[PATCH iproute2-next 0/2] flower: match on the number of vlan tags

[PATCH iproute2-next 0/2] flower: match on the number of vlan tags

[Boris Sukholitko]

[-- Attachment #1: Type: text/plain, Size: 1261 bytes --]

Hi,

Our customers in the fiber telecom world have network configurations
where they would like to control their traffic according to the number
of tags appearing in the packet.

For example, TR247 GPON conformance test suite specification mostly
talks about untagged, single, double tagged packets and gives lax
guidelines on the vlan protocol vs. number of vlan tags.

This is different from the common IT networks where 802.1Q and 802.1ad
protocols are usually describe single and double tagged packet. GPON
configurations that we work with have arbitrary mix the above protocols
and number of vlan tags in the packet.

The following patch series implement number of vlans flower filter. They
add num_of_vlans flower filter as an alternative to vlan ethtype protocol
matching. The end result is that the following command becomes possible:

tc filter add dev eth1 ingress flower \
  num_of_vlans 1 vlan_prio 5 action drop

The corresponding kernel patches are being sent separately.

Thanks,
Boris.

Boris Sukholitko (2):
  Add num of vlans parameter
  Check args with num_of_vlans

 include/uapi/linux/pkt_cls.h |  2 ++
 tc/f_flower.c                | 57 ++++++++++++++++++++++++++----------
 2 files changed, 43 insertions(+), 16 deletions(-)

-- 
2.29.2


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4221 bytes --]

[PATCH iproute2-next 1/2] Add num of vlans parameter

[Boris Sukholitko]

[-- Attachment #1: Type: text/plain, Size: 2783 bytes --]

Our customers in the fiber telecom world have network configurations
where they would like to control their traffic according to the number
of tags appearing in the packet.

For example, TR247 GPON conformance test suite specification mostly
talks about untagged, single, double tagged packets and gives lax
guidelines on the vlan protocol vs. number of vlan tags.

This is different from the common IT networks where 802.1Q and 802.1ad
protocols are usually describe single and double tagged packet. GPON
configurations that we work with have arbitrary mix the above protocols
and number of vlan tags in the packet.

This patch adds num_of_vlans flower key and associated print and parse
routines. The following command becomes possible:

tc filter add dev eth1 ingress flower num_of_vlans 1 action drop

Signed-off-by: Boris Sukholitko <boris.sukholitko@broadcom.com>
---
 include/uapi/linux/pkt_cls.h |  2 ++
 tc/f_flower.c                | 20 ++++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index ee38b35c..658f71db 100644
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h
@@ -587,6 +587,8 @@ enum {
 	TCA_FLOWER_KEY_HASH,		/* u32 */
 	TCA_FLOWER_KEY_HASH_MASK,	/* u32 */
 
+	TCA_FLOWER_KEY_NUM_OF_VLANS,	/* u8 */
+
 	__TCA_FLOWER_MAX,
 };
 
diff --git a/tc/f_flower.c b/tc/f_flower.c
index 728b280c..68f7dbe3 100644
--- a/tc/f_flower.c
+++ b/tc/f_flower.c
@@ -48,6 +48,7 @@ static void explain(void)
 		"\n"
 		"Where: MATCH-LIST := [ MATCH-LIST ] MATCH\n"
 		"       MATCH      := {	indev DEV-NAME |\n"
+		"			num_of_vlans VLANS_COUNT |\n"
 		"			vlan_id VID |\n"
 		"			vlan_prio PRIORITY |\n"
 		"			vlan_ethtype [ ipv4 | ipv6 | ETH-TYPE ] |\n"
@@ -1430,6 +1431,17 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
 			if (check_ifname(*argv))
 				invarg("\"indev\" not a valid ifname", *argv);
 			addattrstrz(n, MAX_MSG, TCA_FLOWER_INDEV, *argv);
+		} else if (matches(*argv, "num_of_vlans") == 0) {
+			__u8 num_of_vlans;
+
+			NEXT_ARG();
+			ret = get_u8(&num_of_vlans, *argv, 10);
+			if (ret < 0) {
+				fprintf(stderr, "Illegal \"num_of_vlans\"\n");
+				return -1;
+			}
+			addattr8(n, MAX_MSG,
+				 TCA_FLOWER_KEY_NUM_OF_VLANS, num_of_vlans);
 		} else if (matches(*argv, "vlan_id") == 0) {
 			__u16 vid;
 
