| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20230621205545.63760-1-zahari.doychev@linux.com>
Date: Wed, 21 Jun 2023 22:55:45 +0200
From: Zahari Doychev <zahari.doychev@...ux.com>
To: netdev@...r.kernel.org
Cc: dsahern@...il.com,
stephen@...workplumber.org,
hmehrtens@...linear.com,
aleksander.lobakin@...el.com,
simon.horman@...igine.com,
idosch@...sch.org,
Zahari Doychev <zdoychev@...linear.com>,
Ido Schimmel <idosch@...dia.com>
Subject: [PATCH iproute2-next v3] f_flower: add cfm support
From: Zahari Doychev <zdoychev@...linear.com>
Add support for matching on CFM Maintenance Domain level and opcode.
# tc filter add dev ens6 ingress pref 1 proto cfm \
flower cfm op 1 mdl 5 action ok
# tc filter show dev ens6 ingress
filter protocol cfm pref 1 flower chain 0
filter protocol cfm pref 1 flower chain 0 handle 0x1
eth_type 8902
cfm mdl 5 op 1
not_in_hw
action order 1: gact action pass
random type none pass val 0
index 1 ref 1 bind 1
# tc -j -p filter show dev ens6 ingress
[ {
"protocol": "cfm",
"pref": 1,
"kind": "flower",
"chain": 0
},{
"protocol": "cfm",
"pref": 1,
"kind": "flower",
"chain": 0,
"options": {
"handle": 1,
"keys": {
"eth_type": "8902",
"cfm": {
"mdl": 5,
"op": 1
}
},
"not_in_hw": true,
"actions": [ {
"order": 1,
"kind": "gact",
"control_action": {
"type": "pass"
},
"prob": {
"random_type": "none",
"control_action": {
"type": "pass"
},
"val": 0
},
"index": 1,
"ref": 1,
"bind": 1
} ]
}
} ]
Signed-off-by: Zahari Doychev <zdoychev@...linear.com>
Reviewed-by: Ido Schimmel <idosch@...dia.com>
---
v1->v2:
- replace matches with strcmp
v2->v3
- don't change uapi header file
- remove empty lines
lib/ll_proto.c | 1 +
man/man8/tc-flower.8 | 29 ++++++++++++-
tc/f_flower.c | 96 +++++++++++++++++++++++++++++++++++++++++++-
3 files changed, 124 insertions(+), 2 deletions(-)
diff --git a/lib/ll_proto.c b/lib/ll_proto.c
index 526e582f..5aacb5b4 100644
--- a/lib/ll_proto.c
+++ b/lib/ll_proto.c
@@ -78,6 +78,7 @@ __PF(8021AD,802.1ad)
__PF(MPLS_UC,mpls_uc)
__PF(MPLS_MC,mpls_mc)
__PF(TEB,teb)
+__PF(CFM,cfm)
{ 0x8100, "802.1Q" },
{ 0x88cc, "LLDP" },
diff --git a/man/man8/tc-flower.8 b/man/man8/tc-flower.8
index cd997450..83245813 100644
--- a/man/man8/tc-flower.8
+++ b/man/man8/tc-flower.8
@@ -102,7 +102,9 @@ flower \- flow based traffic control filter
.BR ip_flags
.IR IP_FLAGS " | "
.B l2_miss
-.IR L2_MISS " }"
+.IR L2_MISS " | "
+.BR cfm
+.IR CFM_OPTIONS " }"
.ti -8
.IR LSE_LIST " := [ " LSE_LIST " ] " LSE
@@ -120,6 +122,13 @@ flower \- flow based traffic control filter
.B ttl
.IR TTL " }"
+.ti -8
+.IR CFM " := "
+.B cfm mdl
+.IR LEVEL " | "
+.B op
+.IR OPCODE "
+
.SH DESCRIPTION
The
.B flower
@@ -496,11 +505,29 @@ fragmented packet. firstfrag can be used to indicate the first fragmented
packet. nofirstfrag can be used to indicates subsequent fragmented packets
or non-fragmented packets.
.TP
+
.BI l2_miss " L2_MISS"
Match on layer 2 miss in the bridge driver's FDB / MDB. \fIL2_MISS\fR may be 0
or 1. When 1, match on packets that encountered a layer 2 miss. When 0, match
on packets that were forwarded using an FDB / MDB entry. Note that broadcast
packets do not encounter a miss since a lookup is not performed for them.
+.TP
+
+.BI cfm " CFM_OPTIONS"
+Match on Connectivity Fault Management (CFM) fields.
+.I CFM_OPTIONS
+is a list of options that describe the properties of the CFM information
+fields to match.
+.RS
+.TP
+.BI mdl " LEVEL "
+Match on the Maintenance Domain (MD) level field.
+\fILEVEL\fR is an unsigned 3 bit value in decimal format.
+.TP
+.BI op " OPCODE "
+Match on the CFM opcode field. \fIOPCODE\fR is an unsigned 8 bit value in
+decimal format.
