| Message ID | 20211124193327.2736-1-cpp.code.lv@gmail.com |
|---|---|
| State | Awaiting Upstream |
| Headers | show |
| Series | [ovs-dev,net-next,v8] net: openvswitch: IPv6: Add IPv6 extension header support | expand |
On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <cpp.code.lv@gmail.com> wrote: > > This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and > packets can be filtered using ipv6_ext flag. > > Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com> > --- > include/uapi/linux/openvswitch.h | 6 ++ > net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++ > net/openvswitch/flow.h | 14 ++++ > net/openvswitch/flow_netlink.c | 26 +++++- > 4 files changed, 184 insertions(+), 2 deletions(-) > > diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h > index a87b44cd5590..43790f07e4a2 100644 > --- a/include/uapi/linux/openvswitch.h > +++ b/include/uapi/linux/openvswitch.h > @@ -342,6 +342,7 @@ enum ovs_key_attr { > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */ > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */ > OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */ > + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */ > > #ifdef __KERNEL__ > OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */ > @@ -421,6 +422,11 @@ struct ovs_key_ipv6 { > __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */ > }; > > +/* separate structure to support backward compatibility with older user space */ > +struct ovs_key_ipv6_exthdrs { > + __u16 hdrs; > +}; > + > struct ovs_key_tcp { > __be16 tcp_src; > __be16 tcp_dst; > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c > index 9d375e74b607..28acb40437ca 100644 > --- a/net/openvswitch/flow.c > +++ b/net/openvswitch/flow.c > @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb) > sizeof(struct icmphdr)); > } > > +/** > + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags. > + * > + * @skb: buffer where extension header data starts in packet > + * @nh: ipv6 header > + * @ext_hdrs: flags are stored here > + * > + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header > + * is unexpectedly encountered. (Two destination options headers may be > + * expected and would not cause this bit to be set.) > + * > + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order > + * preferred (but not required) by RFC 2460: > + * > + * When more than one extension header is used in the same packet, it is > + * recommended that those headers appear in the following order: > + * IPv6 header > + * Hop-by-Hop Options header > + * Destination Options header > + * Routing header > + * Fragment header > + * Authentication header > + * Encapsulating Security Payload header > + * Destination Options header > + * upper-layer header > + */ > +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, > + u16 *ext_hdrs) > +{ > + u8 next_type = nh->nexthdr; > + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr); > + int dest_options_header_count = 0; > + > + *ext_hdrs = 0; > + > + while (ipv6_ext_hdr(next_type)) { > + struct ipv6_opt_hdr _hdr, *hp; > + > + switch (next_type) { > + case IPPROTO_NONE: > + *ext_hdrs |= OFPIEH12_NONEXT; > + /* stop parsing */ > + return; > + > + case IPPROTO_ESP: > + if (*ext_hdrs & OFPIEH12_ESP) > + *ext_hdrs |= OFPIEH12_UNREP; > + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST | > + OFPIEH12_ROUTER | IPPROTO_FRAGMENT | > + OFPIEH12_AUTH | OFPIEH12_UNREP)) || > + dest_options_header_count >= 2) { > + *ext_hdrs |= OFPIEH12_UNSEQ; > + } > + *ext_hdrs |= OFPIEH12_ESP; > + break; you need to check_header() before looking into each extension header.
On Wed, Dec 1, 2021 at 11:34 PM Pravin Shelar <pravin.ovn@gmail.com> wrote: > > On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <cpp.code.lv@gmail.com> wrote: > > > > This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and > > packets can be filtered using ipv6_ext flag. > > > > Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com> > > --- > > include/uapi/linux/openvswitch.h | 6 ++ > > net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++ > > net/openvswitch/flow.h | 14 ++++ > > net/openvswitch/flow_netlink.c | 26 +++++- > > 4 files changed, 184 insertions(+), 2 deletions(-) > > > > diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h > > index a87b44cd5590..43790f07e4a2 100644 > > --- a/include/uapi/linux/openvswitch.h > > +++ b/include/uapi/linux/openvswitch.h > > @@ -342,6 +342,7 @@ enum ovs_key_attr { > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */ > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */ > > OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */ > > + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */ > > > > #ifdef __KERNEL__ > > OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */ > > @@ -421,6 +422,11 @@ struct ovs_key_ipv6 { > > __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */ > > }; > > > > +/* separate structure to support backward compatibility with older user space */ > > +struct ovs_key_ipv6_exthdrs { > > + __u16 hdrs; > > +}; > > + > > struct ovs_key_tcp { > > __be16 tcp_src; > > __be16 tcp_dst; > > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c > > index 9d375e74b607..28acb40437ca 100644 > > --- a/net/openvswitch/flow.c > > +++ b/net/openvswitch/flow.c > > @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb) > > sizeof(struct icmphdr)); > > } > > > > +/** > > + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags. > > + * > > + * @skb: buffer where extension header data starts in packet > > + * @nh: ipv6 header > > + * @ext_hdrs: flags are stored here > > + * > > + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header > > + * is unexpectedly encountered. (Two destination options headers may be > > + * expected and would not cause