* [PATCH net-next v8] net: openvswitch: IPv6: Add IPv6 extension header support
@ 2021-10-29 18:20 Toms Atteka
2021-11-02 18:39 ` Jakub Kicinski
0 siblings, 1 reply; 12+ messages in thread
From: Toms Atteka @ 2021-10-29 18:20 UTC (permalink / raw)
To: netdev, pshelar, davem, kuba, dev, linux-kernel; +Cc: Toms Atteka
This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
packets can be filtered using ipv6_ext flag.
Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com>
---
include/uapi/linux/openvswitch.h | 6 ++
net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
net/openvswitch/flow.h | 14 ++++
net/openvswitch/flow_netlink.c | 26 +++++-
4 files changed, 184 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index a87b44cd5590..43790f07e4a2 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -342,6 +342,7 @@ enum ovs_key_attr {
OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
+ OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */
#ifdef __KERNEL__
OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
@@ -421,6 +422,11 @@ struct ovs_key_ipv6 {
__u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */
};
+/* separate structure to support backward compatibility with older user space */
+struct ovs_key_ipv6_exthdrs {
+ __u16 hdrs;
+};
+
struct ovs_key_tcp {
__be16 tcp_src;
__be16 tcp_dst;
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 9d375e74b607..28acb40437ca 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb)
sizeof(struct icmphdr));
}
+/**
+ * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
+ *
+ * @skb: buffer where extension header data starts in packet
+ * @nh: ipv6 header
+ * @ext_hdrs: flags are stored here
+ *
+ * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
+ * is unexpectedly encountered. (Two destination options headers may be
+ * expected and would not cause this bit to be set.)
+ *
+ * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
+ * preferred (but not required) by RFC 2460:
+ *
+ * When more than one extension header is used in the same packet, it is
+ * recommended that those headers appear in the following order:
+ * IPv6 header
+ * Hop-by-Hop Options header
+ * Destination Options header
+ * Routing header
+ * Fragment header
+ * Authentication header
+ * Encapsulating Security Payload header
+ * Destination Options header
+ * upper-layer header
+ */
+static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
+ u16 *ext_hdrs)
+{
+ u8 next_type = nh->nexthdr;
+ unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
+ int dest_options_header_count = 0;
+
+ *ext_hdrs = 0;
+
+ while (ipv6_ext_hdr(next_type)) {
+ struct ipv6_opt_hdr _hdr, *hp;
+
+ switch (next_type) {
+ case IPPROTO_NONE:
+ *ext_hdrs |= OFPIEH12_NONEXT;
+ /* stop parsing */
+ return;
+
+ case IPPROTO_ESP:
+ if (*ext_hdrs & OFPIEH12_ESP)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
+ OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
+ OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_ESP;
+ break;
+
+ case IPPROTO_AH:
+ if (*ext_hdrs & OFPIEH12_AUTH)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs &
+ ~(OFPIEH12_HOP | OFPIEH12_DEST | OFPIEH12_ROUTER |
+ IPPROTO_FRAGMENT | OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_AUTH;
+ break;
+
+ case IPPROTO_DSTOPTS:
+ if (dest_options_header_count == 0) {
+ if (*ext_hdrs &
+ ~(OFPIEH12_HOP | OFPIEH12_UNREP))
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ *ext_hdrs |= OFPIEH12_DEST;
+ } else if (dest_options_header_count == 1) {
+ if (*ext_hdrs &
+ ~(OFPIEH12_HOP | OFPIEH12_DEST |
+ OFPIEH12_ROUTER | OFPIEH12_FRAG |
+ OFPIEH12_AUTH | OFPIEH12_ESP |
+ OFPIEH12_UNREP)) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ } else {
+ *ext_hdrs |= OFPIEH12_UNREP;
+ }
+ dest_options_header_count++;
+ break;
+
+ case IPPROTO_FRAGMENT:
+ if (*ext_hdrs & OFPIEH12_FRAG)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs & ~(OFPIEH12_HOP |
+ OFPIEH12_DEST |
+ OFPIEH12_ROUTER |
+ OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_FRAG;
+ break;
+
+ case IPPROTO_ROUTING:
+ if (*ext_hdrs & OFPIEH12_ROUTER)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs & ~(OFPIEH12_HOP |
+ OFPIEH12_DEST |
+ OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_ROUTER;
+ break;
+
+ case IPPROTO_HOPOPTS:
+ if (*ext_hdrs & OFPIEH12_HOP)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ /* OFPIEH12_HOP is set to 1 if a hop-by-hop IPv6
+ * extension header is present as the first
+ * extension header in the packet.
+ */
+ if (*ext_hdrs == 0)
+ *ext_hdrs |= OFPIEH12_HOP;
+ else
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ break;
+
+ default:
+ return;
+ }
+
+ hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
+ if (!hp)
+ break;
+ next_type = hp->nexthdr;
+ start += ipv6_optlen(hp);
+ };
+}
+
static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key)
{
unsigned short frag_off;
@@ -254,6 +392,8 @@ static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key)
nh = ipv6_hdr(skb);
+ get_ipv6_ext_hdrs(skb, nh, &key->ipv6.exthdrs);
+
key->ip.proto = NEXTHDR_NONE;
key->ip.tos = ipv6_get_dsfield(nh);
key->ip.ttl = nh->hop_limit;
diff --git a/net/openvswitch/flow.h b/net/openvswitch/flow.h
index 758a8c77f736..073ab73ffeaa 100644
--- a/net/openvswitch/flow.h
+++ b/net/openvswitch/flow.h
@@ -32,6 +32,19 @@ enum sw_flow_mac_proto {
#define SW_FLOW_KEY_INVALID 0x80
#define MPLS_LABEL_DEPTH 3
+/* Bit definitions for IPv6 Extension Header pseudo-field. */
+enum ofp12_ipv6exthdr_flags {
+ OFPIEH12_NONEXT = 1 << 0, /* "No next header" encountered. */
+ OFPIEH12_ESP = 1 << 1, /* Encrypted Sec Payload header present. */
+ OFPIEH12_AUTH = 1 << 2, /* Authentication header present. */
+ OFPIEH12_DEST = 1 << 3, /* 1 or 2 dest headers present. */
+ OFPIEH12_FRAG = 1 << 4, /* Fragment header present. */
+ OFPIEH12_ROUTER = 1 << 5, /* Router header present. */
+ OFPIEH12_HOP = 1 << 6, /* Hop-by-hop header present. */
+ OFPIEH12_UNREP = 1 << 7, /* Unexpected repeats encountered. */
+ OFPIEH12_UNSEQ = 1 << 8 /* Unexpected sequencing encountered. */
+};
+
/* Store options at the end of the array if they are less than the
* maximum size. This allows us to get the benefits of variable length
* matching for small options.
@@ -121,6 +134,7 @@ struct sw_flow_key {
struct in6_addr dst; /* IPv6 destination address. */
} addr;
__be32 label; /* IPv6 flow label. */
+ u16 exthdrs; /* IPv6 extension header flags */
union {
struct {
struct in6_addr src;
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 65c2e3458ff5..0aeaf28594ce 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -344,7 +344,7 @@ size_t ovs_key_attr_size(void)
/* Whenever adding new OVS_KEY_ FIELDS, we should consider
* updating this function.
