netdev - Re: [PATCH iproute2-next 0/2] flower: match on the number of vlan tags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 12 Apr 2022 13:45:14 +0300
From:   Boris Sukholitko <boris.sukholitko@...adcom.com>
To:     Stephen Hemminger <stephen@...workplumber.org>
Cc:     netdev@...r.kernel.org, "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Jamal Hadi Salim <jhs@...atatu.com>,
        Cong Wang <xiyou.wangcong@...il.com>,
        Jiri Pirko <jiri@...nulli.us>,
        "Gustavo A . R . Silva" <gustavoars@...nel.org>,
        Vladimir Oltean <vladimir.oltean@....com>,
        Eric Dumazet <edumazet@...gle.com>,
        zhang kai <zhangkaiheb@....com>,
        Yoshiki Komachi <komachi.yoshiki@...il.com>,
        Ilya Lifshits <ilya.lifshits@...adcom.com>
Subject: Re: [PATCH iproute2-next 0/2] flower: match on the number of vlan
 tags

On Mon, Apr 11, 2022 at 08:45:36AM -0700, Stephen Hemminger wrote:
> On Mon, 11 Apr 2022 16:32:00 +0300
> Boris Sukholitko <boris.sukholitko@...adcom.com> wrote:
> 
> > Hi,
> > 
> > Our customers in the fiber telecom world have network configurations
> > where they would like to control their traffic according to the number
> > of tags appearing in the packet.
> > 
> > For example, TR247 GPON conformance test suite specification mostly
> > talks about untagged, single, double tagged packets and gives lax
> > guidelines on the vlan protocol vs. number of vlan tags.
> > 
> > This is different from the common IT networks where 802.1Q and 802.1ad
> > protocols are usually describe single and double tagged packet. GPON
> > configurations that we work with have arbitrary mix the above protocols
> > and number of vlan tags in the packet.
> > 
> > The following patch series implement number of vlans flower filter. They
> > add num_of_vlans flower filter as an alternative to vlan ethtype protocol
> > matching. The end result is that the following command becomes possible:
> > 
> > tc filter add dev eth1 ingress flower \
> >   num_of_vlans 1 vlan_prio 5 action drop
> > 
> > The corresponding kernel patches are being sent separately.
> > 
> > Thanks,
> > Boris.
> 
> Maybe something custom like this is better done by small BPF program?

I am not sure it is feasible to have BPF match done on the number of
vlans and have the rest of TC machinery work as expected.

For example, the flower filters look at the protocol to allow matching
on the vlan fields. Patch 5 of the kernel part of the series adds number
of vlans as a different precondition. Having BPF program does nothing
for it.

Replicating more of TC functionality in the BPF to alleviate such pain
points is probably possible but will not be "simple".

Also (and sorry for the philosophy rant!) there is an issue of UI and
intended audience here. The TC tools are well known and accessible. I am
not sure that the same can be said for a custom BPF programs. :)

Thanks,
Boris.

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4221 bytes)