this bit to be set.) > > + * > > + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order > > + * preferred (but not required) by RFC 2460: > > + * > > + * When more than one extension header is used in the same packet, it is > > + * recommended that those headers appear in the following order: > > + * IPv6 header > > + * Hop-by-Hop Options header > > + * Destination Options header > > + * Routing header > > + * Fragment header > > + * Authentication header > > + * Encapsulating Security Payload header > > + * Destination Options header > > + * upper-layer header > > + */ > > +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, > > + u16 *ext_hdrs) > > +{ > > + u8 next_type = nh->nexthdr; > > + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr); > > + int dest_options_header_count = 0; > > + > > + *ext_hdrs = 0; > > + > > + while (ipv6_ext_hdr(next_type)) { > > + struct ipv6_opt_hdr _hdr, *hp; > > + > > + switch (next_type) { > > + case IPPROTO_NONE: > > + *ext_hdrs |= OFPIEH12_NONEXT; > > + /* stop parsing */ > > + return; > > + > > + case IPPROTO_ESP: > > + if (*ext_hdrs & OFPIEH12_ESP) > > + *ext_hdrs |= OFPIEH12_UNREP; > > + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST | > > + OFPIEH12_ROUTER | IPPROTO_FRAGMENT | > > + OFPIEH12_AUTH | OFPIEH12_UNREP)) || > > + dest_options_header_count >= 2) { > > + *ext_hdrs |= OFPIEH12_UNSEQ; > > + } > > + *ext_hdrs |= OFPIEH12_ESP; > > + break; > you need to check_header() before looking into each extension header. Could you elaborate why I need to add check_header(), skb_header_pointer() is doing sanitization.
On Thu, Dec 2, 2021 at 12:20 PM Cpp Code <cpp.code.lv@gmail.com> wrote: > > On Wed, Dec 1, 2021 at 11:34 PM Pravin Shelar <pravin.ovn@gmail.com> wrote: > > > > On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <cpp.code.lv@gmail.com> wrote: > > > > > > This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and > > > packets can be filtered using ipv6_ext flag. > > > > > > Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com> > > > --- > > > include/uapi/linux/openvswitch.h | 6 ++ > > > net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++ > > > net/openvswitch/flow.h | 14 ++++ > > > net/openvswitch/flow_netlink.c | 26 +++++- > > > 4 files changed, 184 insertions(+), 2 deletions(-) > > > > > > diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h > > > index a87b44cd5590..43790f07e4a2 100644 > > > --- a/include/uapi/linux/openvswitch.h > > > +++ b/include/uapi/linux/openvswitch.h > > > @@ -342,6 +342,7 @@ enum ovs_key_attr { > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */ > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */ > > > OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */ > > > + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */ > > > > > > #ifdef __KERNEL__ > > > OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */ > > > @@ -421,6 +422,11 @@ struct ovs_key_ipv6 { > > > __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */ > > > }; > > > > > > +/* separate structure to support backward compatibility with older user space */ > > > +struct ovs_key_ipv6_exthdrs { > > > + __u16 hdrs; > > > +}; > > > + > > > struct ovs_key_tcp { > > > __be16 tcp_src; > > > __be16 tcp_dst; > > > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c > > > index 9d375e74b607..28acb40437ca 100644 > > > --- a/net/openvswitch/flow.c > > > +++ b/net/openvswitch/flow.c > > > @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb) > > > sizeof(struct icmphdr)); > > > } > > > > > > +/** > > > + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags. > > > + * > > > + * @skb: buffer where extension header data starts in packet > > > + * @nh: ipv6 header > > > + * @ext_hdrs: flags are stored here > > > + * > > > + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header > > > + * is unexpectedly encountered. (Two destination options headers may be > > > + * expected and would not cause this bit to be set.) > > > + * > > > + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order > > > + * preferred (but not required) by RFC 2460: > > > + * > > > + * When more than one extension header is used in the same packet, it is > > > + * recommended that those headers appear in the following order: > > > + * IPv6 header > > > + * Hop-by-Hop Options header > > > + * Destination Options header > > > + * Routing header > > > + * Fragment header > > > + * Authentication header > > > + * Encapsulating Security Payload header > > > + * Destination Options header > > > + * upper-layer header > > > + */ > > > +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, > > > + u16 *ext_hdrs) > > > +{ > > > + u8 next_type = nh->nexthdr; > > > + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr); > > > + int dest_options_header_count = 0; > > > + > > > + *ext_hdrs = 0; > > > + > > > + while (ipv6_ext_hdr(next_type)) { > > > + struct ipv6_opt_hdr _hdr, *hp; > > > + > > > + switch (next_type) { > > > + case IPPROTO_NONE: > > > + *ext_hdrs |= OFPIEH12_NONEXT; > > > + /* stop parsing */ > > > + return; > > > + > > > + case IPPROTO_ESP: > > > + if (*ext_hdrs & OFPIEH12_ESP) > > > + *ext_hdrs |= OFPIEH12_UNREP; > > > + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST | > > > + OFPIEH12_ROUTER | IPPROTO_FRAGMENT | > > > + OFPIEH12_AUTH | OFPIEH12_UNREP)) || > > > + dest_options_header_count >= 2) { > > > + *ext_hdrs |= OFPIEH12_UNSEQ; > > > + } > > > + *ext_hdrs |= OFPIEH12_ESP; > > > + break; > > you need to check_header() before looking into each extension header. > > Could you elaborate why I need to add check_header(), > skb_header_pointer() is doing sanitization. I mean check_header() would allow you to read the header without copying the bits, it is used in ovs flow extraction so its usual check.
