From patchwork Wed Sep 27 08:16:34 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Horman X-Patchwork-Id: 819023 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=netronome-com.20150623.gappssmtp.com header.i=@netronome-com.20150623.gappssmtp.com header.b="Xvr0IRvl"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3y29f94Dflz9t3x for ; Wed, 27 Sep 2017 18:17:05 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752310AbdI0IRD (ORCPT ); Wed, 27 Sep 2017 04:17:03 -0400 Received: from mail-qk0-f176.google.com ([209.85.220.176]:56491 "EHLO mail-qk0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751739AbdI0IQ4 (ORCPT ); Wed, 27 Sep 2017 04:16:56 -0400 Received: by mail-qk0-f176.google.com with SMTP id g128so12516600qke.13 for ; Wed, 27 Sep 2017 01:16:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netronome-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=WacshCLr7T3VFY4GN7fCftaYMRergJM3BGaBGgi2Rt4=; b=Xvr0IRvlKBfb5e4zY1KJPh9UBXQvLKLCDgpjwftAPhBlrPcP1hYoPHghFKPGZWeHMw XP2bebHSXaijWAlwcWMMxyo5pLgmXESO0NrG/dN32QmhJ7n2NoDnRt+2ZsLhjlgI69wB J24qGIL+Hivmc45fXXpmBB26PGL/ffnJbLX19NjPhZcusdBQdxHmskXnl8tOMAUJX+L/ lcAxV9W2S2nX0M9DK/z0h0w+dPl4iAU9CUcJjDabkaRnQR81S/cPIz3LpWweeH46HDFW sBANmHtif1bXxlJ6kWaAID1BTn5B3jWSvLmAh+8B8EQ5fjJq02W/NJV+bXlUXC5ADF5o ElsQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=WacshCLr7T3VFY4GN7fCftaYMRergJM3BGaBGgi2Rt4=; b=HBA2Y/BvPILgED60OULxz4evwByJSBQdAOtAf2rJpNarhjkOqPV9q/82eY9/JehUR6 KazCcg5Aw69FjOaCYl8ouEZYWKH7xiUtxBqbNZuEJg2EPBo2FNvKznSkBmG5mUdidPBy QBrlRy8sdw/vzlCMOHU1h+G/GGRUS986QjnMLXeVEslp94GLnIgcSjCc+st6iCpph2I1 aDzbyu/DqoctLdNFL6qpM3jywHjJF7qXKnBnFvz6XSEflKYt76HNBA0wTKDqXhy9Js5u OtVY7YWC4fR2pl19KBQNIT/MXLdO0OGZ8IXI3Y6iIxuehGt1Ka7lINi4P1OXC2n5EcKl Ptsw== X-Gm-Message-State: AHPjjUgkEjmzjEzTQ9cPCq81c4jsuhK14fJhrl7am3lT8G3Is1pBl7p/ CQBLwgWohiiRWS9cubCdYEblig== X-Google-Smtp-Source: AOwi7QBwTkLA13iGfqmGQdOk0moUCzTCgUgJn3ZOstTdTFmLC6t9FLdvsW2uoeEuLEdIvPLrWGLi/A== X-Received: by 10.55.198.152 with SMTP id s24mr1268557qkl.3.1506500215159; Wed, 27 Sep 2017 01:16:55 -0700 (PDT) Received: from penelope.pa.netronome.com ([217.111.208.18]) by smtp.gmail.com with ESMTPSA id y15sm8419611qtc.4.2017.09.27.01.16.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 27 Sep 2017 01:16:54 -0700 (PDT) From: Simon Horman To: David Miller , Jiri Pirko Cc: Jamal Hadi Salim , Cong Wang , netdev@vger.kernel.org, oss-drivers@netronome.com, Simon Horman Subject: [PATCH v2 net-next 2/2] net/sched: allow flower to match tunnel options Date: Wed, 27 Sep 2017 10:16:34 +0200 Message-Id: <1506500194-17637-3-git-send-email-simon.horman@netronome.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1506500194-17637-1-git-send-email-simon.horman@netronome.com> References: <1506500194-17637-1-git-send-email-simon.horman@netronome.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Allow matching on options in tunnel headers. This makes use of existing tunnel metadata support. Options are a bytestring of up to 256 bytes. Tunnel implementations may support less or more options, or no options at all. e.g. # ip link add name geneve0 type geneve dstport 0 external # tc qdisc add dev geneve0 ingress # tc filter add dev geneve0 protocol ip parent ffff: \ flower \ enc_src_ip 10.0.99.192 \ enc_dst_ip 10.0.99.193 \ enc_key_id 11 \ enc_opts 0102800100800020/fffffffffffffff0 \ ip_proto udp \ action mirred egress redirect dev eth1 Signed-off-by: Simon Horman Reviewed-by: Jakub Kicinski --- v2 * Correct example which was incorrectly described setting rather than matching tunnel options --- include/net/flow_dissector.h | 13 +++++++++++++ include/uapi/linux/pkt_cls.h | 3 +++ net/sched/cls_flower.c | 35 ++++++++++++++++++++++++++++++++++- 3 files changed, 50 insertions(+), 1 deletion(-) diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h index fc3dce730a6b..43f98bf0b349 100644 --- a/include/net/flow_dissector.h +++ b/include/net/flow_dissector.h @@ -183,6 +183,18 @@ struct flow_dissector_key_ip { __u8 ttl; }; +/** + * struct