[PATCH] net/mlx5: reject unsupported layers before GRE and NVGRE

[PATCH] net/mlx5: reject unsupported layers before GRE and NVGRE

[Itai Sharoni]

Flow patterns such as eth / ipv4 / udp / nvgre were accepted
silently because mlx5_flow_validate_item_gre and
mlx5_flow_validate_item_nvgre did not check which layers precede
the GRE item.

During translation the GRE handler overwrites the ip_protocol
field from UDP (17) to GRE (47), so the resulting firmware rule
matches plain NVGRE packets instead. This misleads users into
believing they created a UDP+NVGRE rule when the UDP item is
silently discarded. The same applies to TCP, ICMP, ICMPv6 and ESP.

GRE-in-UDP (RFC 8086) is a valid encapsulation that mlx5 does not
support, so reject an outer UDP item with ENOTSUP. GRE cannot be
carried over TCP, ICMP or ICMPv6, and cannot be matched inside an
encrypted ESP payload, so reject those with EINVAL.

The checks are unconditional so they cover both the DV and HWS
steering paths.

Fixes: f4b901a46aec ("net/mlx5: add flow GRE item")
Fixes: ea81c1b816f7 ("net/mlx5: fix NVGRE matching")
Cc: stable@dpdk.org

Signed-off-by: Itai Sharoni <isharoni@nvidia.com>
Acked-by: Bing Zhao <bingz@nvidia.com>
---
 drivers/net/mlx5/mlx5_flow.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index 37654918b5..f20214857f 100644
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -3519,6 +3519,16 @@ mlx5_flow_validate_item_gre(const struct rte_eth_dev *dev,
 					  RTE_FLOW_ERROR_TYPE_ITEM, item,
 					  "multiple tunnel layers not"
 					  " supported");
+	if (item_flags & MLX5_FLOW_LAYER_OUTER_L4_UDP)
+		return rte_flow_error_set(error, ENOTSUP,
+					  RTE_FLOW_ERROR_TYPE_ITEM, item,
+					  "GRE over UDP is not supported");
+	if (item_flags & (MLX5_FLOW_LAYER_OUTER_L4_TCP |
+			  MLX5_FLOW_LAYER_ICMP | MLX5_FLOW_LAYER_ICMP6 |
+			  MLX5_FLOW_ITEM_ESP))
+		return rte_flow_error_set(error, EINVAL,
+					  RTE_FLOW_ERROR_TYPE_ITEM, item,
+					  "GRE cannot follow TCP, ICMP or ESP layer");
 	if (!mlx5_hws_active(dev)) {
 		if (!(item_flags & MLX5_FLOW_LAYER_OUTER_L3))
 			return rte_flow_error_set(error, ENOTSUP,
@@ -3894,6 +3904,16 @@ mlx5_flow_validate_item_nvgre(const struct rte_eth_dev *dev,
 					  RTE_FLOW_ERROR_TYPE_ITEM, item,
 					  "multiple tunnel layers not"
 					  " supported");
+	if (item_flags & MLX5_FLOW_LAYER_OUTER_L4_UDP)
+		return rte_flow_error_set(error, ENOTSUP,
+					  RTE_FLOW_ERROR_TYPE_ITEM, item,
+					  "NVGRE over UDP is not supported");
+	if (item_flags & (MLX5_FLOW_LAYER_OUTER_L4_TCP |
+			  MLX5_FLOW_LAYER_ICMP | MLX5_FLOW_LAYER_ICMP6 |
+			  MLX5_FLOW_ITEM_ESP))
+		return rte_flow_error_set(error, EINVAL,
+					  RTE_FLOW_ERROR_TYPE_ITEM, item,
+					  "NVGRE cannot follow TCP, ICMP or ESP layer");
 	if (!mlx5_hws_active(dev)) {
 		if (!(item_flags & MLX5_FLOW_LAYER_OUTER_L3))
 			return rte_flow_error_set(error, ENOTSUP,
-- 
2.43.0

Re: [PATCH] net/mlx5: reject unsupported layers before GRE and NVGRE

[Raslan Darawsheh]

Patch applied to next-net-mlx.

Thanks,
Raslan Darawsheh