[PATCH/RFC net-next 2/2] net/sched: cls_flower: Support matching on ND
From: Simon Horman <hidden>
Date: 2017-02-02 10:37:47
Subsystem:
networking [general], tc subsystem, the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Jamal Hadi Salim, Jiri Pirko, Linus Torvalds
Allow matching on Neighbour Discovery target IP, and source and destination link-layer addresses for neighbour solicitation and advertisement messages. Sample usage: tc qdisc add dev eth0 ingress tc filter add dev eth0 protocol ipv6 parent ffff: flower \ indev eth0 ip_proto icmpv6 type 136 code 0 \ nd_target 2001:470:7eb3:403:201:8eff:fe22:8fea \ nd_tll 00:01:8e:22:8f:ea action drop Signed-off-by: Simon Horman <redacted> --- include/uapi/linux/pkt_cls.h | 7 +++++++ net/core/flow_dissector.c | 6 +++--- net/sched/cls_flower.c | 42 +++++++++++++++++++++++++++++++++++++++++- 3 files changed, 51 insertions(+), 4 deletions(-)
diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index 345551e71410..fc9e9bef726e 100644
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h@@ -430,6 +430,13 @@ enum { TCA_FLOWER_KEY_ARP_THA, /* ETH_ALEN */ TCA_FLOWER_KEY_ARP_THA_MASK, /* ETH_ALEN */ + TCA_FLOWER_KEY_ND_TARGET, /* struct in6_addr */ + TCA_FLOWER_KEY_ND_TARGET_MASK, /* struct in6_addr */ + TCA_FLOWER_KEY_ND_SLL, /* ETH_ALEN */ + TCA_FLOWER_KEY_ND_SLL_MASK, /* ETH_ALEN */ + TCA_FLOWER_KEY_ND_TLL, /* ETH_ALEN */ + TCA_FLOWER_KEY_ND_TLL_MASK, /* ETH_ALEN */ + __TCA_FLOWER_MAX, };
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 745e03f180d0..513193825268 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c@@ -119,7 +119,7 @@ static bool skb_flow_dissect_nd(const struct sk_buff *skb, int icmp_len) { const struct nd_msg *nd; - struct nd_msg *_nd; + struct nd_msg _nd; int off; nd = __skb_header_pointer(skb, nhoff, sizeof(_nd), data, hlen, &_nd);
@@ -131,7 +131,7 @@ static bool skb_flow_dissect_nd(const struct sk_buff *skb, off = sizeof(_nd); while (icmp_len - off >= sizeof(struct nd_opt_hdr) + ETH_ALEN) { const struct nd_opt_hdr *opt_hdr; - struct nd_opt_hdr *_opt_hdr; + struct nd_opt_hdr _opt_hdr; unsigned char *ll_addr = NULL; int opt_data_len;
@@ -704,7 +704,7 @@ bool __skb_flow_dissect(const struct sk_buff *skb, key_icmp->icmp = skb_flow_get_be16(skb, nhoff, data, hlen); if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ND) && - ip_proto == IPPROTO_IPV6 && key_icmp->code == 0 && + ip_proto == IPPROTO_ICMPV6 && key_icmp->code == 0 && (key_icmp->type == NDISC_NEIGHBOUR_SOLICITATION || key_icmp->type == NDISC_NEIGHBOUR_ADVERTISEMENT)) { key_nd = skb_flow_dissector_target(flow_dissector,
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 23c4d224dcb1..49337091a015 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c@@ -40,6 +40,7 @@ struct fl_flow_key { }; struct flow_dissector_key_ports tp; struct flow_dissector_key_icmp icmp; + struct flow_dissector_key_nd nd; struct flow_dissector_key_arp arp; struct flow_dissector_key_keyid enc_key_id; union {
