Commit 69ddc652 authored by Paolo Abeni's avatar Paolo Abeni
Browse files

Merge tag 'nf-25-04-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following batch contains a Netfilter fix and improved test coverage:

1) Fix AVX2 matching in nft_pipapo, from Florian Westphal.

2) Extend existing test to improve coverage for the aforementioned bug,
   also from Florian.

netfilter pull request 25-04-10

* tag 'nf-25-04-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  selftests: netfilter: add test case for recent mismatch bug
  nft_set_pipapo: fix incorrect avx2 match of 5th field octet
====================

Link: https://patch.msgid.link/20250410103647.1030244-1-pablo@netfilter.org


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parents aabc6596 27eb86e2

net/netfilter/nft_set_pipapo_avx2.c

+2 −1
Original line number Diff line number Diff line
@@ -994,8 +994,9 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, 
		NFT_PIPAPO_AVX2_BUCKET_LOAD8(5, lt,  8,  pkt[8], bsize);



		NFT_PIPAPO_AVX2_AND(6, 2, 3);

		NFT_PIPAPO_AVX2_AND(3, 4, 7);

		NFT_PIPAPO_AVX2_BUCKET_LOAD8(7, lt,  9,  pkt[9], bsize);

		NFT_PIPAPO_AVX2_AND(0, 4, 5);

		NFT_PIPAPO_AVX2_AND(0, 3, 5);

		NFT_PIPAPO_AVX2_BUCKET_LOAD8(1, lt, 10, pkt[10], bsize);

		NFT_PIPAPO_AVX2_AND(2, 6, 7);

		NFT_PIPAPO_AVX2_BUCKET_LOAD8(3, lt, 11, pkt[11], bsize);

tools/testing/selftests/net/netfilter/nft_concat_range.sh

+38 −1
Original line number Diff line number Diff line
@@ -27,7 +27,7 @@ TYPES="net_port port_net net6_port port_proto net6_port_mac net6_port_mac_proto 
       net6_port_net6_port net_port_mac_proto_net"



# Reported bugs, also described by TYPE_ variables below

BUGS="flush_remove_add reload net_port_proto_match"

BUGS="flush_remove_add reload net_port_proto_match avx2_mismatch"



# List of possible paths to pktgen script from kernel tree for performance tests

PKTGEN_SCRIPT_PATHS="
@@ -387,6 +387,25 @@ race_repeat 0 


perf_duration	0

"



TYPE_avx2_mismatch="

display		avx2 false match

type_spec	inet_proto . ipv6_addr

chain_spec	meta l4proto . ip6 daddr

dst		proto addr6

src

start		1

count		1

src_delta	1

tools		ping

proto		icmp6



race_repeat	0



perf_duration	0

"





# Set template for all tests, types and rules are filled in depending on test

set_template='

flush ruleset
@@ -1629,6 +1648,24 @@ test_bug_net_port_proto_match() { 
	nft flush ruleset

}



test_bug_avx2_mismatch()

{

	setup veth send_"${proto}" set || return ${ksft_skip}



	local a1="fe80:dead:01ff:0a02:0b03:6007:8009:a001"

	local a2="fe80:dead:01fe:0a02:0b03:6007:8009:a001"



	nft "add element inet filter test { icmpv6 . $a1 }"



	dst_addr6="$a2"

	send_icmp6



	if [ "$(count_packets)" -gt "0" ]; then

		err "False match for $a2"

		return 1

	fi

}



test_reported_issues() {

	eval test_bug_"${subtest}"

}