+
.SH NOTES
As stated above where applicable, matches of a certain layer implicitly depend
on the matches of the next lower layer. Precisely, layer one and two matches
diff --git a/tc/f_flower.c b/tc/f_flower.c
index b9fe6afb..6da5028a 100644
--- a/tc/f_flower.c
+++ b/tc/f_flower.c
@@ -96,12 +96,14 @@ static void explain(void)
" ct_state MASKED_CT_STATE |\n"
" ct_label MASKED_CT_LABEL |\n"
" ct_mark MASKED_CT_MARK |\n"
- " ct_zone MASKED_CT_ZONE }\n"
+ " ct_zone MASKED_CT_ZONE |\n"
+ " cfm CFM }\n"
" LSE-LIST := [ LSE-LIST ] LSE\n"
" LSE := lse depth DEPTH { label LABEL | tc TC | bos BOS | ttl TTL }\n"
" FILTERID := X:Y:Z\n"
" MASKED_LLADDR := { LLADDR | LLADDR/MASK | LLADDR/BITS }\n"
" MASKED_CT_STATE := combination of {+|-} and flags trk,est,new,rel,rpl,inv\n"
+ " CFM := { mdl LEVEL | op OPCODE }\n"
" ACTION-SPEC := ... look at individual actions\n"
"\n"
"NOTE: CLASSID, IP-PROTO are parsed as hexadecimal input.\n"
@@ -1447,6 +1449,57 @@ static int flower_parse_mpls(int *argc_p, char ***argv_p, struct nlmsghdr *nlh)
return 0;
}
+static int flower_parse_cfm(int *argc_p, char ***argv_p, __be16 eth_type,
+ struct nlmsghdr *n)
+{
+ struct rtattr *cfm_attr;
+ char **argv = *argv_p;
+ int argc = *argc_p;
+ int ret;
+
+ if (eth_type != htons(ETH_P_CFM)) {
+ fprintf(stderr,
+ "Can't set attribute if ethertype isn't CFM\n");
+ return -1;
+ }
+
+ cfm_attr = addattr_nest(n, MAX_MSG, TCA_FLOWER_KEY_CFM | NLA_F_NESTED);
+
+ while (argc > 0) {
+ if (!strcmp(*argv, "mdl")) {
+ __u8 val;
+
+ NEXT_ARG();
+ ret = get_u8(&val, *argv, 10);
+ if (ret < 0) {
+ fprintf(stderr, "Illegal \"cfm md level\"\n");
+ return -1;
+ }
+ addattr8(n, MAX_MSG, TCA_FLOWER_KEY_CFM_MD_LEVEL, val);
+ } else if (!strcmp(*argv, "op")) {
+ __u8 val;
+
+ NEXT_ARG();
+ ret = get_u8(&val, *argv, 10);
+ if (ret < 0) {
+ fprintf(stderr, "Illegal \"cfm opcode\"\n");
+ return -1;
+ }
+ addattr8(n, MAX_MSG, TCA_FLOWER_KEY_CFM_OPCODE, val);
+ } else {
+ break;
+ }
+ argc--; argv++;
+ }
+
+ addattr_nest_end(n, cfm_attr);
+
+ *argc_p = argc;
+ *argv_p = argv;
+
+ return 0;
+}
+
static int flower_parse_opt(struct filter_util *qu, char *handle,
int argc, char **argv, struct nlmsghdr *n)
{
@@ -2065,6 +2118,12 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
return -1;
}
continue;
+ } else if (!strcmp(*argv, "cfm")) {
+ NEXT_ARG();
+ ret = flower_parse_cfm(&argc, &argv, eth_type, n);
+ if (ret < 0)
+ return -1;
+ continue;
} else {
if (strcmp(*argv, "help") != 0)
fprintf(stderr, "What is \"%s\"?\n", *argv);
@@ -2754,6 +2813,39 @@ static void flower_print_arp_op(const char *name,
flower_print_arp_op_to_name);
}
+static void flower_print_cfm(struct rtattr *attr)
+{
+ struct rtattr *tb[TCA_FLOWER_KEY_CFM_OPT_MAX + 1];
+ struct rtattr *v;
+ SPRINT_BUF(out);
+ size_t sz = 0;
+
+ if (!attr || !(attr->rta_type & NLA_F_NESTED))
+ return;
+
+ parse_rtattr(tb, TCA_FLOWER_KEY_CFM_OPT_MAX, RTA_DATA(attr),
+ RTA_PAYLOAD(attr));
+
+ print_nl();
+ print_string(PRINT_FP, NULL, " cfm", NULL);
+ open_json_object("cfm");
+
+ v = tb[TCA_FLOWER_KEY_CFM_MD_LEVEL];
+ if (v) {
+ sz += sprintf(out, " mdl %u", rta_getattr_u8(v));
+ print_hhu(PRINT_JSON, "mdl", NULL, rta_getattr_u8(v));
+ }
+
+ v = tb[TCA_FLOWER_KEY_CFM_OPCODE];
+ if (v) {
+ sprintf(out + sz, " op %u", rta_getattr_u8(v));
+ print_hhu(PRINT_JSON, "op", NULL, rta_getattr_u8(v));
+ }
+
+ close_json_object();
+ print_string(PRINT_FP, "cfm", "%s", out);
+}
+
static int flower_print_opt(struct filter_util *qu, FILE *f,
struct rtattr *opt, __u32 handle)
{
@@ -3010,6 +3102,8 @@ static int flower_print_opt(struct filter_util *qu, FILE *f,
flower_print_ct_label(tb[TCA_FLOWER_KEY_CT_LABELS],
tb[TCA_FLOWER_KEY_CT_LABELS_MASK]);
+ flower_print_cfm(tb[TCA_FLOWER_KEY_CFM]);
+
close_json_object();
if (tb[TCA_FLOWER_FLAGS]) {
--
2.41.0
Powered by blists - more mailing lists