@@ -2581,6 +2593,14 @@ static int flower_print_opt(struct filter_util *qu, FILE *f,
 
 	open_json_object("keys");
 
+	if (tb[TCA_FLOWER_KEY_NUM_OF_VLANS]) {
+		struct rtattr *attr = tb[TCA_FLOWER_KEY_NUM_OF_VLANS];
+
+		print_nl();
+		print_uint(PRINT_ANY, "num_of_vlans", "  num_of_vlans %d",
+			   rta_getattr_u8(attr));
+	}
+
 	if (tb[TCA_FLOWER_KEY_VLAN_ID]) {
 		struct rtattr *attr = tb[TCA_FLOWER_KEY_VLAN_ID];
 
-- 
2.29.2


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4221 bytes --]

[PATCH iproute2-next 2/2] Check args with num_of_vlans

[Boris Sukholitko]

[-- Attachment #1: Type: text/plain, Size: 4870 bytes --]

Having more than one vlan allows matching on the vlan tag parameters.
This patch changes vlan key validation to take number of vlan tags into
account.

Signed-off-by: Boris Sukholitko <boris.sukholitko@broadcom.com>
---
 tc/f_flower.c | 41 +++++++++++++++++++++++------------------
 1 file changed, 23 insertions(+), 18 deletions(-)

diff --git a/tc/f_flower.c b/tc/f_flower.c
index 68f7dbe3..968a2bb4 100644
--- a/tc/f_flower.c
+++ b/tc/f_flower.c
@@ -146,21 +146,23 @@ err:
 	return err;
 }
 
-static bool eth_type_vlan(__be16 ethertype)
+static bool eth_type_vlan(__be16 ethertype, bool good_num_of_vlans)
 {
 	return ethertype == htons(ETH_P_8021Q) ||
-	       ethertype == htons(ETH_P_8021AD);
+	       ethertype == htons(ETH_P_8021AD) ||
+	       good_num_of_vlans;
 }
 
 static int flower_parse_vlan_eth_type(char *str, __be16 eth_type, int type,
 				      __be16 *p_vlan_eth_type,
-				      struct nlmsghdr *n)
+				      struct nlmsghdr *n, bool good_num_of_vlans)
 {
 	__be16 vlan_eth_type;
 
-	if (!eth_type_vlan(eth_type)) {
-		fprintf(stderr, "Can't set \"%s\" if ethertype isn't 802.1Q or 802.1AD\n",
-			type == TCA_FLOWER_KEY_VLAN_ETH_TYPE ? "vlan_ethtype" : "cvlan_ethtype");
+	if (!eth_type_vlan(eth_type, good_num_of_vlans)) {
+		fprintf(stderr, "Can't set \"%s\" if ethertype isn't 802.1Q or 802.1AD and num_of_vlans %s\n",
+			type == TCA_FLOWER_KEY_VLAN_ETH_TYPE ? "vlan_ethtype" : "cvlan_ethtype",
+			type == TCA_FLOWER_KEY_VLAN_ETH_TYPE ? "is 0" : "less than 2");
 		return -1;
 	}
 
