* [net-next-2.6 v3 0/3] net_sched: Add support for IFE action
@ 2016-02-26 22:43 Jamal Hadi Salim
2016-02-26 22:43 ` [net-next-2.6 v3 1/3] introduce " Jamal Hadi Salim
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Jamal Hadi Salim @ 2016-02-26 22:43 UTC (permalink / raw)
To: davem; +Cc: netdev, daniel, xiyou.wangcong, Jamal Hadi Salim
From: Jamal Hadi Salim <jhs@mojatatu.com>
As agreed at netconf in Seville, here's the patch finally (1 year
was just too long to wait for an ethertype. Now we are just going
have the user configure one).
Described in netdev01 paper:
"Distributing Linux Traffic Control Classifier-Action Subsystem"
Authors: Jamal Hadi Salim and Damascene M. Joachimpillai
The original motivation and deployment of this work was to horizontally
scale packet processing at scope of a chasis or rack. This means one
could take a tc policy and split it across machines connected over
L2. The paper refers to this as "pipeline stage indexing". Other
use cases which evolved out of the original intent include but are
not limited to carrying OAM information, carrying exception handling
metadata, carrying programmed authentication and authorization information,
encapsulating programmed compliance information, service IDs etc.
Read the referenced paper for more details.
The architecture allows for incremental updates for new metadatum support
to cover different use cases.
This patch set includes support for basic skb metadatum.
Followup patches will have more examples of metadata and other features.
v3 changes:
Integrate with the new namespace changes
Remove skbhash and queue mapping metadata (but keep their claim for ids)
Integrate feedback from Cong
Integrate feedback from Daniel
v2 changes:
Remove module option for an upper bound of metadata
Integrate feedback from Cong
Integrate feedback from Daniel
Jamal Hadi Salim (3):
introduce IFE action
Support to encoding decoding skb mark on IFE action
Support to encoding decoding skb prio on IFE action
include/net/tc_act/tc_ife.h | 61 +++
include/uapi/linux/tc_act/tc_ife.h | 38 ++
net/sched/Kconfig | 22 +
net/sched/Makefile | 3 +
net/sched/act_ife.c | 883 +++++++++++++++++++++++++++++++++++++
net/sched/act_meta_mark.c | 79 ++++
net/sched/act_meta_skbprio.c | 76 ++++
7 files changed, 1162 insertions(+)
create mode 100644 include/net/tc_act/tc_ife.h
create mode 100644 include/uapi/linux/tc_act/tc_ife.h
create mode 100644 net/sched/act_ife.c
create mode 100644 net/sched/act_meta_mark.c
create mode 100644 net/sched/act_meta_skbprio.c
--
1.9.1
^ permalink raw reply [flat|nested] 6+ messages in thread* [net-next-2.6 v3 1/3] introduce IFE action 2016-02-26 22:43 [net-next-2.6 v3 0/3] net_sched: Add support for IFE action Jamal Hadi Salim @ 2016-02-26 22:43 ` Jamal Hadi Salim 2016-02-26 23:49 ` Cong Wang 2016-02-26 22:43 ` [net-next-2.6 v3 2/3] Support to encoding decoding skb mark on " Jamal Hadi Salim 2016-02-26 22:43 ` [net-next-2.6 v3 3/3] Support to encoding decoding skb prio " Jamal Hadi Salim 2 siblings, 1 reply; 6+ messages in thread From: Jamal Hadi Salim @ 2016-02-26 22:43 UTC (permalink / raw) To: davem; +Cc: netdev, daniel, xiyou.wangcong, Jamal Hadi Salim From: Jamal Hadi Salim <jhs@mojatatu.com> Described in netdev01 paper: "Distributing Linux Traffic Control Classifier-Action Subsystem" Authors: Jamal Hadi Salim and Damascene M. Joachimpillai This action allows for a sending side to encapsulate arbitrary metadata which is decapsulated by the receiving end. The sender runs in encoding mode and the receiver in decode mode. Both sender and receiver must specify the same ethertype. At some point we hope to have a registered ethertype and we'll then provide a default so the user doesnt have to specify it. For now we enforce the user specify it. Lets show example usage where we encode icmp from a sender towards a receiver with an skbmark of 17; both sender and receiver use ethertype of 0xdead to interop. YYYY: Lets start with Receiver-side policy config: xxx: add an ingress qdisc sudo tc qdisc add dev $ETH ingress xxx: any packets with ethertype 0xdead will be subjected to ife decoding xxx: we then restart the classification so we can match on icmp at prio 3 sudo $TC filter add dev $ETH parent ffff: prio 2 protocol 0xdead \ u32 match u32 0 0 flowid 1:1 \ action ife decode reclassify xxx: on restarting the classification from above if it was an icmp xxx: packet, then match it here and continue to the next rule at prio 4 xxx: which will match based on skb mark of 17 sudo tc filter add dev $ETH parent ffff: prio 3 protocol ip \ u32 match ip protocol 1 0xff flowid 1:1 \ action continue xxx: match on skbmark of 0x11 (decimal 17) and accept sudo tc filter add dev $ETH parent ffff: prio 4 protocol ip \ handle 0x11 fw flowid 1:1 \ action ok xxx: Lets show the decoding policy sudo tc -s filter ls dev $ETH parent ffff: protocol 0xdead xxx: filter pref 2 u32 filter pref 2 u32 fh 800: ht divisor 1 filter pref 2 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:1 (rule hit 0 success 0) match 00000000/00000000 at 0 (success 0 ) action order 1: ife decode action reclassify index 1 ref 1 bind 1 installed 14 sec used 14 sec type: 0x0 Metadata: allow mark allow hash allow prio allow qmap Action statistics: Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0 xxx: Observe that above lists all metadatum it can decode. Typically these submodules will already be compiled into a monolithic kernel or loaded as modules YYYY: Lets show the sender side now .. xxx: Add an egress qdisc on the sender netdev sudo tc qdisc add dev $ETH root handle 1: prio xxx: xxx: Match all icmp packets to 192.168.122.237/24, then xxx: tag the packet with skb mark of decimal 17, then xxx: Encode it with: xxx: ethertype 0xdead xxx: add skb->mark to whitelist of metadatum to send xxx: rewrite target dst MAC address to 02:15:15:15:15:15 xxx: sudo $TC filter add dev $ETH parent 1: protocol ip prio 10 u32 \ match ip dst 192.168.122.237/24 \ match ip protocol 1 0xff \ flowid 1:2 \ action skbedit mark 17 \ action ife encode \ type 0xDEAD \ allow mark \ dst 02:15:15:15:15:15 xxx: Lets