| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 19 Jun 2023 23:35:23 +0200
From: Zahari Doychev <zahari.doychev@...ux.com>
To: netdev@...r.kernel.org
Cc: dsahern@...il.com,
stephen@...workplumber.org,
hmehrtens@...linear.com,
aleksander.lobakin@...el.com,
simon.horman@...igine.com,
idosch@...sch.org,
Zahari Doychev <zdoychev@...linear.com>
Subject: [PATCH iproute2-next] f_flower: add cfm support
From: Zahari Doychev <zdoychev@...linear.com>
Add support for matching on CFM Maintenance Domain level and opcode.
# tc filter add dev ens6 ingress pref 1 proto cfm \
flower cfm op 1 mdl 5 action ok
# tc filter show dev ens6 ingress
filter protocol cfm pref 1 flower chain 0
filter protocol cfm pref 1 flower chain 0 handle 0x1
eth_type 8902
cfm mdl 5 op 1
not_in_hw
action order 1: gact action pass
random type none pass val 0
index 1 ref 1 bind 1
# tc -j -p filter show dev ens6 ingress
[ {
"protocol": "cfm",
"pref": 1,
"kind": "flower",
"chain": 0
},{
"protocol": "cfm",
"pref": 1,
"kind": "flower",
"chain": 0,
"options": {
"handle": 1,
"keys": {
"eth_type": "8902",
"cfm": {
"mdl": 5,
"op": 1
}
},
"not_in_hw": true,
"actions": [ {
"order": 1,
"kind": "gact",
"control_action": {
"type": "pass"
},
"prob": {
"random_type": "none",
"control_action": {
"type": "pass"
},
"val": 0
},
"index": 1,
"ref": 1,
"bind": 1
} ]
}
} ]
Signed-off-by: Zahari Doychev <zdoychev@...linear.com>
---
include/uapi/linux/pkt_cls.h | 9 ++++
lib/ll_proto.c | 1 +
man/man8/tc-flower.8 | 29 ++++++++++-
tc/f_flower.c | 98 +++++++++++++++++++++++++++++++++++-
4 files changed, 135 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index 00933dda..7865f5a9 100644
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h
@@ -596,6 +596,8 @@ enum {
TCA_FLOWER_L2_MISS, /* u8 */
+ TCA_FLOWER_KEY_CFM, /* nested */
+
__TCA_FLOWER_MAX,
};
@@ -704,6 +706,13 @@ enum {
TCA_FLOWER_KEY_FLAGS_FRAG_IS_FIRST = (1 << 1),
};
+enum {
+ TCA_FLOWER_KEY_CFM_OPT_UNSPEC,
+ TCA_FLOWER_KEY_CFM_MD_LEVEL,
+ TCA_FLOWER_KEY_CFM_OPCODE,
+ TCA_FLOWER_KEY_CFM_OPT_MAX,
+};
+
#define TCA_FLOWER_MASK_FLAGS_RANGE (1 << 0) /* Range-based match */
/* Match-all classifier */
diff --git a/lib/ll_proto.c b/lib/ll_proto.c
index 526e582f..5aacb5b4 100644
--- a/lib/ll_proto.c
+++ b/lib/ll_proto.c
@@ -78,6 +78,7 @@ __PF(8021AD,802.1ad)
__PF(MPLS_UC,mpls_uc)
__PF(MPLS_MC,mpls_mc)
__PF(TEB,teb)
+__PF(CFM,cfm)
{ 0x8100, "802.1Q" },
{ 0x88cc, "LLDP" },
diff --git a/man/man8/tc-flower.8 b/man/man8/tc-flower.8
index cd997450..83245813 100644
--- a/man/man8/tc-flower.8
+++ b/man/man8/tc-flower.8
@@ -102,7 +102,9 @@ flower \- flow based traffic control filter
.BR ip_flags
.IR IP_FLAGS " | "
.B l2_miss
-.IR L2_MISS " }"
+.IR L2_MISS " | "
+.BR cfm
+.IR CFM_OPTIONS " }"
.ti -8
.IR LSE_LIST " := [ " LSE_LIST " ] " LSE
@@ -120,6 +122,13 @@ flower \- flow based traffic control filter
.B ttl
.IR TTL " }"
+.ti -8
+.IR CFM " := "
+.B cfm mdl
+.IR LEVEL " | "
+.B op
+.IR OPCODE "
+
.SH DESCRIPTION
The
.B flower
@@ -496,11 +505,29 @@ fragmented packet. firstfrag can be used to indicate the first fragmented
packet. nofirstfrag can be used to indicates subsequent fragmented packets
or non-fragmented packets.
.TP
+
.BI l2_miss " L2_MISS"
Match on layer 2 miss in the bridge driver's FDB / MDB. \fIL2_MISS\fR may be 0
or 1. When 1, match on packets that encountered a layer 2 miss. When 0, match
on packets that were forwarded using an FDB / MDB entry. Note that broadcast
packets do not encounter a miss since a lookup is not performed for them.
+.TP
+
+.BI cfm " CFM_OPTIONS"
+Match on Connectivity Fault Management (CFM) fields.
+.I CFM_OPTIONS
+is a list of options that describe the properties of the CFM information
+fields to match.
+.RS
+.TP
+.BI mdl " LEVEL "
+Match on the Maintenance Domain (MD) level field.
+\fILEVEL\fR is an unsigned 3 bit value in decimal format.
+.TP
+.BI op " OPCODE "
+Match on the CFM opcode field. \fIOPCODE\fR is an unsigned 8 bit value in
+decimal format.