*/
- BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 29);
+ BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 30);
return nla_total_size(4) /* OVS_KEY_ATTR_PRIORITY */
+ nla_total_size(0) /* OVS_KEY_ATTR_TUNNEL */
@@ -367,7 +367,8 @@ size_t ovs_key_attr_size(void)
+ nla_total_size(2) /* OVS_KEY_ATTR_ETHERTYPE */
+ nla_total_size(40) /* OVS_KEY_ATTR_IPV6 */
+ nla_total_size(2) /* OVS_KEY_ATTR_ICMPV6 */
- + nla_total_size(28); /* OVS_KEY_ATTR_ND */
+ + nla_total_size(28) /* OVS_KEY_ATTR_ND */
+ + nla_total_size(2); /* OVS_KEY_ATTR_IPV6_EXTHDRS */
}
static const struct ovs_len_tbl ovs_vxlan_ext_key_lens[OVS_VXLAN_EXT_MAX + 1] = {
@@ -435,6 +436,8 @@ static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = {
.len = sizeof(struct ovs_key_ct_tuple_ipv6) },
[OVS_KEY_ATTR_NSH] = { .len = OVS_ATTR_NESTED,
.next = ovs_nsh_key_attr_lens, },
+ [OVS_KEY_ATTR_IPV6_EXTHDRS] = {
+ .len = sizeof(struct ovs_key_ipv6_exthdrs) },
};
static bool check_attr_len(unsigned int attr_len, unsigned int expected_len)
@@ -1595,6 +1598,17 @@ static int ovs_key_from_nlattrs(struct net *net, struct sw_flow_match *match,
attrs &= ~(1 << OVS_KEY_ATTR_IPV6);
}
+ if (attrs & (1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS)) {
+ const struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key;
+
+ ipv6_exthdrs_key = nla_data(a[OVS_KEY_ATTR_IPV6_EXTHDRS]);
+
+ SW_FLOW_KEY_PUT(match, ipv6.exthdrs,
+ ipv6_exthdrs_key->hdrs, is_mask);
+
+ attrs &= ~(1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS);
+ }
+
if (attrs & (1 << OVS_KEY_ATTR_ARP)) {
const struct ovs_key_arp *arp_key;
@@ -2097,6 +2111,7 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
ipv4_key->ipv4_frag = output->ip.frag;
} else if (swkey->eth.type == htons(ETH_P_IPV6)) {
struct ovs_key_ipv6 *ipv6_key;
+ struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key;
nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6, sizeof(*ipv6_key));
if (!nla)
@@ -2111,6 +2126,13 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
ipv6_key->ipv6_tclass = output->ip.tos;
ipv6_key->ipv6_hlimit = output->ip.ttl;
ipv6_key->ipv6_frag = output->ip.frag;
+
+ nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6_EXTHDRS,
+ sizeof(*ipv6_exthdrs_key));
+ if (!nla)
+ goto nla_put_failure;
+ ipv6_exthdrs_key = nla_data(nla);
+ ipv6_exthdrs_key->hdrs = output->ipv6.exthdrs;
} else if (swkey->eth.type == htons(ETH_P_NSH)) {
if (nsh_key_to_nlattr(&output->nsh, is_mask, skb))
goto nla_put_failure;
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v8] net: openvswitch: IPv6: Add IPv6 extension header support
2021-10-29 18:20 [PATCH net-next v8] net: openvswitch: IPv6: Add IPv6 extension header support Toms Atteka
@ 2021-11-02 18:39 ` Jakub Kicinski
0 siblings, 0 replies; 12+ messages in thread
From: Jakub Kicinski @ 2021-11-02 18:39 UTC (permalink / raw)
To: Toms Atteka; +Cc: netdev, pshelar, davem, dev, linux-kernel
On Fri, 29 Oct 2021 11:20:08 -0700 Toms Atteka wrote:
> This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
> packets can be filtered using ipv6_ext flag.
>
> Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com>
Hi! This patch didn't get reviewed in time for the v5.16 merge window,
please continue the work but you'll have to repost in two weeks after
v5.16-rc1 has been cut. If you repost before that point please use RFC
designation.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v8] net: openvswitch: IPv6: Add IPv6 extension header support
2022-02-24 0:54 Toms Atteka
@ 2022-02-25 10:40 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 12+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-02-25 10:40 UTC (permalink / raw)
To: Toms Atteka; +Cc: netdev, pshelar, davem, kuba, dev, linux-kernel
Hello:
This patch was applied to netdev/net-next.git (master)
by David S. Miller <davem@davemloft.net>:
On Wed, 23 Feb 2022 16:54:09 -0800 you wrote:
> This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
> packets can be filtered using ipv6_ext flag.
>
> Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com>
> Acked-by: Pravin B Shelar <pshelar@ovn.org>
> ---
> include/uapi/linux/openvswitch.h | 6 ++
> net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
> net/openvswitch/flow.h | 14 ++++
> net/openvswitch/flow_netlink.c | 26 +++++-
> 4 files changed, 184 insertions(+), 2 deletions(-)
Here is the summary with links:
- [net-next,v8] net: openvswitch: IPv6: Add IPv6 extension header support
https://git.kernel.org/netdev/net-next/c/28a3f0601727
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH net-next v8] net: openvswitch: IPv6: Add IPv6 extension header support
@ 2022-02-24 0:54 Toms Atteka
2022-02-25 10:40 ` patchwork-bot+netdevbpf
0 siblings, 1 reply; 12+ messages in thread
From: Toms Atteka @ 2022-02-24 0:54 UTC (permalink / raw)
To: netdev, pshelar, davem, kuba, dev, linux-kernel; +Cc: Toms Atteka
This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
packets can be filtered using ipv6_ext flag.
Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com>
Acked-by: Pravin B Shelar <pshelar@ovn.org>
---
include/uapi/linux/openvswitch.h | 6 ++
net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
net/openvswitch/flow.h | 14 ++++
net/openvswitch/flow_netlink.c | 26 +++++-
4 files changed, 184 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index 150bcff49b1c..9d1710f20505 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -351,6 +351,7 @@ enum ovs_key_attr {
OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
+ OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */
#ifdef __KERNEL__
OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
@@ -430,6 +431,11 @@ struct ovs_key_ipv6 {
__u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */
};
+/* separate structure to support backward compatibility with older user space */
+struct ovs_key_ipv6_exthdrs {
+ __u16 hdrs;
+};
+
struct ovs_key_tcp {
__be16 tcp_src;
__be16 tcp_dst;
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index f6cd24fd530c..8df73d86b968 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -241,6 +241,144 @@ static bool icmphdr_ok(struct sk_buff *skb)
sizeof(struct icmphdr));
}
+/**
+ * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
+ *
+ * @skb: buffer where extension header data starts in packet
+ * @nh: ipv6 header
+ * @ext_hdrs: flags are stored here
+ *
+ * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
+ * is unexpectedly encountered. (Two destination options headers may be
+ * expected and would not cause this bit to be set.)
+ *
+ * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
+ * preferred (but not required) by RFC 2460:
+ *
+ * When more than one extension header is used in the same packet, it is
+ * recommended that those headers appear in the following order:
+ * IPv6 header
+ * Hop-by-Hop Options header
+ * Destination Options header
+ * Routing header
+ * Fragment header
+ * Authentication header
+ * Encapsulating Security Payload header
+ * Destination Options header
+ * upper-layer header
+ */
+static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
+ u16 *ext_hdrs)
+{
+ u8 next_type = nh->nexthdr;
+ unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
+ int dest_options_header_count = 0;
+
+ *ext_hdrs = 0;
+
+ while (ipv6_ext_hdr(next_type)) {
+ struct ipv6_opt_hdr _hdr, *hp;
+
+ switch (next_type) {
+ case IPPROTO_NONE:
+ *ext_hdrs |= OFPIEH12_NONEXT;
+ /* stop parsing */
+ return;
+
+ case IPPROTO_ESP:
+ if (*ext_hdrs & OFPIEH12_ESP)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
+ OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
+ OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_ESP;
+ break;
+
+ case IPPROTO_AH:
+ if (*ext_hdrs & OFPIEH12_AUTH)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs &
+ ~(OFPIEH12_HOP | OFPIEH12_DEST | OFPIEH12_ROUTER |
+ IPPROTO_FRAGMENT | OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_AUTH;
+ break;
+
+ case IPPROTO_DSTOPTS:
+ if (dest_options_header_count == 0) {
+ if (*ext_hdrs &
+ ~(OFPIEH12_HOP | OFPIEH12_UNREP))
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ *ext_hdrs |= OFPIEH12_DEST;
+ } else if (dest_options_header_count == 1) {
+ if (*ext_hdrs &
+ ~(OFPIEH12_HOP | OFPIEH12_DEST |
+ OFPIEH12_ROUTER | OFPIEH12_FRAG |
+ OFPIEH12_AUTH | OFPIEH12_ESP |
+ OFPIEH12_UNREP)) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ } else {
+ *ext_hdrs |= OFPIEH12_UNREP;
+ }
+ dest_options_header_count++;
+ break;
+
+ case IPPROTO_FRAGMENT:
+ if (*ext_hdrs & OFPIEH12_FRAG)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs & ~(OFPIEH12_HOP |
+ OFPIEH12_DEST |
+ OFPIEH12_ROUTER |
+ OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_FRAG;
+ break;
+
+ case IPPROTO_ROUTING:
+ if (*ext_hdrs & OFPIEH12_ROUTER)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs & ~(OFPIEH12_HOP |
+ OFPIEH12_DEST |
+ OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_ROUTER;
+ break;
+
+ case IPPROTO_HOPOPTS:
+ if (*ext_hdrs & OFPIEH12_HOP)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ /* OFPIEH12_HOP is set to 1 if a hop-by-hop IPv6
+ * extension header is present as the first
+ * extension header in the packet.