show the encoding policy sudo tc -s filter ls dev $ETH parent 1: protocol ip xxx: filter pref 10 u32 filter pref 10 u32 fh 800: ht divisor 1 filter pref 10 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:2 (rule hit 0 success 0) match c0a87aed/ffffffff at 16 (success 0 ) match 00010000/00ff0000 at 8 (success 0 ) action order 1: skbedit mark 17 index 6 ref 1 bind 1 Action statistics: Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0 action order 2: ife encode action pipe index 3 ref 1 bind 1 dst MAC: 02:15:15:15:15:15 type: 0xDEAD Metadata: allow mark Action statistics: Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0 xxx: test by sending ping from sender to destination Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> --- include/net/tc_act/tc_ife.h | 61 +++ include/uapi/linux/tc_act/tc_ife.h | 38 ++ net/sched/Kconfig | 12 + net/sched/Makefile | 1 + net/sched/act_ife.c | 883 +++++++++++++++++++++++++++++++++++++ 5 files changed, 995 insertions(+) create mode 100644 include/net/tc_act/tc_ife.h create mode 100644 include/uapi/linux/tc_act/tc_ife.h create mode 100644 net/sched/act_ife.c diff --git a/include/net/tc_act/tc_ife.h b/include/net/tc_act/tc_ife.h new file mode 100644 index 0000000..dc9a09a --- /dev/null +++ b/include/net/tc_act/tc_ife.h @@ -0,0 +1,61 @@ +#ifndef __NET_TC_IFE_H +#define __NET_TC_IFE_H + +#include <net/act_api.h> +#include <linux/etherdevice.h> +#include <linux/rtnetlink.h> +#include <linux/module.h> + +#define IFE_METAHDRLEN 2 +struct tcf_ife_info { + struct tcf_common common; + u8 eth_dst[ETH_ALEN]; + u8 eth_src[ETH_ALEN]; + u16 eth_type; + u16 flags; + /* list of metaids allowed */ + struct list_head metalist; +}; +#define to_ife(a) \ + container_of(a->priv, struct tcf_ife_info, common) + +struct tcf_meta_info { + const struct tcf_meta_ops *ops; + void *metaval; + u16 metaid; + struct list_head metalist; +}; + +struct tcf_meta_ops { + u16 metaid; /*Maintainer provided ID */ + u16 metatype; /*netlink attribute type (look at net/netlink.h) */ + const char *name; + const char *synopsis; + struct list_head list; + int (*check_presence)(struct sk_buff *, struct tcf_meta_info *); + int (*encode)(struct sk_buff *, void *, struct tcf_meta_info *); + int (*decode)(struct sk_buff *, void *, u16 len); + int (*get)(struct sk_buff *skb, struct tcf_meta_info *mi); + int (*alloc)(struct tcf_meta_info *, void *); + void (*release)(struct tcf_meta_info *); + int (*validate)(void *val, int len); + struct module *owner; +}; + +#define MODULE_ALIAS_IFE_META(metan) MODULE_ALIAS("ifemeta" __stringify_1(metan)) + +int ife_get_meta_u32(struct sk_buff *skb, struct tcf_meta_info *mi); +int ife_get_meta_u16(struct sk_buff *skb, struct tcf_meta_info *mi); +int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen, + const void *dval); +int ife_alloc_meta_u32(struct tcf_meta_info *mi, void *metaval); +int ife_alloc_meta_u16(struct tcf_meta_info *mi, void *metaval); +int ife_check_meta_u32(u32 metaval, struct tcf_meta_info *mi); +int ife_encode_meta_u32(u32 metaval, void *skbdata, struct tcf_meta_info *mi); +int ife_validate_meta_u32(void *val, int len); +int ife_validate_meta_u16(void *val, int len); +void ife_release_meta_gen(struct tcf_meta_info *mi); +int register_ife_op(struct tcf_meta_ops *mops); +int unregister_ife_op(struct tcf_meta_ops *mops); + +#endif /* __NET_TC_IFE_H */ diff --git a/include/uapi/linux/tc_act/tc_ife.h b/include/uapi/linux/tc_act/tc_ife.h new file mode 100644 index 0000000..d648ff6 --- /dev/null +++ b/include/uapi/linux/tc_act/tc_ife.h @@ -0,0 +1,38 @@ +#ifndef __UAPI_TC_IFE_H +#define __UAPI_TC_IFE_H + +#include <linux/types.h> +#include <linux/pkt_cls.h> + +#define TCA_ACT_IFE 25 +/* Flag bits for now just encoding/decoding; mutually exclusive */ +#define IFE_ENCODE 1 +#define IFE_DECODE 0 + +struct tc_ife { + tc_gen; + __u16 flags; +}; + +/*XXX: We need to encode the total number of bytes consumed */ +enum { + TCA_IFE_UNSPEC, + TCA_IFE_PARMS, + TCA_IFE_TM, + TCA_IFE_DMAC, + TCA_IFE_SMAC, + TCA_IFE_TYPE, + TCA_IFE_METALST, + __TCA_IFE_MAX +}; +#define TCA_IFE_MAX (__TCA_IFE_MAX - 1) + +#define IFE_META_SKBMARK 1 +#define IFE_META_HASHID 2 +#define IFE_META_PRIO 3 +#define IFE_META_QMAP 4 +/*Can be overridden at runtime by module option*/ +#define __IFE_META_MAX 5 +#define IFE_META_MAX (__IFE_META_MAX - 1) + +#endif diff --git a/net/sched/Kconfig b/net/sched/Kconfig index 8283082..4d48ef5 100644 --- a/net/sched/Kconfig +++ b/net/sched/Kconfig @@ -739,6 +739,18 @@ config NET_ACT_CONNMARK To compile this code as a module, choose M here: the module will be called act_connmark. +config NET_ACT_IFE + tristate "Inter-FE action based on IETF ForCES InterFE LFB" + depends on NET_CLS_ACT + ---help--- + Say Y here to allow for sourcing and terminating metadata + For details refer to netdev01 paper: + "Distributing Linux Traffic Control Classifier-Action Subsystem" + Authors: Jamal Hadi Salim and Damascene M. Joachimpillai + + To compile this code as a module, choose M here: the + module will be called act_ife. + config NET_CLS_IND bool "Incoming device classification" depends on NET_CLS_U32 || NET_CLS_FW diff --git a/net/sched/Makefile b/net/sched/Makefile index 690c1689..3d17667 100644 --- a/net/sched/Makefile +++ b/net/sched/Makefile @@ -19,6 +19,7 @@ obj-$(CONFIG_NET_ACT_CSUM) += act_csum.o obj-$(CONFIG_NET_ACT_VLAN) += act_vlan.o obj-$(CONFIG_NET_ACT_BPF) += act_bpf.o obj-$(CONFIG_NET_ACT_CONNMARK) += act_connmark.o +obj-$(CONFIG_NET_ACT_IFE) += act_ife.o obj-$(CONFIG_NET_SCH_FIFO) += sch_fifo.o obj-$(CONFIG_NET_SCH_CBQ) += sch_cbq.o obj-$(CONFIG_NET_SCH_HTB) += sch_htb.o diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c new file mode 100644 index 0000000..6134f31 --- /dev/null +++ b/net/sched/act_ife.c @@ -0,0 +1,883 @@ +/* + * net/sched/ife.c Inter-FE action based on ForCES WG InterFE LFB + * + * Refer to: + * draft-ietf-forces-interfelfb-03 + * and + * netdev01 paper: + * "Distributing Linux Traffic Control Classifier-Action + * Subsystem" + * Authors: Jamal Hadi Salim and Damascene M. Joachimpillai + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version + * 2 of the License, or (at your option) any later version. + * + * copyright Jamal Hadi Salim (2015) + * +*/ + +#include <linux/types.h> +#include <linux/kernel.h> +#include <linux/string.h> +#include <linux/errno.h> +#include <linux/skbuff.h> +#include <linux/rtnetlink.h> +#include <linux/module.h> +#include <linux/init.h> +#include <net/net_namespace.h> +#include <net/netlink.h> +#include <net/pkt_sched.h> +#include <uapi/linux/tc_act/tc_ife.h> +#include <net/tc_act/tc_ife.h> +#include <linux/etherdevice.h> + +#define IFE_TAB_MASK 15 + +static int ife_net_id; +static int max_metacnt = IFE_META_MAX + 1; + +static const struct nla_policy ife_policy[TCA_IFE_MAX + 1] = { + [TCA_IFE_PARMS] = { .len = sizeof(struct tc_ife)}, + [TCA_IFE_DMAC] = { .len = ETH_ALEN}, + [TCA_IFE_SMAC] = { .len = ETH_ALEN}, + [TCA_IFE_TYPE] = { .type = NLA_U16}, +}; + +/* Caller takes care of presenting data in network order +*/ +int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen, const void *dval) +{ + u32 *tlv = (u32 *)(skbdata); + u16 totlen = nla_total_size(dlen); /*alignment + hdr */ + char *dptr = (char *)tlv + NLA_HDRLEN; + u32 htlv = attrtype << 16 | totlen; + + *tlv = htonl(htlv); + memset(dptr, 0, totlen - NLA_HDRLEN); + memcpy(dptr, dval, dlen); + + return totlen; +} +EXPORT_SYMBOL_GPL(ife_tlv_meta_encode); + +int ife_get_meta_u32(struct sk_buff *skb, struct tcf_meta_info *mi) +{ + if (mi->metaval) + return nla_put_u32(skb, mi->metaid, *(u32 *)mi->metaval); + else + return nla_put(skb, mi->metaid, 0, NULL); +} +EXPORT_SYMBOL_GPL(ife_get_meta_u32); + +int ife_check_meta_u32(u32 metaval, struct tcf_meta_info *mi) +{ + if (metaval || mi->metaval) + return 8; /* T+L+V == 2+2+4 */ + + return 0; +} +EXPORT_SYMBOL_GPL(ife_check_meta_u32); + +int ife_encode_meta_u32(u32 metaval, void *skbdata, struct tcf_meta_info *mi) +{ + u32 edata = metaval; + + if (mi->metaval) + edata = *(u32 *)mi->metaval; + else if (metaval) + edata = metaval; + + if (!edata) /* will not encode */ + return 0; + + edata = htonl(edata); + return ife_tlv_meta_encode(skbdata, mi->metaid, 4, &edata); +} +EXPORT_SYMBOL_GPL(ife_encode_meta_u32); + +int ife_get_meta_u16(struct sk_buff *skb, struct tcf_meta_info *mi) +{ + if (mi->metaval) + return nla_put_u16(skb, mi->metaid, *(u16 *)mi->metaval); + else + return nla_put(skb, mi->metaid, 0, NULL); +} +EXPORT_SYMBOL_GPL(ife_get_meta_u16); + +int ife_alloc_meta_u32(struct tcf_meta_info *mi, void *metaval) +{ + mi->metaval = kmemdup(&metaval, sizeof(u32), GFP_KERNEL); + if (!mi->metaval) + return -ENOMEM; + + return 0; +} +EXPORT_SYMBOL_GPL(ife_alloc_meta_u32); + +int ife_alloc_meta_u16(struct tcf_meta_info *mi, void *metaval) +{ + mi->metaval = kmemdup(&metaval, sizeof(u16), GFP_KERNEL); + if (!mi->metaval) + return -ENOMEM; + + return 0; +} +EXPORT_SYMBOL_GPL(ife_alloc_meta_u16); + +void ife_release_meta_gen(struct tcf_meta_info *mi) +{ + kfree(mi->metaval); +} +EXPORT_SYMBOL_GPL(ife_release_meta_gen); + +int ife_validate_meta_u32(void *val, int len) +{ + if (len == 4) + return 0; + + return -EINVAL; +} +EXPORT_SYMBOL_GPL(ife_validate_meta_u32); + +int ife_validate_meta_u16(void *val, int len) +{ + /* length will include padding */ + if (len == NLA_ALIGN(2)) + return 0; + + return -EINVAL; +} +EXPORT_SYMBOL_GPL(ife_validate_meta_u16); + +static LIST_HEAD(ifeoplist); +static DEFINE_RWLOCK(ife_mod_lock); + +struct tcf_meta_ops *find_ife_oplist(u16 metaid) +{ + struct tcf_meta_ops *o; + + read_lock(&ife_mod_lock); + list_for_each_entry(o, &ifeoplist, list) { + if (o->metaid == metaid) { + if (!try_module_get(o->owner)) + o = NULL; + read_unlock(&ife_mod_lock); + return o; + } + } + read_unlock(&ife_mod_lock); + + return NULL; +} + +int register_ife_op(struct tcf_meta_ops *mops) +{ + struct tcf_meta_ops *m; + + if (!mops->metaid || !mops->metatype || !mops->name || + !mops->check_presence || !mops->encode || !mops->decode || + !mops->get || !mops->alloc) + return -EINVAL; + + write_lock(&ife_mod_lock); + + list_for_each_entry(m, &ifeoplist, list) { + if (m->metaid == mops->metaid || + (strcmp(mops->name, m->name) == 0)) { + write_unlock(&ife_mod_lock); + return -EEXIST; + } + } + + if (!mops->release) + mops->release = ife_release_meta_gen; + + list_add_tail(&mops->list, &ifeoplist); + write_unlock(&ife_mod_lock); + return 0; +} +EXPORT_SYMBOL_GPL(unregister_ife_op); + +int unregister_ife_op(struct tcf_meta_ops *mops) +{ + struct tcf_meta_ops *m; + int err = -ENOENT; + + write_lock(&ife_mod_lock); + list_for_each_entry(m, &ifeoplist, list) { + if (m->metaid == mops->metaid) { + list_del(&mops->list); + err = 0; + break; + } + } + write_unlock(&ife_mod_lock); + + return err; +} +EXPORT_SYMBOL_GPL(register_ife_op); + +void print_ife_oplist(void) +{ + struct tcf_meta_ops *o; + int i = 0; + + read_lock(&ife_mod_lock); + list_for_each_entry(o, &ifeoplist, list) { + pr_debug("%d: %s metaid %d\n", ++i, o->name, o->metaid); + } + read_unlock(&ife_mod_lock); +} + +static int ife_validate_metatype(struct tcf_meta_ops *ops, void *val, int len) +{ + int ret = 0; + /* XXX: unfortunately cant use nla_policy at this point + * because a length of 0 is valid in the case of + * "allow". "use" semantics do enforce for proper + * length and i couldve use nla_policy but it makes it hard + * to use it just for that.. + */ + if (ops->validate) + return ops->validate(val, len); + + if (ops->metatype == NLA_U32) + ret = ife_validate_meta_u32(val, len); + else if (ops->metatype == NLA_U16) + ret = ife_validate_meta_u16(val, len); + + return ret; +} + +/* called when adding new meta information + * under ife->tcf_lock +*/ +int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid, + void *val, int len) +{ + struct tcf_meta_ops *ops = find_ife_oplist(metaid); + int ret = 0; + + if (!ops) { + ret = -ENOENT; +#ifdef CONFIG_MODULES + spin_unlock_bh(&ife->tcf_lock); + rtnl_unlock(); + request_module("ifemeta%u", metaid); + rtnl_lock(); + spin_lock_bh(&ife->tcf_lock); + ops = find_ife_oplist(metaid); +#endif + } + + if (ops) { + ret = 0; + if (len) + ret = ife_validate_metatype(ops, val, len); + + module_put(ops->owner); + } + + return