On Thu, Dec 2, 2021 at 9:28 PM Pravin Shelar <pravin.ovn@gmail.com> wrote: > > On Thu, Dec 2, 2021 at 12:20 PM Cpp Code <cpp.code.lv@gmail.com> wrote: > > > > On Wed, Dec 1, 2021 at 11:34 PM Pravin Shelar <pravin.ovn@gmail.com> wrote: > > > > > > On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <cpp.code.lv@gmail.com> wrote: > > > > > > > > This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and > > > > packets can be filtered using ipv6_ext flag. > > > > > > > > Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com> > > > > --- > > > > include/uapi/linux/openvswitch.h | 6 ++ > > > > net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++ > > > > net/openvswitch/flow.h | 14 ++++ > > > > net/openvswitch/flow_netlink.c | 26 +++++- > > > > 4 files changed, 184 insertions(+), 2 deletions(-) > > > > > > > > diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h > > > > index a87b44cd5590..43790f07e4a2 100644 > > > > --- a/include/uapi/linux/openvswitch.h > > > > +++ b/include/uapi/linux/openvswitch.h > > > > @@ -342,6 +342,7 @@ enum ovs_key_attr { > > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */ > > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */ > > > > OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */ > > > > + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */ > > > > > > > > #ifdef __KERNEL__ > > > > OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */ > > > > @@ -421,6 +422,11 @@ struct ovs_key_ipv6 { > > > > __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */ > > > > }; > > > > > > > > +/* separate structure to support backward compatibility with older user space */ > > > > +struct ovs_key_ipv6_exthdrs { > > > > + __u16 hdrs; > > > > +}; > > > > + > > > > struct ovs_key_tcp { > > > > __be16 tcp_src; > > > > __be16 tcp_dst; > > > > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c > > > > index 9d375e74b607..28acb40437ca 100644 > > > > --- a/net/openvswitch/flow.c > > > > +++ b/net/openvswitch/flow.c > > > > @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb) > > > > sizeof(struct icmphdr)); > > > > } > > > > > > > > +/** > > > > + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags. > > > > + * > > > > + * @skb: buffer where extension header data starts in packet > > > > + * @nh: ipv6 header > > > > + * @ext_hdrs: flags are stored here > > > > + * > > > > + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header > > > > + * is unexpectedly encountered. (Two destination options headers may be > > > > + * expected and would not cause this bit to be set.) > > > > + * > > > > + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order > > > > + * preferred (but not required) by RFC 2460: > > > > + * > > > > + * When more than one extension header is used in the same packet, it is > > > > + * recommended that those headers appear in the following order: > > > > + * IPv6 header > > > > + * Hop-by-Hop Options header > > > > + * Destination Options header > > > > + * Routing header > > > > + * Fragment header > > > > + * Authentication header > > > > + * Encapsulating Security Payload header > > > > + * Destination Options header > > > > + * upper-layer header > > > > + */ > > > > +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, > > > > + u16 *ext_hdrs) > > > > +{ > > > > + u8 next_type = nh->nexthdr; > > > > + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr); > > > > + int dest_options_header_count = 0; > > > > + > > > > + *ext_hdrs = 0; > > > > + > > > > + while (ipv6_ext_hdr(next_type)) { > > > > + struct ipv6_opt_hdr _hdr, *hp; > > > > + > > > > + switch (next_type) { > > > > + case IPPROTO_NONE: > > > > + *ext_hdrs |= OFPIEH12_NONEXT; > > > > + /* stop parsing */ > > > > + return; > > > > + > > > > + case IPPROTO_ESP: > > > > + if (*ext_hdrs & OFPIEH12_ESP) > > > > + *ext_hdrs |= OFPIEH12_UNREP; > > > > + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST | > > > > + OFPIEH12_ROUTER | IPPROTO_FRAGMENT | > > > > + OFPIEH12_AUTH | OFPIEH12_UNREP)) || > > > > + dest_options_header_count >= 2) { > > > > + *ext_hdrs |= OFPIEH12_UNSEQ; > > > > + } > > > > + *ext_hdrs |= OFPIEH12_ESP; > > > > + break; > > > you need to check_header() before looking into each extension header. > > > > Could you elaborate why I need to add check_header(), > > skb_header_pointer() is doing sanitization. > > I