+ */
+ if (*ext_hdrs == 0)
+ *ext_hdrs |= OFPIEH12_HOP;
+ else
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ break;
+
+ default:
+ return;
+ }
+
+ hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
+ if (!hp)
+ break;
+ next_type = hp->nexthdr;
+ start += ipv6_optlen(hp);
+ };
+}
+
static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key)
{
unsigned short frag_off;
@@ -256,6 +394,8 @@ static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key)
nh = ipv6_hdr(skb);
+ get_ipv6_ext_hdrs(skb, nh, &key->ipv6.exthdrs);
+
key->ip.proto = NEXTHDR_NONE;
key->ip.tos = ipv6_get_dsfield(nh);
key->ip.ttl = nh->hop_limit;
diff --git a/net/openvswitch/flow.h b/net/openvswitch/flow.h
index 758a8c77f736..073ab73ffeaa 100644
--- a/net/openvswitch/flow.h
+++ b/net/openvswitch/flow.h
@@ -32,6 +32,19 @@ enum sw_flow_mac_proto {
#define SW_FLOW_KEY_INVALID 0x80
#define MPLS_LABEL_DEPTH 3
+/* Bit definitions for IPv6 Extension Header pseudo-field. */
+enum ofp12_ipv6exthdr_flags {
+ OFPIEH12_NONEXT = 1 << 0, /* "No next header" encountered. */
+ OFPIEH12_ESP = 1 << 1, /* Encrypted Sec Payload header present. */
+ OFPIEH12_AUTH = 1 << 2, /* Authentication header present. */
+ OFPIEH12_DEST = 1 << 3, /* 1 or 2 dest headers present. */
+ OFPIEH12_FRAG = 1 << 4, /* Fragment header present. */
+ OFPIEH12_ROUTER = 1 << 5, /* Router header present. */
+ OFPIEH12_HOP = 1 << 6, /* Hop-by-hop header present. */
+ OFPIEH12_UNREP = 1 << 7, /* Unexpected repeats encountered. */
+ OFPIEH12_UNSEQ = 1 << 8 /* Unexpected sequencing encountered. */
+};
+
/* Store options at the end of the array if they are less than the
* maximum size. This allows us to get the benefits of variable length
* matching for small options.
@@ -121,6 +134,7 @@ struct sw_flow_key {
struct in6_addr dst; /* IPv6 destination address. */
} addr;
__be32 label; /* IPv6 flow label. */
+ u16 exthdrs; /* IPv6 extension header flags */
union {
struct {
struct in6_addr src;
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index fd1f809e9bc1..8b4124820f7d 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -346,7 +346,7 @@ size_t ovs_key_attr_size(void)
/* Whenever adding new OVS_KEY_ FIELDS, we should consider
* updating this function.
*/
- BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 29);
+ BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 30);
return nla_total_size(4) /* OVS_KEY_ATTR_PRIORITY */
+ nla_total_size(0) /* OVS_KEY_ATTR_TUNNEL */
@@ -369,7 +369,8 @@ size_t ovs_key_attr_size(void)
+ nla_total_size(2) /* OVS_KEY_ATTR_ETHERTYPE */
+ nla_total_size(40) /* OVS_KEY_ATTR_IPV6 */
+ nla_total_size(2) /* OVS_KEY_ATTR_ICMPV6 */
- + nla_total_size(28); /* OVS_KEY_ATTR_ND */
+ + nla_total_size(28) /* OVS_KEY_ATTR_ND */
+ + nla_total_size(2); /* OVS_KEY_ATTR_IPV6_EXTHDRS */
}
static const struct ovs_len_tbl ovs_vxlan_ext_key_lens[OVS_VXLAN_EXT_MAX + 1] = {
@@ -437,6 +438,8 @@ static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = {
.len = sizeof(struct ovs_key_ct_tuple_ipv6) },
[OVS_KEY_ATTR_NSH] = { .len = OVS_ATTR_NESTED,
.next = ovs_nsh_key_attr_lens, },
+ [OVS_KEY_ATTR_IPV6_EXTHDRS] = {
+ .len = sizeof(struct ovs_key_ipv6_exthdrs) },
};
static bool check_attr_len(unsigned int attr_len, unsigned int expected_len)
@@ -1597,6 +1600,17 @@ static int ovs_key_from_nlattrs(struct net *net, struct sw_flow_match *match,
attrs &= ~(1 << OVS_KEY_ATTR_IPV6);
}
+ if (attrs & (1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS)) {
+ const struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key;
+
+ ipv6_exthdrs_key = nla_data(a[OVS_KEY_ATTR_IPV6_EXTHDRS]);
+
+ SW_FLOW_KEY_PUT(match, ipv6.exthdrs,
+ ipv6_exthdrs_key->hdrs, is_mask);
+
+ attrs &= ~(1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS);
+ }
+
if (attrs & (1 << OVS_KEY_ATTR_ARP)) {
const struct ovs_key_arp *arp_key;
@@ -2099,6 +2113,7 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
ipv4_key->ipv4_frag = output->ip.frag;
} else if (swkey->eth.type == htons(ETH_P_IPV6)) {
struct ovs_key_ipv6 *ipv6_key;
+ struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key;
nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6, sizeof(*ipv6_key));
if (!nla)
@@ -2113,6 +2128,13 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
ipv6_key->ipv6_tclass = output->ip.tos;
ipv6_key->ipv6_hlimit = output->ip.ttl;
ipv6_key->ipv6_frag = output->ip.frag;
+
+ nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6_EXTHDRS,
+ sizeof(*ipv6_exthdrs_key));
+ if (!nla)
+ goto nla_put_failure;
+ ipv6_exthdrs_key = nla_data(nla);
+ ipv6_exthdrs_key->hdrs = output->ipv6.exthdrs;
} else if (swkey->eth.type == htons(ETH_P_NSH)) {
if (nsh_key_to_nlattr(&output->nsh, is_mask, skb))
goto nla_put_failure;
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v8] net: openvswitch: IPv6: Add IPv6 extension header support
2022-02-09 20:46 ` Cpp Code
@ 2022-02-10 0:58 ` Jakub Kicinski
0 siblings, 0 replies; 12+ messages in thread
From: Jakub Kicinski @ 2022-02-10 0:58 UTC (permalink / raw)
To: Cpp Code
Cc: Pravin Shelar, Linux Kernel Network Developers, David S. Miller,
ovs dev, LKML
On Wed, 9 Feb 2022 12:46:01 -0800 Cpp Code wrote:
> > ok, I see advantage of using skb_header_pointer() in this case, but
> > replacing all check_header() with skb_header_pointer() would add lot
> > of copy operation in flow extract. Anyways for this use case
> > skb_header_pointer() is fine.
> >
> > Acked-by: Pravin B Shelar <pshelar@ovn.org>
>
> Could this be applied please.
