From patchwork Mon Aug 30 10:01:44 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Boris Sukholitko X-Patchwork-Id: 12464831 X-Patchwork-Delegate: dsahern@gmail.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,MIME_NO_TEXT, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2D96C432BE for ; Mon, 30 Aug 2021 10:02:07 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 812B1610A2 for ; Mon, 30 Aug 2021 10:02:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236294AbhH3KDA (ORCPT ); Mon, 30 Aug 2021 06:03:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42230 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236288AbhH3KC6 (ORCPT ); Mon, 30 Aug 2021 06:02:58 -0400 Received: from mail-pf1-x42e.google.com (mail-pf1-x42e.google.com [IPv6:2607:f8b0:4864:20::42e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 69837C061575 for ; Mon, 30 Aug 2021 03:02:05 -0700 (PDT) Received: by mail-pf1-x42e.google.com with SMTP id e16so11352487pfc.6 for ; Mon, 30 Aug 2021 03:02:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=from:to:cc:subject:date:message-id:mime-version; bh=OcBOoB0YQ4t1T5q3o72a5ThGpgNzeczhoyHyl7NGgm8=; b=aSuumAQZysibfPqL/4Fvrxsbo1Lo3IH3TKGE3rfbfUeM42xFZ77Rre718kOI/bTC40 NYcfBNgWmnaWRAKrb0xhsPX8HvF7PN/0U8Epdjs1/7Xxcy8wDAZ2Vj0VbGE9yT9zf5a1 EhmkzqnZh447nWB5bGL+cW69rqodQRRrRMSVo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version; bh=OcBOoB0YQ4t1T5q3o72a5ThGpgNzeczhoyHyl7NGgm8=; b=bJFTKRFo44ZiQ9lDJkuPxa3ocbCETFcdv4iT3JLwmYmklHFbgVx02/pIXjhXkITi1J G1WV7LzAH5jyVNlRsXwx3Cu/0zlTZs/ExJbGMIuPAxq2hoT0QHBb1GSJOjc3P+9u4R8I hJEc0y4FJJFqgNp9/JS8S/WGQnl+IdLAdEdfGQ+cWUgOV8WN5aV+pNtpvt+Bik9CYb8L 8UMRyyoW44PdhLlI4wKXAhLLnMxuikpDGObpyv9GMJOwG44YHwequ2aCvVyzdr/HE8L/ AwfiO2u/GnDwolQtvLEMP3ly/nEuQrQ9jjosNuSpjzYK98/0qYsXbzWPf0tCBu0g2/SC D5Tw== X-Gm-Message-State: AOAM533hHz6UQAMtSDtfJz1T4UakCBE9EdXmWUDNKFXPaX4RtH3bQe6p 2QUhC8bstEk1x2dw9S49x5S3VPfZxHKrg/RAru3iihCgA73SFXv/qp9PeGL+iwNQ1cvx+sDM3wo VZZAZQJHB87z/EAQW+8QT9jyKbucpblbLRRYIMBAqLoy11ggrhgYG09jU5EiC/p8kSbJXSx6vCW wDbN0HJ5s= X-Google-Smtp-Source: ABdhPJxei6uBWwyOUtmcYbO+KYBTw4smRwooLdi3YdGfdqgZZ6ag7OobhX2aspW4JOulJ3BrVYGR9g== X-Received: by 2002:a63:b1a:: with SMTP id 26mr20576639pgl.12.1630317724393; Mon, 30 Aug 2021 03:02:04 -0700 (PDT) Received: from localhost.localdomain ([192.19.250.250]) by smtp.gmail.com with ESMTPSA id u17sm14008777pfh.184.2021.08.30.03.02.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 30 Aug 2021 03:02:03 -0700 (PDT) From: Boris Sukholitko To: netdev@vger.kernel.org Cc: Ilya Lifshits , Boris Sukholitko Subject: [PATCH iproute2-next v2] flower: add orig_ethtype key Date: Mon, 30 Aug 2021 13:01:44 +0300 Message-Id: <20210830100144.30120-1-boris.sukholitko@broadcom.com> X-Mailer: git-send-email 2.29.2 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: dsahern@gmail.com The following flower filter fails to match packets: tc filter add dev eth0 ingress protocol 0x8864 flower \ action simple sdata hi64 The following is explanation of the issue on the kernel side. The protocol 0x8864 (ETH_P_PPP_SES) is a tunnel protocol. As such, it is being dissected by __skb_flow_dissect and it's internal protocol is being set as key->basic.n_proto. IOW, the existence of ETH_P_PPP_SES tunnel is transparent to the callers of __skb_flow_dissect. OTOH, in the filters above, cls_flower configures its key->basic.n_proto to the ETH_P_PPP_SES value configured