mean check_header() would allow you to read the header without > copying the bits, it is used in ovs flow extraction so its usual > check. But check_header() will call *__pskb_pull_tail which in turn will copy bits if data will be fragmented. /* Moves tail of skb head forward, copying data from fragmented part, * when it is necessary. * 1. It may fail due to malloc failure. * 2. It may change skb pointers. * * It is pretty complicated. Luckily, it is called only in exceptional cases. */ void *__pskb_pull_tail(struct sk_buff *skb, int delta) as well I noticed that for example commit 4a06fa67c4da20148803525151845276cdb995c1 is moving from pskb_may_pull() to skb_header_pointer()
() On Mon, Dec 6, 2021 at 3:00 PM Cpp Code <cpp.code.lv@gmail.com> wrote: > > On Thu, Dec 2, 2021 at 9:28 PM Pravin Shelar <pravin.ovn@gmail.com> wrote: > > > > On Thu, Dec 2, 2021 at 12:20 PM Cpp Code <cpp.code.lv@gmail.com> wrote: > > > > > > On Wed, Dec 1, 2021 at 11:34 PM Pravin Shelar <pravin.ovn@gmail.com> wrote: > > > > > > > > On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <cpp.code.lv@gmail.com> wrote: > > > > > > > > > > This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and > > > > > packets can be filtered using ipv6_ext flag. > > > > > > > > > > Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com> > > > > > --- > > > > > include/uapi/linux/openvswitch.h | 6 ++ > > > > > net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++ > > > > > net/openvswitch/flow.h | 14 ++++ > > > > > net/openvswitch/flow_netlink.c | 26 +++++- > > > > > 4 files changed, 184 insertions(+), 2 deletions(-) > > > > > > > > > > diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h > > > > > index a87b44cd5590..43790f07e4a2 100644 > > > > > --- a/include/uapi/linux/openvswitch.h > > > > > +++ b/include/uapi/linux/openvswitch.h > > > > > @@ -342,6 +342,7 @@ enum ovs_key_attr { > > > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */ > > > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */ > > > > > OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */ > > > > > + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */ > > > > > > > > > > #ifdef __KERNEL__ > > > > > OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */ > > > > > @@ -421,6 +422,11 @@ struct ovs_key_ipv6 { > > > > > __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */ > > > > > }; > > > > > > > > > > +/* separate structure to support backward compatibility with older user space */ > > > > > +struct ovs_key_ipv6_exthdrs { > > > > > + __u16 hdrs; > > > > > +}; > > > > > + > > > > > struct ovs_key_tcp { > > > > > __be16 tcp_src; > > > > > __be16 tcp_dst; > > > > > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c > > > > > index 9d375e74b607..28acb40437ca 100644 > > > > > --- a/net/openvswitch/flow.c > > > > > +++ b/net/openvswitch/flow.c > > > > > @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb) > > > > > sizeof(struct icmphdr)); > > > > > } > > > > > > > > > > +/** > > > > > + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags. > > > > > + * > > > > > + * @skb: buffer where extension header data starts in packet > > > > > + * @nh: ipv6 header > > > > > + * @ext_hdrs: flags are stored here > > > > > + * > > > > > + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header > > > > > + * is unexpectedly encountered. (Two destination options headers may be > > > > > + * expected and would not cause this bit to be set.) > > > > > + * > > > > > + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order > > > > > + * preferred (but not required) by RFC 2460: > > > > > + * > > > > > + * When more than one extension header is used in the same packet, it is > > > > > + * recommended that those headers appear in the following order: > > > > > + * IPv6 header > > > > > + * Hop-by-Hop Options header > > > > > + * Destination Options header > > > > > + * Routing header > > > > > + * Fragment header > > > > > + * Authentication header > > > > > + * Encapsulating Security Payload header > > > > > + * Destination Options header > > > > > + * upper-layer header > > > > > + */ > > > > > +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, > > > > > + u16 *ext_hdrs) > > > > > +{ > > > > > + u8 next_type = nh->nexthdr; > > > > > + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr); > > > > > + int