@@ -418,6 +419,12 @@ static const struct nla_policy fl_policy[TCA_FLOWER_MAX + 1] = { [TCA_FLOWER_KEY_ARP_SHA_MASK] = { .len = ETH_ALEN }, [TCA_FLOWER_KEY_ARP_THA] = { .len = ETH_ALEN }, [TCA_FLOWER_KEY_ARP_THA_MASK] = { .len = ETH_ALEN }, + [TCA_FLOWER_KEY_ND_TARGET] = { .len = sizeof(struct in6_addr) }, + [TCA_FLOWER_KEY_ND_TARGET_MASK] = { .len = sizeof(struct in6_addr) }, + [TCA_FLOWER_KEY_ND_SLL] = { .len = ETH_ALEN }, + [TCA_FLOWER_KEY_ND_SLL_MASK] = { .len = ETH_ALEN }, + [TCA_FLOWER_KEY_ND_TLL] = { .len = ETH_ALEN }, + [TCA_FLOWER_KEY_ND_TLL_MASK] = { .len = ETH_ALEN }, }; static void fl_set_key_val(struct nlattr **tb,
@@ -589,6 +596,22 @@ static int fl_set_key(struct net *net, struct nlattr **tb, &mask->icmp.code, TCA_FLOWER_KEY_ICMPV6_CODE_MASK, sizeof(key->icmp.code)); + if (key->icmp.code == 0 && mask->icmp.code == 0xff && + (key->icmp.type == NDISC_NEIGHBOUR_SOLICITATION || + key->icmp.type == NDISC_NEIGHBOUR_ADVERTISEMENT) && + mask->icmp.type == 0xff) { + fl_set_key_val(tb, &key->nd.target, + TCA_FLOWER_KEY_ND_TARGET, + &mask->nd.target, + TCA_FLOWER_KEY_ND_TARGET_MASK, + sizeof(key->nd.target)); + fl_set_key_val(tb, key->nd.sll, TCA_FLOWER_KEY_ND_SLL, + mask->nd.sll, TCA_FLOWER_KEY_ND_SLL_MASK, + sizeof(key->nd.sll)); + fl_set_key_val(tb, key->nd.tll, TCA_FLOWER_KEY_ND_TLL, + mask->nd.tll, TCA_FLOWER_KEY_ND_TLL_MASK, + sizeof(key->nd.tll)); + } } else if (key->basic.n_proto == htons(ETH_P_ARP) || key->basic.n_proto == htons(ETH_P_RARP)) { fl_set_key_val(tb, &key->arp.sip, TCA_FLOWER_KEY_ARP_SIP,
@@ -725,6 +748,8 @@ static void fl_init_dissector(struct cls_fl_head *head, FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt, FLOW_DISSECTOR_KEY_ARP, arp); FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt, + FLOW_DISSECTOR_KEY_ND, nd); + FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt, FLOW_DISSECTOR_KEY_VLAN, vlan); FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt, FLOW_DISSECTOR_KEY_ENC_KEYID, enc_key_id);
@@ -1162,7 +1187,22 @@ static int fl_dump(struct net *net, struct tcf_proto *tp, unsigned long fh, fl_dump_key_val(skb, &key->icmp.code, TCA_FLOWER_KEY_ICMPV6_CODE, &mask->icmp.code, TCA_FLOWER_KEY_ICMPV6_CODE_MASK, - sizeof(key->icmp.code)))) + sizeof(key->icmp.code)) || + (key->icmp.code == 0 && mask->icmp.code == 0xff && + (key->icmp.type == NDISC_NEIGHBOUR_SOLICITATION || + key->icmp.type == NDISC_NEIGHBOUR_ADVERTISEMENT) && + mask->icmp.type == 0xff && + (fl_dump_key_val(skb, &key->nd.target, + TCA_FLOWER_KEY_ND_TARGET, + &mask->nd.target, + TCA_FLOWER_KEY_ND_TARGET_MASK, + sizeof(key->nd.target)) || + fl_dump_key_val(skb, key->nd.sll, TCA_FLOWER_KEY_ND_SLL, + mask->nd.sll, TCA_FLOWER_KEY_ND_SLL_MASK, + sizeof(key->nd.sll)) || + fl_dump_key_val(skb, key->nd.tll, TCA_FLOWER_KEY_ND_TLL, + mask->nd.tll, TCA_FLOWER_KEY_ND_TLL_MASK, + sizeof(key->nd.tll)))))) goto nla_put_failure; else if ((key->basic.n_proto == htons(ETH_P_ARP) || key->basic.n_proto == htons(ETH_P_RARP)) &&
--
2.7.0.rc3.207.g0ac5344