Please repost with Pravin's ack included.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v8] net: openvswitch: IPv6: Add IPv6 extension header support
2021-12-10 7:36 ` Pravin Shelar
@ 2022-02-09 20:46 ` Cpp Code
2022-02-10 0:58 ` Jakub Kicinski
0 siblings, 1 reply; 12+ messages in thread
From: Cpp Code @ 2022-02-09 20:46 UTC (permalink / raw)
To: Pravin Shelar
Cc: Linux Kernel Network Developers, David S. Miller, Jakub Kicinski,
ovs dev, LKML
On Thu, Dec 9, 2021 at 11:36 PM Pravin Shelar <pravin.ovn@gmail.com> wrote:
>
> ()
>
> On Mon, Dec 6, 2021 at 3:00 PM Cpp Code <cpp.code.lv@gmail.com> wrote:
> >
> > On Thu, Dec 2, 2021 at 9:28 PM Pravin Shelar <pravin.ovn@gmail.com> wrote:
> > >
> > > On Thu, Dec 2, 2021 at 12:20 PM Cpp Code <cpp.code.lv@gmail.com> wrote:
> > > >
> > > > On Wed, Dec 1, 2021 at 11:34 PM Pravin Shelar <pravin.ovn@gmail.com> wrote:
> > > > >
> > > > > On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <cpp.code.lv@gmail.com> wrote:
> > > > > >
> > > > > > This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
> > > > > > packets can be filtered using ipv6_ext flag.
> > > > > >
> > > > > > Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com>
> > > > > > ---
> > > > > > include/uapi/linux/openvswitch.h | 6 ++
> > > > > > net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
> > > > > > net/openvswitch/flow.h | 14 ++++
> > > > > > net/openvswitch/flow_netlink.c | 26 +++++-
> > > > > > 4 files changed, 184 insertions(+), 2 deletions(-)
> > > > > >
> > > > > > diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
> > > > > > index a87b44cd5590..43790f07e4a2 100644
> > > > > > --- a/include/uapi/linux/openvswitch.h
> > > > > > +++ b/include/uapi/linux/openvswitch.h
> > > > > > @@ -342,6 +342,7 @@ enum ovs_key_attr {
> > > > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
> > > > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
> > > > > > OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
> > > > > > + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */
> > > > > >
> > > > > > #ifdef __KERNEL__
> > > > > > OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
> > > > > > @@ -421,6 +422,11 @@ struct ovs_key_ipv6 {
> > > > > > __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */
> > > > > > };
> > > > > >
> > > > > > +/* separate structure to support backward compatibility with older user space */
> > > > > > +struct ovs_key_ipv6_exthdrs {
> > > > > > + __u16 hdrs;
> > > > > > +};
> > > > > > +
> > > > > > struct ovs_key_tcp {
> > > > > > __be16 tcp_src;
> > > > > > __be16 tcp_dst;
> > > > > > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
> > > > > > index 9d375e74b607..28acb40437ca 100644
> > > > > > --- a/net/openvswitch/flow.c
> > > > > > +++ b/net/openvswitch/flow.c
> > > > > > @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb)
> > > > > > sizeof(struct icmphdr));
> > > > > > }
> > > > > >
> > > > > > +/**
> > > > > > + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
> > > > > > + *
> > > > > > + * @skb: buffer where extension header data starts in packet
> > > > > > + * @nh: ipv6 header
> > > > > > + * @ext_hdrs: flags are stored here
> > > > > > + *
> > > > > > + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
> > > > > > + * is unexpectedly encountered. (Two destination options headers may be
> > > > > > + * expected and would not cause this bit to be set.)
> > > > > > + *
> > > > > > + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
> > > > > > + * preferred (but not required) by RFC 2460:
> > > > > > + *
> > > > > > + * When more than one extension header is used in the same packet, it is
> > > > > > + * recommended that those headers appear in the following order:
> > > > > > + * IPv6 header
> > > > > > + * Hop-by-Hop Options header
> > > > > > + * Destination Options header
> > > > > > + * Routing header
> > > > > > + * Fragment header
> > > > > > + * Authentication header
> > > > > > + * Encapsulating Security Payload header
> > > > > > + * Destination Options header
> > > > > > + * upper-layer header
> > > > > > + */
> > > > > > +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
> > > > > > + u16 *ext_hdrs)
> > > > > > +{
> > > > > > + u8 next_type = nh->nexthdr;
> > > > > > + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
> > > > > > + int dest_options_header_count = 0;
> > > > > > +
> > > > > > + *ext_hdrs = 0;
> > > > > > +
> > > > > > + while (ipv6_ext_hdr(next_type)) {
> > > > > > + struct ipv6_opt_hdr _hdr, *hp;
> > > > > > +
> > > > > > + switch (next_type) {
> > > > > > + case IPPROTO_NONE:
> > > > > > + *ext_hdrs |= OFPIEH12_NONEXT;
> > > > > > + /* stop parsing */
> > > > > > + return;
> > > > > > +
> > > > > > + case IPPROTO_ESP:
> > > > > > + if (*ext_hdrs & OFPIEH12_ESP)
> > > > > > + *ext_hdrs |= OFPIEH12_UNREP;
> > > > > > + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
> > > > > > + OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
> > > > > > + OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
> > > > > > + dest_options_header_count >= 2) {
> > > > > > + *ext_hdrs |= OFPIEH12_UNSEQ;
> > > > > > + }
> > > > > > + *ext_hdrs |= OFPIEH12_ESP;
> > > > > > + break;
> > > > > you need to check_header() before looking into each extension header.
> > > >
> > > > Could you elaborate why I need to add check_header(),
> > > > skb_header_pointer() is doing sanitization.
> > >
> > > I mean check_header() would allow you to read the header without
> > > copying the bits, it is used in ovs flow extraction so its usual
> > > check.
> >
> > But check_header() will call *__pskb_pull_tail which in turn will copy
> > bits if data will be fragmented.
> >
> OVS flow extract uses this function to extract flow upto L4, so
> skb_header_pointer() is not saving any copy operation.
>
> > /* Moves tail of skb head forward, copying data from fragmented part,
> > * when it is necessary.
> > * 1. It may fail due to malloc failure.
> > * 2. It may change skb pointers.
> > *
> > * It is pretty complicated. Luckily, it is called only in exceptional cases.
> > */
> > void *__pskb_pull_tail(struct sk_buff *skb, int delta)
> >
> > as well I noticed that for example commit
> > 4a06fa67c4da20148803525151845276cdb995c1 is moving from
> > pskb_may_pull() to skb_header_pointer()
> ok, I see advantage of using skb_header_pointer() in this case, but
> replacing all check_header() with skb_header_pointer() would add lot
> of copy operation in flow extract. Anyways for this use case
> skb_header_pointer() is fine.
>
> Acked-by: Pravin B Shelar <pshelar@ovn.org>
Hi,
Could this be applied please.
Thanks,
Tom
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v8] net: openvswitch: IPv6: Add IPv6 extension header support
2021-12-06 23:00 ` Cpp Code
@ 2021-12-10 7:36 ` Pravin Shelar
2022-02-09 20:46 ` Cpp Code
0 siblings, 1 reply; 12+ messages in thread
From: Pravin Shelar @ 2021-12-10 7:36 UTC (permalink / raw)
To: Cpp Code
Cc: Linux Kernel Network Developers, David S. Miller, Jakub Kicinski,
ovs dev, LKML
()
On Mon, Dec 6, 2021 at 3:00 PM Cpp Code <cpp.code.lv@gmail.com> wrote:
>
> On Thu, Dec 2, 2021 at 9:28 PM Pravin Shelar <pravin.ovn@gmail.com> wrote:
> >
> > On Thu, Dec 2, 2021 at 12:20 PM Cpp Code <cpp.code.lv@gmail.com> wrote:
> > >
> > > On Wed, Dec 1, 2021 at 11:34 PM Pravin Shelar <pravin.ovn@gmail.com> wrote:
> > > >
> > > > On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <cpp.code.lv@gmail.com> wrote:
> > > > >
> > > > > This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
> > > > > packets can be filtered using ipv6_ext flag.
