[PATCH iproute2-next v2 0/3] L2TPv3 support in tc-flower

[PATCH iproute2-next v2 0/3] L2TPv3 support in tc-flower

[Wojciech Drewek]

This patchset implements support for matching
on L2TPv3 session id using tc-flower.
First two patches are uapi updates.

Kernel changes (merged):
https://lore.kernel.org/netdev/166365901622.22752.10799448124008445080.git-patchwork-notify@kernel.org/

v2: workaround for IPPROTO_L2TP definition in f_flower.c

Wojciech Drewek (3):
  uapi: move IPPROTO_L2TP to in.h
  uapi: Add TCA_FLOWER_KEY_L2TPV3_SID
  f_flower: Introduce L2TPv3 support

 include/uapi/linux/in.h      |  2 ++
 include/uapi/linux/l2tp.h    |  2 --
 include/uapi/linux/pkt_cls.h |  2 ++
 man/man8/tc-flower.8         | 11 ++++++--
 tc/f_flower.c                | 49 +++++++++++++++++++++++++++++++++++-
 5 files changed, 61 insertions(+), 5 deletions(-)

-- 
2.31.1

[PATCH iproute2-next v2 1/3] uapi: move IPPROTO_L2TP to in.h

[Wojciech Drewek]

Reflect changes in the kernel [1].

[1] https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=65b32f801bfbc54dc98144a6ec26082b59d131ee

Signed-off-by: Wojciech Drewek <wojciech.drewek@intel.com>
---
 include/uapi/linux/in.h   | 2 ++
 include/uapi/linux/l2tp.h | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/uapi/linux/in.h b/include/uapi/linux/in.h
index 42cfea14401d..34b3516c9581 100644
--- a/include/uapi/linux/in.h
+++ b/include/uapi/linux/in.h
@@ -68,6 +68,8 @@ enum {
 #define IPPROTO_PIM		IPPROTO_PIM
   IPPROTO_COMP = 108,		/* Compression Header Protocol		*/
 #define IPPROTO_COMP		IPPROTO_COMP
+  IPPROTO_L2TP = 115,		/* Layer 2 Tunnelling Protocol		*/
+#define IPPROTO_L2TP		IPPROTO_L2TP
   IPPROTO_SCTP = 132,		/* Stream Control Transport Protocol	*/
 #define IPPROTO_SCTP		IPPROTO_SCTP
   IPPROTO_UDPLITE = 136,	/* UDP-Lite (RFC 3828)			*/
diff --git a/include/uapi/linux/l2tp.h b/include/uapi/linux/l2tp.h
index 0480d2dbed1a..e7705e875200 100644
--- a/include/uapi/linux/l2tp.h
+++ b/include/uapi/linux/l2tp.h
@@ -13,8 +13,6 @@
 #include <linux/in.h>
 #include <linux/in6.h>
 
-#define IPPROTO_L2TP		115
-
 /**
  * struct sockaddr_l2tpip - the sockaddr structure for L2TP-over-IP sockets
  * @l2tp_family:  address family number AF_L2TPIP.
-- 
2.31.1

[PATCH iproute2-next v2 2/3] uapi: Add TCA_FLOWER_KEY_L2TPV3_SID

[Wojciech Drewek]

Reflect changes in the kernel [1].

[1] https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=8b189ea08c334f25dbb3d076f8adb8b80491d01d

Signed-off-by: Wojciech Drewek <wojciech.drewek@intel.com>
---
 include/uapi/linux/pkt_cls.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index c142c0f8ed8a..b4fb72ac680a 100644
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h
@@ -592,6 +592,8 @@ enum {
 	TCA_FLOWER_KEY_PPPOE_SID,	/* be16 */
 	TCA_FLOWER_KEY_PPP_PROTO,	/* be16 */
 
+	TCA_FLOWER_KEY_L2TPV3_SID,	/* be32 */
+
 	__TCA_FLOWER_MAX,
 };
 
-- 
2.31.1

[PATCH iproute2-next v2 3/3] f_flower: Introduce L2TPv3 support

[Wojciech Drewek]

Add support for matching on L2TPv3 session ID.
Session ID can be specified only when ip proto was
set to IPPROTO_L2TP.

L2TPv3 might be transported over IP or over UDP,
this implementation is only about L2TPv3 over IP.
IPv6 is also supported, in this case next header
is set to IPPROTO_L2TP.

