* [PATCH v2] net/mlx5: fix connection tracking state item validation
@ 2025-08-12 12:41 Khadem Ullah
0 siblings, 0 replies; 3+ messages in thread
From: Khadem Ullah @ 2025-08-12 12:41 UTC (permalink / raw)
To: Dariusz Sosnowski, Viacheslav Ovsiienko, Bing Zhao, Ori Kam,
Suanming Mou, Matan Azrad
Cc: dev, stable, Khadem Ullah
This patch validate a connection tracking state when matching
'conntrack is' in rte_flow rules. Since conntrack item flags
is a bitmap, then any combination of RTE_FLOW_CONNTRACK_PKT_STATE_*
flags is a valid value to match on.
This patch validate the CT state item.
Fixes: aca19061e4b9 ('net/mlx5: validate connection tracking item')
Cc: stable@dpdk.org
Signed-off-by: Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk>
---
drivers/net/mlx5/mlx5_flow_dv.c | 12 +++++++++++-
drivers/net/mlx5/mlx5_flow_hw.c | 17 ++++++++++++++++-
2 files changed, 27 insertions(+), 2 deletions(-)
diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_dv.c
index 7b9e5018b8..19475b931f 100644
--- a/drivers/net/mlx5/mlx5_flow_dv.c
+++ b/drivers/net/mlx5/mlx5_flow_dv.c
@@ -3271,7 +3271,7 @@ mlx5_flow_dv_validate_item_aso_ct(struct rte_eth_dev *dev,
{
const struct rte_flow_item_conntrack *spec = item->spec;
const struct rte_flow_item_conntrack *mask = item->mask;
- uint32_t flags;
+ uint32_t flags, flags_all;
if (*item_flags & MLX5_FLOW_LAYER_ASO_CT)
return rte_flow_error_set(error, EINVAL,
@@ -3289,6 +3289,16 @@ mlx5_flow_dv_validate_item_aso_ct(struct rte_eth_dev *dev,
RTE_FLOW_ERROR_TYPE_ITEM,
NULL,
"Conflict status bits");
+ flags_all = (RTE_FLOW_CONNTRACK_PKT_STATE_VALID |
+ RTE_FLOW_CONNTRACK_PKT_STATE_CHANGED |
+ RTE_FLOW_CONNTRACK_PKT_STATE_INVALID |
+ RTE_FLOW_CONNTRACK_PKT_STATE_DISABLED |
+ RTE_FLOW_CONNTRACK_PKT_STATE_BAD);
+ if (spec->flags & ~flags_all)
+ return rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ NULL,
+ "Invalid CT item matching \n");
}
/* State change also needs to be considered. */
*item_flags |= MLX5_FLOW_LAYER_ASO_CT;
diff --git a/drivers/net/mlx5/mlx5_flow_hw.c b/drivers/net/mlx5/mlx5_flow_hw.c
index 6dc16f80d3..6dbbc44819 100644
--- a/drivers/net/mlx5/mlx5_flow_hw.c
+++ b/drivers/net/mlx5/mlx5_flow_hw.c
@@ -16957,7 +16957,6 @@ flow_hw_validate_rule_pattern(struct rte_eth_dev *dev,
{
const struct rte_flow_pattern_template *pt;
const struct rte_flow_item *pt_item;
-
if (pattern_template_idx >= table->nb_item_templates)
return rte_flow_error_set(error, EINVAL, RTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,
"Pattern template index out of range");
@@ -16996,7 +16995,9 @@ flow_hw_validate_rule_pattern(struct rte_eth_dev *dev,
switch (items->type) {
const struct rte_flow_item_ethdev *ethdev;
const struct rte_flow_item_tx_queue *tx_queue;
+ const struct rte_flow_item_conntrack *spec;
struct mlx5_txq_ctrl *txq;
+ uint32_t flags_all;
case RTE_FLOW_ITEM_TYPE_REPRESENTED_PORT:
ethdev = items->spec;