> > > > >
> > > > > Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com>
> > > > > ---
> > > > > include/uapi/linux/openvswitch.h | 6 ++
> > > > > net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
> > > > > net/openvswitch/flow.h | 14 ++++
> > > > > net/openvswitch/flow_netlink.c | 26 +++++-
> > > > > 4 files changed, 184 insertions(+), 2 deletions(-)
> > > > >
> > > > > diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
> > > > > index a87b44cd5590..43790f07e4a2 100644
> > > > > --- a/include/uapi/linux/openvswitch.h
> > > > > +++ b/include/uapi/linux/openvswitch.h
> > > > > @@ -342,6 +342,7 @@ enum ovs_key_attr {
> > > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
> > > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
> > > > > OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
> > > > > + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */
> > > > >
> > > > > #ifdef __KERNEL__
> > > > > OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
> > > > > @@ -421,6 +422,11 @@ struct ovs_key_ipv6 {
> > > > > __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */
> > > > > };
> > > > >
> > > > > +/* separate structure to support backward compatibility with older user space */
> > > > > +struct ovs_key_ipv6_exthdrs {
> > > > > + __u16 hdrs;
> > > > > +};
> > > > > +
> > > > > struct ovs_key_tcp {
> > > > > __be16 tcp_src;
> > > > > __be16 tcp_dst;
> > > > > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
> > > > > index 9d375e74b607..28acb40437ca 100644
> > > > > --- a/net/openvswitch/flow.c
> > > > > +++ b/net/openvswitch/flow.c
> > > > > @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb)
> > > > > sizeof(struct icmphdr));
> > > > > }
> > > > >
> > > > > +/**
> > > > > + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
> > > > > + *
> > > > > + * @skb: buffer where extension header data starts in packet
> > > > > + * @nh: ipv6 header
> > > > > + * @ext_hdrs: flags are stored here
> > > > > + *
> > > > > + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
> > > > > + * is unexpectedly encountered. (Two destination options headers may be
> > > > > + * expected and would not cause this bit to be set.)
> > > > > + *
> > > > > + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
> > > > > + * preferred (but not required) by RFC 2460:
> > > > > + *
> > > > > + * When more than one extension header is used in the same packet, it is
> > > > > + * recommended that those headers appear in the following order:
> > > > > + * IPv6 header
> > > > > + * Hop-by-Hop Options header
> > > > > + * Destination Options header
> > > > > + * Routing header
> > > > > + * Fragment header
> > > > > + * Authentication header
> > > > > + * Encapsulating Security Payload header
> > > > > + * Destination Options header
> > > > > + * upper-layer header
> > > > > + */
> > > > > +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
> > > > > + u16 *ext_hdrs)
> > > > > +{
> > > > > + u8 next_type = nh->nexthdr;
> > > > > + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
> > > > > + int dest_options_header_count = 0;
> > > > > +
> > > > > + *ext_hdrs = 0;
> > > > > +
> > > > > + while (ipv6_ext_hdr(next_type)) {
> > > > > + struct ipv6_opt_hdr _hdr, *hp;
> > > > > +
> > > > > + switch (next_type) {
> > > > > + case IPPROTO_NONE:
> > > > > + *ext_hdrs |= OFPIEH12_NONEXT;
> > > > > + /* stop parsing */
> > > > > + return;
> > > > > +
> > > > > + case IPPROTO_ESP:
> > > > > + if (*ext_hdrs & OFPIEH12_ESP)
> > > > > + *ext_hdrs |= OFPIEH12_UNREP;
> > > > > + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
> > > > > + OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
> > > > > + OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
> > > > > + dest_options_header_count >= 2) {
> > > > > + *ext_hdrs |= OFPIEH12_UNSEQ;
> > > > > + }
> > > > > + *ext_hdrs |= OFPIEH12_ESP;
> > > > > + break;
> > > > you need to check_header() before looking into each extension header.
> > >
> > > Could you elaborate why I need to add check_header(),
> > > skb_header_pointer() is doing sanitization.
> >
> > I mean check_header() would allow you to read the header without
> > copying the bits, it is used in ovs flow extraction so its usual
> > check.
>
> But check_header() will call *__pskb_pull_tail which in turn will copy
> bits if data will be fragmented.
>
OVS flow extract uses this function to extract flow upto L4, so
skb_header_pointer() is not saving any copy operation.
> /* Moves tail of skb head forward, copying data from fragmented part,
> * when it is necessary.
> * 1. It may fail due to malloc failure.
> * 2. It may change skb pointers.
> *
> * It is pretty complicated. Luckily, it is called only in exceptional cases.
> */
> void *__pskb_pull_tail(struct sk_buff *skb, int delta)
>
> as well I noticed that for example commit
> 4a06fa67c4da20148803525151845276cdb995c1 is moving from
> pskb_may_pull() to skb_header_pointer()
ok, I see advantage of using skb_header_pointer() in this case, but
replacing all check_header() with skb_header_pointer() would add lot
of copy operation in flow extract. Anyways for this use case
skb_header_pointer() is fine.
Acked-by: Pravin B Shelar <pshelar@ovn.org>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v8] net: openvswitch: IPv6: Add IPv6 extension header support
2021-12-03 5:28 ` Pravin Shelar
@ 2021-12-06 23:00 ` Cpp Code
2021-12-10 7:36 ` Pravin Shelar
0 siblings, 1 reply; 12+ messages in thread
From: Cpp Code @ 2021-12-06 23:00 UTC (permalink / raw)
To: Pravin Shelar
Cc: Linux Kernel Network Developers, David S. Miller, Jakub Kicinski,
ovs dev, LKML
On Thu, Dec 2, 2021 at 9:28 PM Pravin Shelar <pravin.ovn@gmail.com> wrote:
>
> On Thu, Dec 2, 2021 at 12:20 PM Cpp Code <cpp.code.lv@gmail.com> wrote:
> >
> > On Wed, Dec 1, 2021 at 11:34 PM Pravin Shelar <pravin.ovn@gmail.com> wrote:
> > >
> > > On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <cpp.code.lv@gmail.com> wrote:
> > > >
> > > > This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
> > > > packets can be filtered using ipv6_ext flag.
> > > >
> > > > Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com>
> > > > ---
> > > > include/uapi/linux/openvswitch.h | 6 ++
> > > > net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
> > > > net/openvswitch/flow.h | 14 ++++
> > > > net/openvswitch/flow_netlink.c | 26 +++++-
> > > > 4 files changed, 184 insertions(+), 2 deletions(-)
> > > >
> > > > diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
> > > > index a87b44cd5590..43790f07e4a2 100644
> > > > --- a/include/uapi/linux/openvswitch.h
> > > > +++ b/include/uapi/linux/openvswitch.h
> > > > @@ -342,6 +342,7 @@ enum ovs_key_attr {
> > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
> > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
> > > > OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
> > > > + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */
> > > >
> > > > #ifdef __KERNEL__
> > > > OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
> > > > @@ -421,6 +422,11 @@ struct ovs_key_ipv6 {
> > > > __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */
> > > > };
> > > >
> > > > +/* separate structure to support backward compatibility with older user space */
> > > > +struct ovs_key_ipv6_exthdrs {
> > > > + __u16 hdrs;
> > > > +};
> > > > +
> > > > struct ovs_key_tcp {
> > > > __be16 tcp_src;
> > > > __be16 tcp_dst;
> > > > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
> > > > index 9d375e74b607..28acb40437ca 100644
> > > > --- a/net/openvswitch/flow.c
> > > > +++ b/net/openvswitch/flow.c
> > > > @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb)
> > > > sizeof(struct icmphdr));
> > > > }
> > > >
> > > > +/**
> > > > + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
> > > > + *
> > > > + * @skb: buffer where extension header data starts in packet
> > > > + * @nh: ipv6 header
> > > > + * @ext_hdrs: flags are stored here
> > > > + *
> > > > + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
> > > > + * is unexpectedly encountered. (Two destination options headers may be
> > > > + * expected and would not cause this bit to be set.)
> > > > + *
> > > > + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
> > > > + * preferred (but not required) by RFC 2460:
> > > > + *
> > > > + * When more than one extension header is used in the same packet, it is
> > > > + * recommended that those headers appear in the following order:
> > > > + * IPv6 header
> > > > + * Hop-by-Hop Options header
> > > > + * Destination Options header
> > > > + * Routing header
> > > > + * Fragment header
> > > > + * Authentication header
> > > > + * Encapsulating Security Payload header
> > > > + * Destination Options header
> > > > + * upper-layer header
> > > > + */
> > > > +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
> > > > + u16 *ext_hdrs)
> > > > +{
> > > > + u8 next_type = nh->nexthdr;
> > > > + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
> > > > + int dest_options_header_count = 0;
> > > > +
> > > > + *ext_hdrs = 0;
> > > > +
> > > > + while (ipv6_ext_hdr(next_type)) {
> > > > + struct ipv6_opt_hdr _hdr, *hp;
> > > > +
> > > > + switch (next_type) {
> > > > + case IPPROTO_NONE:
> > > > + *ext_hdrs |= OFPIEH12_NONEXT;
> > > > + /* stop parsing */
> > > > + return;
> > > > +
> > > > + case IPPROTO_ESP:
> > > > + if (*ext_hdrs & OFPIEH12_ESP)
> > > > + *ext_hdrs |= OFPIEH12_UNREP;
> > > > + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
> > > > + OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
> > > > + OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
> > > > + dest_options_header_count >= 2) {
> > > > + *ext_hdrs |= OFPIEH12_UNSEQ;
> > > > + }
> > > > + *ext_hdrs |= OFPIEH12_ESP;
> > > > + break;
> > > you need to check_header() before looking into each extension header.
