Commit 12aa0a3b authored by Ratheesh Kannoth's avatar Ratheesh Kannoth Committed by David S. Miller
Browse files

octeontx2-af: Harden rule validation. 



Accept TC offload classifier rule only if SPI field
can be extracted by HW.

Signed-off-by: default avatarRatheesh Kannoth <rkannoth@marvell.com>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7a1c3821

drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c

+3 −1
Original line number Diff line number Diff line
@@ -580,7 +580,9 @@ static void npc_set_features(struct rvu *rvu, int blkaddr, u8 intf) 
		if (!npc_check_field(rvu, blkaddr, NPC_LB, intf))

			*features &= ~BIT_ULL(NPC_OUTER_VID);



	if (*features & (BIT_ULL(NPC_IPPROTO_AH) | BIT_ULL(NPC_IPPROTO_ESP)))

	/* Set SPI flag only if AH/ESP and IPSEC_SPI are in the key */

	if (npc_check_field(rvu, blkaddr, NPC_IPSEC_SPI, intf) &&

	    (*features & (BIT_ULL(NPC_IPPROTO_ESP) | BIT_ULL(NPC_IPPROTO_AH))))

		*features |= BIT_ULL(NPC_IPSEC_SPI);



	/* for vlan ethertypes corresponding layer type should be in the key */