netdev - Re: [iproute2-next PATCH v6] tc: flower: Classify packets based port ranges

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7b95d121-256f-728f-4efd-a3216e7919b5@gmail.com>
Date:   Mon, 3 Dec 2018 16:52:18 -0700
From:   David Ahern <dsahern@...il.com>
To:     Amritha Nambiar <amritha.nambiar@...el.com>,
        stephen@...workplumber.org, netdev@...r.kernel.org
Cc:     jakub.kicinski@...ronome.com, sridhar.samudrala@...el.com,
        jhs@...atatu.com, xiyou.wangcong@...il.com, jiri@...nulli.us
Subject: Re: [iproute2-next PATCH v6] tc: flower: Classify packets based port
 ranges

On 11/27/18 3:40 PM, Amritha Nambiar wrote:
> Added support for filtering based on port ranges.
> UAPI changes have been accepted into net-next.
> 
> Example:
> 1. Match on a port range:
> -------------------------
> $ tc filter add dev enp4s0 protocol ip parent ffff:\
>   prio 1 flower ip_proto tcp dst_port 20-30 skip_hw\
>   action drop
> 
> $ tc -s filter show dev enp4s0 parent ffff:
> filter protocol ip pref 1 flower chain 0
> filter protocol ip pref 1 flower chain 0 handle 0x1
>   eth_type ipv4
>   ip_proto tcp
>   dst_port 20-30
>   skip_hw
>   not_in_hw
>         action order 1: gact action drop
>          random type none pass val 0
>          index 1 ref 1 bind 1 installed 85 sec used 3 sec
>         Action statistics:
>         Sent 460 bytes 10 pkt (dropped 10, overlimits 0 requeues 0)
>         backlog 0b 0p requeues 0
> 
> 2. Match on IP address and port range:
> --------------------------------------
> $ tc filter add dev enp4s0 protocol ip parent ffff:\
>   prio 1 flower dst_ip 192.168.1.1 ip_proto tcp dst_port 100-200\
>   skip_hw action drop
> 
> $ tc -s filter show dev enp4s0 parent ffff:
> filter protocol ip pref 1 flower chain 0 handle 0x2
>   eth_type ipv4
>   ip_proto tcp
>   dst_ip 192.168.1.1
>   dst_port 100-200
>   skip_hw
>   not_in_hw
>         action order 1: gact action drop
>          random type none pass val 0
>          index 2 ref 1 bind 1 installed 58 sec used 2 sec
>         Action statistics:
>         Sent 920 bytes 20 pkt (dropped 20, overlimits 0 requeues 0)
>         backlog 0b 0p requeues 0
> 
> v6:
> Modified to change json output format as object for sport/dport.
> 
>  "dst_port":{
>            "start":2000,
>            "end":6000
>  },
>  "src_port":{
>            "start":50,
>            "end":60
>  }
> 
> v5:
> Simplified some code and used 'sscanf' for parsing. Removed
> space in output format.
> 
> v4:
> Added man updates explaining filtering based on port ranges.
> Removed 'range' keyword.
> 
> v3:
> Modified flower_port_range_attr_type calls.
> 
> v2:
> Addressed Jiri's comment to sync output format with input
> 
> Signed-off-by: Amritha Nambiar <amritha.nambiar@...el.com>
> ---
>  man/man8/tc-flower.8 |   13 +++++---
>  tc/f_flower.c        |   85 +++++++++++++++++++++++++++++++++++++++++++++-----
>  2 files changed, 84 insertions(+), 14 deletions(-)
> 

sorry for the delay; fell through the cracks. It no longer applies to
net-next. Please update. Thanks,