+
.SH NOTES
As stated above where applicable, matches of a certain layer implicitly depend
on the matches of the next lower layer. Precisely, layer one and two matches
diff --git a/tc/f_flower.c b/tc/f_flower.c
index b9fe6afb..cfff36c0 100644
--- a/tc/f_flower.c
+++ b/tc/f_flower.c
@@ -96,12 +96,14 @@ static void explain(void)
" ct_state MASKED_CT_STATE |\n"
" ct_label MASKED_CT_LABEL |\n"
" ct_mark MASKED_CT_MARK |\n"
- " ct_zone MASKED_CT_ZONE }\n"
+ " ct_zone MASKED_CT_ZONE |\n"
+ " cfm CFM }\n"
" LSE-LIST := [ LSE-LIST ] LSE\n"
" LSE := lse depth DEPTH { label LABEL | tc TC | bos BOS | ttl TTL }\n"
" FILTERID := X:Y:Z\n"
" MASKED_LLADDR := { LLADDR | LLADDR/MASK | LLADDR/BITS }\n"
" MASKED_CT_STATE := combination of {+|-} and flags trk,est,new,rel,rpl,inv\n"
+ " CFM := { mdl LEVEL | op OPCODE }\n"
" ACTION-SPEC := ... look at individual actions\n"
"\n"
"NOTE: CLASSID, IP-PROTO are parsed as hexadecimal input.\n"
@@ -1447,6 +1449,57 @@ static int flower_parse_mpls(int *argc_p, char ***argv_p, struct nlmsghdr *nlh)
return 0;
}
+static int flower_parse_cfm(int *argc_p, char ***argv_p, __be16 eth_type,
+ struct nlmsghdr *n)
+{
+ struct rtattr *cfm_attr;
+ char **argv = *argv_p;
+ int argc = *argc_p;
+ int ret;
+
+ if (eth_type != htons(ETH_P_CFM)) {
+ fprintf(stderr,
+ "Can't set attribute if ethertype isn't CFM\n");
+ return -1;
+ }
+
+ cfm_attr = addattr_nest(n, MAX_MSG, TCA_FLOWER_KEY_CFM | NLA_F_NESTED);
+
+ while (argc > 0) {
+ if (matches(*argv, "mdl") == 0) {
+ __u8 val;
+
+ NEXT_ARG();
+ ret = get_u8(&val, *argv, 10);
+ if (ret < 0) {
+ fprintf(stderr, "Illegal \"cfm md level\"\n");
+ return -1;
+ }
+ addattr8(n, MAX_MSG, TCA_FLOWER_KEY_CFM_MD_LEVEL, val);
+ } else if (matches(*argv, "op") == 0) {
+ __u8 val;
+
+ NEXT_ARG();
+ ret = get_u8(&val, *argv, 10);
+ if (ret < 0) {
+ fprintf(stderr, "Illegal \"cfm opcode\"\n");
+ return -1;
+ }
+ addattr8(n, MAX_MSG, TCA_FLOWER_KEY_CFM_OPCODE, val);
+ } else {
+ break;
+ }
+ argc--; argv++;
+ }
+
+ addattr_nest_end(n, cfm_attr);
+
+ *argc_p = argc;
+ *argv_p = argv;
+
+ return 0;
+}
+
static int flower_parse_opt(struct filter_util *qu, char *handle,
int argc, char **argv, struct nlmsghdr *n)
{
@@ -2065,6 +2118,12 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
return -1;
}
continue;
+ } else if (matches(*argv, "cfm") == 0) {
+ NEXT_ARG();
+ ret = flower_parse_cfm(&argc, &argv, eth_type, n);
+ if (ret < 0)
+ return -1;
+ continue;
} else {
if (strcmp(*argv, "help") != 0)
fprintf(stderr, "What is \"%s\"?\n", *argv);
@@ -2754,6 +2813,41 @@ static void flower_print_arp_op(const char *name,
flower_print_arp_op_to_name);
}
+static void flower_print_cfm(struct rtattr *attr)
+{
+ struct rtattr *tb[TCA_FLOWER_KEY_CFM_OPT_MAX + 1];
+ struct rtattr *v;
+ SPRINT_BUF(out);
+ size_t sz = 0;
+
+ if (!attr || !(attr->rta_type & NLA_F_NESTED))
+ return;
+
+ parse_rtattr(tb, TCA_FLOWER_KEY_CFM_OPT_MAX, RTA_DATA(attr),
+ RTA_PAYLOAD(attr));
+
+ print_nl();
+ print_string(PRINT_FP, NULL, " cfm", NULL);
+ open_json_object("cfm");
+
+ v = tb[TCA_FLOWER_KEY_CFM_MD_LEVEL];
+ if (v) {
+ sz += sprintf(out, " mdl %u", rta_getattr_u8(v));
+ print_hhu(PRINT_JSON, "mdl", NULL, rta_getattr_u8(v));
+
+ }
+
+ v = tb[TCA_FLOWER_KEY_CFM_OPCODE];
+ if (v) {
+ sprintf(out + sz, " op %u", rta_getattr_u8(v));
+ print_hhu(PRINT_JSON, "op", NULL, rta_getattr_u8(v));
+
+ }
+
+ close_json_object();
+ print_string(PRINT_FP, "cfm", "%s", out);
+}
+
static int flower_print_opt(struct filter_util *qu, FILE *f,
struct rtattr *opt, __u32 handle)
{
@@ -3010,6 +3104,8 @@ static int flower_print_opt(struct filter_util *qu, FILE *f,
flower_print_ct_label(tb[TCA_FLOWER_KEY_CT_LABELS],
tb[TCA_FLOWER_KEY_CT_LABELS_MASK]);
+ flower_print_cfm(tb[TCA_FLOWER_KEY_CFM]);
+
close_json_object();
if (tb[TCA_FLOWER_FLAGS]) {
--
2.41.0
Powered by blists - more mailing lists