This patch validate a connection tracking state when matching
'conntrack is' in rte_flow rules. Since conntrack item flags
is a bitmap, then any combination of RTE_FLOW_CONNTRACK_PKT_STATE_*
flags is a valid value to match on.
This patch validate the CT state item.
Fixes: aca19061e4b96 ("net/mlx5: validate connection tracking item")
Cc: sta...@dpdk.org
Signed-off-by: Khadem Ullah <14pwcse1...@uetpeshawar.edu.pk>
---
drivers/net/mlx5/mlx5_flow.h | 5 +++++
drivers/net/mlx5/mlx5_flow_dv.c | 5 +++++
drivers/net/mlx5/mlx5_flow_hw.c | 10 ++++++++++
3 files changed, 20 insertions(+)
diff --git a/drivers/net/mlx5/mlx5_flow.h b/drivers/net/mlx5/mlx5_flow.h
index e890e732c3..ed0c1fcfd2 100644
--- a/drivers/net/mlx5/mlx5_flow.h
+++ b/drivers/net/mlx5/mlx5_flow.h
@@ -100,6 +100,11 @@ enum mlx5_indirect_type {
#define MLX5_INDIRECT_ACT_CT_GET_IDX(index) \
((index) & ((1 << MLX5_INDIRECT_ACT_CT_OWNER_SHIFT) - 1))
+#define MLX5_FLOW_CONNTRACK_PKT_STATE_ALL \
+ (RTE_FLOW_CONNTRACK_PKT_STATE_VALID |
RTE_FLOW_CONNTRACK_PKT_STATE_CHANGED | \
+ RTE_FLOW_CONNTRACK_PKT_STATE_INVALID |
RTE_FLOW_CONNTRACK_PKT_STATE_DISABLED | \
+ RTE_FLOW_CONNTRACK_PKT_STATE_BAD)
+
/*
* When HW steering flow engine is used, the CT action handles are encoded in
a following way:
* - bits 31:29 - type
diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_dv.c
index 7b9e5018b8..f673637e7d 100644
--- a/drivers/net/mlx5/mlx5_flow_dv.c
+++ b/drivers/net/mlx5/mlx5_flow_dv.c
@@ -3289,6 +3289,11 @@ mlx5_flow_dv_validate_item_aso_ct(struct rte_eth_dev
*dev,
RTE_FLOW_ERROR_TYPE_ITEM,
NULL,
"Conflict status bits");
+ if (spec->flags & ~MLX5_FLOW_CONNTRACK_PKT_STATE_ALL)
+ return rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ NULL,
+ "Invalid CT item flags");
}
/* State change also needs to be considered. */
*item_flags |= MLX5_FLOW_LAYER_ASO_CT;
diff --git a/drivers/net/mlx5/mlx5_flow_hw.c b/drivers/net/mlx5/mlx5_flow_hw.c
index 6dc16f80d3..7b279138bc 100644
--- a/drivers/net/mlx5/mlx5_flow_hw.c
+++ b/drivers/net/mlx5/mlx5_flow_hw.c
@@ -16996,6 +16996,7 @@ flow_hw_validate_rule_pattern(struct rte_eth_dev *dev,
switch (items->type) {
const struct rte_flow_item_ethdev *ethdev;
const struct rte_flow_item_tx_queue *tx_queue;
+ const struct rte_flow_item_conntrack *spec;
struct mlx5_txq_ctrl *txq;
case RTE_FLOW_ITEM_TYPE_REPRESENTED_PORT:
@@ -17016,6 +17017,15 @@ flow_hw_validate_rule_pattern(struct rte_eth_dev *dev,
RTE_FLOW_ERROR_TYPE_ITEM_SPEC, items,
"Invalid Tx queue");
mlx5_txq_release(dev, tx_queue->tx_queue);
+ break;
+ case RTE_FLOW_ITEM_TYPE_CONNTRACK:
+ spec = items->spec;
+ if (spec->flags & ~MLX5_FLOW_CONNTRACK_PKT_STATE_ALL)
+ return rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ NULL,
+ "Invalid CT item flags");
+ break;
default:
break;
}
--
2.43.0