@@ -17016,6 +17017,20 @@ flow_hw_validate_rule_pattern(struct rte_eth_dev *dev,
RTE_FLOW_ERROR_TYPE_ITEM_SPEC, items,
"Invalid Tx queue");
mlx5_txq_release(dev, tx_queue->tx_queue);
+ break;
+ case RTE_FLOW_ITEM_TYPE_CONNTRACK:
+ spec = items->spec;
+ flags_all = (RTE_FLOW_CONNTRACK_PKT_STATE_VALID |
+ RTE_FLOW_CONNTRACK_PKT_STATE_CHANGED |
+ RTE_FLOW_CONNTRACK_PKT_STATE_INVALID |
+ RTE_FLOW_CONNTRACK_PKT_STATE_DISABLED |
+ RTE_FLOW_CONNTRACK_PKT_STATE_BAD);
+ if (spec->flags & ~flags_all)
+ return rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ NULL,
+ "Invalid CT item matching \n");
+ break;
default:
break;
}
--
2.43.0
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH] net/mlx5: fix connection tracking state item validation
@ 2025-08-05 13:23 Khadem Ullah
2025-08-12 12:46 ` [PATCH v2] " Khadem Ullah
0 siblings, 1 reply; 3+ messages in thread
From: Khadem Ullah @ 2025-08-05 13:23 UTC (permalink / raw)
To: Dariusz Sosnowski, Viacheslav Ovsiienko, Bing Zhao, Ori Kam,
Suanming Mou, Matan Azrad
Cc: dev, stable, Khadem Ullah
This patch validate a connection tracking state when matching
'conntrack is' in rte_flow rules. The conntract possible CT states
are SYN_RECV, ESTABLISHED, FIN_WAIT, CLOSE_WAIT, LAST_ACK and
TIME_WAIT. Therefore the maximum possible value to match on
in rte_flow is TIME_WAIT but mlx5 allowed matching on any values.
This patch validate the CT state item.
Fixes: aca19061e4b9 ('net/mlx5: validate connection tracking item')
Cc: stable@dpdk.org
Signed-off-by: Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk>
---
drivers/net/mlx5/mlx5_flow_dv.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_dv.c
index 7b9e5018b8..750385cd42 100644
--- a/drivers/net/mlx5/mlx5_flow_dv.c
+++ b/drivers/net/mlx5/mlx5_flow_dv.c
@@ -3290,6 +3290,11 @@ mlx5_flow_dv_validate_item_aso_ct(struct rte_eth_dev *dev,
NULL,
"Conflict status bits");
}
+ if (spec->flags > RTE_FLOW_CONNTRACK_STATE_TIME_WAIT)
+ return rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ NULL,
+ "Invalid CT state matching \n");
/* State change also needs to be considered. */
*item_flags |= MLX5_FLOW_LAYER_ASO_CT;
return 0;
--
2.43.0
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH v2] net/mlx5: fix connection tracking state item validation
2025-08-05 13:23 [PATCH] " Khadem Ullah
@ 2025-08-12 12:46 ` Khadem Ullah
2025-08-13 14:16 ` Dariusz Sosnowski
0 siblings, 1 reply; 3+ messages in thread
From: Khadem Ullah @ 2025-08-12 12:46 UTC (permalink / raw)
To: Dariusz Sosnowski, Viacheslav Ovsiienko, Bing Zhao, Ori Kam,
Suanming Mou, Matan Azrad
Cc: dev, stable, Khadem Ullah
This patch validate a connection tracking state when matching
'conntrack is' in rte_flow rules. Since conntrack item flags
is a bitmap, then any combination of RTE_FLOW_CONNTRACK_PKT_STATE_*
flags is a valid value to match on.
This patch validate the CT state item.
