Re: [PATCH net-next 0/2] flower: add MPLS matching support

Benjamin LaHaise
2017-04-25T17:26:13Z

On Tue, Apr 25, 2017 at 08:47:00AM -0400, Jamal Hadi Salim wrote:
> On 17-04-25 07:55 AM, Simon Horman wrote:
> [..]
> >
> > I agree something should be done wrt BOS. If the LABEL and TC are to
> > be left as-is then I think a similar treatment of BOS - that is masking it
> > - makes sense.
> >
> > I also agree with statements made earlier in the thread that it is unlikely
> > that the unused bits of these attributes will be used - as opposed to a
> > bitmask of flag values which seems ripe for re-use for future flags.
> >
>
> For your use case, I think you are fine if you just do the mask in the
> kernel. A mask to a user value implies "I am ignoring the rest
> of these bits - I dont care if you set them "
>
> > I would like to add to the discussion that I think in future it would
> > be good to expand the features provided by this patch to support supplying
> > a mask as part of the match - as flower supports for other fields such
> > as IP addresses. But I think the current scheme of masking out invalid bits
> > should also work in conjunction with user-supplied masks.
> >
>
> The challenge we have right now is "users do stoopid or malicious
> things". So are you going to accept the wrong bitmap + mask?

I think rejecting bits in a mask that clearly cannot be set (like the
bits above the lower 20 bits in an MPLS label) makes perfect sense. It
doesn't impact usability for the tools since they shouldn't be set (and
actually can't be in the iproute2 changes).

-ben

> cheers,
> jamal
>