dest_options_header_count = 0; > > > > > + > > > > > + *ext_hdrs = 0; > > > > > + > > > > > + while (ipv6_ext_hdr(next_type)) { > > > > > + struct ipv6_opt_hdr _hdr, *hp; > > > > > + > > > > > + switch (next_type) { > > > > > + case IPPROTO_NONE: > > > > > + *ext_hdrs |= OFPIEH12_NONEXT; > > > > > + /* stop parsing */ > > > > > + return; > > > > > + > > > > > + case IPPROTO_ESP: > > > > > + if (*ext_hdrs & OFPIEH12_ESP) > > > > > + *ext_hdrs |= OFPIEH12_UNREP; > > > > > + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST | > > > > > + OFPIEH12_ROUTER | IPPROTO_FRAGMENT | > > > > > + OFPIEH12_AUTH | OFPIEH12_UNREP)) || > > > > > + dest_options_header_count >= 2) { > > > > > + *ext_hdrs |= OFPIEH12_UNSEQ; > > > > > + } > > > > > + *ext_hdrs |= OFPIEH12_ESP; > > > > > + break; > > > > you need to check_header() before looking into each extension header. > > > > > > Could you elaborate why I need to add check_header(), > > > skb_header_pointer() is doing sanitization. > > > > I mean check_header() would allow you to read the header without > > copying the bits, it is used in ovs flow extraction so its usual > > check. > > But check_header() will call *__pskb_pull_tail which in turn will copy > bits if data will be fragmented. > OVS flow extract uses this function to extract flow upto L4, so skb_header_pointer() is not saving any copy operation. > /* Moves tail of skb head forward, copying data from fragmented part, > * when it is necessary. > * 1. It may fail due to malloc failure. > * 2. It may change skb pointers. > * > * It is pretty complicated. Luckily, it is called only in exceptional cases. > */ > void *__pskb_pull_tail(struct sk_buff *skb, int delta) > > as well I noticed that for example commit > 4a06fa67c4da20148803525151845276cdb995c1 is moving from > pskb_may_pull() to skb_header_pointer() ok, I see advantage of using skb_header_pointer() in this case, but replacing all check_header() with skb_header_pointer() would add lot of copy operation in flow extract. Anyways for this use case skb_header_pointer() is fine. Acked-by: Pravin B Shelar <pshelar@ovn.org>
On Thu, Dec 9, 2021 at 11:36 PM Pravin Shelar <pravin.ovn@gmail.com> wrote: > > () > > On Mon, Dec 6, 2021 at 3:00 PM Cpp Code <cpp.code.lv@gmail.com> wrote: > > > > On Thu, Dec 2, 2021 at 9:28 PM Pravin Shelar <pravin.ovn@gmail.com> wrote: > > > > > > On Thu, Dec 2, 2021 at 12:20 PM Cpp Code <cpp.code.lv@gmail.com> wrote: > > > > > > > > On Wed, Dec 1, 2021 at 11:34 PM Pravin Shelar <pravin.ovn@gmail.com> wrote: > > > > > > > > > > On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <cpp.code.lv@gmail.com> wrote: > > > > > > > > > > > > This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and > > > > > > packets can be filtered using ipv6_ext flag. > > > > > > > > > > > > Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com> > > > > > > --- > > > > > > include/uapi/linux/openvswitch.h | 6 ++ > > > > > > net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++ > > > > > > net/openvswitch/flow.h | 14 ++++ > > > > > > net/openvswitch/flow_netlink.c | 26 +++++- > > > > > > 4 files changed, 184 insertions(+), 2 deletions(-) > > > > > > > > > > > > diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h > > > > > > index a87b44cd5590..43790f07e4a2 100644 > > > > > > --- a/include/uapi/linux/openvswitch.h > > > > > > +++ b/include/uapi/linux/openvswitch.h > > > > > > @@ -342,6 +342,7 @@ enum ovs_key_attr { > > > > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */ > > > > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */ > > > > > > OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */ > > > > > > + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */ > > > > > > > > > > > > #ifdef __KERNEL__ > > > > > > OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */ > > > > > > @@ -421,6 +422,11 @@ struct ovs_key_ipv6 { > > > > > > __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */ > > > > > > }; > > > > > > > > > > > > +/* separate structure to support backward compatibility with older user space */ > > > > > > +struct ovs_key_ipv6_exthdrs { > > > > > > + __u16 hdrs; > > > > > > +}; > > > > > > + > > > > > > struct ovs_key_tcp { > > > > > > __be16 tcp_src; > > > > > > __be16 tcp_dst; > > > > > > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c > > > > > > index 9d375e74b607..28acb40437ca 