ret; +} + +/* called when adding new meta information + * under ife->tcf_lock +*/ +int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval, int len) +{ + struct tcf_meta_info *mi = NULL; + struct tcf_meta_ops *ops = find_ife_oplist(metaid); + int ret = 0; + + if (!ops) + return -ENOENT; + + mi = kzalloc(sizeof(*mi), GFP_KERNEL); + if (!mi) { + /*put back what find_ife_oplist took */ + module_put(ops->owner); + return -ENOMEM; + } + + mi->metaid = metaid; + mi->ops = ops; + if (len > 0) { + ret = ops->alloc(mi, metaval); + if (ret != 0) { + kfree(mi); + module_put(ops->owner); + return ret; + } + } + + list_add_tail(&mi->metalist, &ife->metalist); + + return ret; +} + +int use_all_metadata(struct tcf_ife_info *ife) +{ + struct tcf_meta_ops *o; + int rc = 0; + int installed = 0; + + list_for_each_entry(o, &ifeoplist, list) { + rc = add_metainfo(ife, o->metaid, NULL, 0); + if (rc == 0) + installed += 1; + } + + if (installed) + return 0; + else + return -EINVAL; +} + +int dump_metalist(struct sk_buff *skb, struct tcf_ife_info *ife) +{ + struct tcf_meta_info *e; + struct nlattr *nest; + unsigned char *b = skb_tail_pointer(skb); + int total_encoded = 0; + + /*can only happen on decode */ + if (list_empty(&ife->metalist)) + return 0; + + nest = nla_nest_start(skb, TCA_IFE_METALST); + if (!nest) + goto out_nlmsg_trim; + + list_for_each_entry(e, &ife->metalist, metalist) { + if (!e->ops->get(skb, e)) + total_encoded += 1; + } + + if (!total_encoded) + goto out_nlmsg_trim; + + nla_nest_end(skb, nest); + + return 0; + +out_nlmsg_trim: + nlmsg_trim(skb, b); + return -1; +} + +/* under ife->tcf_lock */ +static void _tcf_ife_cleanup(struct tc_action *a, int bind) +{ + struct tcf_ife_info *ife = a->priv; + struct tcf_meta_info *e, *n; + + list_for_each_entry_safe(e, n, &ife->metalist, metalist) { + module_put(e->ops->owner); + list_del(&e->metalist); + if (e->metaval) { + if (e->ops->release) + e->ops->release(e); + else + kfree(e->metaval); + } + kfree(e); + } +} + +static void tcf_ife_cleanup(struct tc_action *a, int bind) +{ + struct tcf_ife_info *ife = a->priv; + + spin_lock_bh(&ife->tcf_lock); + _tcf_ife_cleanup(a, bind); + spin_unlock_bh(&ife->tcf_lock); +} + +/* under ife->tcf_lock */ +int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb) +{ + int len = 0; + int rc = 0; + int i = 0; + void *val; + + for (i = 1; i < max_metacnt; i++) { + if (tb[i]) { + val = nla_data(tb[i]); + len = nla_len(tb[i]); + + rc = load_metaops_and_vet(ife, i, val, len); + if (rc != 0) + return rc; + + rc = add_metainfo(ife, i, val, len); + if (rc) + return rc; + } + } + + return rc; +} + +static int tcf_ife_init(struct net *net, struct nlattr *nla, + struct nlattr *est, struct tc_action *a, + int ovr, int bind) +{ + struct tc_action_net *tn = net_generic(net, ife_net_id); + struct nlattr *tb[TCA_IFE_MAX + 1]; + struct nlattr *tb2[IFE_META_MAX + 1]; + struct tcf_ife_info *ife; + struct tc_ife *parm; + u16 ife_type = 0; + u8 *daddr = NULL; + u8 *saddr = NULL; + int ret = 0; + int err; + + err = nla_parse_nested(tb, TCA_IFE_MAX, nla, ife_policy); + if (err < 0) + return err; + + if (!tb[TCA_IFE_PARMS]) + return -EINVAL; + + parm = nla_data(tb[TCA_IFE_PARMS]); + + if (parm->flags & IFE_ENCODE) { + /* Until we get issued the ethertype, we cant have + * a default.. + **/ + if (!tb[TCA_IFE_TYPE]) { + pr_info("You MUST pass etherype for encoding\n"); + return -EINVAL; + } + } + + if (!tcf_hash_check(tn, parm->index, a, bind)) { + ret = tcf_hash_create(tn, parm->index, est, a, sizeof(*ife), + bind, false); + if (ret) + return ret; + ret = ACT_P_CREATED; + } else { + if (bind) /* dont override defaults */ + return 0; + tcf_hash_release(a, bind); + if (!ovr) + return -EEXIST; + } + + ife = to_ife(a); + ife->flags = parm->flags; + + if (parm->flags & IFE_ENCODE) { + ife_type = nla_get_u16(tb[TCA_IFE_TYPE]); + if (tb[TCA_IFE_DMAC]) + daddr = nla_data(tb[TCA_IFE_DMAC]); + if (tb[TCA_IFE_SMAC]) + saddr = nla_data(tb[TCA_IFE_SMAC]); + } + + spin_lock_bh(&ife->tcf_lock); + ife->tcf_action = parm->action; + + if (parm->flags & IFE_ENCODE) { + if (daddr) + ether_addr_copy(ife->eth_dst, daddr); + else + eth_zero_addr(ife->eth_dst); + + if (saddr) + ether_addr_copy(ife->eth_src, saddr); + else + eth_zero_addr(ife->eth_src); + + ife->eth_type = ife_type; + } + + if (ret == ACT_P_CREATED) + INIT_LIST_HEAD(&ife->metalist); + + if (tb[TCA_IFE_METALST]) { + err = nla_parse_nested(tb2, IFE_META_MAX, tb[TCA_IFE_METALST], + NULL); + if (err) { +metadata_parse_err: + if (ret == ACT_P_CREATED) + _tcf_ife_cleanup(a, bind); + + spin_unlock_bh(&ife->tcf_lock); + return err; + } + + err = populate_metalist(ife, tb2); + if (err) + goto metadata_parse_err; + + } else { + /* if no passed metadata allow list or passed allow-all + * then here we process by adding as many supported metadatum + * as we can. You better have at least one else we are + * going to bail out + */ + err = use_all_metadata(ife); + if (err) { + if (ret == ACT_P_CREATED) + _tcf_ife_cleanup(a, bind); + + spin_unlock_bh(&ife->tcf_lock); + return err; + } + } + + spin_unlock_bh(&ife->tcf_lock); + + if (ret == ACT_P_CREATED) + tcf_hash_insert(tn, a); + + print_ife_oplist(); + return ret; +} + +static int tcf_ife_dump(struct sk_buff *skb, struct tc_action *a, int bind, + int ref) +{ + unsigned char *b = skb_tail_pointer(skb); + struct tcf_ife_info *ife = a->priv; + struct tc_ife opt = { + .index = ife->tcf_index, + .refcnt = ife->tcf_refcnt - ref, + .bindcnt = ife->tcf_bindcnt - bind, + .action = ife->tcf_action, + .flags = ife->flags, + }; + struct tcf_t t; + + if (nla_put(skb, TCA_IFE_PARMS, sizeof(opt), &opt)) + goto nla_put_failure; + + t.install = jiffies_to_clock_t(jiffies - ife->tcf_tm.install); + t.lastuse = jiffies_to_clock_t(jiffies - ife->tcf_tm.lastuse); + t.expires = jiffies_to_clock_t(ife->tcf_tm.expires); + if (nla_put(skb, TCA_IFE_TM, sizeof(t), &t)) + goto nla_put_failure; + + if (!is_zero_ether_addr(ife->eth_dst)) { + if (nla_put(skb, TCA_IFE_DMAC, ETH_ALEN, ife->eth_dst)) + goto nla_put_failure; + } + + if (!is_zero_ether_addr(ife->eth_src)) { + if (nla_put(skb, TCA_IFE_SMAC, ETH_ALEN, ife->eth_src)) + goto nla_put_failure; + } + + if (nla_put(skb, TCA_IFE_TYPE, 2, &ife->eth_type)) + goto nla_put_failure; + + if (dump_metalist(skb, ife)) { + /*ignore failure to dump metalist */ + pr_info("Failed to dump metalist\n"); + } + + return skb->len; + +nla_put_failure: + nlmsg_trim(skb, b); + return -1; +} + +int find_decode_metaid(struct sk_buff *skb, struct tcf_ife_info *ife, + u16 metaid, u16 mlen, void *mdata) +{ + struct tcf_meta_info *e; + + /* XXX: use hash to speed up */ + list_for_each_entry(e, &ife->metalist, metalist) { + if (metaid == e->metaid) { + if (e->ops) { + /* We check for decode presence already */ + return e->ops->decode(skb, mdata, mlen); + } + } + } + + return 0; +} + +struct ifeheadr { + __be16 metalen; + u8 tlv_data[]; +}; + +struct meta_tlvhdr { + __be16 type; + __be16 len; +}; + +static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a, + struct tcf_result *res) +{ + struct tcf_ife_info *ife = a->priv; + int action = ife->tcf_action; + struct ifeheadr *ifehdr = (struct ifeheadr *)skb->data; + u16 ifehdrln = ifehdr->metalen; + struct meta_tlvhdr *tlv = (struct meta_tlvhdr *)(ifehdr->tlv_data); + + spin_lock(&ife->tcf_lock); + bstats_update(&ife->tcf_bstats, skb); + ife->tcf_tm.lastuse = jiffies; + spin_unlock(&ife->tcf_lock); + + ifehdrln = ntohs(ifehdrln); + if (unlikely(!pskb_may_pull(skb, ifehdrln))) { + spin_lock(&ife->tcf_lock); + ife->tcf_qstats.drops++; + spin_unlock(&ife->tcf_lock); + return TC_ACT_SHOT; + } + + skb_set_mac_header(skb, ifehdrln); + __skb_pull(skb, ifehdrln); + skb->protocol = eth_type_trans(skb, skb->dev); + ifehdrln -= IFE_METAHDRLEN; + + while (ifehdrln > 0) { + u8 *tlvdata = (u8 *)tlv; + u16 mtype = tlv->type; + u16 mlen = tlv->len; + + mtype = ntohs(mtype); + mlen = ntohs(mlen); + + if (find_decode_metaid(skb, ife, mtype, (mlen - 4), + (void *)(tlvdata + 4))) { + /* abuse overlimits to count when we receive metadata + * but dont have an ops for it + */ + pr_info_ratelimited("Unknown metaid %d alnlen %d\n", + mtype, mlen); + ife->tcf_qstats.overlimits++; + } + + tlvdata += mlen; + ifehdrln -= mlen; + tlv = (struct meta_tlvhdr *)tlvdata; + } + + skb_reset_network_header(skb); + return action; +} + +/*XXX: check if we can do this at install time instead of current + * send data path +**/ +static int ife_get_sz(struct sk_buff *skb, struct tcf_ife_info *ife) +{ + struct tcf_meta_info *e, *n; + int tot_run_sz = 0, run_sz = 0; + + list_for_each_entry_safe(e, n, &ife->metalist, metalist) { + if (e->ops->check_presence) { + run_sz = e->ops->check_presence(skb, e); + tot_run_sz += run_sz; + } + } + + return tot_run_sz; +} + +static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a, + struct tcf_result *res) +{ + struct tcf_ife_info *ife = a->priv; + int action = ife->tcf_action; + struct ethhdr *oethh; /* outer ether header */ + struct ethhdr *iethh; /* inner eth header */ + struct tcf_meta_info *e; + /* + OUTERHDR:TOTMETALEN:{TLVHDR:Metadatum:TLVHDR..}:ORIGDATA + where ORIGDATA = original ethernet header ... + */ + u16 metalen = ife_get_sz(skb, ife); + int hdrm = metalen + skb->dev->hard_header_len + IFE_METAHDRLEN; + unsigned int skboff = skb->dev->hard_header_len; + u32 at = G_TC_AT(skb->tc_verd); + int new_len = skb->len + hdrm; + int exceed_mtu = 0; + int err; + + if (at & AT_EGRESS) { + if (new_len > skb->dev->mtu) + exceed_mtu = 1; + } + + spin_lock(&ife->tcf_lock); + bstats_update(&ife->tcf_bstats, skb); + ife->tcf_tm.lastuse = jiffies; + + if (!metalen) { /* no metadata to send */ + spin_unlock(&ife->tcf_lock); + /* abuse overlimits to count when we allow packet + * with no metadata + */ + ife->tcf_qstats.overlimits++; + return action; + } + /* could be stupid policy setup or mtu config + * so lets be conservative.. */ + if ((action == TC_ACT_SHOT) || exceed_mtu) { + ife->tcf_qstats.drops++; + spin_unlock(&ife->tcf_lock); + return TC_ACT_SHOT; + } + + iethh = eth_hdr(skb); + + err = skb_cow_head(skb, hdrm); + if (unlikely(err)) { + ife->tcf_qstats.drops++; + spin_unlock(&ife->tcf_lock); + return TC_ACT_SHOT; + } + + if (!(at & AT_EGRESS)) { + skb_push(skb, skb->dev->hard_header_len); + } + + __skb_push(skb, hdrm); + memcpy(skb->data, iethh, skb->mac_len); + skb_reset_mac_header(skb); + oethh = eth_hdr(skb); + + /*total metadata length */ + metalen += IFE_METAHDRLEN; + metalen = htons(metalen); + memcpy((void *)(skb->data + skboff), &metalen, IFE_METAHDRLEN); + skboff += IFE_METAHDRLEN; + + /* XXX: we dont have a clever way of telling encode to + * not repeat some of the computations that are done by + * ops->presence_check... + */ + list_for_each_entry(e, &ife->metalist, metalist) { + if (e->ops->encode) { + err = e->ops->encode(skb, (void *)(skb->data + skboff), + e); + } + if (err < 0) { + /* too corrupt to keep around if overwritten */ + ife->tcf_qstats.drops++; + spin_unlock(&ife->tcf_lock); + return TC_ACT_SHOT; + } + skboff += err; + } + + if (!is_zero_ether_addr(ife->eth_src)) + ether_addr_copy(oethh->h_source, ife->eth_src); + else + ether_addr_copy(oethh->h_source, iethh->h_source); + if (!is_zero_ether_addr(ife->eth_dst)) + ether_addr_copy(oethh->h_dest, ife->eth_dst); + else + ether_addr_copy(oethh->h_dest, iethh->h_dest); + oethh->h_proto = htons(ife->eth_type); + + if (!(at & AT_EGRESS)) + skb_pull(skb, skb->dev->hard_header_len); + + spin_unlock(&ife->tcf_lock); + + return action; +} + +static int tcf_ife_act(struct sk_buff *skb, const struct tc_action *a, + struct tcf_result *res) +{ + struct tcf_ife_info *ife = a->priv; + + if (ife->flags & IFE_ENCODE) + return tcf_ife_encode(skb, a, res); + + if (!