| Message ID | cover.1691764353.git.petrm@nvidia.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | mlxsw: Support traffic redirection from a locked bridge port | expand |
Hello: This series was applied to netdev/net-next.git (main) by David S. Miller <davem@davemloft.net>: On Fri, 11 Aug 2023 17:13:54 +0200 you wrote: > Ido Schimmel writes: > > It is possible to add a filter that redirects traffic from the ingress > of a bridge port that is locked (i.e., performs security / SMAC lookup) > and has learning enabled. For example: > > # ip link add name br0 type bridge > # ip link set dev swp1 master br0 > # bridge link set dev swp1 learning on locked on mab on > # tc qdisc add dev swp1 clsact > # tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw src_ip 192.0.2.1 action mirred egress redirect dev swp2 > > [...] Here is the summary with links: - [net-next,1/4] mlxsw: core_acl_flex_actions: Add IGNORE_ACTION https://git.kernel.org/netdev/net-next/c/d0d449c74764 - [net-next,2/4] mlxsw: spectrum_flower: Disable learning and security lookup when redirecting https://git.kernel.org/netdev/net-next/c/0433670e136a - [net-next,3/4] mlxsw: spectrum: Stop ignoring learning notifications from redirected traffic https://git.kernel.org/netdev/net-next/c/9793a5a9c493 - [net-next,4/4] selftests: forwarding: Add test case for traffic redirection from a locked port https://git.kernel.org/netdev/net-next/c/38c43a1ce758 You are awesome, thank you!
Ido Schimmel writes: It is possible to add a filter that redirects traffic from the ingress of a bridge port that is locked (i.e., performs security / SMAC lookup) and has learning enabled. For example: # ip link add name br0 type bridge # ip link set dev swp1 master br0 # bridge link set dev swp1 learning on locked on mab on # tc qdisc add dev swp1 clsact # tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw src_ip 192.0.2.1 action mirred egress redirect dev swp2 In the kernel's Rx path, this filter is evaluated before the Rx handler of the bridge, which means that redirected traffic should not be affected by bridge port configuration such as learning. However, the hardware data path is a bit different and the redirect action (FORWARDING_ACTION in hardware) merely attaches a pointer to the packet, which is later used by the L2 lookup stage to understand how to forward the packet. Between both stages - ingress ACL and L2 lookup - learning and security lookup are performed, which means that redirected traffic is affected by bridge port configuration, unlike in the kernel's data path. The learning discrepancy was handled in commit 577fa14d2100 ("mlxsw: spectrum: Do not process learned records with a dummy FID") by simply ignoring learning notifications generated by the redirected traffic. A similar solution is not possible for the security / SMAC lookup since - unlike learning - the CPU is not involved and packets that failed the lookup are dropped by the device. Instead, solve this by prepending the ignore action to the redirect action and use it to instruct the device to disable both learning and the security / SMAC lookup for redirected traffic. Patch #1 adds the ignore action. Patch #2 prepends the action to the redirect action in flower offload code. Patch #3 removes the workaround in commit 577fa14d2100 ("mlxsw: spectrum: Do not process learned records with a dummy FID") since it is no longer needed. Patch #4 adds a test case. Ido Schimmel (4): mlxsw: core_acl_flex_actions: Add IGNORE_ACTION mlxsw: spectrum_flower: Disable learning and security lookup when redirecting mlxsw: spectrum: Stop ignoring learning notifications from redirected traffic selftests: forwarding: Add test case for traffic redirection from a locked port .../mellanox/mlxsw/core_acl_flex_actions.c | 40 +++++++++++++++++++ .../mellanox/mlxsw/core_acl_flex_actions.h | 2 + .../net/ethernet/mellanox/mlxsw/spectrum.h | 4 +- .../ethernet/mellanox/mlxsw/spectrum_acl.c | 9 +++++ .../ethernet/mellanox/mlxsw/spectrum_fid.c | 10 ----- .../ethernet/mellanox/mlxsw/spectrum_flower.c | 10 +++++ .../mellanox/mlxsw/spectrum_switchdev.c | 6 --- .../net/forwarding/bridge_locked_port.sh | 36 +++++++++++++++++ 8 files changed, 100 insertions(+), 17 deletions(-)