@@ -1330,6 +1332,7 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
 	__be16 tc_proto = TC_H_MIN(t->tcm_info);
 	__be16 eth_type = tc_proto;
 	__be16 vlan_ethtype = 0;
+	__u8 num_of_vlans = 0;
 	__u8 ip_proto = 0xff;
 	__u32 flags = 0;
 	__u32 mtf = 0;
@@ -1432,8 +1435,6 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
 				invarg("\"indev\" not a valid ifname", *argv);
 			addattrstrz(n, MAX_MSG, TCA_FLOWER_INDEV, *argv);
 		} else if (matches(*argv, "num_of_vlans") == 0) {
-			__u8 num_of_vlans;
-
 			NEXT_ARG();
 			ret = get_u8(&num_of_vlans, *argv, 10);
 			if (ret < 0) {
@@ -1446,8 +1447,9 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
 			__u16 vid;
 
 			NEXT_ARG();
-			if (!eth_type_vlan(tc_proto)) {
-				fprintf(stderr, "Can't set \"vlan_id\" if ethertype isn't 802.1Q or 802.1AD\n");
+			if (!eth_type_vlan(tc_proto, num_of_vlans > 0)) {
+				fprintf(stderr, "Can't set \"vlan_id\" if ethertype isn't 802.1Q or 802.1AD"
+						" and num_of_vlans is 0\n");
 				return -1;
 			}
 			ret = get_u16(&vid, *argv, 10);
@@ -1460,8 +1462,9 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
 			__u8 vlan_prio;
 
 			NEXT_ARG();
-			if (!eth_type_vlan(tc_proto)) {
-				fprintf(stderr, "Can't set \"vlan_prio\" if ethertype isn't 802.1Q or 802.1AD\n");
+			if (!eth_type_vlan(tc_proto, num_of_vlans > 0)) {
+				fprintf(stderr, "Can't set \"vlan_prio\" if ethertype isn't 802.1Q or 802.1AD"
+						" and num_of_vlans is 0\n");
 				return -1;
 			}
 			ret = get_u8(&vlan_prio, *argv, 10);
@@ -1475,7 +1478,7 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
 			NEXT_ARG();
 			ret = flower_parse_vlan_eth_type(*argv, eth_type,
 						 TCA_FLOWER_KEY_VLAN_ETH_TYPE,
-						 &vlan_ethtype, n);
+						 &vlan_ethtype, n, num_of_vlans > 0);
 			if (ret < 0)
 				return -1;
 			/* get new ethtype for later parsing  */
@@ -1484,8 +1487,9 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
 			__u16 vid;
 
 			NEXT_ARG();
-			if (!eth_type_vlan(vlan_ethtype)) {
-				fprintf(stderr, "Can't set \"cvlan_id\" if inner vlan ethertype isn't 802.1Q or 802.1AD\n");
+			if (!eth_type_vlan(vlan_ethtype, num_of_vlans > 1)) {
+				fprintf(stderr, "Can't set \"cvlan_id\" if inner vlan ethertype isn't 802.1Q or 802.1AD"
+						" and num_of_vlans is less than 2\n");
 				return -1;
 			}
 			ret = get_u16(&vid, *argv, 10);
@@ -1498,8 +1502,9 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
 			__u8 cvlan_prio;
 
 			NEXT_ARG();
-			if (!eth_type_vlan(vlan_ethtype)) {
-				fprintf(stderr, "Can't set \"cvlan_prio\" if inner vlan ethertype isn't 802.1Q or 802.1AD\n");
+			if (!eth_type_vlan(vlan_ethtype, num_of_vlans > 1)) {
+				fprintf(stderr, "Can't set \"cvlan_prio\" if inner vlan ethertype isn't 802.1Q or 802.1AD"
+						" and num_of_vlans is less than 2\n");
 				return -1;
 			}
 			ret = get_u8(&cvlan_prio, *argv, 10);
@@ -1514,7 +1519,7 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
 			/* get new ethtype for later parsing */
 			ret = flower_parse_vlan_eth_type(*argv, vlan_ethtype,
 						 TCA_FLOWER_KEY_CVLAN_ETH_TYPE,
-						 &eth_type, n);
+						 &eth_type, n, num_of_vlans > 1);
 			if (ret < 0)
 				return -1;
 		} else if (matches(*argv, "mpls") == 0) {
-- 
2.29.2


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4221 bytes --]

