netdev - [PATCH net-next v4 0/5] net/sched: flower: match on the number of vlan tags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220419081434.5192-1-boris.sukholitko@broadcom.com>
Date:   Tue, 19 Apr 2022 11:14:29 +0300
From:   Boris Sukholitko <boris.sukholitko@...adcom.com>
To:     netdev@...r.kernel.org, "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Jamal Hadi Salim <jhs@...atatu.com>,
        Cong Wang <xiyou.wangcong@...il.com>,
        Jiri Pirko <jiri@...nulli.us>,
        "Gustavo A . R . Silva" <gustavoars@...nel.org>,
        Vladimir Oltean <vladimir.oltean@....com>,
        Eric Dumazet <edumazet@...gle.com>,
        zhang kai <zhangkaiheb@....com>,
        Yoshiki Komachi <komachi.yoshiki@...il.com>,
        Paolo Abeni <pabeni@...hat.com>
Cc:     Ilya Lifshits <ilya.lifshits@...adcom.com>,
        Boris Sukholitko <boris.sukholitko@...adcom.com>
Subject: [PATCH net-next v4 0/5] net/sched: flower: match on the number of vlan tags

Hi,

Our customers in the fiber telecom world have network configurations
where they would like to control their traffic according to the number
of tags appearing in the packet.

For example, TR247 GPON conformance test suite specification mostly
talks about untagged, single, double tagged packets and gives lax
guidelines on the vlan protocol vs. number of vlan tags.

This is different from the common IT networks where 802.1Q and 802.1ad
protocols are usually describe single and double tagged packet. GPON
configurations that we work with have arbitrary mix the above protocols
and number of vlan tags in the packet.

The following patch series implement number of vlans flower filter. They
add num_of_vlans flower filter as an alternative to vlan ethtype protocol
matching. The end result is that the following command becomes possible:

tc filter add dev eth1 ingress flower \
  num_of_vlans 1 vlan_prio 5 action drop

Also, from our logs, we have redirect rules such that:

tc filter add dev $GPON ingress flower num_of_vlans $N \
     action mirred egress redirect dev $DEV

where N can range from 0 to 3 and $DEV is the function of $N.

Also there are rules setting skb mark based on the number of vlans:

tc filter add dev $GPON ingress flower num_of_vlans $N vlan_prio \
    $P action skbedit mark $M

More about the patch series:
  - patches 1-2 remove duplicate code by introducing is_key_vlan
    helper.
  - patch 3, 4 implement num_of_vlans in the dissector and in the
    flower.
  - patch 5 uses the num_of_vlans filter to allow further matching on
    vlan attributes.

Complementary iproute2 patches are being sent separately.

Thanks,
Boris.

- v4: rebased to the latest net-next
- v3:
    - more example commands in patch 3 description (request by Jamal)
    - patch 5 description made clearer (thanks to Jiri)
- v2:
    - add suitable subject prefixes
    - more evolved patch 5 description

Boris Sukholitko (5):
  net/sched: flower: Helper function for vlan ethtype checks
  net/sched: flower: Reduce identation after is_key_vlan refactoring
  flow_dissector: Add number of vlan tags dissector
  net/sched: flower: Add number of vlan tags filter
  net/sched: flower: Consider the number of tags for vlan filters

 include/net/flow_dissector.h |  9 ++++
 include/uapi/linux/pkt_cls.h |  2 +
 net/core/flow_dissector.c    | 20 ++++++++
 net/sched/cls_flower.c       | 90 +++++++++++++++++++++++-------------
 4 files changed, 88 insertions(+), 33 deletions(-)

-- 
2.29.2

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4221 bytes)