@@ -583,6 +583,7 @@ enum {
TCA_FLOWER_KEY_HASH, /* u32 */
TCA_FLOWER_KEY_HASH_MASK, /* u32 */
+ TCA_FLOWER_KEY_ORIG_ETH_TYPE, /* be16 */
__TCA_FLOWER_MAX,
};
@@ -28,6 +28,8 @@ flower \- flow based traffic control filter
.RI " | { "
.BR dst_mac " | " src_mac " } "
.IR MASKED_LLADDR " | "
+.BR orig_ethtype " { " ipv4 " | " ipv6 " | "
+.IR ETH_TYPE " } | "
.B vlan_id
.IR VID " | "
.B vlan_prio
@@ -162,6 +164,18 @@ provided in LLADDR format, in which case it is a bitwise mask, or as a
number of high bits to match. If the mask is missing then a match on all
bits is assumed.
.TP
+.BI orig_ethtype " ORIG_ETH_TYPE"
+Match on layer three protocol as it appears in the network packet.
+Some tunnel protocols will be parsed by the Linux kernel. Therefore
+.B protocol
+option of tc filter will match their inner ethernet types.
+.B orig_ethtype
+will match the original protocol untouched by the kernel.
+.I ORIG_ETH_TYPE
+may be either
+.BR ipv4 ", " ipv6
+or an unsigned 16bit value in hexadecimal format.
+.TP
.BI vlan_id " VID"
Match on vlan tag id.
.I VID
@@ -48,6 +48,7 @@ static void explain(void)
"\n"
"Where: MATCH-LIST := [ MATCH-LIST ] MATCH\n"
" MATCH := { indev DEV-NAME |\n"
+ " orig_ethtype [ ipv4 | ipv6 | ETH-TYPE ] |\n"
" vlan_id VID |\n"
" vlan_prio PRIORITY |\n"
" vlan_ethtype [ ipv4 | ipv6 | ETH-TYPE ] |\n"
@@ -1431,6 +1432,13 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
if (check_ifname(*argv))
invarg("\"indev\" not a valid ifname", *argv);
addattrstrz(n, MAX_MSG, TCA_FLOWER_INDEV, *argv);
+ } else if (matches(*argv, "orig_ethtype") == 0) {
+ __be16 orig_ethtype;
+
+ NEXT_ARG();
+ if (ll_proto_a2n(&orig_ethtype, *argv))
+ invarg("invalid orig_ethtype", *argv);
+ addattr16(n, MAX_MSG, TCA_FLOWER_KEY_ORIG_ETH_TYPE, orig_ethtype);
} else if (matches(*argv, "vlan_id") == 0) {
__u16 vid;
@@ -2582,6 +2590,16 @@ static int flower_print_opt(struct filter_util *qu, FILE *f,
rta_getattr_str(attr));
}
+ if (tb[TCA_FLOWER_KEY_ORIG_ETH_TYPE]) {
+ SPRINT_BUF(buf);
+ struct rtattr *attr = tb[TCA_FLOWER_KEY_ORIG_ETH_TYPE];
+
+ print_nl();
+ print_string(PRINT_ANY, "orig_ethtype", " orig_ethtype %s",
+ ll_proto_n2a(rta_getattr_u16(attr),
+ buf, sizeof(buf)));
+ }
+
open_json_object("keys");
if (tb[TCA_FLOWER_KEY_VLAN_ID]) {
The following flower filter fails to match packets: tc filter add dev eth0 ingress protocol 0x8864 flower \ action simple sdata hi64 The following is explanation of the issue on the kernel side. The protocol 0x8864 (ETH_P_PPP_SES) is a tunnel protocol. As such, it is being dissected by __skb_flow_dissect and it's internal protocol is being set as key->basic.n_proto. IOW, the existence of ETH_P_PPP_SES tunnel is transparent to the callers of __skb_flow_dissect. OTOH, in the filters above, cls_flower configures its key->basic.n_proto to the ETH_P_PPP_SES value configured by the user. Matching on this key fails because of __skb_flow_dissect "transparency" mentioned above. Therefore there is no way currently to match on such packets using flower. To fix the issue add new orig_ethtype key to the flower along with the necessary changes to the flow dissector etc. To filter the ETH_P_PPP_SES packets the command becomes: tc filter add dev eth0 ingress flower orig_ethtype 0x8864 \ action simple sdata hi64 Corresponding kernel patch was sent separately. Signed-off-by: Boris Sukholitko <boris.sukholitko@broadcom.com> --- v2: - Add help and man page entries --- include/uapi/linux/pkt_cls.h | 1 + man/man8/tc-flower.8 | 14 ++++++++++++++ tc/f_flower.c | 18 ++++++++++++++++++ 3 files changed, 33 insertions(+)