Fixes: aca19061e4b9 ('net/mlx5: validate connection tracking item')
Cc: stable@dpdk.org
Signed-off-by: Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk>
---
drivers/net/mlx5/mlx5_flow_dv.c | 12 +++++++++++-
drivers/net/mlx5/mlx5_flow_hw.c | 17 ++++++++++++++++-
2 files changed, 27 insertions(+), 2 deletions(-)
diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_dv.c
index 7b9e5018b8..19475b931f 100644
--- a/drivers/net/mlx5/mlx5_flow_dv.c
+++ b/drivers/net/mlx5/mlx5_flow_dv.c
@@ -3271,7 +3271,7 @@ mlx5_flow_dv_validate_item_aso_ct(struct rte_eth_dev *dev,
{
const struct rte_flow_item_conntrack *spec = item->spec;
const struct rte_flow_item_conntrack *mask = item->mask;
- uint32_t flags;
+ uint32_t flags, flags_all;
if (*item_flags & MLX5_FLOW_LAYER_ASO_CT)
return rte_flow_error_set(error, EINVAL,
@@ -3289,6 +3289,16 @@ mlx5_flow_dv_validate_item_aso_ct(struct rte_eth_dev *dev,
RTE_FLOW_ERROR_TYPE_ITEM,
NULL,
"Conflict status bits");
+ flags_all = (RTE_FLOW_CONNTRACK_PKT_STATE_VALID |
+ RTE_FLOW_CONNTRACK_PKT_STATE_CHANGED |
+ RTE_FLOW_CONNTRACK_PKT_STATE_INVALID |
+ RTE_FLOW_CONNTRACK_PKT_STATE_DISABLED |
+ RTE_FLOW_CONNTRACK_PKT_STATE_BAD);
+ if (spec->flags & ~flags_all)
+ return rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ NULL,
+ "Invalid CT item matching \n");
}
/* State change also needs to be considered. */
*item_flags |= MLX5_FLOW_LAYER_ASO_CT;
diff --git a/drivers/net/mlx5/mlx5_flow_hw.c b/drivers/net/mlx5/mlx5_flow_hw.c
index 6dc16f80d3..6dbbc44819 100644
--- a/drivers/net/mlx5/mlx5_flow_hw.c
+++ b/drivers/net/mlx5/mlx5_flow_hw.c
@@ -16957,7 +16957,6 @@ flow_hw_validate_rule_pattern(struct rte_eth_dev *dev,
{
const struct rte_flow_pattern_template *pt;
const struct rte_flow_item *pt_item;
-
if (pattern_template_idx >= table->nb_item_templates)
return rte_flow_error_set(error, EINVAL, RTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,
"Pattern template index out of range");
@@ -16996,7 +16995,9 @@ flow_hw_validate_rule_pattern(struct rte_eth_dev *dev,
switch (items->type) {
const struct rte_flow_item_ethdev *ethdev;
const struct rte_flow_item_tx_queue *tx_queue;
+ const struct rte_flow_item_conntrack *spec;
struct mlx5_txq_ctrl *txq;
+ uint32_t flags_all;
case RTE_FLOW_ITEM_TYPE_REPRESENTED_PORT:
ethdev = items->spec;
@@ -17016,6 +17017,20 @@ flow_hw_validate_rule_pattern(struct rte_eth_dev *dev,
RTE_FLOW_ERROR_TYPE_ITEM_SPEC, items,
"Invalid Tx queue");
mlx5_txq_release(dev, tx_queue->tx_queue);
+ break;
+ case RTE_FLOW_ITEM_TYPE_CONNTRACK:
+ spec = items->spec;
+ flags_all = (RTE_FLOW_CONNTRACK_PKT_STATE_VALID |
+ RTE_FLOW_CONNTRACK_PKT_STATE_CHANGED |
+ RTE_FLOW_CONNTRACK_PKT_STATE_INVALID |
+ RTE_FLOW_CONNTRACK_PKT_STATE_DISABLED |
+ RTE_FLOW_CONNTRACK_PKT_STATE_BAD);
+ if (spec->flags & ~flags_all)
+ return rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ NULL,
+ "Invalid CT item matching \n");
+ break;
default:
break;
}
--
2.43.0
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH v2] net/mlx5: fix connection tracking state item validation
2025-08-12 12:46 ` [PATCH v2] " Khadem Ullah
@ 2025-08-13 14:16 ` Dariusz Sosnowski
0 siblings, 0 replies; 3+ messages in thread
From: Dariusz Sosnowski @ 2025-08-13 14:16 UTC (permalink / raw)
To: Khadem Ullah, Thomas Monjalon, David Marchand, Ali Alnubani
Cc: Viacheslav Ovsiienko, Bing Zhao, Ori Kam, Suanming Mou,
Matan Azrad, dev, stable
Hi,
Thank you for the patch. Please see comments inline.
On Tue, Aug 12, 2025 at 08:46:30AM -0400, Khadem Ullah wrote:
> This patch validate a connection tracking state when matching
> 'conntrack is' in rte_flow rules. Since conntrack item flags
> is a bitmap, then any combination of RTE_FLOW_CONNTRACK_PKT_STATE_*
> flags is a valid value to match on.
>
> This patch validate the CT state item.
> Fixes: aca19061e4b9 ('net/mlx5: validate connection tracking item')
When used locally ./devtool/checkpatches.sh reports the following:
WARNING:BAD_FIXES_TAG: Please use correct Fixes: style 'Fixes: <12+ chars of sha1> ("<title line>")' - ie: 'Fixes: aca19061e4b9 ("net/mlx5: validate connection tracking item")'
#12:
Fixes: aca19061e4b9 ('net/mlx5: validate connection tracking item')
but it's not reported in "ci/checkpatch" job in Patchwork.