> >
> > Could you elaborate why I need to add check_header(),
> > skb_header_pointer() is doing sanitization.
>
> I mean check_header() would allow you to read the header without
> copying the bits, it is used in ovs flow extraction so its usual
> check.
But check_header() will call *__pskb_pull_tail which in turn will copy
bits if data will be fragmented.
/* Moves tail of skb head forward, copying data from fragmented part,
* when it is necessary.
* 1. It may fail due to malloc failure.
* 2. It may change skb pointers.
*
* It is pretty complicated. Luckily, it is called only in exceptional cases.
*/
void *__pskb_pull_tail(struct sk_buff *skb, int delta)
as well I noticed that for example commit
4a06fa67c4da20148803525151845276cdb995c1 is moving from
pskb_may_pull() to skb_header_pointer()
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v8] net: openvswitch: IPv6: Add IPv6 extension header support
2021-12-02 20:20 ` Cpp Code
@ 2021-12-03 5:28 ` Pravin Shelar
2021-12-06 23:00 ` Cpp Code
0 siblings, 1 reply; 12+ messages in thread
From: Pravin Shelar @ 2021-12-03 5:28 UTC (permalink / raw)
To: Cpp Code
Cc: Linux Kernel Network Developers, David S. Miller, Jakub Kicinski,
ovs dev, LKML
On Thu, Dec 2, 2021 at 12:20 PM Cpp Code <cpp.code.lv@gmail.com> wrote:
>
> On Wed, Dec 1, 2021 at 11:34 PM Pravin Shelar <pravin.ovn@gmail.com> wrote:
> >
> > On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <cpp.code.lv@gmail.com> wrote:
> > >
> > > This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
> > > packets can be filtered using ipv6_ext flag.
> > >
> > > Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com>
> > > ---
> > > include/uapi/linux/openvswitch.h | 6 ++
> > > net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
> > > net/openvswitch/flow.h | 14 ++++
> > > net/openvswitch/flow_netlink.c | 26 +++++-
> > > 4 files changed, 184 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
> > > index a87b44cd5590..43790f07e4a2 100644
> > > --- a/include/uapi/linux/openvswitch.h
> > > +++ b/include/uapi/linux/openvswitch.h
> > > @@ -342,6 +342,7 @@ enum ovs_key_attr {
> > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
> > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
> > > OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
> > > + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */
> > >
> > > #ifdef __KERNEL__
> > > OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
> > > @@ -421,6 +422,11 @@ struct ovs_key_ipv6 {
> > > __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */
> > > };
> > >
> > > +/* separate structure to support backward compatibility with older user space */
> > > +struct ovs_key_ipv6_exthdrs {
> > > + __u16 hdrs;
> > > +};
> > > +
> > > struct ovs_key_tcp {
> > > __be16 tcp_src;
> > > __be16 tcp_dst;
> > > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
> > > index 9d375e74b607..28acb40437ca 100644
> > > --- a/net/openvswitch/flow.c
> > > +++ b/net/openvswitch/flow.c
> > > @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb)
> > > sizeof(struct icmphdr));
> > > }
> > >
> > > +/**
> > > + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
> > > + *
> > > + * @skb: buffer where extension header data starts in packet
> > > + * @nh: ipv6 header
> > > + * @ext_hdrs: flags are stored here
> > > + *
> > > + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
> > > + * is unexpectedly encountered. (Two destination options headers may be
> > > + * expected and would not cause this bit to be set.)
> > > + *
> > > + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
> > > + * preferred (but not required) by RFC 2460:
> > > + *
> > > + * When more than one extension header is used in the same packet, it is
> > > + * recommended that those headers appear in the following order:
> > > + * IPv6 header
> > > + * Hop-by-Hop Options header
> > > + * Destination Options header
> > > + * Routing header
> > > + * Fragment header
> > > + * Authentication header
> > > + * Encapsulating Security Payload header
> > > + * Destination Options header
> > > + * upper-layer header
> > > + */
> > > +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
> > > + u16 *ext_hdrs)
> > > +{
> > > + u8 next_type = nh->nexthdr;
> > > + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
> > > + int dest_options_header_count = 0;
> > > +
> > > + *ext_hdrs = 0;
> > > +
> > > + while (ipv6_ext_hdr(next_type)) {
> > > + struct ipv6_opt_hdr _hdr, *hp;
> > > +
> > > + switch (next_type) {
> > > + case IPPROTO_NONE:
> > > + *ext_hdrs |= OFPIEH12_NONEXT;
> > > + /* stop parsing */
> > > + return;
> > > +
> > > + case IPPROTO_ESP:
> > > + if (*ext_hdrs & OFPIEH12_ESP)
> > > + *ext_hdrs |= OFPIEH12_UNREP;
> > > + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
> > > + OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
> > > + OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
> > > + dest_options_header_count >= 2) {
> > > + *ext_hdrs |= OFPIEH12_UNSEQ;
> > > + }
> > > + *ext_hdrs |= OFPIEH12_ESP;
> > > + break;
> > you need to check_header() before looking into each extension header.
>
> Could you elaborate why I need to add check_header(),
> skb_header_pointer() is doing sanitization.
I mean check_header() would allow you to read the header without
copying the bits, it is used in ovs flow extraction so its usual
check.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v8] net: openvswitch: IPv6: Add IPv6 extension header support
2021-12-02 7:33 ` Pravin Shelar
@ 2021-12-02 20:20 ` Cpp Code
2021-12-03 5:28 ` Pravin Shelar
0 siblings, 1 reply; 12+ messages in thread
From: Cpp Code @ 2021-12-02 20:20 UTC (permalink / raw)
To: Pravin Shelar
Cc: Linux Kernel Network Developers, David S. Miller, Jakub Kicinski,
ovs dev, LKML
On Wed, Dec 1, 2021 at 11:34 PM Pravin Shelar <pravin.ovn@gmail.com> wrote:
>
> On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <cpp.code.lv@gmail.com> wrote:
> >
> > This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
> > packets can be filtered using ipv6_ext flag.
> >
> > Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com>
> > ---
> > include/uapi/linux/openvswitch.h | 6 ++
> > net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
> > net/openvswitch/flow.h | 14 ++++
> > net/openvswitch/flow_netlink.c | 26 +++++-
> > 4 files changed, 184 insertions(+), 2 deletions(-)
> >
> > diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
> > index a87b44cd5590..43790f07e4a2 100644
> > --- a/include/uapi/linux/openvswitch.h
> > +++ b/include/uapi/linux/openvswitch.h
> > @@ -342,6 +342,7 @@ enum ovs_key_attr {
> > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
> > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
> > OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
> > + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */
> >
> > #ifdef __KERNEL__
> > OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
> > @@ -421,6 +422,11 @@ struct ovs_key_ipv6 {
> > __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */
> > };
> >
> > +/* separate structure to support backward compatibility with older user space */
> > +struct ovs_key_ipv6_exthdrs {
> > + __u16 hdrs;
> > +};
> > +
> > struct ovs_key_tcp {
> > __be16 tcp_src;
> > __be16 tcp_dst;
> > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
> > index 9d375e74b607..28acb40437ca 100644
> > --- a/net/openvswitch/flow.c
> > +++ b/net/openvswitch/flow.c
> > @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb)
> > sizeof(struct icmphdr));
> > }
> >
> > +/**
> > + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
> > + *
> > + * @skb: buffer where extension header data starts in packet
> > + * @nh: ipv6 header
> > + * @ext_hdrs: flags are stored here
> > + *
> > + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
> > + * is unexpectedly encountered. (Two destination options headers may be
> > + * expected and would not cause this bit to be set.)