Re: [PATCH iproute2-next 0/2] flower: match on the number of vlan tags

[Stephen Hemminger]

On Mon, 11 Apr 2022 16:32:00 +0300
Boris Sukholitko <boris.sukholitko@broadcom.com> wrote:

> Hi,
> 
> Our customers in the fiber telecom world have network configurations
> where they would like to control their traffic according to the number
> of tags appearing in the packet.
> 
> For example, TR247 GPON conformance test suite specification mostly
> talks about untagged, single, double tagged packets and gives lax
> guidelines on the vlan protocol vs. number of vlan tags.
> 
> This is different from the common IT networks where 802.1Q and 802.1ad
> protocols are usually describe single and double tagged packet. GPON
> configurations that we work with have arbitrary mix the above protocols
> and number of vlan tags in the packet.
> 
> The following patch series implement number of vlans flower filter. They
> add num_of_vlans flower filter as an alternative to vlan ethtype protocol
> matching. The end result is that the following command becomes possible:
> 
> tc filter add dev eth1 ingress flower \
>   num_of_vlans 1 vlan_prio 5 action drop
> 
> The corresponding kernel patches are being sent separately.
> 
> Thanks,
> Boris.

Maybe something custom like this is better done by small BPF program?

Re: [PATCH iproute2-next 0/2] flower: match on the number of vlan tags

[Boris Sukholitko]

[-- Attachment #1: Type: text/plain, Size: 2048 bytes --]

On Mon, Apr 11, 2022 at 08:45:36AM -0700, Stephen Hemminger wrote:
> On Mon, 11 Apr 2022 16:32:00 +0300
> Boris Sukholitko <boris.sukholitko@broadcom.com> wrote:
> 
> > Hi,
> > 
> > Our customers in the fiber telecom world have network configurations
> > where they would like to control their traffic according to the number
> > of tags appearing in the packet.
> > 
> > For example, TR247 GPON conformance test suite specification mostly
> > talks about untagged, single, double tagged packets and gives lax
> > guidelines on the vlan protocol vs. number of vlan tags.
> > 
> > This is different from the common IT networks where 802.1Q and 802.1ad
> > protocols are usually describe single and double tagged packet. GPON
> > configurations that we work with have arbitrary mix the above protocols
> > and number of vlan tags in the packet.
> > 
> > The following patch series implement number of vlans flower filter. They
> > add num_of_vlans flower filter as an alternative to vlan ethtype protocol
> > matching. The end result is that the following command becomes possible:
> > 
> > tc filter add dev eth1 ingress flower \
> >   num_of_vlans 1 vlan_prio 5 action drop
> > 
> > The corresponding kernel patches are being sent separately.
> > 
> > Thanks,
> > Boris.
> 
> Maybe something custom like this is better done by small BPF program?

I am not sure it is feasible to have BPF match done on the number of
vlans and have the rest of TC machinery work as expected.

For example, the flower filters look at the protocol to allow matching
on the vlan fields. Patch 5 of the kernel part of the series adds number
of vlans as a different precondition. Having BPF program does nothing
for it.

Replicating more of TC functionality in the BPF to alleviate such pain
points is probably possible but will not be "simple".

Also (and sorry for the philosophy rant!) there is an issue of UI and
intended audience here. The TC tools are well known and accessible. I am
not sure that the same can be said for a custom BPF programs. :)

Thanks,
Boris.

