Commit 3e579686 authored by Cong Wang's avatar Cong Wang Committed by Jakub Kicinski
Browse files

flow_dissector: Fix handling of mixed port and port-range keys 



This patch fixes a bug in TC flower filter where rules combining a
specific destination port with a source port range weren't working
correctly.

The specific case was when users tried to configure rules like:

tc filter add dev ens38 ingress protocol ip flower ip_proto udp \
dst_port 5000 src_port 2000-3000 action drop

The root cause was in the flow dissector code. While both
FLOW_DISSECTOR_KEY_PORTS and FLOW_DISSECTOR_KEY_PORTS_RANGE flags
were being set correctly in the classifier, the __skb_flow_dissect_ports()
function was only populating one of them: whichever came first in
the enum check. This meant that when the code needed both a specific
port and a port range, one of them would be left as 0, causing the
filter to not match packets as expected.

Fix it by removing the either/or logic and instead checking and
populating both key types independently when they're in use.

Fixes: 8ffb055b ("cls_flower: Fix the behavior using port ranges with hw-offload")
Reported-by: default avatarQiang Zhang <dtzq01@gmail.com>
Closes: https://lore.kernel.org/netdev/CAPx+-5uvFxkhkz4=j_Xuwkezjn9U6kzKTD5jz4tZ9msSJ0fOJA@mail.gmail.com/


Cc: Yoshiki Komachi <komachi.yoshiki@gmail.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: default avatarIdo Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20250218043210.732959-2-xiyou.wangcong@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 346b3416

net/core/flow_dissector.c

+19 −12
Original line number Diff line number Diff line
@@ -853,23 +853,30 @@ __skb_flow_dissect_ports(const struct sk_buff *skb, 
			 void *target_container, const void *data,

			 int nhoff, u8 ip_proto, int hlen)

{

	enum flow_dissector_key_id dissector_ports = FLOW_DISSECTOR_KEY_MAX;

	struct flow_dissector_key_ports *key_ports;

	struct flow_dissector_key_ports_range *key_ports_range = NULL;

	struct flow_dissector_key_ports *key_ports = NULL;

	__be32 ports;



	if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS))

		dissector_ports = FLOW_DISSECTOR_KEY_PORTS;

	else if (dissector_uses_key(flow_dissector,

				    FLOW_DISSECTOR_KEY_PORTS_RANGE))

		dissector_ports = FLOW_DISSECTOR_KEY_PORTS_RANGE;

		key_ports = skb_flow_dissector_target(flow_dissector,

						      FLOW_DISSECTOR_KEY_PORTS,

						      target_container);



	if (dissector_ports == FLOW_DISSECTOR_KEY_MAX)

	if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS_RANGE))

		key_ports_range = skb_flow_dissector_target(flow_dissector,

							    FLOW_DISSECTOR_KEY_PORTS_RANGE,

							    target_container);



	if (!key_ports && !key_ports_range)

		return;



	key_ports = skb_flow_dissector_target(flow_dissector,

					      dissector_ports,

					      target_container);

	key_ports->ports = __skb_flow_get_ports(skb, nhoff, ip_proto,

						data, hlen);

	ports = __skb_flow_get_ports(skb, nhoff, ip_proto, data, hlen);



	if (key_ports)

		key_ports->ports = ports;



	if (key_ports_range)

		key_ports_range->tp.ports = ports;

}



static void