Example filter:
  # tc filter add dev eth0 ingress prio 1 protocol ip \
      flower \
        ip_proto l2tp \
        l2tpv3_sid 1234 \
        skip_sw \
      action drop

Signed-off-by: Wojciech Drewek <wojciech.drewek@intel.com>
---
 man/man8/tc-flower.8 | 11 ++++++++--
 tc/f_flower.c        | 49 +++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 57 insertions(+), 3 deletions(-)

diff --git a/man/man8/tc-flower.8 b/man/man8/tc-flower.8
index 5e486ea31d37..4de823e4ef3e 100644
--- a/man/man8/tc-flower.8
+++ b/man/man8/tc-flower.8
@@ -54,7 +54,9 @@ flower \- flow based traffic control filter
 .IR BOS " | "
 .B mpls_ttl
 .IR TTL " | "
-.BR ip_proto " { " tcp " | " udp " | " sctp " | " icmp " | " icmpv6 " | "
+.B l2tpv3_sid
+.IR LSID " | "
+.BR ip_proto " { " tcp " | " udp " | " sctp " | " icmp " | " icmpv6 " | " l2tp " | "
 .IR IP_PROTO " } | "
 .B ip_tos
 .IR MASKED_IP_TOS " | "
@@ -291,11 +293,16 @@ entry.
 .I TTL
 is an unsigned 8 bit value in decimal format.
 .TP
+.BI l2tpv3_sid " LSID"
+Match on L2TPv3 session id field transported over IP or IPv6.
+.I LSID
+is an unsigned 32 bit value in decimal format.
+.TP
 .BI ip_proto " IP_PROTO"
 Match on layer four protocol.
 .I IP_PROTO
 may be
-.BR tcp ", " udp ", " sctp ", " icmp ", " icmpv6
+.BR tcp ", " udp ", " sctp ", " icmp ", " icmpv6 ", " l2tp
 or an unsigned 8bit value in hexadecimal format.
 .TP
 .BI ip_tos " MASKED_IP_TOS"
diff --git a/tc/f_flower.c b/tc/f_flower.c
index 069896a48f33..a9085bf0d1c5 100644
--- a/tc/f_flower.c
+++ b/tc/f_flower.c
@@ -26,6 +26,10 @@
 #include "tc_util.h"
 #include "rt_names.h"
 
+#ifndef IPPROTO_L2TP
+#define IPPROTO_L2TP 115
+#endif
+
 enum flower_matching_flags {
 	FLOWER_IP_FLAGS,
 };
@@ -60,7 +64,7 @@ static void explain(void)
 		"			ppp_proto [ ipv4 | ipv6 | mpls_uc | mpls_mc | PPP_PROTO ]"
 		"			dst_mac MASKED-LLADDR |\n"
 		"			src_mac MASKED-LLADDR |\n"
-		"			ip_proto [tcp | udp | sctp | icmp | icmpv6 | IP-PROTO ] |\n"
+		"			ip_proto [tcp | udp | sctp | icmp | icmpv6 | l2tp | IP-PROTO ] |\n"
 		"			ip_tos MASKED-IP_TOS |\n"
 		"			ip_ttl MASKED-IP_TTL |\n"
 		"			mpls LSE-LIST |\n"
@@ -68,6 +72,7 @@ static void explain(void)
 		"			mpls_tc TC |\n"
 		"			mpls_bos BOS |\n"
 		"			mpls_ttl TTL |\n"
+		"			l2tpv3_sid LSID |\n"
 		"			dst_ip PREFIX |\n"
 		"			src_ip PREFIX |\n"
 		"			dst_port PORT-NUMBER |\n"
@@ -428,6 +433,11 @@ static int flower_parse_ip_proto(char *str, __be16 eth_type, int type,
 		if (eth_type != htons(ETH_P_IPV6))
 			goto err;
 		ip_proto = IPPROTO_ICMPV6;
+	} else if (!strcmp(str, "l2tp")) {
+		if (eth_type != htons(ETH_P_IP) &&
+		    eth_type != htons(ETH_P_IPV6))
+			goto err;
+		ip_proto = IPPROTO_L2TP;
 	} else {
 		ret = get_u8(&ip_proto, str, 16);
 		if (ret)
@@ -646,6 +656,28 @@ static int flower_parse_icmp(char *str, __u16 eth_type, __u8 ip_proto,
 	return flower_parse_u8(str, value_type, mask_type, NULL, NULL, n);
 }
 
