From: Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk>
To: Dariusz Sosnowski <dsosnowski@nvidia.com>,
Viacheslav Ovsiienko <viacheslavo@nvidia.com>,
Bing Zhao <bingz@nvidia.com>, Ori Kam <orika@nvidia.com>,
Suanming Mou <suanmingm@nvidia.com>,
Matan Azrad <matan@nvidia.com>
Cc: dev@dpdk.org, stable@dpdk.org,
Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk>
Subject: [PATCH v2] net/mlx5: fix connection tracking state item validation
Date: Tue, 12 Aug 2025 08:41:50 -0400 [thread overview]
Message-ID: <20250812124150.2915138-1-14pwcse1224@uetpeshawar.edu.pk> (raw)
This patch validate a connection tracking state when matching
'conntrack is' in rte_flow rules. Since conntrack item flags
is a bitmap, then any combination of RTE_FLOW_CONNTRACK_PKT_STATE_*
flags is a valid value to match on.
This patch validate the CT state item.
Fixes: aca19061e4b9 ('net/mlx5: validate connection tracking item')
Cc: stable@dpdk.org
Signed-off-by: Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk>
---
drivers/net/mlx5/mlx5_flow_dv.c | 12 +++++++++++-
drivers/net/mlx5/mlx5_flow_hw.c | 17 ++++++++++++++++-
2 files changed, 27 insertions(+), 2 deletions(-)
diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_dv.c
index 7b9e5018b8..19475b931f 100644
--- a/drivers/net/mlx5/mlx5_flow_dv.c
+++ b/drivers/net/mlx5/mlx5_flow_dv.c
@@ -3271,7 +3271,7 @@ mlx5_flow_dv_validate_item_aso_ct(struct rte_eth_dev *dev,
{
const struct rte_flow_item_conntrack *spec = item->spec;
const struct rte_flow_item_conntrack *mask = item->mask;
- uint32_t flags;
+ uint32_t flags, flags_all;
if (*item_flags & MLX5_FLOW_LAYER_ASO_CT)
return rte_flow_error_set(error, EINVAL,
@@ -3289,6 +3289,16 @@ mlx5_flow_dv_validate_item_aso_ct(struct rte_eth_dev *dev,
RTE_FLOW_ERROR_TYPE_ITEM,
NULL,
"Conflict status bits");
+ flags_all = (RTE_FLOW_CONNTRACK_PKT_STATE_VALID |
+ RTE_FLOW_CONNTRACK_PKT_STATE_CHANGED |
+ RTE_FLOW_CONNTRACK_PKT_STATE_INVALID |
+ RTE_FLOW_CONNTRACK_PKT_STATE_DISABLED |
+ RTE_FLOW_CONNTRACK_PKT_STATE_BAD);
+ if (spec->flags & ~flags_all)
+ return rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ NULL,
+ "Invalid CT item matching \n");
}
/* State change also needs to be considered. */
*item_flags |= MLX5_FLOW_LAYER_ASO_CT;
diff --git a/drivers/net/mlx5/mlx5_flow_hw.c b/drivers/net/mlx5/mlx5_flow_hw.c
index 6dc16f80d3..6dbbc44819 100644
--- a/drivers/net/mlx5/mlx5_flow_hw.c
+++ b/drivers/net/mlx5/mlx5_flow_hw.c
@@ -16957,7 +16957,6 @@ flow_hw_validate_rule_pattern(struct rte_eth_dev *dev,
{
const struct rte_flow_pattern_template *pt;
const struct rte_flow_item *pt_item;
-
if (pattern_template_idx >= table->nb_item_templates)
return rte_flow_error_set(error, EINVAL, RTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,
"Pattern template index out of range");
@@ -16996,7 +16995,9 @@ flow_hw_validate_rule_pattern(struct rte_eth_dev *dev,
switch (items->type) {
const struct rte_flow_item_ethdev *ethdev;
const struct rte_flow_item_tx_queue *tx_queue;
+ const struct rte_flow_item_conntrack *spec;
struct mlx5_txq_ctrl *txq;
+ uint32_t flags_all;
case RTE_FLOW_ITEM_TYPE_REPRESENTED_PORT:
ethdev = items->spec;
@@ -17016,6 +17017,20 @@ flow_hw_validate_rule_pattern(struct rte_eth_dev *dev,
RTE_FLOW_ERROR_TYPE_ITEM_SPEC, items,
"Invalid Tx queue");
mlx5_txq_release(dev, tx_queue->tx_queue);
+ break;
+ case RTE_FLOW_ITEM_TYPE_CONNTRACK:
+ spec = items->spec;
+ flags_all = (RTE_FLOW_CONNTRACK_PKT_STATE_VALID |
+ RTE_FLOW_CONNTRACK_PKT_STATE_CHANGED |
+ RTE_FLOW_CONNTRACK_PKT_STATE_INVALID |
+ RTE_FLOW_CONNTRACK_PKT_STATE_DISABLED |
+ RTE_FLOW_CONNTRACK_PKT_STATE_BAD);
+ if (spec->flags & ~flags_all)
+ return rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ NULL,
+ "Invalid CT item matching \n");
+ break;
default:
break;
}
--
2.43.0
next reply other threads:[~2025-08-12 12:42 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-08-12 12:41 Khadem Ullah [this message]
-- strict thread matches above, loose matches on Subject: below --
2025-08-05 13:23 [PATCH] " Khadem Ullah
2025-08-12 12:46 ` [PATCH v2] " Khadem Ullah
2025-08-13 14:16 ` Dariusz Sosnowski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250812124150.2915138-1-14pwcse1224@uetpeshawar.edu.pk \
--to=14pwcse1224@uetpeshawar.edu.pk \
--cc=bingz@nvidia.com \
--cc=dev@dpdk.org \
--cc=dsosnowski@nvidia.com \
--cc=matan@nvidia.com \
--cc=orika@nvidia.com \
--cc=stable@dpdk.org \
--cc=suanmingm@nvidia.com \
--cc=viacheslavo@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).