| Message ID | 20220927082318.289252-4-wojciech.drewek@intel.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | David Ahern |
| Headers | show |
| Series | L2TPv3 support in tc-flower | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Not a local patch |
On 9/27/22 1:23 AM, Wojciech Drewek wrote: > Add support for matching on L2TPv3 session ID. > Session ID can be specified only when ip proto was > set to IPPROTO_L2TP. > > L2TPv3 might be transported over IP or over UDP, > this implementation is only about L2TPv3 over IP. > IPv6 is also supported, in this case next header > is set to IPPROTO_L2TP. > > Example filter: > # tc filter add dev eth0 ingress prio 1 protocol ip \ > flower \ > ip_proto l2tp \ > l2tpv3_sid 1234 \ > skip_sw \ > action drop > > Signed-off-by: Wojciech Drewek <wojciech.drewek@intel.com> > --- > man/man8/tc-flower.8 | 11 +++++++++-- > tc/f_flower.c | 45 +++++++++++++++++++++++++++++++++++++++++++- > 2 files changed, 53 insertions(+), 3 deletions(-) > I updated kernel headers to latest net-next tree. (uapi headers are synched via a script.) This patch on top of that does not compile, so something is missing. Please take a look and re-send.
> -----Original Message----- > From: David Ahern <dsahern@gmail.com> > Sent: poniedziałek, 3 października 2022 00:51 > To: Drewek, Wojciech <wojciech.drewek@intel.com>; netdev@vger.kernel.org > Cc: stephen@networkplumber.org; gnault@redhat.com > Subject: Re: [PATCH iproute2-next 3/3] f_flower: Introduce L2TPv3 support > > On 9/27/22 1:23 AM, Wojciech Drewek wrote: > > Add support for matching on L2TPv3 session ID. > > Session ID can be specified only when ip proto was > > set to IPPROTO_L2TP. > > > > L2TPv3 might be transported over IP or over UDP, > > this implementation is only about L2TPv3 over IP. > > IPv6 is also supported, in this case next header > > is set to IPPROTO_L2TP. > > > > Example filter: > > # tc filter add dev eth0 ingress prio 1 protocol ip \ > > flower \ > > ip_proto l2tp \ > > l2tpv3_sid 1234 \ > > skip_sw \ > > action drop > > > > Signed-off-by: Wojciech Drewek <wojciech.drewek@intel.com> > > --- > > man/man8/tc-flower.8 | 11 +++++++++-- > > tc/f_flower.c | 45 +++++++++++++++++++++++++++++++++++++++++++- > > 2 files changed, 53 insertions(+), 3 deletions(-) > > > > > I updated kernel headers to latest net-next tree. (uapi headers are > synched via a script.) This patch on top of that does not compile, so > something is missing. Please take a look and re-send. Ok, the issue is that IPPROTO_L2TP is undeclared and I'm not sure how to resolve this. I've moved IPPROTO_L2TP to in.h file but while building, system file is included (/usr/include/netinet/in.h) not the project one (iproute2-next/include/uapi/linux/in.h). I guess the workaround would be to define it in f_flower.c like this: #ifndef IPPROTO_L2TP #define IPPROTO_L2TP 115 #endif I saw similar solution in case of IPPROTO_MPTCP. Let me know if it works for you. Regards, Wojtek