This check was added in Linux 6.1: https://github.com/torvalds/linux/commit/bd17e036b495bebbf07a5fc814c868e30e1dc131
so it appears that checkpatch.pl version used in CI is older than that.
Locally, I have a version from Linux 6.16.
Ali, Thomas, David: What do you think about updating the version of
checkpatch.pl used in community CI?
Khadem: Could you please fix the quotations marks in Fixes tag according to the error?
For the future, you can set up a git alias, which can be used
to automatically generate a correct tag.
It is described in: https://doc.dpdk.org/guides/contributing/patches.html#commit-messages-body
> Cc: stable@dpdk.org
>
> Signed-off-by: Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk>
> ---
> drivers/net/mlx5/mlx5_flow_dv.c | 12 +++++++++++-
> drivers/net/mlx5/mlx5_flow_hw.c | 17 ++++++++++++++++-
> 2 files changed, 27 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_dv.c
> index 7b9e5018b8..19475b931f 100644
> --- a/drivers/net/mlx5/mlx5_flow_dv.c
> +++ b/drivers/net/mlx5/mlx5_flow_dv.c
> @@ -3271,7 +3271,7 @@ mlx5_flow_dv_validate_item_aso_ct(struct rte_eth_dev *dev,
> {
> const struct rte_flow_item_conntrack *spec = item->spec;
> const struct rte_flow_item_conntrack *mask = item->mask;
> - uint32_t flags;
> + uint32_t flags, flags_all;
>
> if (*item_flags & MLX5_FLOW_LAYER_ASO_CT)
> return rte_flow_error_set(error, EINVAL,
> @@ -3289,6 +3289,16 @@ mlx5_flow_dv_validate_item_aso_ct(struct rte_eth_dev *dev,
> RTE_FLOW_ERROR_TYPE_ITEM,
> NULL,
> "Conflict status bits");
> + flags_all = (RTE_FLOW_CONNTRACK_PKT_STATE_VALID |
> + RTE_FLOW_CONNTRACK_PKT_STATE_CHANGED |
> + RTE_FLOW_CONNTRACK_PKT_STATE_INVALID |
> + RTE_FLOW_CONNTRACK_PKT_STATE_DISABLED |
> + RTE_FLOW_CONNTRACK_PKT_STATE_BAD);
I think it would be better to define a macro for "all possible packet state
flags", because now the definition of all flags is repeated in 2 places.
Could you please add MLX5_FLOW_CONNTRACK_PKT_STATE_ALL macro to mlx5_flow.h?
> + if (spec->flags & ~flags_all)
> + return rte_flow_error_set(error, EINVAL,
> + RTE_FLOW_ERROR_TYPE_ITEM,
> + NULL,
> + "Invalid CT item matching \n");
Please remove the new line character and preceding space from error message here.
rte_flow_error_set() does not print the message, it only stores
the pointer to error message in rte_flow_error struct.
Users later can print it/log it however they like.
I also propose to change the message itself, so it better pinpoints
the exact error. For example: "Invalid CT item flags".
Please apply the same to the second instance of that error.
> }
> /* State change also needs to be considered. */
> *item_flags |= MLX5_FLOW_LAYER_ASO_CT;
> diff --git a/drivers/net/mlx5/mlx5_flow_hw.c b/drivers/net/mlx5/mlx5_flow_hw.c
> index 6dc16f80d3..6dbbc44819 100644
> --- a/drivers/net/mlx5/mlx5_flow_hw.c
> +++ b/drivers/net/mlx5/mlx5_flow_hw.c
> @@ -16957,7 +16957,6 @@ flow_hw_validate_rule_pattern(struct rte_eth_dev *dev,
> {
> const struct rte_flow_pattern_template *pt;
> const struct rte_flow_item *pt_item;
> -
When you'll be sending a new version, could you reapply this empty line?
It's removal is not needed.
> /* snip rest of the diff */
Best regards,
Dariusz Sosnowski
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-08-13 14:17 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-08-12 12:41 [PATCH v2] net/mlx5: fix connection tracking state item validation Khadem Ullah
-- strict thread matches above, loose matches on Subject: below --
2025-08-05 13:23 [PATCH] " Khadem Ullah
2025-08-12 12:46 ` [PATCH v2] " Khadem Ullah
2025-08-13 14:16 ` Dariusz Sosnowski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).