(ife->flags & IFE_ENCODE)) + return tcf_ife_decode(skb, a, res); + + pr_info("unknown failure(policy neither de/encode\n"); + spin_lock(&ife->tcf_lock); + bstats_update(&ife->tcf_bstats, skb); + ife->tcf_tm.lastuse = jiffies; + ife->tcf_qstats.drops++; + spin_unlock(&ife->tcf_lock); + + return TC_ACT_SHOT; +} + +static int tcf_ife_walker(struct net *net, struct sk_buff *skb, + struct netlink_callback *cb, int type, + struct tc_action *a) +{ + struct tc_action_net *tn = net_generic(net, ife_net_id); + + return tcf_generic_walker(tn, skb, cb, type, a); +} + +static int tcf_ife_search(struct net *net, struct tc_action *a, u32 index) +{ + struct tc_action_net *tn = net_generic(net, ife_net_id); + + return tcf_hash_search(tn, a, index); +} + +static struct tc_action_ops act_ife_ops = { + .kind = "ife", + .type = TCA_ACT_IFE, + .owner = THIS_MODULE, + .act = tcf_ife_act, + .dump = tcf_ife_dump, + .cleanup = tcf_ife_cleanup, + .init = tcf_ife_init, + .walk = tcf_ife_walker, + .lookup = tcf_ife_search, +}; + +static __net_init int ife_init_net(struct net *net) +{ + struct tc_action_net *tn = net_generic(net, ife_net_id); + + return tc_action_net_init(tn, &act_ife_ops, IFE_TAB_MASK); +} + +static void __net_exit ife_exit_net(struct net *net) +{ + struct tc_action_net *tn = net_generic(net, ife_net_id); + + tc_action_net_exit(tn); +} + +static struct pernet_operations ife_net_ops = { + .init = ife_init_net, + .exit = ife_exit_net, + .id = &ife_net_id, + .size = sizeof(struct tc_action_net), +}; + +MODULE_AUTHOR("Jamal Hadi Salim(2015)"); +MODULE_DESCRIPTION("Inter-FE LFB action"); +MODULE_LICENSE("GPL"); + +static int __init ife_init_module(void) +{ + return tcf_register_action(&act_ife_ops, &ife_net_ops); +} + +static void __exit ife_cleanup_module(void) +{ + tcf_unregister_action(&act_ife_ops, &ife_net_ops); +} + +module_init(ife_init_module); +module_exit(ife_cleanup_module); -- 1.9.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [net-next-2.6 v3 1/3] introduce IFE action 2016-02-26 22:43 ` [net-next-2.6 v3 1/3] introduce " Jamal Hadi Salim @ 2016-02-26 23:49 ` Cong Wang 2016-02-27 12:27 ` Jamal Hadi Salim 0 siblings, 1 reply; 6+ messages in thread From: Cong Wang @ 2016-02-26 23:49 UTC (permalink / raw) To: Jamal Hadi Salim Cc: David Miller, Linux Kernel Network Developers, Daniel Borkmann On Fri, Feb 26, 2016 at 2:43 PM, Jamal Hadi Salim <jhs@mojatatu.com> wrote: [...] Just some quick reviews... ;) > +#define IFE_TAB_MASK 15 > + > +static int ife_net_id; > +static int max_metacnt = IFE_META_MAX + 1; > + > +static const struct nla_policy ife_policy[TCA_IFE_MAX + 1] = { > + [TCA_IFE_PARMS] = { .len = sizeof(struct tc_ife)}, > + [TCA_IFE_DMAC] = { .len = ETH_ALEN}, > + [TCA_IFE_SMAC] = { .len = ETH_ALEN}, > + [TCA_IFE_TYPE] = { .type = NLA_U16}, > +}; > + > +/* Caller takes care of presenting data in network order > +*/ > +int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen, const void *dval) > +{ > + u32 *tlv = (u32 *)(skbdata); > + u16 totlen = nla_total_size(dlen); /*alignment + hdr */ > + char *dptr = (char *)tlv + NLA_HDRLEN; > + u32 htlv = attrtype << 16 | totlen; > + > + *tlv = htonl(htlv); > + memset(dptr, 0, totlen - NLA_HDRLEN); > + memcpy(dptr, dval, dlen); > + > + return totlen; > +} > +EXPORT_SYMBOL_GPL(ife_tlv_meta_encode); > + > +int ife_get_meta_u32(struct sk_buff *skb, struct tcf_meta_info *mi) > +{ > + if (mi->metaval) > + return nla_put_u32(skb, mi->metaid, *(u32 *)mi->metaval); > + else > + return nla_put(skb, mi->metaid, 0, NULL); > +} > +EXPORT_SYMBOL_GPL(ife_get_meta_u32); > + > +int ife_check_meta_u32(u32 metaval, struct tcf_meta_info *mi) > +{ > + if (metaval || mi->metaval) > + return 8; /* T+L+V == 2+2+4 */ > + > + return 0; > +} > +EXPORT_SYMBOL_GPL(ife_check_meta_u32); > + > +int ife_encode_meta_u32(u32 metaval, void *skbdata, struct tcf_meta_info *mi) > +{ > + u32 edata = metaval; > + > + if (mi->metaval) > + edata = *(u32 *)mi->metaval; > + else if (metaval) > + edata = metaval; > + > + if (!edata) /* will not encode */ > + return 0; > + > + edata = htonl(edata); > + return ife_tlv_meta_encode(skbdata, mi->metaid, 4, &edata); > +} > +EXPORT_SYMBOL_GPL(ife_encode_meta_u32); > + > +int ife_get_meta_u16(struct sk_buff *skb, struct tcf_meta_info *mi) > +{ > + if (mi->metaval) > + return nla_put_u16(skb, mi->metaid, *(u16 *)mi->metaval); > + else > + return nla_put(skb, mi->metaid, 0, NULL); > +} > +EXPORT_SYMBOL_GPL(ife_get_meta_u16); > + > +int ife_alloc_meta_u32(struct tcf_meta_info *mi, void *metaval) > +{ > + mi->metaval = kmemdup(&metaval, sizeof(u32), GFP_KERNEL); > + if (!mi->metaval) > + return -ENOMEM; > + > + return 0; > +} > +EXPORT_SYMBOL_GPL(ife_alloc_meta_u32); > + > +int ife_alloc_meta_u16(struct tcf_meta_info *mi, void *metaval) > +{ > + mi->metaval = kmemdup(&metaval, sizeof(u16), GFP_KERNEL); > + if (!mi->metaval) > + return -ENOMEM; > + > + return 0; > +} > +EXPORT_SYMBOL_GPL(ife_alloc_meta_u16); > + > +void ife_release_meta_gen(struct tcf_meta_info *mi) > +{ > + kfree(mi->metaval); > +} > +EXPORT_SYMBOL_GPL(ife_release_meta_gen); > + > +int ife_validate_meta_u32(void *val, int len) > +{ > + if (len == 4) > + return 0; > + > + return -EINVAL; > +} > +EXPORT_SYMBOL_GPL(ife_validate_meta_u32); > + > +int ife_validate_meta_u16(void *val, int len) > +{ > + /* length will include padding */ > + if (len == NLA_ALIGN(2)) > + return 0; > + > + return -EINVAL; > +} > +EXPORT_SYMBOL_GPL(ife_validate_meta_u16); > + > +static LIST_HEAD(ifeoplist); > +static DEFINE_RWLOCK(ife_mod_lock); > + > +struct tcf_meta_ops *find_ife_oplist(u16 metaid) static? > +{ > + struct tcf_meta_ops *o; > + > + read_lock(&ife_mod_lock); > + list_for_each_entry(o, &ifeoplist, list) { > + if (o->metaid == metaid) { > + if (!try_module_get(o->owner)) > + o = NULL; > + read_unlock(&ife_mod_lock); > + return o; > + } > + } > + read_unlock(&ife_mod_lock); > + > + return NULL; > +} > + > +int register_ife_op(struct tcf_meta_ops *mops) > +{ > + struct tcf_meta_ops *m; > + > + if (!mops->metaid || !mops->metatype || !mops->name || > + !mops->check_presence || !mops->encode || !mops->decode || > + !mops->get || !mops->alloc) > + return -EINVAL; > + > + write_lock(&ife_mod_lock); > + > + list_for_each_entry(m, &ifeoplist, list) { > + if (m->metaid == mops->metaid || > + (strcmp(mops->name, m->name) == 0)) { > + write_unlock(&ife_mod_lock); > + return -EEXIST; > + } > + } > + > + if (!mops->release) > + mops->release = ife_release_meta_gen; > + > + list_add_tail(&mops->list, &ifeoplist); > + write_unlock(&ife_mod_lock); > + return 