On 10/3/22 3:19 AM, Drewek, Wojciech wrote: > > >> -----Original Message----- >> From: David Ahern <dsahern@gmail.com> >> Sent: poniedziałek, 3 października 2022 00:51 >> To: Drewek, Wojciech <wojciech.drewek@intel.com>; netdev@vger.kernel.org >> Cc: stephen@networkplumber.org; gnault@redhat.com >> Subject: Re: [PATCH iproute2-next 3/3] f_flower: Introduce L2TPv3 support >> >> On 9/27/22 1:23 AM, Wojciech Drewek wrote: >>> Add support for matching on L2TPv3 session ID. >>> Session ID can be specified only when ip proto was >>> set to IPPROTO_L2TP. >>> >>> L2TPv3 might be transported over IP or over UDP, >>> this implementation is only about L2TPv3 over IP. >>> IPv6 is also supported, in this case next header >>> is set to IPPROTO_L2TP. >>> >>> Example filter: >>> # tc filter add dev eth0 ingress prio 1 protocol ip \ >>> flower \ >>> ip_proto l2tp \ >>> l2tpv3_sid 1234 \ >>> skip_sw \ >>> action drop >>> >>> Signed-off-by: Wojciech Drewek <wojciech.drewek@intel.com> >>> --- >>> man/man8/tc-flower.8 | 11 +++++++++-- >>> tc/f_flower.c | 45 +++++++++++++++++++++++++++++++++++++++++++- >>> 2 files changed, 53 insertions(+), 3 deletions(-) >>> >> >> >> I updated kernel headers to latest net-next tree. (uapi headers are >> synched via a script.) This patch on top of that does not compile, so >> something is missing. Please take a look and re-send. > > Ok, the issue is that IPPROTO_L2TP is undeclared and I'm not sure how to resolve this. > I've moved IPPROTO_L2TP to in.h file but while building, system file is included > (/usr/include/netinet/in.h) not the project one (iproute2-next/include/uapi/linux/in.h). utils.h -> resolv.h -> netinet/in.h I believe is the problem. > I guess the workaround would be to define it in f_flower.c like this: > #ifndef IPPROTO_L2TP > #define IPPROTO_L2TP 115 > #endif > I saw similar solution in case of IPPROTO_MPTCP. > > Let me know if it works for you. > I don't want to propagate redefines like that, but I don't see a feasible solution with the headers.
diff --git a/man/man8/tc-flower.8 b/man/man8/tc-flower.8 index 5e486ea31d37..4de823e4ef3e 100644 --- a/man/man8/tc-flower.8 +++ b/man/man8/tc-flower.8 @@ -54,7 +54,9 @@ flower \- flow based traffic control filter .IR BOS " | " .B mpls_ttl .IR TTL " | " -.BR ip_proto " { " tcp " | " udp " | " sctp " | " icmp " | " icmpv6 " | " +.B l2tpv3_sid +.IR LSID " | " +.BR ip_proto " { " tcp " | " udp " | " sctp " | " icmp " | " icmpv6 " | " l2tp " | " .IR IP_PROTO " } | " .B ip_tos .IR MASKED_IP_TOS " | " @@ -291,11 +293,16 @@ entry. .I TTL is an unsigned 8 bit value in decimal format. .TP +.BI l2tpv3_sid " LSID" +Match on L2TPv3 session id field transported over IP or IPv6. +.I LSID +is an unsigned 32 bit value in decimal format. +.TP .BI ip_proto " IP_PROTO" Match on layer four protocol. .I IP_PROTO may be -.BR tcp ", " udp ", " sctp ", " icmp ", " icmpv6 +.BR tcp ", " udp ", " sctp ", " icmp ", " icmpv6 ", " l2tp or an unsigned 8bit value in hexadecimal format. .TP .BI ip_tos " MASKED_IP_TOS" diff --git a/tc/f_flower.c b/tc/f_flower.c index 069896a48f33..cf19009c63e1 100644 --- a/tc/f_flower.c +++ b/tc/f_flower.c @@ -60,7 +60,7 @@ static void explain(void) " ppp_proto [ ipv4 | ipv6 | mpls_uc | mpls_mc | PPP_PROTO ]" " dst_mac MASKED-LLADDR |\n" " src_mac MASKED-LLADDR |\n" - " ip_proto [tcp | udp | sctp | icmp | icmpv6 | IP-PROTO ] |\n" + " ip_proto [tcp | udp | sctp | icmp | icmpv6 | l2tp | IP-PROTO ] |\n" " ip_tos MASKED-IP_TOS |\n" " ip_ttl