by the user. Matching on this key fails because of __skb_flow_dissect "transparency" mentioned above. Therefore there is no way currently to match on such packets using flower. To fix the issue add new orig_ethtype key to the flower along with the necessary changes to the flow dissector etc. To filter the ETH_P_PPP_SES packets the command becomes: tc filter add dev eth0 ingress flower orig_ethtype 0x8864 \ action simple sdata hi64 Corresponding kernel patch was sent separately. Signed-off-by: Boris Sukholitko --- v2: - Add help and man page entries --- include/uapi/linux/pkt_cls.h | 1 + man/man8/tc-flower.8 | 14 ++++++++++++++ tc/f_flower.c | 18 ++++++++++++++++++ 3 files changed, 33 insertions(+) diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h index 025c40fe..238dee49 100644 --- a/include/uapi/linux/pkt_cls.h +++ b/include/uapi/linux/pkt_cls.h @@ -583,6 +583,7 @@ enum { TCA_FLOWER_KEY_HASH, /* u32 */ TCA_FLOWER_KEY_HASH_MASK, /* u32 */ + TCA_FLOWER_KEY_ORIG_ETH_TYPE, /* be16 */ __TCA_FLOWER_MAX, }; diff --git a/man/man8/tc-flower.8 b/man/man8/tc-flower.8 index 4541d937..927b3320 100644 --- a/man/man8/tc-flower.8 +++ b/man/man8/tc-flower.8 @@ -28,6 +28,8 @@ flower \- flow based traffic control filter .RI " | { " .BR dst_mac " | " src_mac " } " .IR MASKED_LLADDR " | " +.BR orig_ethtype " { " ipv4 " | " ipv6 " | " +.IR ETH_TYPE " } | " .B vlan_id .IR VID " | " .B vlan_prio @@ -162,6 +164,18 @@ provided in LLADDR format, in which case it is a bitwise mask, or as a number of high bits to match. If the mask is missing then a match on all bits is assumed. .TP +.BI orig_ethtype " ORIG_ETH_TYPE" +Match on layer three protocol as it appears in the network packet. +Some tunnel protocols will be parsed by the Linux kernel. Therefore +.B protocol +option of tc filter will match their inner ethernet types. +.B orig_ethtype +will match the original protocol untouched by the kernel. +.I ORIG_ETH_TYPE +may be either +.BR ipv4 ", " ipv6 +or an unsigned 16bit value in hexadecimal format. +.TP .BI vlan_id " VID" Match on vlan tag id. .I VID diff --git a/tc/f_flower.c b/tc/f_flower.c index c5af0276..2480285b 100644 --- a/tc/f_flower.c +++ b/tc/f_flower.c @@ -48,6 +48,7 @@ static void explain(void) "\n" "Where: MATCH-LIST := [ MATCH-LIST ] MATCH\n" " MATCH := { indev DEV-NAME |\n" + " orig_ethtype [ ipv4 | ipv6 | ETH-TYPE ] |\n" " vlan_id VID |\n" " vlan_prio PRIORITY |\n" " vlan_ethtype [ ipv4 | ipv6 | ETH-TYPE ] |\n" @@ -1431,6 +1432,13 @@ static int flower_parse_opt(struct filter_util *qu, char *handle, if (check_ifname(*argv)) invarg("\"indev\" not a valid ifname", *argv); addattrstrz(n, MAX_MSG, TCA_FLOWER_INDEV, *argv); + } else if (matches(*argv, "orig_ethtype") == 0) { + __be16 orig_ethtype; + + NEXT_ARG(); + if (ll_proto_a2n(&orig_ethtype, *argv)) + invarg("invalid orig_ethtype", *argv); + addattr16(n, MAX_MSG, TCA_FLOWER_KEY_ORIG_ETH_TYPE, orig_ethtype); } else if (matches(*argv, "vlan_id") == 0) { __u16 vid; @@ -2582,6 +2590,16 @@ static int flower_print_opt(struct filter_util *qu, FILE *f, rta_getattr_str(attr)); } + if (tb[TCA_FLOWER_KEY_ORIG_ETH_TYPE]) { + SPRINT_BUF(buf); + struct rtattr *attr = tb[TCA_FLOWER_KEY_ORIG_ETH_TYPE]; + + print_nl(); + print_string(PRINT_ANY, "orig_ethtype", " orig_ethtype %s", + ll_proto_n2a(rta_getattr_u16(attr), + buf, sizeof(buf))); + } + open_json_object("keys"); if (tb[TCA_FLOWER_KEY_VLAN_ID]) {