From patchwork Wed Jan 11 10:03:04 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Horman X-Patchwork-Id: 713671 X-Patchwork-Delegate: shemminger@vyatta.com Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3tz4GN22S4z9vF3 for ; Wed, 11 Jan 2017 21:03:24 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=netronome-com.20150623.gappssmtp.com header.i=@netronome-com.20150623.gappssmtp.com header.b="fzQzkcRl"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965549AbdAKKDT (ORCPT ); Wed, 11 Jan 2017 05:03:19 -0500 Received: from mail-wm0-f54.google.com ([74.125.82.54]:34837 "EHLO mail-wm0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965533AbdAKKDP (ORCPT ); Wed, 11 Jan 2017 05:03:15 -0500 Received: by mail-wm0-f54.google.com with SMTP id r126so7763424wmr.0 for ; Wed, 11 Jan 2017 02:03:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netronome-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=SJkhM/WesfpnMYVJboP7XOzakaOCzfmNiic93x7QWI4=; b=fzQzkcRltwTEenzSNfhT+vs3m2cxESI/QmbN+SZTGQVy3erE8pxQ7tsrxl/g0GEhtr s2XJpTe1igSbfNO7n5WWVEYXELshX+2EsZl8KY4M1pV8DdnN4JPufQXr1ElJBR770LBG j7cO8gn3WNVaiT1RxQKThAGuia3V9vmOdU0JA8hi4vDMswOFlnQDCIfamjICtCKX2oLC VL1WgLRYZxi2TSOgOo6XbcWL+WXb2HL6kaXnG5NjJKxBcGPvS0J/MO/gk1efKWZmGokU bOLT8ZIee0aQYy9rqbNT0t/2N9C3Zgxwhz0Zfh40oNmQITpXGZwtto/YkyEyFv5IDmRN 9KJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=SJkhM/WesfpnMYVJboP7XOzakaOCzfmNiic93x7QWI4=; b=kzzyf6XBswj/+CxMhocHG92d6hgLlu2lRWNQXPINEkmLcBOcYI3/TUQwgZA7y195LM s+Gl7BwO5cVefYQhGkLibZ22+LrsuVzO0s+DL2SbZXx7XDKY6Byyy6KLQwULgv0GwZfe 1XPKa0QHztIUSnFkT85nLkpg728v/druq3a9zwg0pUT1EyIKtLK94g5eLcyDwmYENI52 rbqr44KQRz0XMD9T5QtvEaOHavlfXheC2uKO46HZcg8Uq7G4yKDeuKpEcsJqnlUkMIJi iEdv9Fzj9951XEAbsp2NgXzrsZTL8S8hBDqz/+Ea3AH5ysT0LMmFg0Q1a/iut/L8XYSX 9x/w== X-Gm-Message-State: AIkVDXKTWbWD0Kd9o3MawDAbtJWqgjzonR3DhuYicicUMc95W1gtXjYLIFM2gwjlKONZqG6+ X-Received: by 10.28.234.66 with SMTP id i63mr2617728wmh.43.1484128993792; Wed, 11 Jan 2017 02:03:13 -0800 (PST) Received: from penelope.isobedori.kobe.vergenet.net ([217.111.208.18]) by smtp.gmail.com with ESMTPSA id yo9sm7639689wjc.14.2017.01.11.02.03.12 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 11 Jan 2017 02:03:12 -0800 (PST) From: Simon Horman To: Stephen Hemminger Cc: Dinan Gunawardena , netdev@vger.kernel.org, Simon Horman Subject: [PATCH/RFC iproute2/net-next 2/2] tc: flower: Support matching ARP Date: Wed, 11 Jan 2017 11:03:04 +0100 Message-Id: <1484128984-11891-3-git-send-email-simon.horman@netronome.com> X-Mailer: git-send-email 2.7.0.rc3.207.g0ac5344 In-Reply-To: <1484128984-11891-1-git-send-email-simon.horman@netronome.com> References: <1484128984-11891-1-git-send-email-simon.horman@netronome.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Support matching on ARP operation, and hardware and protocol addresses for Ethernet hardware and IPv4 protocol addresses. Example usage: tc qdisc add dev eth0 ingress tc filter add dev eth0 protocol arp parent ffff: flower indev eth0 \ arp_op request arp_sip 10.0.0.1 action drop tc filter add dev eth0 protocol rarp parent ffff: flower indev eth0 \ arp_op reply arp_tha 52:54:3f:00:00:00/24 action drop Signed-off-by: Simon Horman --- man/man8/tc-flower.8 | 41 +++++++++- tc/f_flower.c | 208 +++++++++++++++++++++++++++++++++++++++++++++++---- 2 files changed, 232 insertions(+), 17 deletions(-) diff --git a/man/man8/tc-flower.8 b/man/man8/tc-flower.8 index 5904a9ecafdf..2dd2c5e6e4a5 100644 --- a/man/man8/tc-flower.8 +++ b/man/man8/tc-flower.8 @@ -34,7 +34,13 @@ flower \- flow based traffic control filter .BR dst_ip " | " src_ip " } " .IR PREFIX " | { " .BR dst_port " | " src_port " } " -.IR port_number " } | " +.IR port_number " } | { " +.BR arp_tip " | " arp_sip " } " +.IR PREFIX " | " +.BR arp_op " { " request " | " reply " | " +.IR OP " } | { " +.BR arp_tha " | " arp_sha " } " +.IR MASKED_LLADDR " | " .B enc_key_id .IR KEY-ID " | {" .BR enc_dst_ip " | " enc_src_ip " } { " @@ -131,6 +137,36 @@ Match on ICMP type or code. Only available for .BR ip_proto " values " icmp " and " icmpv6 which have to be specified in beforehand. .TP +.BI arp_tip " PREFIX" +.TQ +.BI arp_sip " PREFIX" +Match on ARP or RARP sender or target IP address. +.I PREFIX +must be a valid IPv4 address optionally followed by a slash and the prefix +length. If the prefix is missing, \fBtc\fR assumes a full-length host +match. +.TP +.BI arp_op " ARP_OP" +Match on ARP or RARP operation. +.I ARP_OP +may be +.BR request ", " reply +or an integer value 0, 1 or 2. A mask may be optionally provided to limit +the bits of the operation which are matched. A mask is provided by +following the address with a slash and then the mask. It may be provided as +an unsigned 8 bit value representing a bitwise mask. If the mask is missing +then a match on all bits is assumed. +.TP +.BI arp_sha " MASKED_LLADDR" +.TQ +.BI arp_tha " MASKED_LLADDR" +Match on ARP or RARP sender or target MAC address. A mask may be optionally +provided to limit the bits of the address which are matched. A mask is +provided by following the address with a slash and then the mask. It may be +provided in LLADDR format, in which case it is a bitwise mask, or as a +number of high bits to match. If the mask is missing then a match on all +bits is assumed. +.TP .BI enc_key_id " NUMBER" .TQ .BI enc_dst_ip " PREFIX" @@ -152,7 +188,8 @@ As stated above where applicable, matches of a certain layer implicitly depend on the matches of the next lower layer. Precisely, layer one and two matches (\fBindev\fR, \fBdst_mac\fR and \fBsrc_mac\fR) have no dependency, layer three matches -(\fBip_proto\fR, \fBdst_ip\fR and \fBsrc_ip\fR) +(\fBip_proto\fR, \fBdst_ip\fR, \fBsrc_ip\fR, \fBarp_tip\fR, \fBarp_sip\fR, +\fBarp_op\fR, \fBarp_tha\fR and \fBarp_sha\fR) depend on the .B protocol option of tc filter, layer four port matches diff --git a/tc/f_flower.c b/tc/f_flower.c index 99f5f8163ee0..d301db36a549 100644 --- a/tc/f_flower.c +++ b/tc/f_flower.c @@ -15,6 +15,7 @@ #include #include #include +#include #include #include #include @@ -54,6 +55,11 @@ static void explain(void) " src_port PORT-NUMBER |\n" " type ICMP-TYPE |\n" " code ICMP-CODE |\n" + " arp_tip PREFIX |\n" + " arp_sip PREFIX |\n" + " arp_op [ request | reply | OP ] |\n" + " arp_tha MASKED-LLADDR |\n" + " arp_sha MASKED-LLADDR |\n" " enc_dst_ip [ IPV4-ADDR | IPV6-ADDR ] |\n" " enc_src_ip [ IPV4-ADDR | IPV6-ADDR ] |\n" " enc_key_id [ KEY-ID ] |\n" @@ -192,27 +198,16 @@ err: return -1; } -static int flower_parse_ip_addr(char *str, __be16 eth_type, - int addr4_type, int mask4_type, - int addr6_type, int mask6_type, - struct nlmsghdr *n) +static int __flower_parse_ip_addr(char *str, int family, + int addr4_type, int mask4_type, + int addr6_type, int mask6_type, + struct nlmsghdr *n) { int ret; inet_prefix addr; - int family; int bits; int i; - if (eth_type == htons(ETH_P_IP)) { - family = AF_INET; - } else if (eth_type == htons(ETH_P_IPV6)) { - family = AF_INET6; - } else if (!eth_type) { - family = AF_UNSPEC; - } else { - return -1; - } - ret = get_prefix(&addr, str, family); if (ret) return -1; @@ -245,6 +240,89 @@ static int flower_parse_ip_addr(char *str, __be16 eth_type, return 0; } +static int flower_parse_ip_addr(char *str, __be16 eth_type, + int addr4_type, int mask4_type, + int addr6_type, int mask6_type, + struct nlmsghdr *n) +{ + int family; + + if (eth_type == htons(ETH_P_IP)) { + family = AF_INET; + } else if (eth_type == htons(ETH_P_IPV6)) { + family = AF_INET6; + } else if (!eth_type) { + family = AF_UNSPEC; + } else { + return -1; + } + + return __flower_parse_ip_addr(str, family, addr4_type, addr6_type, + mask4_type, mask6_type, n); +} + +static bool flower_eth_type_arp(__be16 eth_type) +{ + return eth_type == htons(ETH_P_ARP) || eth_type == htons(ETH_P_RARP); +} + +static int flower_parse_arp_ip_addr(char *str, __be16 eth_type, + int addr_type, int mask_type, + struct nlmsghdr *n) +{ + if (!flower_eth_type_arp(eth_type)) + return -1; + + return __flower_parse_ip_addr(str, AF_INET, addr_type, mask_type, + TCA_FLOWER_UNSPEC, TCA_FLOWER_UNSPEC, n); +} + +static int flower_parse_arp_op(char *str, __be16 eth_type, + int op_type, int mask_type, + struct nlmsghdr *n) +{ + char *slash; + int ret, err = -1; + uint8_t value, mask; + + slash = strchr(str, '/'); + if (slash) + *slash = '\0'; + + if (!flower_eth_type_arp(eth_type)) + goto err; + + if (!strcmp(str, "request")) { + value = ARPOP_REQUEST; + } else if (!strcmp(str, "reply")) { + value = ARPOP_REPLY; + } else { + ret = get_u8(&value, str, 10); + if (ret) + goto err; + if (value && value != ARPOP_REQUEST && value != ARPOP_REPLY) + goto err; + } + + if (slash) { + ret = get_u8(&mask, slash + 1, 10); + if (ret) + goto err; + } + else { + mask = UINT8_MAX; + } + + addattr8(n, MAX_MSG, op_type, value); + addattr8(n, MAX_MSG, mask_type, mask); + + err = 0; +err: + if (slash) + *slash = '/'; + return err; +} + static int flower_icmp_attr_type(__be16 eth_type, __u8 ip_proto, enum flower_icmp_field field) { @@ -530,6 +608,59 @@ static int flower_parse_opt(struct filter_util *qu, char *handle, fprintf(stderr, "Illegal \"icmp code\"\n"); return -1; } + } else if (matches(*argv, "arp_tip") == 0) { + NEXT_ARG(); + ret = flower_parse_arp_ip_addr(*argv, vlan_ethtype ? + vlan_ethtype : eth_type, + TCA_FLOWER_KEY_ARP_TIP, + TCA_FLOWER_KEY_ARP_TIP_MASK, + n); + if (ret < 0) { + fprintf(stderr, "Illegal \"arp_tip\"\n"); + return -1; + } + } else if (matches(*argv, "arp_sip") == 0) { + NEXT_ARG(); + ret = flower_parse_arp_ip_addr(*argv, vlan_ethtype ? + vlan_ethtype : eth_type, + TCA_FLOWER_KEY_ARP_SIP, + TCA_FLOWER_KEY_ARP_SIP_MASK, + n); + if (ret < 0) { + fprintf(stderr, "Illegal \"arp_sip\"\n"); + return -1; + } + } else if (matches(*argv, "arp_op") == 0) { + NEXT_ARG(); + ret = flower_parse_arp_op(*argv, vlan_ethtype ? + vlan_ethtype : eth_type, + TCA_FLOWER_KEY_ARP_OP, + TCA_FLOWER_KEY_ARP_OP_MASK, + n); + if (ret < 0) { + fprintf(stderr, "Illegal \"arp_op\"\n"); + return -1; + } + } else if (matches(*argv, "arp_tha") == 0) { + NEXT_ARG(); + ret = flower_parse_eth_addr(*argv, + TCA_FLOWER_KEY_ARP_THA, + TCA_FLOWER_KEY_ARP_THA_MASK, + n); + if (ret < 0) { + fprintf(stderr, "Illegal \"arp_tha\"\n"); + return -1; + } + } else if (matches(*argv, "arp_sha") == 0) { + NEXT_ARG(); + ret = flower_parse_eth_addr(*argv, + TCA_FLOWER_KEY_ARP_SHA, + TCA_FLOWER_KEY_ARP_SHA_MASK, + n); + if (ret < 0) { + fprintf(stderr, "Illegal \"arp_sha\"\n"); + return -1; + } } else if (matches(*argv, "enc_dst_ip") == 0) { NEXT_ARG(); ret = flower_parse_ip_addr(*argv, 0, @@ -662,6 +793,10 @@ static void flower_print_eth_type(FILE *f, __be16 *p_eth_type, fprintf(f, "ipv4"); else if (eth_type == htons(ETH_P_IPV6)) fprintf(f, "ipv6"); + else if (eth_type == htons(ETH_P_ARP)) + fprintf(f, "arp"); + else if (eth_type == htons(ETH_P_RARP)) + fprintf(f, "rarp"); else fprintf(f, "%04x", ntohs(eth_type)); *p_eth_type = eth_type; @@ -739,6 +874,13 @@ static void flower_print_ip_addr(FILE *f, char *name, __be16 eth_type, else if (bits < len * 8) fprintf(f, "/%d", bits); } +static void flower_print_ip4_addr(FILE *f, char *name, + struct rtattr *addr_attr, + struct rtattr *mask_attr) +{ + return flower_print_ip_addr(f, name, htons(ETH_P_IP), + addr_attr, mask_attr, 0, 0); +} static void flower_print_port(FILE *f, char *name, struct rtattr *attr) { @@ -759,6 +901,31 @@ static void flower_print_icmp(FILE *f, char *name, struct rtattr *attr) fprintf(f, "\n %s %d", name, rta_getattr_u8(attr)); } +static void flower_print_arp_op(FILE *f, char *name, + struct rtattr *op_attr, + struct rtattr *mask_attr) +{ + uint8_t op, mask; + + if (!op_attr) + return; + + op = rta_getattr_u8(op_attr); + mask = mask_attr ? rta_getattr_u8(mask_attr) : UINT8_MAX; + + fprintf(f, "\n %s ", name); + + if (mask == UINT8_MAX && op == ARPOP_REQUEST) + fprintf(f, "request"); + else if (mask == UINT8_MAX && op == ARPOP_REPLY) + fprintf(f, "reply"); + else + fprintf(f, "%d", op); + + if (mask != UINT8_MAX) + fprintf(f, "/%d", mask); +} + static int flower_print_opt(struct filter_util *qu, FILE *f, struct rtattr *opt, __u32 handle) { @@ -834,6 +1001,17 @@ static int flower_print_opt(struct filter_util *qu, FILE *f, if (nl_type >= 0) flower_print_icmp(f, "icmp_code", tb[nl_type]); + flower_print_ip4_addr(f, "arp_sip", tb[TCA_FLOWER_KEY_ARP_SIP], + tb[TCA_FLOWER_KEY_ARP_SIP_MASK]); + flower_print_ip4_addr(f, "arp_tip", tb[TCA_FLOWER_KEY_ARP_TIP], + tb[TCA_FLOWER_KEY_ARP_TIP_MASK]); + flower_print_arp_op(f, "arp_op", tb[TCA_FLOWER_KEY_ARP_OP], + tb[TCA_FLOWER_KEY_ARP_OP_MASK]); + flower_print_eth_addr(f, "arp_sha", tb[TCA_FLOWER_KEY_ARP_SHA], + tb[TCA_FLOWER_KEY_ARP_SHA_MASK]); + flower_print_eth_addr(f, "arp_tha", tb[TCA_FLOWER_KEY_ARP_THA], + tb[TCA_FLOWER_KEY_ARP_THA_MASK]); + flower_print_ip_addr(f, "enc_dst_ip", tb[TCA_FLOWER_KEY_ENC_IPV4_DST_MASK] ? htons(ETH_P_IP) : htons(ETH_P_IPV6),