On 2021-08-30 4:08 a.m., Boris Sukholitko wrote:
The following flower filter fails to match packets:
tc filter add dev eth0 ingress protocol 0x8864 flower \
action simple sdata hi64
The protocol 0x8864 (ETH_P_PPP_SES) is a tunnel protocol. As such, it is
being dissected by __skb_flow_dissect and it's internal protocol is
being set as key->basic.n_proto. IOW, the existence of ETH_P_PPP_SES
tunnel is transparent to the callers of __skb_flow_dissect.
OTOH, in the filters above, cls_flower configures its key->basic.n_proto
to the ETH_P_PPP_SES value configured by the user. Matching on this key
fails because of __skb_flow_dissect "transparency" mentioned above.
Therefore there is no way currently to match on such packets using
flower.
To fix the issue add new orig_ethtype key to the flower along with the
necessary changes to the flow dissector etc.
To filter the ETH_P_PPP_SES packets the command becomes:
tc filter add dev eth0 ingress flower orig_ethtype 0x8864 \
action simple sdata hi64
Where's "protocol" on the above command line is. Probably a typo?
The main culprit is clearly the flow dissector parsing. I am not sure
if in general flowdisc to deal with deeper hierarchies/tunnels
without constantly adding a lot more hacks. Imagine if you had an
ethernet packet with double vlan tags and encapsulating a pppoe packet
(i.e 3 or more layers of ethernet) - that would be a nightmare.
IMO, your approach is adding yet another bandaid.
Would it make sense for the setting of the
skb_key.basic.n_proto to be from tp->protocol for
your specific case in classify().
Which means your original setup:
tc filter add dev eth0 ingress protocol 0x8864 flower \
action simple sdata hi64
should continue to work if i am not mistaken. Vlans would
continue to be a speacial case.
I dont know what that would break though...
cheers,
jamal