netdev - [PATCH iproute2-next v2] flower: add orig

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <20210830100144.30120-1-boris.sukholitko@broadcom.com>
Date:   Mon, 30 Aug 2021 13:01:44 +0300
From:   Boris Sukholitko <boris.sukholitko@...adcom.com>
To:     netdev@...r.kernel.org
Cc:     Ilya Lifshits <ilya.lifshits@...adcom.com>,
        Boris Sukholitko <boris.sukholitko@...adcom.com>
Subject: [PATCH iproute2-next v2] flower: add orig_ethtype key

The following flower filter fails to match packets:

tc filter add dev eth0 ingress protocol 0x8864 flower \
        action simple sdata hi64

The following is explanation of the issue on the kernel side.

The protocol 0x8864 (ETH_P_PPP_SES) is a tunnel protocol. As such, it is
being dissected by __skb_flow_dissect and it's internal protocol is
being set as key->basic.n_proto. IOW, the existence of ETH_P_PPP_SES
tunnel is transparent to the callers of __skb_flow_dissect.

OTOH, in the filters above, cls_flower configures its key->basic.n_proto
to the ETH_P_PPP_SES value configured by the user. Matching on this key
fails because of __skb_flow_dissect "transparency" mentioned above.

Therefore there is no way currently to match on such packets using
flower.

To fix the issue add new orig_ethtype key to the flower along with the
necessary changes to the flow dissector etc.

To filter the ETH_P_PPP_SES packets the command becomes:

tc filter add dev eth0 ingress flower orig_ethtype 0x8864 \
        action simple sdata hi64

Corresponding kernel patch was sent separately.

Signed-off-by: Boris Sukholitko <boris.sukholitko@...adcom.com>
---
v2:
 - Add help and man page entries
---
 include/uapi/linux/pkt_cls.h |  1 +
 man/man8/tc-flower.8         | 14 ++++++++++++++
 tc/f_flower.c                | 18 ++++++++++++++++++
 3 files changed, 33 insertions(+)

diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index 025c40fe..238dee49 100644
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h
@@ -583,6 +583,7 @@ enum {
 	TCA_FLOWER_KEY_HASH,		/* u32 */
 	TCA_FLOWER_KEY_HASH_MASK,	/* u32 */
 
+	TCA_FLOWER_KEY_ORIG_ETH_TYPE,	/* be16 */
 	__TCA_FLOWER_MAX,
 };
 
diff --git a/man/man8/tc-flower.8 b/man/man8/tc-flower.8
index 4541d937..927b3320 100644
--- a/man/man8/tc-flower.8
+++ b/man/man8/tc-flower.8
@@ -28,6 +28,8 @@ flower \- flow based traffic control filter
 .RI " | { "
 .BR dst_mac " | " src_mac " } "
 .IR MASKED_LLADDR " | "
+.BR orig_ethtype " { " ipv4 " | " ipv6 " | "
+.IR ETH_TYPE " } | "
 .B vlan_id
 .IR VID " | "
 .B vlan_prio
@@ -162,6 +164,18 @@ provided in LLADDR format, in which case it is a bitwise mask, or as a
 number of high bits to match. If the mask is missing then a match on all
 bits is assumed.
 .TP
+.BI orig_ethtype " ORIG_ETH_TYPE"
+Match on layer three protocol as it appears in the network packet.
+Some tunnel protocols will be parsed by the Linux kernel. Therefore
+.B protocol
+option of tc filter will match their inner ethernet types.
+.B orig_ethtype
+will match the original protocol untouched by the kernel.
+.I ORIG_ETH_TYPE
+may be either
+.BR ipv4 ", " ipv6
+or an unsigned 16bit value in hexadecimal format.
+.TP
 .BI vlan_id " VID"
 Match on vlan tag id.
 .I VID
diff --git a/tc/f_flower.c b/tc/f_flower.c
index c5af0276..2480285b 100644
--- a/tc/f_flower.c
+++ b/tc/f_flower.c
@@ -48,6 +48,7 @@ static void explain(void)
 		"\n"
 		"Where: MATCH-LIST := [ MATCH-LIST ] MATCH\n"
 		"       MATCH      := {	indev DEV-NAME |\n"
+		"			orig_ethtype [ ipv4 | ipv6 | ETH-TYPE ] |\n"
 		"			vlan_id VID |\n"
 		"			vlan_prio PRIORITY |\n"
 		"			vlan_ethtype [ ipv4 | ipv6 | ETH-TYPE ] |\n"
@@ -1431,6 +1432,13 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
 			if (check_ifname(*argv))
 				invarg("\"indev\" not a valid ifname", *argv);
 			addattrstrz(n, MAX_MSG, TCA_FLOWER_INDEV, *argv);
+		} else if (matches(*argv, "orig_ethtype") == 0) {
+			__be16 orig_ethtype;
+
+			NEXT_ARG();
+			if (ll_proto_a2n(&orig_ethtype, *argv))
+				invarg("invalid orig_ethtype", *argv);
+			addattr16(n, MAX_MSG, TCA_FLOWER_KEY_ORIG_ETH_TYPE, orig_ethtype);
 		} else if (matches(*argv, "vlan_id") == 0) {
 			__u16 vid;
 
@@ -2582,6 +2590,16 @@ static int flower_print_opt(struct filter_util *qu, FILE *f,
 			     rta_getattr_str(attr));
 	}
 
+	if (tb[TCA_FLOWER_KEY_ORIG_ETH_TYPE]) {
+		SPRINT_BUF(buf);
+		struct rtattr *attr = tb[TCA_FLOWER_KEY_ORIG_ETH_TYPE];
+
+		print_nl();
+		print_string(PRINT_ANY, "orig_ethtype", "  orig_ethtype %s",
+			     ll_proto_n2a(rta_getattr_u16(attr),
+			     buf, sizeof(buf)));
+	}
+
 	open_json_object("keys");
 
 	if (tb[TCA_FLOWER_KEY_VLAN_ID]) {
-- 
2.29.2


Download attachment "smime.p7s" of type "application/pkcs7-signature" (4221 bytes)