flow_dissector_key_enc_opts: + * @data: data + * @len: len + */ +struct flow_dissector_key_enc_opts { + u8 data[256]; /* Using IP_TUNNEL_OPTS_MAX is desired here + * but seems difficult to #include + */ + u8 len; +}; + enum flow_dissector_key_id { FLOW_DISSECTOR_KEY_CONTROL, /* struct flow_dissector_key_control */ FLOW_DISSECTOR_KEY_BASIC, /* struct flow_dissector_key_basic */ @@ -205,6 +217,7 @@ enum flow_dissector_key_id { FLOW_DISSECTOR_KEY_MPLS, /* struct flow_dissector_key_mpls */ FLOW_DISSECTOR_KEY_TCP, /* struct flow_dissector_key_tcp */ FLOW_DISSECTOR_KEY_IP, /* struct flow_dissector_key_ip */ + FLOW_DISSECTOR_KEY_ENC_OPTS, /* struct flow_dissector_key_enc_opts */ FLOW_DISSECTOR_KEY_MAX, }; diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h index d5e2bf68d0d4..7a09a28f21e0 100644 --- a/include/uapi/linux/pkt_cls.h +++ b/include/uapi/linux/pkt_cls.h @@ -467,6 +467,9 @@ enum { TCA_FLOWER_KEY_IP_TTL, /* u8 */ TCA_FLOWER_KEY_IP_TTL_MASK, /* u8 */ + TCA_FLOWER_KEY_ENC_OPTS, + TCA_FLOWER_KEY_ENC_OPTS_MASK, + __TCA_FLOWER_MAX, }; diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c index d230cb4c8094..e72a17c46f07 100644 --- a/net/sched/cls_flower.c +++ b/net/sched/cls_flower.c @@ -51,6 +51,7 @@ struct fl_flow_key { struct flow_dissector_key_mpls mpls; struct flow_dissector_key_tcp tcp; struct flow_dissector_key_ip ip; + struct flow_dissector_key_enc_opts enc_opts; } __aligned(BITS_PER_LONG / 8); /* Ensure that we can do comparisons as longs. */ struct fl_flow_mask_range { @@ -181,6 +182,11 @@ static int fl_classify(struct sk_buff *skb, const struct tcf_proto *tp, skb_key.enc_key_id.keyid = tunnel_id_to_key32(key->tun_id); skb_key.enc_tp.src = key->tp_src; skb_key.enc_tp.dst = key->tp_dst; + + if (info->options_len) { + skb_key.enc_opts.len = info->options_len; + ip_tunnel_info_opts_get(skb_key.enc_opts.data, info); + } } skb_key.indev_ifindex = skb->skb_iif; @@ -421,6 +427,8 @@ static const struct nla_policy fl_policy[TCA_FLOWER_MAX + 1] = { [TCA_FLOWER_KEY_IP_TOS_MASK] = { .type = NLA_U8 }, [TCA_FLOWER_KEY_IP_TTL] = { .type = NLA_U8 }, [TCA_FLOWER_KEY_IP_TTL_MASK] = { .type = NLA_U8 }, + [TCA_FLOWER_KEY_ENC_OPTS] = { .type = NLA_BINARY }, + [TCA_FLOWER_KEY_ENC_OPTS_MASK] = { .type = NLA_BINARY }, }; static void fl_set_key_val(struct nlattr **tb, @@ -712,6 +720,26 @@ static int fl_set_key(struct net *net, struct nlattr **tb, &mask->enc_tp.dst, TCA_FLOWER_KEY_ENC_UDP_DST_PORT_MASK, sizeof(key->enc_tp.dst)); + if (tb[TCA_FLOWER_KEY_ENC_OPTS]) { + key->enc_opts.len = nla_len(tb[TCA_FLOWER_KEY_ENC_OPTS]); + + if (key->enc_opts.len > sizeof(key->enc_opts.data)) + return -EINVAL; + + /* enc_opts is variable length. + * If present ensure the value and mask are the same length. + */ + if (tb[TCA_FLOWER_KEY_ENC_OPTS_MASK] && + nla_len(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]) != key->enc_opts.len) + return -EINVAL; + + mask->enc_opts.len = key->enc_opts.len; + fl_set_key_val(tb, key->enc_opts.data, TCA_FLOWER_KEY_ENC_OPTS, + mask->enc_opts.data, + TCA_FLOWER_KEY_ENC_OPTS_MASK, + key->enc_opts.len); + } + if (tb[TCA_FLOWER_KEY_FLAGS]) ret = fl_set_key_flags(tb, &key->control.flags, &mask->control.flags); @@ -804,6 +832,8 @@ static void fl_init_dissector(struct cls_fl_head *head, enc_control); FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt, FLOW_DISSECTOR_KEY_ENC_PORTS, enc_tp); + FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt, + FLOW_DISSECTOR_KEY_ENC_OPTS, enc_opts); skb_flow_dissector_init(&head->dissector, keys, cnt); } @@ -1330,7 +1360,10 @@ static int fl_dump(struct net *net, struct tcf_proto *tp, void *fh, TCA_FLOWER_KEY_ENC_UDP_DST_PORT, &mask->enc_tp.dst, TCA_FLOWER_KEY_ENC_UDP_DST_PORT_MASK, - sizeof(key->enc_tp.dst))) + sizeof(key->enc_tp.dst)) || + fl_dump_key_val(skb, key->enc_opts.data, TCA_FLOWER_KEY_ENC_OPTS, + mask->enc_opts.data, TCA_FLOWER_KEY_ENC_OPTS_MASK, + key->enc_opts.len)) goto nla_put_failure; if (fl_dump_key_flags(skb, key->control.flags, mask->control.flags))