[PATCH iproute2-next v2] flower: add orig_ethtype key
From: Boris Sukholitko <hidden>
Date: 2021-08-30 10:02:07
Subsystem:
tc subsystem, the rest · Maintainers:
Jamal Hadi Salim, Jiri Pirko, Linus Torvalds
The following flower filter fails to match packets:
tc filter add dev eth0 ingress protocol 0x8864 flower \
action simple sdata hi64
The following is explanation of the issue on the kernel side.
The protocol 0x8864 (ETH_P_PPP_SES) is a tunnel protocol. As such, it is
being dissected by __skb_flow_dissect and it's internal protocol is
being set as key->basic.n_proto. IOW, the existence of ETH_P_PPP_SES
tunnel is transparent to the callers of __skb_flow_dissect.
OTOH, in the filters above, cls_flower configures its key->basic.n_proto
to the ETH_P_PPP_SES value configured by the user. Matching on this key
fails because of __skb_flow_dissect "transparency" mentioned above.
Therefore there is no way currently to match on such packets using
flower.
To fix the issue add new orig_ethtype key to the flower along with the
necessary changes to the flow dissector etc.
To filter the ETH_P_PPP_SES packets the command becomes:
tc filter add dev eth0 ingress flower orig_ethtype 0x8864 \
action simple sdata hi64
Corresponding kernel patch was sent separately.
Signed-off-by: Boris Sukholitko <redacted>
---
v2:
- Add help and man page entries
---
include/uapi/linux/pkt_cls.h | 1 +
man/man8/tc-flower.8 | 14 ++++++++++++++
tc/f_flower.c | 18 ++++++++++++++++++
3 files changed, 33 insertions(+)
diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index 025c40fe..238dee49 100644
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h@@ -583,6 +583,7 @@ enum { TCA_FLOWER_KEY_HASH, /* u32 */ TCA_FLOWER_KEY_HASH_MASK, /* u32 */ + TCA_FLOWER_KEY_ORIG_ETH_TYPE, /* be16 */ __TCA_FLOWER_MAX, };
diff --git a/man/man8/tc-flower.8 b/man/man8/tc-flower.8
index 4541d937..927b3320 100644
--- a/man/man8/tc-flower.8
+++ b/man/man8/tc-flower.8@@ -28,6 +28,8 @@ flower \- flow based traffic control filter .RI " | { " .BR dst_mac " | " src_mac " } " .IR MASKED_LLADDR " | " +.BR orig_ethtype " { " ipv4 " | " ipv6 " | " +.IR ETH_TYPE " } | " .B vlan_id .IR VID " | " .B vlan_prio
@@ -162,6 +164,18 @@ provided in LLADDR format, in which case it is a bitwise mask, or as a number of high bits to match. If the mask is missing then a match on all bits is assumed. .TP +.BI orig_ethtype " ORIG_ETH_TYPE" +Match on layer three protocol as it appears in the network packet. +Some tunnel protocols will be parsed by the Linux kernel. Therefore +.B protocol +option of tc filter will match their inner ethernet types. +.B orig_ethtype +will match the original protocol untouched by the kernel. +.I ORIG_ETH_TYPE +may be either +.BR ipv4 ", " ipv6 +or an unsigned 16bit value in hexadecimal format. +.TP .BI vlan_id " VID" Match on vlan tag id. .I VID
diff --git a/tc/f_flower.c b/tc/f_flower.c
index c5af0276..2480285b 100644
--- a/tc/f_flower.c
+++ b/tc/f_flower.c@@ -48,6 +48,7 @@ static void explain(void) "\n" "Where: MATCH-LIST := [ MATCH-LIST ] MATCH\n" " MATCH := { indev DEV-NAME |\n" + " orig_ethtype [ ipv4 | ipv6 | ETH-TYPE ] |\n" " vlan_id VID |\n" " vlan_prio PRIORITY |\n" " vlan_ethtype [ ipv4 | ipv6 | ETH-TYPE ] |\n"
@@ -1431,6 +1432,13 @@ static int flower_parse_opt(struct filter_util *qu, char *handle, if (check_ifname(*argv)) invarg("\"indev\" not a valid ifname", *argv); addattrstrz(n, MAX_MSG, TCA_FLOWER_INDEV, *argv); + } else if (matches(*argv, "orig_ethtype") == 0) { + __be16 orig_ethtype; + + NEXT_ARG(); + if (ll_proto_a2n(&orig_ethtype, *argv)) + invarg("invalid orig_ethtype", *argv); + addattr16(n, MAX_MSG, TCA_FLOWER_KEY_ORIG_ETH_TYPE, orig_ethtype); } else if (matches(*argv, "vlan_id") == 0) { __u16 vid;
@@ -2582,6 +2590,16 @@ static int flower_print_opt(struct filter_util *qu, FILE *f, rta_getattr_str(attr)); } + if (tb[TCA_FLOWER_KEY_ORIG_ETH_TYPE]) { + SPRINT_BUF(buf); + struct rtattr *attr = tb[TCA_FLOWER_KEY_ORIG_ETH_TYPE]; + + print_nl(); + print_string(PRINT_ANY, "orig_ethtype", " orig_ethtype %s", + ll_proto_n2a(rta_getattr_u16(attr), + buf, sizeof(buf))); + } + open_json_object("keys"); if (tb[TCA_FLOWER_KEY_VLAN_ID]) {
--
2.29.2
Attachments
- smime.p7s [application/pkcs7-signature] 4221 bytes