100644 > > > > > > --- a/net/openvswitch/flow.c > > > > > > +++ b/net/openvswitch/flow.c > > > > > > @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb) > > > > > > sizeof(struct icmphdr)); > > > > > > } > > > > > > > > > > > > +/** > > > > > > + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags. > > > > > > + * > > > > > > + * @skb: buffer where extension header data starts in packet > > > > > > + * @nh: ipv6 header > > > > > > + * @ext_hdrs: flags are stored here > > > > > > + * > > > > > > + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header > > > > > > + * is unexpectedly encountered. (Two destination options headers may be > > > > > > + * expected and would not cause this bit to be set.) > > > > > > + * > > > > > > + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order > > > > > > + * preferred (but not required) by RFC 2460: > > > > > > + * > > > > > > + * When more than one extension header is used in the same packet, it is > > > > > > + * recommended that those headers appear in the following order: > > > > > > + * IPv6 header > > > > > > + * Hop-by-Hop Options header > > > > > > + * Destination Options header > > > > > > + * Routing header > > > > > > + * Fragment header > > > > > > + * Authentication header > > > > > > + * Encapsulating Security Payload header > > > > > > + * Destination Options header > > > > > > + * upper-layer header > > > > > > + */ > > > > > > +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, > > > > > > + u16 *ext_hdrs) > > > > > > +{ > > > > > > + u8 next_type = nh->nexthdr; > > > > > > + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr); > > > > > > + int dest_options_header_count = 0; > > > > > > + > > > > > > + *ext_hdrs = 0; > > > > > > + > > > > > > + while (ipv6_ext_hdr(next_type)) { > > > > > > + struct ipv6_opt_hdr _hdr, *hp; > > > > > > + > > > > > > + switch (next_type) { > > > > > > + case IPPROTO_NONE: > > > > > > + *ext_hdrs |= OFPIEH12_NONEXT; > > > > > > + /* stop parsing */ > > > > > > + return; > > > > > > + > > > > > > + case IPPROTO_ESP: > > > > > > + if (*ext_hdrs & OFPIEH12_ESP) > > > > > > + *ext_hdrs |= OFPIEH12_UNREP; > > > > > > + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST | > > > > > > + OFPIEH12_ROUTER | IPPROTO_FRAGMENT | > > > > > > + OFPIEH12_AUTH | OFPIEH12_UNREP)) || > > > > > > + dest_options_header_count >= 2) { > > > > > > + *ext_hdrs |= OFPIEH12_UNSEQ; > > > > > > + } > > > > > > + *ext_hdrs |= OFPIEH12_ESP; > > > > > > + break; > > > > > you need to check_header() before looking into each extension header. > > > > > > > > Could you elaborate why I need to add check_header(), > > > > skb_header_pointer() is doing sanitization. > > > > > > I mean check_header() would allow you to read the header without > > > copying the bits, it is used in ovs flow extraction so its usual > > > check. > > > > But check_header() will call *__pskb_pull_tail which in turn will copy > > bits if data will be fragmented. > > > OVS flow extract uses this function to extract flow upto L4, so > skb_header_pointer() is not saving any copy operation. > > > /* Moves tail of skb head forward, copying data from fragmented part, > > * when it is necessary. > > * 1. It may fail due to malloc failure. > > * 2. It may change skb pointers. > > * > > * It is pretty complicated. Luckily, it is called only in exceptional cases. > > */ > > void *__pskb_pull_tail(struct sk_buff *skb, int delta) > > > > as well I noticed that for example commit > > 4a06fa67c4da20148803525151845276cdb995c1 is moving from > > pskb_may_pull() to skb_header_pointer() > ok, I see advantage of using skb_header_pointer() in this case, but > replacing all check_header() with skb_header_pointer() would add lot > of copy operation in flow extract. Anyways for this use case > skb_header_pointer() is fine. > > Acked-by: Pravin B Shelar <pshelar@ovn.org> Hi, Could this be applied please. Thanks, Tom
On Wed, 9 Feb 2022 12:46:01 -0800 Cpp Code wrote: > > ok, I see advantage of using skb_header_pointer() in this case, but > > replacing all check_header() with skb_header_pointer() would add lot > > of copy operation in flow extract. Anyways for this use case > > skb_header_pointer() is fine. > > > > Acked-by: Pravin B Shelar <pshelar@ovn.org> > > Could this be applied please. Please repost with Pravin's ack included.
