[dpdk-stable] patch 'net/mlx5: validate flow rule item order' has been queued to LTS release 18.11.6

[Kevin Traynor]

Hi,

FYI, your patch has been queued to LTS release 18.11.6

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 12/10/19. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable-queue

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable-queue/commit/16dfdb13c1e86e2643b2181f6b7dc1a966e6e460

Thanks.

Kevin.

---
>From 16dfdb13c1e86e2643b2181f6b7dc1a966e6e460 Mon Sep 17 00:00:00 2001
From: Xiaoyu Min <jackmin at mellanox.com>
Date: Wed, 11 Sep 2019 16:46:15 +0800
Subject: [PATCH] net/mlx5: validate flow rule item order

[ upstream commit 906a2efae8da8507bab2d089c544d4fa4150a5fd ]

The Item order validation between L2 and L3 is missing, which leading to
the following flow rule is accepted:

  testpmd> flow create 0 ingress pattern ipv4 / eth / end actions drop /
           end

Only the outer L3 layer should check whether the L2 layer is present,
because the L3 layer could directly follow the tunnel layer
without L2 layer.

Meanwhile inner L2 layer should check whether there is inner L3 layer
before it.

Fixes: 23c1d42c7138 ("net/mlx5: split flow validation to dedicated function")

Signed-off-by: Xiaoyu Min <jackmin at mellanox.com>
Acked-by: Viacheslav Ovsiienko <viacheslavo at mellanox.com>
---
 drivers/net/mlx5/mlx5_flow.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index f19b27ede..cf9cdcfe3 100644
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -1069,4 +1069,9 @@ mlx5_flow_validate_item_eth(const struct rte_flow_item *item,
 					  RTE_FLOW_ERROR_TYPE_ITEM, item,
 					  "multiple L2 layers not supported");
+	if (tunnel && (item_flags & MLX5_FLOW_LAYER_INNER_L3))
+		return rte_flow_error_set(error, EINVAL,
+					  RTE_FLOW_ERROR_TYPE_ITEM, item,
+					  "inner L2 layer should not "
+					  "follow inner L3 layers");
 	if (!mask)
 		mask = &rte_flow_item_eth_mask;
@@ -1112,4 +1117,6 @@ mlx5_flow_validate_item_vlan(const struct rte_flow_item *item,
 					MLX5_FLOW_LAYER_OUTER_VLAN;
 
+	const uint64_t l2m = tunnel ? MLX5_FLOW_LAYER_INNER_L2 :
+				      MLX5_FLOW_LAYER_OUTER_L2;
 	if (item_flags & vlanm)
 		return rte_flow_error_set(error, EINVAL,
@@ -1120,4 +1127,8 @@ mlx5_flow_validate_item_vlan(const struct rte_flow_item *item,
 					  RTE_FLOW_ERROR_TYPE_ITEM, item,
 					  "L2 layer cannot follow L3/L4 layer");
+	else if ((item_flags & l2m) == 0)
+		return rte_flow_error_set(error, EINVAL,
+					  RTE_FLOW_ERROR_TYPE_ITEM, item,
+					  "no L2 layer before VLAN");
 	if (!mask)
 		mask = &rte_flow_item_vlan_mask;
@@ -1186,4 +1197,8 @@ mlx5_flow_validate_item_ipv4(const struct rte_flow_item *item,
 					  RTE_FLOW_ERROR_TYPE_ITEM, item,
 					  "L3 cannot follow an L4 layer.");
+	else if (!tunnel && !(item_flags & MLX5_FLOW_LAYER_OUTER_L2))
+		return rte_flow_error_set(error, EINVAL,
+					  RTE_FLOW_ERROR_TYPE_ITEM, item,
+					  "no L2 layer before IPV4");
 	if (!mask)
 		mask = &rte_flow_item_ipv4_mask;
@@ -1250,4 +1265,8 @@ mlx5_flow_validate_item_ipv6(const struct rte_flow_item *item,
 					  RTE_FLOW_ERROR_TYPE_ITEM, item,
 					  "L3 cannot follow an L4 layer.");
+	else if (!tunnel && !(item_flags & MLX5_FLOW_LAYER_OUTER_L2))
+		return rte_flow_error_set(error, EINVAL,
+					  RTE_FLOW_ERROR_TYPE_ITEM, item,
+					  "no L2 layer before IPV6");
 	if (!mask)
 		mask = &rte_flow_item_ipv6_mask;
-- 
2.21.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2019-12-03 17:29:54.913024875 +0000
+++ 0055-net-mlx5-validate-flow-rule-item-order.patch	2019-12-03 17:29:51.778749370 +0000
@@ -1 +1 @@
-From 906a2efae8da8507bab2d089c544d4fa4150a5fd Mon Sep 17 00:00:00 2001
+From 16dfdb13c1e86e2643b2181f6b7dc1a966e6e460 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 906a2efae8da8507bab2d089c544d4fa4150a5fd ]
+
@@ -20 +21,0 @@
-Cc: stable at dpdk.org
@@ -29 +30 @@
-index 482f65b5d..578d00338 100644
+index f19b27ede..cf9cdcfe3 100644
@@ -32 +33 @@
-@@ -1225,4 +1225,9 @@ mlx5_flow_validate_item_eth(const struct rte_flow_item *item,
+@@ -1069,4 +1069,9 @@ mlx5_flow_validate_item_eth(const struct rte_flow_item *item,
@@ -42 +43 @@
-@@ -1271,4 +1276,6 @@ mlx5_flow_validate_item_vlan(const struct rte_flow_item *item,
+@@ -1112,4 +1117,6 @@ mlx5_flow_validate_item_vlan(const struct rte_flow_item *item,
@@ -49 +50 @@
-@@ -1279,4 +1286,8 @@ mlx5_flow_validate_item_vlan(const struct rte_flow_item *item,
+@@ -1120,4 +1127,8 @@ mlx5_flow_validate_item_vlan(const struct rte_flow_item *item,
@@ -58 +59 @@
-@@ -1391,4 +1402,8 @@ mlx5_flow_validate_item_ipv4(const struct rte_flow_item *item,
+@@ -1186,4 +1197,8 @@ mlx5_flow_validate_item_ipv4(const struct rte_flow_item *item,
@@ -60 +61 @@
- 					  "L3 cannot follow an NVGRE layer.");
+ 					  "L3 cannot follow an L4 layer.");
@@ -67 +68 @@
-@@ -1482,4 +1497,8 @@ mlx5_flow_validate_item_ipv6(const struct rte_flow_item *item,
+@@ -1250,4 +1265,8 @@ mlx5_flow_validate_item_ipv6(const struct rte_flow_item *item,
@@ -69 +70 @@
- 					  "L3 cannot follow an NVGRE layer.");
+ 					  "L3 cannot follow an L4 layer.");