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4221 bytes --]

Re: [PATCH iproute2-next 0/2] flower: match on the number of vlan tags

[Jamal Hadi Salim]

On 2022-04-12 06:45, Boris Sukholitko wrote:
> On Mon, Apr 11, 2022 at 08:45:36AM -0700, Stephen Hemminger wrote:
>> On Mon, 11 Apr 2022 16:32:00 +0300
>> Boris Sukholitko <boris.sukholitko@broadcom.com> wrote:
>>
>>> Hi,
>>>
>>> Our customers in the fiber telecom world have network configurations
>>> where they would like to control their traffic according to the number
>>> of tags appearing in the packet.
>>>
>>> For example, TR247 GPON conformance test suite specification mostly
>>> talks about untagged, single, double tagged packets and gives lax
>>> guidelines on the vlan protocol vs. number of vlan tags.
>>>
>>> This is different from the common IT networks where 802.1Q and 802.1ad
>>> protocols are usually describe single and double tagged packet. GPON
>>> configurations that we work with have arbitrary mix the above protocols
>>> and number of vlan tags in the packet.
>>>
>>> The following patch series implement number of vlans flower filter. They
>>> add num_of_vlans flower filter as an alternative to vlan ethtype protocol
>>> matching. The end result is that the following command becomes possible:
>>>
>>> tc filter add dev eth1 ingress flower \
>>>    num_of_vlans 1 vlan_prio 5 action drop
>>>
>>> The corresponding kernel patches are being sent separately.
>>>
>>> Thanks,
>>> Boris.
>>
>> Maybe something custom like this is better done by small BPF program?
> 
> I am not sure it is feasible to have BPF match done on the number of
> vlans and have the rest of TC machinery work as expected.
> 
> For example, the flower filters look at the protocol to allow matching
> on the vlan fields. Patch 5 of the kernel part of the series adds number
> of vlans as a different precondition. Having BPF program does nothing
> for it.
> 
> Replicating more of TC functionality in the BPF to alleviate such pain
> points is probably possible but will not be "simple".
> 
> Also (and sorry for the philosophy rant!) there is an issue of UI and
> intended audience here. The TC tools are well known and accessible. I am
> not sure that the same can be said for a custom BPF programs. :)
> 

I hate to use +1 (proverbial death-by-pluse-one in effect) but, damn
couldnt resist. Stephen, this mantra only makes sense if:

a) You are a big cloud vendor with a gazillion developers who will
write, test and maintain your custom code.
b) willing to pay some consultant or other vendor to do the above.

The majority of the world just wants to pay RH or Cannonical for the
basic distro support and then run their bash scripts (the ops part,
_not the dev_).
I wouldnt call what Boris is doing as "custom". The VLAN infrastructure
has some challenges when it comes to multiple tags.

My 2c Canadiana rant:
I am not saying there's no room for custom - in which case ebpf has
a role to play (and we widely use it here when it makes sense), just
that the standard answer shouldnt be "use ebpf" just because.

Rant continued:
As community we now seem to be driven by cloud vendor mentality really.
What happened to "lets contribute back so everyone can benefit"?
There's a lot of value still in upstreaming things.

cheers,
jamal

[PATCH iproute2-next 0/2] flower: match on the number of vlan tags

[Boris Sukholitko]

[-- Attachment #1: Type: text/plain, Size: 1261 bytes --]

Hi,

Our customers in the fiber telecom world have network configurations
where they would like to control their traffic according to the number
of tags appearing in the packet.

For example, TR247 GPON conformance test suite specification mostly
talks about untagged, single, double tagged packets and gives lax
guidelines on the vlan protocol vs. number of vlan tags.

This is different from the common IT networks where 802.1Q and 802.1ad
protocols are usually describe single and double tagged packet. GPON
configurations that we work with have arbitrary mix the above protocols
and number of vlan tags in the packet.

The following patch series implement number of vlans flower filter. They
add num_of_vlans flower filter as an alternative to vlan ethtype protocol
matching. The end result is that the following command becomes possible:

tc filter add dev eth1 ingress flower \
  num_of_vlans 1 vlan_prio 5 action drop

The corresponding kernel patches are being sent separately.

Thanks,
Boris.

Boris Sukholitko (2):
  Add num of vlans parameter
  Check args with num_of_vlans

 include/uapi/linux/pkt_cls.h |  2 ++
 tc/f_flower.c                | 57 ++++++++++++++++++++++++++----------
 2 files changed, 43 insertions(+), 16 deletions(-)

-- 
2.29.2


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4221 bytes --]