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h index a87b44cd5590..43790f07e4a2 100644 --- a/include/uapi/linux/openvswitch.h +++ b/include/uapi/linux/openvswitch.h @@ -342,6 +342,7 @@ enum ovs_key_attr { OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */ OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */ OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */ + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */ #ifdef __KERNEL__ OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */ @@ -421,6 +422,11 @@ struct ovs_key_ipv6 { __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */ }; +/* separate structure to support backward compatibility with older user space */ +struct ovs_key_ipv6_exthdrs { + __u16 hdrs; +}; + struct ovs_key_tcp { __be16 tcp_src; __be16 tcp_dst; diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c index 9d375e74b607..28acb40437ca 100644 --- a/net/openvswitch/flow.c +++ b/net/openvswitch/flow.c @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb) sizeof(struct icmphdr)); } +/** + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags. + * + * @skb: buffer where extension header data starts in packet + * @nh: ipv6 header + * @ext_hdrs: flags are stored here + * + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header + * is unexpectedly encountered. (Two destination options headers may be + * expected and would not cause this bit to be set.) + * + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order + * preferred (but not required) by RFC 2460: + * + * When more than one extension header is used in the same packet, it is + * recommended that those headers appear in the following order: + * IPv6 header + * Hop-by-Hop Options header + * Destination Options header + * Routing header + * Fragment header + * Authentication header + * Encapsulating Security Payload header + * Destination Options header + * upper-layer header + */ +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh, + u16 *ext_hdrs) +{ + u8 next_type = nh->nexthdr; + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr); + int dest_options_header_count = 0; + + *ext_hdrs = 0; + + while (ipv6_ext_hdr(next_type)) { + struct ipv6_opt_hdr _hdr, *hp; + + switch (next_type) { + case IPPROTO_NONE: + *ext_hdrs |= OFPIEH12_NONEXT; + /* stop parsing */ + return; + + case IPPROTO_ESP: + if (*ext_hdrs & OFPIEH12_ESP) + *ext_hdrs |= OFPIEH12_UNREP; + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST | + OFPIEH12_ROUTER | IPPROTO_FRAGMENT | + OFPIEH12_AUTH | OFPIEH12_UNREP)) || + dest_options_header_count >= 2) { + *ext_hdrs |= OFPIEH12_UNSEQ; + } + *ext_hdrs |= OFPIEH12_ESP; + break; + + case IPPROTO_AH: + if (*ext_hdrs & OFPIEH12_AUTH) + *ext_hdrs |= OFPIEH12_UNREP; + if ((*ext_hdrs & + ~(OFPIEH12_HOP | OFPIEH12_DEST | OFPIEH12_ROUTER | + IPPROTO_FRAGMENT | OFPIEH12_UNREP)) || + dest_options_header_count >= 2) { + *ext_hdrs |= OFPIEH12_UNSEQ; + } + *ext_hdrs |= OFPIEH12_AUTH; + break; + + case IPPROTO_DSTOPTS: + if (dest_options_header_count == 0) { + if (*ext_hdrs & + ~(OFPIEH12_HOP | OFPIEH12_UNREP)) + *ext_hdrs |= OFPIEH12_UNSEQ; + *ext_hdrs |= OFPIEH12_DEST; + } else if (dest_options_header_count == 1) { + if (*ext_hdrs & + ~(OFPIEH12_HOP | OFPIEH12_DEST | + OFPIEH12_ROUTER | OFPIEH12_FRAG | + OFPIEH12_AUTH | OFPIEH12_ESP | + OFPIEH12_UNREP)) { + *ext_hdrs |= OFPIEH12_UNSEQ; + } + } else { + *ext_hdrs |= OFPIEH12_UNREP; + } + dest_options_header_count++; + break; + + case IPPROTO_FRAGMENT: + if (*ext_hdrs & OFPIEH12_FRAG) + *ext_hdrs |= OFPIEH12_UNREP; + if ((*ext_hdrs & ~(OFPIEH12_HOP | + OFPIEH12_DEST | + OFPIEH12_ROUTER | + OFPIEH12_UNREP)) || + dest_options_header_count >= 2) { + *ext_hdrs |= OFPIEH12_UNSEQ; + } + *ext_hdrs |= OFPIEH12_FRAG; + break; + + case IPPROTO_ROUTING: + if (*ext_hdrs & OFPIEH12_ROUTER) + *ext_hdrs |= OFPIEH12_UNREP; + if ((*ext_hdrs & ~(OFPIEH12_HOP | + OFPIEH12_DEST | + OFPIEH12_UNREP)) || + dest_options_header_count >= 2) { + *ext_hdrs |= OFPIEH12_UNSEQ; + } + *ext_hdrs |= OFPIEH12_ROUTER; + break; + + case IPPROTO_HOPOPTS: + if (*ext_hdrs & OFPIEH12_HOP) + *ext_hdrs |= OFPIEH12_UNREP; + /* OFPIEH12_HOP is set to 1 if a hop-by-hop IPv6 + * extension header is present as the first + * extension header in the packet. + */ + if (*ext_hdrs == 0) + *ext_hdrs |= OFPIEH12_HOP; + else + *ext_hdrs |= OFPIEH12_UNSEQ; + break; + + default: + return; + } + + hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr); + if (!hp) + break; + next_type = hp->nexthdr; + start += ipv6_optlen(hp); + }; +} + static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key) { unsigned short frag_off; @@ -254,6 +392,8 @@ static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key) nh = ipv6_hdr(skb); + get_ipv6_ext_hdrs(skb, nh, &key->ipv6.exthdrs); + key->ip.proto = NEXTHDR_NONE; key->ip.tos = ipv6_get_dsfield(nh); key->ip.ttl = nh->hop_limit; diff --git a/net/openvswitch/flow.h b/net/openvswitch/flow.h index 758a8c77f736..073ab73ffeaa 100644 --- a/net/openvswitch/flow.h +++ b/net/openvswitch/flow.h @@ -32,6 +32,19 @@ enum sw_flow_mac_proto { #define SW_FLOW_KEY_INVALID 0x80 #define MPLS_LABEL_DEPTH 3 +/* Bit definitions for IPv6 Extension Header pseudo-field. */ +enum ofp12_ipv6exthdr_flags { + OFPIEH12_NONEXT = 1 << 0, /* "No next header" encountered. */ + OFPIEH12_ESP = 1 << 1, /* Encrypted Sec Payload header present. */ + OFPIEH12_AUTH = 1 << 2, /* Authentication header present. */ + OFPIEH12_DEST = 1 << 3, /* 1 or 2 dest headers present. */ + OFPIEH12_FRAG = 1 << 4, /* Fragment header present. */ + OFPIEH12_ROUTER = 1 << 5, /* Router header present. */ + OFPIEH12_HOP = 1 << 6, /* Hop-by-hop header present. */ + OFPIEH12_UNREP = 1 << 7, /* Unexpected repeats encountered. */ + OFPIEH12_UNSEQ = 1 << 8 /* Unexpected sequencing encountered. */ +}; + /* Store options at the end of the array if they are less than the * maximum size. This allows us to get the benefits of variable length * matching for small options. @@ -121,6 +134,7 @@ struct sw_flow_key { struct in6_addr dst; /* IPv6 destination address. */ } addr; __be32 label; /* IPv6 flow label. */ + u16 exthdrs; /* IPv6 extension header flags */ union { struct { struct in6_addr src; diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index 65c2e3458ff5..0aeaf28594ce 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net/openvswitch/flow_netlink.c @@ -344,7 +344,7 @@ size_t ovs_key_attr_size(void) /* Whenever adding new OVS_KEY_ FIELDS, we should consider * updating this function. */ - BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 29); + BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 30); return nla_total_size(4) /* OVS_KEY_ATTR_PRIORITY */ + nla_total_size(0) /* OVS_KEY_ATTR_TUNNEL */ @@ -367,7 +367,8 @@ size_t ovs_key_attr_size(void) + nla_total_size(2) /* OVS_KEY_ATTR_ETHERTYPE */ + nla_total_size(40) /* OVS_KEY_ATTR_IPV6 */ + nla_total_size(2) /* OVS_KEY_ATTR_ICMPV6 */ - + nla_total_size(28); /* OVS_KEY_ATTR_ND */ + + nla_total_size(28) /* OVS_KEY_ATTR_ND */ + + nla_total_size(2); /* OVS_KEY_ATTR_IPV6_EXTHDRS */ } static const struct ovs_len_tbl ovs_vxlan_ext_key_lens[OVS_VXLAN_EXT_MAX + 1] = { @@ -435,6 +436,8 @@ static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = { .len = sizeof(struct ovs_key_ct_tuple_ipv6) }, [OVS_KEY_ATTR_NSH] = { .len = OVS_ATTR_NESTED, .next = ovs_nsh_key_attr_lens, }, + [OVS_KEY_ATTR_IPV6_EXTHDRS] = { + .len = sizeof(struct ovs_key_ipv6_exthdrs) }, }; static bool check_attr_len(unsigned int attr_len, unsigned int expected_len) @@ -1595,6 +1598,17 @@ static int ovs_key_from_nlattrs(struct net *net, struct sw_flow_match *match, attrs &= ~(1 << OVS_KEY_ATTR_IPV6); } + if (attrs & (1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS)) { + const struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key; + + ipv6_exthdrs_key = nla_data(a[OVS_KEY_ATTR_IPV6_EXTHDRS]); + + SW_FLOW_KEY_PUT(match, ipv6.exthdrs, + ipv6_exthdrs_key->hdrs, is_mask); + + attrs &= ~(1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS); + } + if (attrs & (1 << OVS_KEY_ATTR_ARP)) { const struct ovs_key_arp *arp_key; @@ -2097,6 +2111,7 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey, ipv4_key->ipv4_frag = output->ip.frag; } else if (swkey->eth.type == htons(ETH_P_IPV6)) { struct ovs_key_ipv6 *ipv6_key; + struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key; nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6, sizeof(*ipv6_key)); if (!nla) @@ -2111,6 +2126,13 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey, ipv6_key->ipv6_tclass = output->ip.tos; ipv6_key->ipv6_hlimit = output->ip.ttl; ipv6_key->ipv6_frag = output->ip.frag; + + nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6_EXTHDRS, + sizeof(*ipv6_exthdrs_key)); + if (!nla) + goto nla_put_failure; + ipv6_exthdrs_key = nla_data(nla); + ipv6_exthdrs_key->hdrs = output->ipv6.exthdrs; } else if (swkey->eth.type == htons(ETH_P_NSH)) { if (nsh_key_to_nlattr(&output->nsh, is_mask, skb)) goto nla_put_failure;
This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and packets can be filtered using ipv6_ext flag. Signed-off-by: Toms Atteka <cpp.code.lv@gmail.com> --- include/uapi/linux/openvswitch.h | 6 ++ net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++ net/openvswitch/flow.h | 14 ++++ net/openvswitch/flow_netlink.c | 26 +++++- 4 files changed, 184 insertions(+), 2 deletions(-)