> > + *
> > + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
> > + * preferred (but not required) by RFC 2460:
> > + *
> > + * When more than one extension header is used in the same packet, it is
> > + * recommended that those headers appear in the following order:
> > + * IPv6 header
> > + * Hop-by-Hop Options header
> > + * Destination Options header
> > + * Routing header
> > + * Fragment header
> > + * Authentication header
> > + * Encapsulating Security Payload header
> > + * Destination Options header
> > + * upper-layer header
> > + */
> > +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
> > + u16 *ext_hdrs)
> > +{
> > + u8 next_type = nh->nexthdr;
> > + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
> > + int dest_options_header_count = 0;
> > +
> > + *ext_hdrs = 0;
> > +
> > + while (ipv6_ext_hdr(next_type)) {
> > + struct ipv6_opt_hdr _hdr, *hp;
> > +
> > + switch (next_type) {
> > + case IPPROTO_NONE:
> > + *ext_hdrs |= OFPIEH12_NONEXT;
> > + /* stop parsing */
> > + return;
> > +
> > + case IPPROTO_ESP:
> > + if (*ext_hdrs & OFPIEH12_ESP)
> > + *ext_hdrs |= OFPIEH12_UNREP;
> > + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
> > + OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
> > + OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
> > + dest_options_header_count >= 2) {
> > + *ext_hdrs |= OFPIEH12_UNSEQ;
> > + }
> > + *ext_hdrs |= OFPIEH12_ESP;
> > + break;
> you need to check_header() before looking into each extension header.
Could you elaborate why I need to add check_header(),
skb_header_pointer() is doing sanitization.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v8] net: openvswitch: IPv6: Add IPv6 extension header support
2021-11-24 19:33 Toms Atteka
@ 2021-12-02 7:33 ` Pravin Shelar
2021-12-02 20:20 ` Cpp Code
0 siblings, 1 reply; 12+ messages in thread
From: Pravin Shelar @ 2021-12-02 7:33 UTC (permalink / raw)
To: Toms Atteka
Cc: Linux Kernel Network Developers, David S. Miller, Jakub Kicinski,
ovs dev, LKML
On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <cpp.code.lv@gmail.com> wrote:
>
> This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
> packets can be filtered using ipv6_ext flag.
>
> Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com>
> ---
> include/uapi/linux/openvswitch.h | 6 ++
> net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
> net/openvswitch/flow.h | 14 ++++
> net/openvswitch/flow_netlink.c | 26 +++++-
> 4 files changed, 184 insertions(+), 2 deletions(-)
>
> diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
> index a87b44cd5590..43790f07e4a2 100644
> --- a/include/uapi/linux/openvswitch.h
> +++ b/include/uapi/linux/openvswitch.h
> @@ -342,6 +342,7 @@ enum ovs_key_attr {
> OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
> OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
> OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
> + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */
>
> #ifdef __KERNEL__
> OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
> @@ -421,6 +422,11 @@ struct ovs_key_ipv6 {
> __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */
> };
>
> +/* separate structure to support backward compatibility with older user space */
> +struct ovs_key_ipv6_exthdrs {
> + __u16 hdrs;
> +};
> +
> struct ovs_key_tcp {
> __be16 tcp_src;
> __be16 tcp_dst;
> diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
> index 9d375e74b607..28acb40437ca 100644
> --- a/net/openvswitch/flow.c
> +++ b/net/openvswitch/flow.c
> @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb)
> sizeof(struct icmphdr));
> }
>
> +/**
> + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
> + *
> + * @skb: buffer where extension header data starts in packet
> + * @nh: ipv6 header
> + * @ext_hdrs: flags are stored here
> + *
> + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
> + * is unexpectedly encountered. (Two destination options headers may be
> + * expected and would not cause this bit to be set.)
> + *
> + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
> + * preferred (but not required) by RFC 2460:
> + *
> + * When more than one extension header is used in the same packet, it is
> + * recommended that those headers appear in the following order:
> + * IPv6 header
> + * Hop-by-Hop Options header
> + * Destination Options header
> + * Routing header
> + * Fragment header
> + * Authentication header
> + * Encapsulating Security Payload header
> + * Destination Options header
> + * upper-layer header
> + */
> +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
> + u16 *ext_hdrs)
> +{
> + u8 next_type = nh->nexthdr;
> + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
> + int dest_options_header_count = 0;
> +
> + *ext_hdrs = 0;
> +
> + while (ipv6_ext_hdr(next_type)) {
> + struct ipv6_opt_hdr _hdr, *hp;
> +
> + switch (next_type) {
> + case IPPROTO_NONE:
> + *ext_hdrs |= OFPIEH12_NONEXT;
> + /* stop parsing */
> + return;
> +
> + case IPPROTO_ESP:
> + if (*ext_hdrs & OFPIEH12_ESP)
> + *ext_hdrs |= OFPIEH12_UNREP;
> + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
> + OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
> + OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
> + dest_options_header_count >= 2) {
> + *ext_hdrs |= OFPIEH12_UNSEQ;
> + }
> + *ext_hdrs |= OFPIEH12_ESP;
> + break;
you need to check_header() before looking into each extension header.
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH net-next v8] net: openvswitch: IPv6: Add IPv6 extension header support
@ 2021-11-24 19:33 Toms Atteka
2021-12-02 7:33 ` Pravin Shelar
0 siblings, 1 reply; 12+ messages in thread
From: Toms Atteka @ 2021-11-24 19:33 UTC (permalink / raw)
To: netdev, pshelar, davem, kuba, dev, linux-kernel; +Cc: Toms Atteka
This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
packets can be filtered using ipv6_ext flag.
Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com>
---
include/uapi/linux/openvswitch.h | 6 ++
net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
net/openvswitch/flow.h | 14 ++++
net/openvswitch/flow_netlink.c | 26 +++++-
4 files changed, 184 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index a87b44cd5590..43790f07e4a2 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -342,6 +342,7 @@ enum ovs_key_attr {
OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
+ OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */
#ifdef __KERNEL__
OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
@@ -421,6 +422,11 @@ struct ovs_key_ipv6 {
__u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */
};
+/* separate structure to support backward compatibility with older user space */
+struct ovs_key_ipv6_exthdrs {
+ __u16 hdrs;
+};
+
struct ovs_key_tcp {
__be16 tcp_src;
__be16 tcp_dst;
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 9d375e74b607..28acb40437ca 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb)
sizeof(struct icmphdr));
}
+/**
+ * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
+ *
+ * @skb: buffer where extension header data starts in packet
+ * @nh: ipv6 header
+ * @ext_hdrs: flags are stored here
+ *
+ * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
+ * is unexpectedly encountered. (Two destination options headers may be
+ * expected and would not cause this bit to be set.)
