From: Boris Sukholitko <boris.sukholitko@broadcom.com>
To: netdev@vger.kernel.org, Jamal Hadi Salim <jhs@mojatatu.com>,
Jiri Pirko <jiri@resnulli.us>,
Cong Wang <xiyou.wangcong@gmail.com>
Cc: "David S . Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>,
Vladimir Oltean <olteanv@gmail.com>,
Vadym Kochan <vadym.kochan@plvision.eu>,
Ilya Lifshits <ilya.lifshits@broadcom.com>,
Boris Sukholitko <boris.sukholitko@broadcom.com>
Subject: [PATCH net-next] net/sched: cls_flower: Add orig_ethtype
Date: Mon, 30 Aug 2021 11:08:00 +0300 [thread overview]
Message-ID: <20210830080800.18591-1-boris.sukholitko@broadcom.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 5885 bytes --]
The following flower filter fails to match packets:
tc filter add dev eth0 ingress protocol 0x8864 flower \
action simple sdata hi64
The protocol 0x8864 (ETH_P_PPP_SES) is a tunnel protocol. As such, it is
being dissected by __skb_flow_dissect and it's internal protocol is
being set as key->basic.n_proto. IOW, the existence of ETH_P_PPP_SES
tunnel is transparent to the callers of __skb_flow_dissect.
OTOH, in the filters above, cls_flower configures its key->basic.n_proto
to the ETH_P_PPP_SES value configured by the user. Matching on this key
fails because of __skb_flow_dissect "transparency" mentioned above.
Therefore there is no way currently to match on such packets using
flower.
To fix the issue add new orig_ethtype key to the flower along with the
necessary changes to the flow dissector etc.
To filter the ETH_P_PPP_SES packets the command becomes:
tc filter add dev eth0 ingress flower orig_ethtype 0x8864 \
action simple sdata hi64
Corresponding iproute2 patch follows.
Signed-off-by: Boris Sukholitko <boris.sukholitko@broadcom.com>
---
include/net/flow_dissector.h | 9 +++++++++
include/uapi/linux/pkt_cls.h | 1 +
net/core/flow_dissector.c | 12 ++++++++++++
net/sched/cls_flower.c | 15 +++++++++++++++
4 files changed, 37 insertions(+)
diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h
index ffd386ea0dbb..083245a2d408 100644
--- a/include/net/flow_dissector.h
+++ b/include/net/flow_dissector.h
@@ -251,6 +251,14 @@ struct flow_dissector_key_hash {
u32 hash;
};
+/**
+ * struct flow_dissector_key_orig_ethtype:
+ * @orig_ethtype: eth type as it appears in the packet
+ */
+struct flow_dissector_key_orig_ethtype {
+ __be16 orig_ethtype;
+};
+
enum flow_dissector_key_id {
FLOW_DISSECTOR_KEY_CONTROL, /* struct flow_dissector_key_control */
FLOW_DISSECTOR_KEY_BASIC, /* struct flow_dissector_key_basic */
@@ -280,6 +288,7 @@ enum flow_dissector_key_id {
FLOW_DISSECTOR_KEY_META, /* struct flow_dissector_key_meta */
FLOW_DISSECTOR_KEY_CT, /* struct flow_dissector_key_ct */
FLOW_DISSECTOR_KEY_HASH, /* struct flow_dissector_key_hash */
+ FLOW_DISSECTOR_KEY_ORIG_ETH_TYPE, /* struct flow_dissector_key_orig_ethtype */
FLOW_DISSECTOR_KEY_MAX,
};
diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index 025c40fef93d..238dee49f450 100644
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h
@@ -583,6 +583,7 @@ enum {
TCA_FLOWER_KEY_HASH, /* u32 */
TCA_FLOWER_KEY_HASH_MASK, /* u32 */
+ TCA_FLOWER_KEY_ORIG_ETH_TYPE, /* be16 */
__TCA_FLOWER_MAX,
};
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 4b2415d34873..23051e0d02fd 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -924,6 +924,7 @@ bool __skb_flow_dissect(const struct net *net,
struct flow_dissector_key_vlan *key_vlan;
enum flow_dissect_ret fdret;
enum flow_dissector_key_id dissector_vlan = FLOW_DISSECTOR_KEY_MAX;
+ __be16 orig_proto = proto;
bool mpls_el = false;
int mpls_lse = 0;
int num_hdrs = 0;
@@ -934,6 +935,7 @@ bool __skb_flow_dissect(const struct net *net,
data = skb->data;
proto = skb_vlan_tag_present(skb) ?
