics/mlx5.rst
> +++ b/doc/guides/nics/mlx5.rst
> @@ -311,6 +311,13 @@ Limitations
>      for some NICs (such as ConnectX-6 Dx and BlueField 2).
>      The capability bit ``scatter_fcs_w_decap_disable`` shows NIC support.
> 
> +- IPv6 header item 'proto' field, indicating the next header protocol, should
> +  not be set as extension header.
> +  In case the next header is an extension header, it should not be specified in
> +  IPv6 header item 'proto' field.
> +  The last extension header item 'next header' field can specify the following
> +  header protocol type.
> +
>  Statistics
>  ----------
> 
> diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
> index 906741f..7a438cf 100644
> --- a/drivers/net/mlx5/mlx5_flow.c
> +++ b/drivers/net/mlx5/mlx5_flow.c
> @@ -1645,9 +1645,9 @@ struct mlx5_flow_tunnel_info {
>  					  RTE_FLOW_ERROR_TYPE_ITEM,
> item,
>  					  "IPv6 cannot follow L2/VLAN layer "
>  					  "which ether type is not IPv6");
> +	if (mask && spec)
> +		next_proto = mask->hdr.proto & spec->hdr.proto;
>  	if (item_flags & MLX5_FLOW_LAYER_IPV6_ENCAP) {
> -		if (mask && spec)
> -			next_proto = mask->hdr.proto & spec->hdr.proto;
>  		if (next_proto == IPPROTO_IPIP || next_proto ==
> IPPROTO_IPV6)
>  			return rte_flow_error_set(error, EINVAL,
> 
> RTE_FLOW_ERROR_TYPE_ITEM,
> @@ -1655,6 +1655,16 @@ struct mlx5_flow_tunnel_info {
>  						  "multiple tunnel "
>  						  "not supported");
>  	}
> +	if (next_proto == IPPROTO_HOPOPTS  ||
> +	    next_proto == IPPROTO_ROUTING  ||
> +	    next_proto == IPPROTO_FRAGMENT ||
> +	    next_proto == IPPROTO_ESP	   ||
> +	    next_proto == IPPROTO_AH	   ||
> +	    next_proto == IPPROTO_DSTOPTS)
> +		return rte_flow_error_set(error, EINVAL,
> +					  RTE_FLOW_ERROR_TYPE_ITEM,
> item,
> +					  "IPv6 proto (next header) should "
> +					  "not be set as extension header");
>  	if (item_flags & MLX5_FLOW_LAYER_IPIP)
>  		return rte_flow_error_set(error, EINVAL,
>  					  RTE_FLOW_ERROR_TYPE_ITEM,
> item,
> --
> 1.8.3.1


Acked-by: Ori Kam <orika@nvidia.com>
Thanks,
Ori
diff mbox series

Patch

diff --git a/doc/guides/nics/mlx5.rst b/doc/guides/nics/mlx5.rst
index 211c0c5..e6ca5e1 100644
--- a/doc/guides/nics/mlx5.rst
+++ b/doc/guides/nics/mlx5.rst
@@ -311,6 +311,13 @@  Limitations
     for some NICs (such as ConnectX-6 Dx and BlueField 2).
     The capability bit ``scatter_fcs_w_decap_disable`` shows NIC support.
 
+- IPv6 header item 'proto' field, indicating the next header protocol, should
+  not be set as extension header.
+  In case the next header is an extension header, it should not be specified in
+  IPv6 header item 'proto' field.
+  The last extension header item 'next header' field can specify the following
+  header protocol type.
+
 Statistics
 ----------
 
diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index 906741f..7a438cf 100644
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -1645,9 +1645,9 @@  struct mlx5_flow_tunnel_info {
 					  RTE_FLOW_ERROR_TYPE_ITEM, item,
 					  "IPv6 cannot follow L2/VLAN layer "
 					  "which ether type is not IPv6");
+	if (mask && spec)
+		next_proto = mask->hdr.proto & spec->hdr.proto;
 	if (item_flags & MLX5_FLOW_LAYER_IPV6_ENCAP) {
-		if (mask && spec)
-			next_proto = mask->hdr.proto & spec->hdr.proto;
 		if (next_proto == IPPROTO_IPIP || next_proto == IPPROTO_IPV6)
 			return rte_flow_error_set(error, EINVAL,
 						  RTE_FLOW_ERROR_TYPE_ITEM,
@@ -1655,6 +1655,16 @@  struct mlx5_flow_tunnel_info {
 						  "multiple tunnel "
 						  "not supported");
 	}
+	if (next_proto == IPPROTO_HOPOPTS  ||
+	    next_proto == IPPROTO_ROUTING  ||
+	    next_proto == IPPROTO_FRAGMENT ||
+	    next_proto == IPPROTO_ESP	   ||
+	    next_proto == IPPROTO_AH	   ||
+	    next_proto == IPPROTO_DSTOPTS)
+		return rte_flow_error_set(error, EINVAL,
+					  RTE_FLOW_ERROR_TYPE_ITEM, item,
+					  "IPv6 proto (next header) should "
+					  "not be set as extension header");
 	if (item_flags & MLX5_FLOW_LAYER_IPIP)
 		return rte_flow_error_set(error, EINVAL,
 					  RTE_FLOW_ERROR_TYPE_ITEM, item,