+ *
+ * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
+ * preferred (but not required) by RFC 2460:
+ *
+ * When more than one extension header is used in the same packet, it is
+ * recommended that those headers appear in the following order:
+ * IPv6 header
+ * Hop-by-Hop Options header
+ * Destination Options header
+ * Routing header
+ * Fragment header
+ * Authentication header
+ * Encapsulating Security Payload header
+ * Destination Options header
+ * upper-layer header
+ */
+static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
+ u16 *ext_hdrs)
+{
+ u8 next_type = nh->nexthdr;
+ unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
+ int dest_options_header_count = 0;
+
+ *ext_hdrs = 0;
+
+ while (ipv6_ext_hdr(next_type)) {
+ struct ipv6_opt_hdr _hdr, *hp;
+
+ switch (next_type) {
+ case IPPROTO_NONE:
+ *ext_hdrs |= OFPIEH12_NONEXT;
+ /* stop parsing */
+ return;
+
+ case IPPROTO_ESP:
+ if (*ext_hdrs & OFPIEH12_ESP)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
+ OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
+ OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_ESP;
+ break;
+
+ case IPPROTO_AH:
+ if (*ext_hdrs & OFPIEH12_AUTH)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs &
+ ~(OFPIEH12_HOP | OFPIEH12_DEST | OFPIEH12_ROUTER |
+ IPPROTO_FRAGMENT | OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_AUTH;
+ break;
+
+ case IPPROTO_DSTOPTS:
+ if (dest_options_header_count == 0) {
+ if (*ext_hdrs &
+ ~(OFPIEH12_HOP | OFPIEH12_UNREP))
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ *ext_hdrs |= OFPIEH12_DEST;
+ } else if (dest_options_header_count == 1) {
+ if (*ext_hdrs &
+ ~(OFPIEH12_HOP | OFPIEH12_DEST |
+ OFPIEH12_ROUTER | OFPIEH12_FRAG |
+ OFPIEH12_AUTH | OFPIEH12_ESP |
+ OFPIEH12_UNREP)) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ } else {
+ *ext_hdrs |= OFPIEH12_UNREP;
+ }
+ dest_options_header_count++;
+ break;
+
+ case IPPROTO_FRAGMENT:
+ if (*ext_hdrs & OFPIEH12_FRAG)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs & ~(OFPIEH12_HOP |
+ OFPIEH12_DEST |
+ OFPIEH12_ROUTER |
+ OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_FRAG;
+ break;
+
+ case IPPROTO_ROUTING:
+ if (*ext_hdrs & OFPIEH12_ROUTER)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs & ~(OFPIEH12_HOP |
+ OFPIEH12_DEST |
+ OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_ROUTER;
+ break;
+
+ case IPPROTO_HOPOPTS:
+ if (*ext_hdrs & OFPIEH12_HOP)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ /* OFPIEH12_HOP is set to 1 if a hop-by-hop IPv6
+ * extension header is present as the first
+ * extension header in the packet.
+ */
+ if (*ext_hdrs == 0)
+ *ext_hdrs |= OFPIEH12_HOP;
+ else
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ break;
+
+ default:
+ return;
+ }
+
+ hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
+ if (!hp)
+ break;
+ next_type = hp->nexthdr;
+ start += ipv6_optlen(hp);
+ };
+}
+
static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key)
{
unsigned short frag_off;
@@ -254,6 +392,8 @@ static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key)
nh = ipv6_hdr(skb);
+ get_ipv6_ext_hdrs(skb, nh, &key->ipv6.exthdrs);
+
key->ip.proto = NEXTHDR_NONE;
key->ip.tos = ipv6_get_dsfield(nh);
key->ip.ttl = nh->hop_limit;
diff --git a/net/openvswitch/flow.h b/net/openvswitch/flow.h
index 758a8c77f736..073ab73ffeaa 100644
--- a/net/openvswitch/flow.h
+++ b/net/openvswitch/flow.h
@@ -32,6 +32,19 @@ enum sw_flow_mac_proto {
#define SW_FLOW_KEY_INVALID 0x80
#define MPLS_LABEL_DEPTH 3
+/* Bit definitions for IPv6 Extension Header pseudo-field. */
+enum ofp12_ipv6exthdr_flags {
+ OFPIEH12_NONEXT = 1 << 0, /* "No next header" encountered. */
+ OFPIEH12_ESP = 1 << 1, /* Encrypted Sec Payload header present. */
+ OFPIEH12_AUTH = 1 << 2, /* Authentication header present. */
+ OFPIEH12_DEST = 1 << 3, /* 1 or 2 dest headers present. */
+ OFPIEH12_FRAG = 1 << 4, /* Fragment header present. */
+ OFPIEH12_ROUTER = 1 << 5, /* Router header present. */
+ OFPIEH12_HOP = 1 << 6, /* Hop-by-hop header present. */
+ OFPIEH12_UNREP = 1 << 7, /* Unexpected repeats encountered. */
+ OFPIEH12_UNSEQ = 1 << 8 /* Unexpected sequencing encountered. */
+};
+
/* Store options at the end of the array if they are less than the
* maximum size. This allows us to get the benefits of variable length
* matching for small options.
@@ -121,6 +134,7 @@ struct sw_flow_key {
struct in6_addr dst; /* IPv6 destination address. */
} addr;
__be32 label; /* IPv6 flow label. */
+ u16 exthdrs; /* IPv6 extension header flags */
union {
struct {
struct in6_addr src;
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 65c2e3458ff5..0aeaf28594ce 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -344,7 +344,7 @@ size_t ovs_key_attr_size(void)
/* Whenever adding new OVS_KEY_ FIELDS, we should consider
* updating this function.
*/
- BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 29);
+ BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 30);
return nla_total_size(4) /* OVS_KEY_ATTR_PRIORITY */
+ nla_total_size(0) /* OVS_KEY_ATTR_TUNNEL */
@@ -367,7 +367,8 @@ size_t ovs_key_attr_size(void)
+ nla_total_size(2) /* OVS_KEY_ATTR_ETHERTYPE */
+ nla_total_size(40) /* OVS_KEY_ATTR_IPV6 */
+ nla_total_size(2) /* OVS_KEY_ATTR_ICMPV6 */
- + nla_total_size(28); /* OVS_KEY_ATTR_ND */
+ + nla_total_size(28) /* OVS_KEY_ATTR_ND */
+ + nla_total_size(2); /* OVS_KEY_ATTR_IPV6_EXTHDRS */
}
static const struct ovs_len_tbl ovs_vxlan_ext_key_lens[OVS_VXLAN_EXT_MAX + 1] = {
@@ -435,6 +436,8 @@ static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = {
.len = sizeof(struct ovs_key_ct_tuple_ipv6) },
[OVS_KEY_ATTR_NSH] = { .len = OVS_ATTR_NESTED,
.next = ovs_nsh_key_attr_lens, },
+ [OVS_KEY_ATTR_IPV6_EXTHDRS] = {
+ .len = sizeof(struct ovs_key_ipv6_exthdrs) },
};
static bool check_attr_len(unsigned int attr_len, unsigned int expected_len)
@@ -1595,6 +1598,17 @@ static int ovs_key_from_nlattrs(struct net *net, struct sw_flow_match *match,
attrs &= ~(1 << OVS_KEY_ATTR_IPV6);
}
+ if (attrs & (1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS)) {
+ const struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key;
+
+ ipv6_exthdrs_key = nla_data(a[OVS_KEY_ATTR_IPV6_EXTHDRS]);
+
+ SW_FLOW_KEY_PUT(match, ipv6.exthdrs,
+ ipv6_exthdrs_key->hdrs, is_mask);
+
+ attrs &= ~(1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS);
+ }
+
if (attrs & (1 << OVS_KEY_ATTR_ARP)) {
const struct ovs_key_arp *arp_key;
@@ -2097,6 +2111,7 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
ipv4_key->ipv4_frag = output->ip.frag;
} else if (swkey->eth.type == htons(ETH_P_IPV6)) {
struct ovs_key_ipv6 *ipv6_key;
+ struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key;
nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6, sizeof(*ipv6_key));
if (!nla)
@@ -2111,6 +2126,13 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
ipv6_key->ipv6_tclass = output->ip.tos;
ipv6_key->ipv6_hlimit = output->ip.ttl;
ipv6_key->ipv6_frag = output->ip.frag;
+
+ nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6_EXTHDRS,
+ sizeof(*ipv6_exthdrs_key));
+ if (!nla)
+ goto nla_put_failure;
+ ipv6_exthdrs_key = nla_data(nla);
+ ipv6_exthdrs_key->hdrs = output->ipv6.exthdrs;
} else if (swkey->eth.type == htons(ETH_P_NSH)) {
if (nsh_key_to_nlattr(&output->nsh, is_mask, skb))
goto nla_put_failure;
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
end of thread, other threads:[~2022-02-25 10:40 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-29 18:20 [PATCH net-next v8] net: openvswitch: IPv6: Add IPv6 extension header support Toms Atteka
2021-11-02 18:39 ` Jakub Kicinski
2021-11-24 19:33 Toms Atteka
2021-12-02 7:33 ` Pravin Shelar
2021-12-02 20:20 ` Cpp Code
2021-12-03 5:28 ` Pravin Shelar
2021-12-06 23:00 ` Cpp Code
2021-12-10 7:36 ` Pravin Shelar
2022-02-09 20:46 ` Cpp Code
2022-02-10 0:58 ` Jakub Kicinski
2022-02-24 0:54 Toms Atteka
2022-02-25 10:40 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).