0; > +} > +EXPORT_SYMBOL_GPL(unregister_ife_op); > + > +int unregister_ife_op(struct tcf_meta_ops *mops) > +{ > + struct tcf_meta_ops *m; > + int err = -ENOENT; > + > + write_lock(&ife_mod_lock); > + list_for_each_entry(m, &ifeoplist, list) { > + if (m->metaid == mops->metaid) { > + list_del(&mops->list); > + err = 0; > + break; > + } > + } > + write_unlock(&ife_mod_lock); > + > + return err; > +} > +EXPORT_SYMBOL_GPL(register_ife_op); > + > +void print_ife_oplist(void) static? > +{ > + struct tcf_meta_ops *o; > + int i = 0; > + > + read_lock(&ife_mod_lock); > + list_for_each_entry(o, &ifeoplist, list) { > + pr_debug("%d: %s metaid %d\n", ++i, o->name, o->metaid); > + } Is this really useful? Modules can be found by lsmod. > + read_unlock(&ife_mod_lock); > +} > + > +static int ife_validate_metatype(struct tcf_meta_ops *ops, void *val, int len) > +{ > + int ret = 0; > + /* XXX: unfortunately cant use nla_policy at this point > + * because a length of 0 is valid in the case of > + * "allow". "use" semantics do enforce for proper > + * length and i couldve use nla_policy but it makes it hard > + * to use it just for that.. > + */ > + if (ops->validate) > + return ops->validate(val, len); > + > + if (ops->metatype == NLA_U32) > + ret = ife_validate_meta_u32(val, len); > + else if (ops->metatype == NLA_U16) > + ret = ife_validate_meta_u16(val, len); > + > + return ret; > +} > + > +/* called when adding new meta information > + * under ife->tcf_lock > +*/ > +int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid, > + void *val, int len) Can become static? > +{ > + struct tcf_meta_ops *ops = find_ife_oplist(metaid); > + int ret = 0; > + > + if (!ops) { > + ret = -ENOENT; > +#ifdef CONFIG_MODULES > + spin_unlock_bh(&ife->tcf_lock); > + rtnl_unlock(); > + request_module("ifemeta%u", metaid); > + rtnl_lock(); > + spin_lock_bh(&ife->tcf_lock); > + ops = find_ife_oplist(metaid); > +#endif > + } > + > + if (ops) { > + ret = 0; > + if (len) > + ret = ife_validate_metatype(ops, val, len); > + > + module_put(ops->owner); > + } > + > + return ret; > +} > + > +/* called when adding new meta information > + * under ife->tcf_lock > +*/ > +int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval, int len) > +{ static? > + struct tcf_meta_info *mi = NULL; > + struct tcf_meta_ops *ops = find_ife_oplist(metaid); > + int ret = 0; > + > + if (!ops) > + return -ENOENT; > + > + mi = kzalloc(sizeof(*mi), GFP_KERNEL); > + if (!mi) { > + /*put back what find_ife_oplist took */ > + module_put(ops->owner); > + return -ENOMEM; > + } > + > + mi->metaid = metaid; > + mi->ops = ops; > + if (len > 0) { > + ret = ops->alloc(mi, metaval); > + if (ret != 0) { > + kfree(mi); > + module_put(ops->owner); > + return ret; > + } > + } > + > + list_add_tail(&mi->metalist, &ife->metalist); > + > + return ret; > +} > + > +int use_all_metadata(struct tcf_ife_info *ife) static? > +{ > + struct tcf_meta_ops *o; > + int rc = 0; > + int installed = 0; > + > + list_for_each_entry(o, &ifeoplist, list) { > + rc = add_metainfo(ife, o->metaid, NULL, 0); > + if (rc == 0) > + installed += 1; > + } > + > + if (installed) > + return 0; > + else > + return -EINVAL; > +} > + > +int dump_metalist(struct sk_buff *skb, struct tcf_ife_info *ife) static? > +{ > + struct tcf_meta_info *e; > + struct nlattr *nest; > + unsigned char *b = skb_tail_pointer(skb); > + int total_encoded = 0; > + > + /*can only happen on decode */ > + if (list_empty(&ife->metalist)) > + return 0; > + > + nest = nla_nest_start(skb, TCA_IFE_METALST); > + if (!nest) > + goto out_nlmsg_trim; > + > + list_for_each_entry(e, &ife->metalist, metalist) { > + if (!e->ops->get(skb, e)) > + total_encoded += 1; > + } > + > + if (!total_encoded) > + goto out_nlmsg_trim; > + > + nla_nest_end(skb, nest); > + > + return 0; > + > +out_nlmsg_trim: > + nlmsg_trim(skb, b); > + return -1; > +} > + > +/* under ife->tcf_lock */ > +static void _tcf_ife_cleanup(struct tc_action *a, int bind) > +{ > + struct tcf_ife_info *ife = a->priv; > + struct tcf_meta_info *e, *n; > + > + list_for_each_entry_safe(e, n, &ife->metalist, metalist) { > + module_put(e->ops->owner); > + list_del(&e->metalist); > + if (e->metaval) { > + if (e->ops->release) > + e->ops->release(e); > + else > + kfree(e->metaval); > + } > + kfree(e); > + } > +} > + > +static void tcf_ife_cleanup(struct tc_action *a, int bind) > +{ > + struct tcf_ife_info *ife = a->priv; > + > + spin_lock_bh(&ife->tcf_lock); > + _tcf_ife_cleanup(a, bind); > + spin_unlock_bh(&ife->tcf_lock); > +} > + > +/* under ife->tcf_lock */ > +int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb) static? > +{ > + int len = 0; > + int rc = 0; > + int i = 0; > + void *val; > + > + for (i = 1; i < max_metacnt; i++) { > + if (tb[i]) { > + val = nla_data(tb[i]); > + len = nla_len(tb[i]); > + > + rc = load_metaops_and_vet(ife, i, val, len); > + if (rc != 0) > + return rc; > + > + rc = add_metainfo(ife, i, val, len); > + if (rc) > + return rc; > + } > + } > + > + return rc; > +} > + > +static int tcf_ife_init(struct net *net, struct nlattr *nla, > + struct nlattr *est, struct tc_action *a, > + int ovr, int bind) > +{ > + struct tc_action_net *tn = net_generic(net, ife_net_id); > + struct nlattr *tb[TCA_IFE_MAX + 1]; > + struct nlattr *tb2[IFE_META_MAX + 1]; > + struct tcf_ife_info *ife; > + struct tc_ife *parm; > + u16 ife_type = 0; > + u8 *daddr = NULL; > + u8 *saddr = NULL; > + int ret = 0; > + int err; > + > + err = nla_parse_nested(tb, TCA_IFE_MAX, nla, ife_policy); > + if (err < 0) > + return err; > + > + if (!tb[TCA_IFE_PARMS]) > + return -EINVAL; > + > + parm = nla_data(tb[TCA_IFE_PARMS]); > + > + if (parm->flags & IFE_ENCODE) { > + /* Until we get issued the ethertype, we cant have > + * a default.. > + **/ > + if (!tb[TCA_IFE_TYPE]) { > + pr_info("You MUST pass etherype for encoding\n"); > + return -EINVAL; > + } > + } > + > + if (!tcf_hash_check(tn, parm->index, a, bind)) { > + ret = tcf_hash_create(tn, parm->index, est, a, sizeof(*ife), > + bind, false); > + if (ret) > + return ret; > + ret = ACT_P_CREATED; > + } else { > + if (bind) /* dont