skb->vlan_proto : skb->protocol;
+ orig_proto = proto;
nhoff = skb_network_offset(skb);
hlen = skb_headlen(skb);
#if IS_ENABLED(CONFIG_NET_DSA)
@@ -1032,6 +1034,16 @@ bool __skb_flow_dissect(const struct net *net,
memcpy(key_eth_addrs, ð->h_dest, sizeof(*key_eth_addrs));
}
+ if (dissector_uses_key(flow_dissector,
+ FLOW_DISSECTOR_KEY_ORIG_ETH_TYPE)) {
+ struct flow_dissector_key_orig_ethtype *orig_ethtype;
+
+ orig_ethtype = skb_flow_dissector_target(flow_dissector,
+ FLOW_DISSECTOR_KEY_ORIG_ETH_TYPE,
+ target_container);
+ orig_ethtype->orig_ethtype = orig_proto;
+ }
+
proto_again:
fdret = FLOW_DISSECT_RET_CONTINUE;
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index d7869a984881..bf6e88819f7d 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -70,6 +70,7 @@ struct fl_flow_key {
} tp_range;
struct flow_dissector_key_ct ct;
struct flow_dissector_key_hash hash;
+ struct flow_dissector_key_orig_ethtype orig_ethtype;
} __aligned(BITS_PER_LONG / 8); /* Ensure that we can do comparisons as longs. */
struct fl_flow_mask_range {
@@ -710,6 +711,7 @@ static const struct nla_policy fl_policy[TCA_FLOWER_MAX + 1] = {
[TCA_FLOWER_FLAGS] = { .type = NLA_U32 },
[TCA_FLOWER_KEY_HASH] = { .type = NLA_U32 },
[TCA_FLOWER_KEY_HASH_MASK] = { .type = NLA_U32 },
+ [TCA_FLOWER_KEY_ORIG_ETH_TYPE] = { .type = NLA_U16 },
};
@@ -1696,6 +1698,11 @@ static int fl_set_key(struct net *net, struct nlattr **tb,
&mask->hash.hash, TCA_FLOWER_KEY_HASH_MASK,
sizeof(key->hash.hash));
+ fl_set_key_val(tb, &key->orig_ethtype.orig_ethtype,
+ TCA_FLOWER_KEY_ORIG_ETH_TYPE,
+ &mask->orig_ethtype.orig_ethtype, TCA_FLOWER_UNSPEC,
+ sizeof(key->orig_ethtype.orig_ethtype));
+
if (tb[TCA_FLOWER_KEY_ENC_OPTS]) {
ret = fl_set_enc_opt(tb, key, mask, extack);
if (ret)
@@ -1812,6 +1819,8 @@ static void fl_init_dissector(struct flow_dissector *dissector,
FLOW_DISSECTOR_KEY_CT, ct);
FL_KEY_SET_IF_MASKED(mask, keys, cnt,
FLOW_DISSECTOR_KEY_HASH, hash);
+ FL_KEY_SET_IF_MASKED(mask, keys, cnt,
+ FLOW_DISSECTOR_KEY_ORIG_ETH_TYPE, orig_ethtype);
skb_flow_dissector_init(dissector, keys, cnt);
}
@@ -3037,6 +3046,12 @@ static int fl_dump_key(struct sk_buff *skb, struct net *net,
sizeof(key->hash.hash)))
goto nla_put_failure;
+ if (fl_dump_key_val(skb, &key->orig_ethtype.orig_ethtype,
+ TCA_FLOWER_KEY_ORIG_ETH_TYPE,
+ &mask->orig_ethtype.orig_ethtype, TCA_FLOWER_UNSPEC,
+ sizeof(key->orig_ethtype.orig_ethtype)))
+ goto nla_put_failure;
+
return 0;
nla_put_failure:
--
2.29.2
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4221 bytes --]
next reply other threads:[~2021-08-30 8:08 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-30 8:08 Boris Sukholitko [this message]
2021-08-30 9:00 ` [PATCH net-next] net/sched: cls_flower: Add orig_ethtype Vladimir Oltean
2021-08-30 9:04 ` Vladimir Oltean
2021-08-30 9:18 ` Boris Sukholitko
2021-08-30 9:21 ` Vladimir Oltean
2021-08-30 9:42 ` Boris Sukholitko
2021-08-30 10:13 ` Vladimir Oltean
2021-08-31 1:48 ` Jamal Hadi Salim
2021-08-31 12:04 ` Boris Sukholitko
2021-08-31 13:18 ` Jamal Hadi Salim
2021-08-31 14:03 ` Boris Sukholitko
2021-09-02 6:48 ` Ido Schimmel
2021-09-03 22:52 ` Jamal Hadi Salim
2021-09-04 14:08 ` Tom Herbert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210830080800.18591-1-boris.sukholitko@broadcom.com \
--to=boris.sukholitko@broadcom.com \
--cc=davem@davemloft.net \
--cc=ilya.lifshits@broadcom.com \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=olteanv@gmail.com \
--cc=vadym.kochan@plvision.eu \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).