MASKED-IP_TTL |\n" " mpls LSE-LIST |\n" @@ -68,6 +68,7 @@ static void explain(void) " mpls_tc TC |\n" " mpls_bos BOS |\n" " mpls_ttl TTL |\n" + " l2tpv3_sid LSID |\n" " dst_ip PREFIX |\n" " src_ip PREFIX |\n" " dst_port PORT-NUMBER |\n" @@ -428,6 +429,11 @@ static int flower_parse_ip_proto(char *str, __be16 eth_type, int type, if (eth_type != htons(ETH_P_IPV6)) goto err; ip_proto = IPPROTO_ICMPV6; + } else if (!strcmp(str, "l2tp")) { + if (eth_type != htons(ETH_P_IP) && + eth_type != htons(ETH_P_IPV6)) + goto err; + ip_proto = IPPROTO_L2TP; } else { ret = get_u8(&ip_proto, str, 16); if (ret) @@ -646,6 +652,28 @@ static int flower_parse_icmp(char *str, __u16 eth_type, __u8 ip_proto, return flower_parse_u8(str, value_type, mask_type, NULL, NULL, n); } +static int flower_parse_l2tpv3(char *str, __be16 eth_type, __u8 ip_proto, + struct nlmsghdr *n) +{ + __be32 sid; + int ret; + + if ((eth_type != htons(ETH_P_IP) && eth_type != htons(ETH_P_IPV6)) || + ip_proto != IPPROTO_L2TP) { + fprintf(stderr, + "Can't set \"l2tpv3_sid\" if ethertype isn't IP and IPv6 or ip_proto isn't l2tp\n"); + return -1; + } + ret = get_be32(&sid, str, 10); + if (ret < 0) { + fprintf(stderr, "Illegal \"l2tpv3 session id\"\n"); + return -1; + } + addattr32(n, MAX_MSG, TCA_FLOWER_KEY_L2TPV3_SID, sid); + + return 0; +} + static int flower_port_attr_type(__u8 ip_proto, enum flower_endpoint endpoint) { if (ip_proto == IPPROTO_TCP) @@ -1840,6 +1868,11 @@ static int flower_parse_opt(struct filter_util *qu, char *handle, fprintf(stderr, "Illegal \"icmp code\"\n"); return -1; } + } else if (!strcmp(*argv, "l2tpv3_sid")) { + NEXT_ARG(); + ret = flower_parse_l2tpv3(*argv, eth_type, ip_proto, n); + if (ret < 0) + return -1; } else if (matches(*argv, "arp_tip") == 0) { NEXT_ARG(); ret = flower_parse_arp_ip_addr(*argv, eth_type, @@ -2153,6 +2186,8 @@ static void flower_print_ip_proto(__u8 *p_ip_proto, sprintf(out, "icmp"); else if (ip_proto == IPPROTO_ICMPV6) sprintf(out, "icmpv6"); + else if (ip_proto == IPPROTO_L2TP) + sprintf(out, "l2tp"); else sprintf(out, "%02x", ip_proto); @@ -2880,6 +2915,14 @@ static int flower_print_opt(struct filter_util *qu, FILE *f, flower_print_masked_u8("icmp_code", tb[nl_type], tb[nl_mask_type], NULL); + if (tb[TCA_FLOWER_KEY_L2TPV3_SID]) { + struct rtattr *attr = tb[TCA_FLOWER_KEY_L2TPV3_SID]; + + print_nl(); + print_uint(PRINT_ANY, "l2tpv3_sid", " l2tpv3_sid %u", + rta_getattr_be32(attr)); + } + flower_print_ip4_addr("arp_sip", tb[TCA_FLOWER_KEY_ARP_SIP], tb[TCA_FLOWER_KEY_ARP_SIP_MASK]); flower_print_ip4_addr("arp_tip", tb[TCA_FLOWER_KEY_ARP_TIP],
Add support for matching on L2TPv3 session ID. Session ID can be specified only when ip proto was set to IPPROTO_L2TP. L2TPv3 might be transported over IP or over UDP, this implementation is only about L2TPv3 over IP. IPv6 is also supported, in this case next header is set to IPPROTO_L2TP. Example filter: # tc filter add dev eth0 ingress prio 1 protocol ip \ flower \ ip_proto l2tp \ l2tpv3_sid 1234 \ skip_sw \ action drop Signed-off-by: Wojciech Drewek <wojciech.drewek@intel.com> --- man/man8/tc-flower.8 | 11 +++++++++-- tc/f_flower.c | 45 +++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 53 insertions(+), 3 deletions(-)