| Message ID | 20220411133100.18126-1-boris.sukholitko@broadcom.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | flower: match on the number of vlan tags | expand |
On 2022-04-11 09:30, Boris Sukholitko wrote: > Hi, > > Our customers in the fiber telecom world have network configurations > where they would like to control their traffic according to the number > of tags appearing in the packet. > > For example, TR247 GPON conformance test suite specification mostly > talks about untagged, single, double tagged packets and gives lax > guidelines on the vlan protocol vs. number of vlan tags. > > This is different from the common IT networks where 802.1Q and 802.1ad > protocols are usually describe single and double tagged packet. GPON > configurations that we work with have arbitrary mix the above protocols > and number of vlan tags in the packet. > > The following patch series implement number of vlans flower filter. They > add num_of_vlans flower filter as an alternative to vlan ethtype protocol > matching. The end result is that the following command becomes possible: > > tc filter add dev eth1 ingress flower \ > num_of_vlans 1 vlan_prio 5 action drop > The idea looks sane. I guess flow dissector is now not just involving headers but metadata as well. I can see this applied to MPLS for example, etc. Can you please provide more elaborate example of more than 1 vlan? Where would the line be drawn: Is it max of two vlans? Is there potential of <=X, meaning matching of upto X Vlans? cheers, jamal
On Mon, Apr 11, 2022 at 10:07:14AM -0400, Jamal Hadi Salim wrote: > On 2022-04-11 09:30, Boris Sukholitko wrote: > > Hi, > > > > Our customers in the fiber telecom world have network configurations > > where they would like to control their traffic according to the number > > of tags appearing in the packet. > > > > For example, TR247 GPON conformance test suite specification mostly > > talks about untagged, single, double tagged packets and gives lax > > guidelines on the vlan protocol vs. number of vlan tags. > > > > This is different from the common IT networks where 802.1Q and 802.1ad > > protocols are usually describe single and double tagged packet. GPON > > configurations that we work with have arbitrary mix the above protocols > > and number of vlan tags in the packet. > > > > The following patch series implement number of vlans flower filter. They > > add num_of_vlans flower filter as an alternative to vlan ethtype protocol > > matching. The end result is that the following command becomes possible: > > > > tc filter add dev eth1 ingress flower \ > > num_of_vlans 1 vlan_prio 5 action drop > > > > The idea looks sane. I guess flow dissector is now not just involving > headers but metadata as well. I can see this applied to MPLS for example, > etc. > Can you please provide more elaborate example of more than 1 vlan? Perusing our logs, we have redirect rules such as: tc filter add dev $GPON ingress flower num_of_vlans $N \ action mirred egress redirect dev $DEV where N can range from 0 to 3 and $DEV is the function of $N. Also there are rules setting skb mark based on the number of vlans: tc filter add dev $GPON ingress flower num_of_vlans $N vlan_prio \ $P action skbedit mark $M > Where would the line be drawn: > Is it max of two vlans? We have seen the maximum of 3 vlans. > Is there potential of <=X, meaning matching of upto X Vlans? > We've managed to get by without such feature somehow :) Thanks, Boris. > cheers, > jamal
On 2022-04-11 10:56, Boris Sukholitko wrote: > On Mon, Apr 11, 2022 at 10:07:14AM -0400, Jamal Hadi Salim wrote: >> On 2022-04-11 09:30, Boris Sukholitko wrote: >>> Hi, [..] >> Can you please provide more elaborate example of more than 1 vlan? > > Perusing our logs, we have redirect rules such as: > > tc filter add dev $GPON ingress flower num_of_vlans $N \ > action mirred egress redirect dev $DEV > Please add in the commit logs. > where N can range from 0 to 3 and $DEV is the function of $N. > Also in the commit log, very specific to GPON. I have seen upto 4 in some telco environment. > Also there are rules setting skb mark based on the number of vlans: > > tc filter add dev $GPON ingress flower num_of_vlans $N vlan_prio \ > $P action skbedit mark $M > Yep makes sense. >> Where would the line be drawn: >> Is it max of two vlans? > > We have seen the maximum of 3 vlans. > >> Is there potential of <=X, meaning matching of upto X Vlans? >> > > We've managed to get by without such feature somehow :) If needed should be extensible. You already have ability to count, so adding inequality check should not be hard to add when needed. cheers, jamal
On Tue, Apr 12, 2022 at 06:54:43AM -0400, Jamal Hadi Salim wrote: > On 2022-04-11 10:56, Boris Sukholitko wrote: > > On Mon, Apr 11, 2022 at 10:07:14AM -0400, Jamal Hadi Salim wrote: > > > On 2022-04-11 09:30, Boris Sukholitko wrote: > > > > Hi, > > [..] > > > > Can you please provide more elaborate example of more than 1 vlan? > > > > Perusing our logs, we have redirect rules such as: > > > > tc filter add dev $GPON ingress flower num_of_vlans $N \ > > action mirred egress redirect dev $DEV > > > > Please add in the commit logs. > > > where N can range from 0 to 3 and $DEV is the function of $N. > > > > Also in the commit log, very specific to GPON. I have seen upto > 4 in some telco environment. > > > Also there are rules setting skb mark based on the number of vlans: > > > > tc filter add dev $GPON ingress flower num_of_vlans $N vlan_prio \ > > $P action skbedit mark $M > > All of the above added to the commit log in v3 (added to the cover and patch 3 in the series). > > Yep makes sense. > > > > > Where would the line be drawn: > > > Is it max of two vlans? > > > > We have seen the maximum of 3 vlans. > > > > > Is there potential of <=X, meaning matching of upto X Vlans? > > > > > > > We've managed to get by without such feature somehow :) > > If needed should be extensible. You already have ability to count, so > adding inequality check should not be hard to add when needed. > Yes, it can certainly be done as a further patch. Thanks, Boris.
Hi, Our customers in the fiber telecom world have network configurations where they would like to control their traffic according to the number of tags appearing in the packet. For example, TR247 GPON conformance test suite specification mostly talks about untagged, single, double tagged packets and gives lax guidelines on the vlan protocol vs. number of vlan tags. This is different from the common IT networks where 802.1Q and 802.1ad protocols are usually describe single and double tagged packet. GPON configurations that we work with have arbitrary mix the above protocols and number of vlan tags in the packet. The following patch series implement number of vlans flower filter. They add num_of_vlans flower filter as an alternative to vlan ethtype protocol matching. The end result is that the following command becomes possible: tc filter add dev eth1 ingress flower \ num_of_vlans 1 vlan_prio 5 action drop More about the patch series: - patches 1-2 remove duplicate code by introducing is_key_vlan helper. - patch 3, 4 implement num_of_vlans in the dissector and in the flower. - patch 5 uses the num_of_vlans filter to allow further matching on vlan attributes. Complementary iproute2 patches are being sent separately. Thanks, Boris. Boris Sukholitko (5): Helper function for vlan ethtype checks Reduce identation after is_key_vlan refactoring Add number of vlan tags dissector Add number of vlan tags filter to the flower Consider the number of vlan tags for vlan filters include/net/flow_dissector.h | 9 ++++ include/uapi/linux/pkt_cls.h | 2 + net/core/flow_dissector.c | 20 +++++++++ net/sched/cls_flower.c | 86 +++++++++++++++++++++++------------- 4 files changed, 86 insertions(+), 31 deletions(-)