+static int flower_parse_l2tpv3(char *str, __be16 eth_type, __u8 ip_proto,
+			       struct nlmsghdr *n)
+{
+	__be32 sid;
+	int ret;
+
+	if ((eth_type != htons(ETH_P_IP) && eth_type != htons(ETH_P_IPV6)) ||
+	    ip_proto != IPPROTO_L2TP) {
+		fprintf(stderr,
+			"Can't set \"l2tpv3_sid\" if ethertype isn't IP and IPv6 or ip_proto isn't l2tp\n");
+		return -1;
+	}
+	ret = get_be32(&sid, str, 10);
+	if (ret < 0) {
+		fprintf(stderr, "Illegal \"l2tpv3 session id\"\n");
+		return -1;
+	}
+	addattr32(n, MAX_MSG, TCA_FLOWER_KEY_L2TPV3_SID, sid);
+
+	return 0;
+}
+
 static int flower_port_attr_type(__u8 ip_proto, enum flower_endpoint endpoint)
 {
 	if (ip_proto == IPPROTO_TCP)
@@ -1840,6 +1872,11 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
 				fprintf(stderr, "Illegal \"icmp code\"\n");
 				return -1;
 			}
+		} else if (!strcmp(*argv, "l2tpv3_sid")) {
+			NEXT_ARG();
+			ret = flower_parse_l2tpv3(*argv, eth_type, ip_proto, n);
+			if (ret < 0)
+				return -1;
 		} else if (matches(*argv, "arp_tip") == 0) {
 			NEXT_ARG();
 			ret = flower_parse_arp_ip_addr(*argv, eth_type,
@@ -2153,6 +2190,8 @@ static void flower_print_ip_proto(__u8 *p_ip_proto,
 		sprintf(out, "icmp");
 	else if (ip_proto == IPPROTO_ICMPV6)
 		sprintf(out, "icmpv6");
+	else if (ip_proto == IPPROTO_L2TP)
+		sprintf(out, "l2tp");
 	else
 		sprintf(out, "%02x", ip_proto);
 
@@ -2880,6 +2919,14 @@ static int flower_print_opt(struct filter_util *qu, FILE *f,
 		flower_print_masked_u8("icmp_code", tb[nl_type],
 				       tb[nl_mask_type], NULL);
 
+	if (tb[TCA_FLOWER_KEY_L2TPV3_SID]) {
+		struct rtattr *attr = tb[TCA_FLOWER_KEY_L2TPV3_SID];
+
+		print_nl();
+		print_uint(PRINT_ANY, "l2tpv3_sid", "  l2tpv3_sid %u",
+			   rta_getattr_be32(attr));
+	}
+
 	flower_print_ip4_addr("arp_sip", tb[TCA_FLOWER_KEY_ARP_SIP],
 			     tb[TCA_FLOWER_KEY_ARP_SIP_MASK]);
 	flower_print_ip4_addr("arp_tip", tb[TCA_FLOWER_KEY_ARP_TIP],
-- 
2.31.1

Re: [PATCH iproute2-next v2 0/3] L2TPv3 support in tc-flower

[Guillaume Nault]

On Wed, Oct 05, 2022 at 12:44:29PM +0200, Wojciech Drewek wrote:
> This patchset implements support for matching
> on L2TPv3 session id using tc-flower.
> First two patches are uapi updates.

Patches 1 and 2 can be dropped since iproute2-next has updated its
kernel headers with commit 5e42ff10b12a ("Update kernel headers").

Re: [PATCH iproute2-next v2 3/3] f_flower: Introduce L2TPv3 support

[Guillaume Nault]

On Wed, Oct 05, 2022 at 12:44:32PM +0200, Wojciech Drewek wrote:
> @@ -291,11 +293,16 @@ entry.
>  .I TTL
>  is an unsigned 8 bit value in decimal format.
>  .TP
> +.BI l2tpv3_sid " LSID"
> +Match on L2TPv3 session id field transported over IP or IPv6.

I'd rather say either just 'over IP.' (any version), or
'over IPv4 or IPv6.' (both versions written explicitly).

> +static int flower_parse_l2tpv3(char *str, __be16 eth_type, __u8 ip_proto,
> +			       struct nlmsghdr *n)
> +{
> +	__be32 sid;
> +	int ret;
> +
> +	if ((eth_type != htons(ETH_P_IP) && eth_type != htons(ETH_P_IPV6)) ||

Testing eth_type shouldn't be necessary here, since
flower_parse_ip_proto() should have already verified that eth_type is
compatible with IPPROTO_L2TP. So eth_type can even be dropped from
the function parameters. Also the error message probably doesn't need
to talk about the ethertype as flower_parse_ip_proto() should have
already complained.

Apart from that,

Reviewed-by: Guillaume Nault <gnault@redhat.com>