override defaults */ > + return 0; > + tcf_hash_release(a, bind); > + if (!ovr) > + return -EEXIST; > + } > + > + ife = to_ife(a); > + ife->flags = parm->flags; > + > + if (parm->flags & IFE_ENCODE) { > + ife_type = nla_get_u16(tb[TCA_IFE_TYPE]); > + if (tb[TCA_IFE_DMAC]) > + daddr = nla_data(tb[TCA_IFE_DMAC]); > + if (tb[TCA_IFE_SMAC]) > + saddr = nla_data(tb[TCA_IFE_SMAC]); > + } > + > + spin_lock_bh(&ife->tcf_lock); > + ife->tcf_action = parm->action; > + > + if (parm->flags & IFE_ENCODE) { > + if (daddr) > + ether_addr_copy(ife->eth_dst, daddr); > + else > + eth_zero_addr(ife->eth_dst); > + > + if (saddr) > + ether_addr_copy(ife->eth_src, saddr); > + else > + eth_zero_addr(ife->eth_src); > + > + ife->eth_type = ife_type; > + } > + > + if (ret == ACT_P_CREATED) > + INIT_LIST_HEAD(&ife->metalist); > + > + if (tb[TCA_IFE_METALST]) { > + err = nla_parse_nested(tb2, IFE_META_MAX, tb[TCA_IFE_METALST], > + NULL); > + if (err) { > +metadata_parse_err: > + if (ret == ACT_P_CREATED) > + _tcf_ife_cleanup(a, bind); > + > + spin_unlock_bh(&ife->tcf_lock); > + return err; > + } > + > + err = populate_metalist(ife, tb2); > + if (err) > + goto metadata_parse_err; > + > + } else { > + /* if no passed metadata allow list or passed allow-all > + * then here we process by adding as many supported metadatum > + * as we can. You better have at least one else we are > + * going to bail out > + */ > + err = use_all_metadata(ife); > + if (err) { > + if (ret == ACT_P_CREATED) > + _tcf_ife_cleanup(a, bind); > + > + spin_unlock_bh(&ife->tcf_lock); > + return err; > + } > + } > + > + spin_unlock_bh(&ife->tcf_lock); > + > + if (ret == ACT_P_CREATED) > + tcf_hash_insert(tn, a); > + > + print_ife_oplist(); > + return ret; > +} > + > +static int tcf_ife_dump(struct sk_buff *skb, struct tc_action *a, int bind, > + int ref) > +{ > + unsigned char *b = skb_tail_pointer(skb); > + struct tcf_ife_info *ife = a->priv; > + struct tc_ife opt = { > + .index = ife->tcf_index, > + .refcnt = ife->tcf_refcnt - ref, > + .bindcnt = ife->tcf_bindcnt - bind, > + .action = ife->tcf_action, > + .flags = ife->flags, > + }; > + struct tcf_t t; > + > + if (nla_put(skb, TCA_IFE_PARMS, sizeof(opt), &opt)) > + goto nla_put_failure; > + > + t.install = jiffies_to_clock_t(jiffies - ife->tcf_tm.install); > + t.lastuse = jiffies_to_clock_t(jiffies - ife->tcf_tm.lastuse); > + t.expires = jiffies_to_clock_t(ife->tcf_tm.expires); > + if (nla_put(skb, TCA_IFE_TM, sizeof(t), &t)) > + goto nla_put_failure; > + > + if (!is_zero_ether_addr(ife->eth_dst)) { > + if (nla_put(skb, TCA_IFE_DMAC, ETH_ALEN, ife->eth_dst)) > + goto nla_put_failure; > + } > + > + if (!is_zero_ether_addr(ife->eth_src)) { > + if (nla_put(skb, TCA_IFE_SMAC, ETH_ALEN, ife->eth_src)) > + goto nla_put_failure; > + } > + > + if (nla_put(skb, TCA_IFE_TYPE, 2, &ife->eth_type)) > + goto nla_put_failure; > + > + if (dump_metalist(skb, ife)) { > + /*ignore failure to dump metalist */ > + pr_info("Failed to dump metalist\n"); > + } Make it void? > + > + return skb->len; > + > +nla_put_failure: > + nlmsg_trim(skb, b); > + return -1; > +} > + > +int find_decode_metaid(struct sk_buff *skb, struct tcf_ife_info *ife, > + u16 metaid, u16 mlen, void *mdata) > +{ > + struct tcf_meta_info *e; > + > + /* XXX: use hash to speed up */ > + list_for_each_entry(e, &ife->metalist, metalist) { > + if (metaid == e->metaid) { > + if (e->ops) { > + /* We check for decode presence already */ > + return e->ops->decode(skb, mdata, mlen); > + } > + } > + } > + > + return 0; > +} > + > +struct ifeheadr { > + __be16 metalen; > + u8 tlv_data[]; > +}; > + > +struct meta_tlvhdr { > + __be16 type; > + __be16 len; > +}; > + > +static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a, > + struct tcf_result *res) > +{ > + struct tcf_ife_info *ife = a->priv; > + int action = ife->tcf_action; > + struct ifeheadr *ifehdr = (struct ifeheadr *)skb->data; > + u16 ifehdrln = ifehdr->metalen; > + struct meta_tlvhdr *tlv = (struct meta_tlvhdr *)(ifehdr->tlv_data); > + > + spin_lock(&ife->tcf_lock); > + bstats_update(&ife->tcf_bstats, skb); > + ife->tcf_tm.lastuse = jiffies; > + spin_unlock(&ife->tcf_lock); > + > + ifehdrln = ntohs(ifehdrln); > + if (unlikely(!pskb_may_pull(skb, ifehdrln))) { > + spin_lock(&ife->tcf_lock); > + ife->tcf_qstats.drops++; > + spin_unlock(&ife->tcf_lock); > + return TC_ACT_SHOT; > + } > + > + skb_set_mac_header(skb, ifehdrln); > + __skb_pull(skb, ifehdrln); > + skb->protocol = eth_type_trans(skb, skb->dev); > + ifehdrln -= IFE_METAHDRLEN; > + > + while (ifehdrln > 0) { > + u8 *tlvdata = (u8 *)tlv; > + u16 mtype = tlv->type; > + u16 mlen = tlv->len; > + > + mtype = ntohs(mtype); > + mlen = ntohs(mlen); > + > + if (find_decode_metaid(skb, ife, mtype, (mlen - 4), > + (void *)(tlvdata + 4))) { > + /* abuse overlimits to count when we receive metadata > + * but dont have an ops for it > + */ > + pr_info_ratelimited("Unknown metaid %d alnlen %d\n", > + mtype, mlen); > + ife->tcf_qstats.overlimits++; > + } > + > + tlvdata += mlen; > + ifehdrln -= mlen; > + tlv = (struct meta_tlvhdr *)tlvdata; > + } > + > + skb_reset_network_header(skb); > + return action; > +} > + > +/*XXX: check if we can do this at install time instead of current > + * send data path > +**/ > +static int ife_get_sz(struct sk_buff *skb, struct tcf_ife_info *ife) > +{ > + struct tcf_meta_info *e, *n; > + int tot_run_sz = 0, run_sz = 0; > + > + list_for_each_entry_safe(e, n, &ife->metalist, metalist) { > + if (e->ops->check_presence) { > + run_sz = e->ops->check_presence(skb, e); > + tot_run_sz += run_sz; > + } > + } > + > + return tot_run_sz; > +} > + > +static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a, > + struct tcf_result *res) > +{ > + struct tcf_ife_info *ife = a->priv; > + int action = ife->tcf_action; > + struct ethhdr *oethh; /* outer ether header */ > + struct ethhdr *iethh; /* inner eth header */ > + struct tcf_meta_info *e; > + /* > + OUTERHDR:TOTMETALEN:{TLVHDR:Metadatum:TLVHDR..}:ORIGDATA > + where ORIGDATA = original ethernet header ... > + */ > + u16 metalen = ife_get_sz(skb, ife); > + int hdrm = metalen + skb->dev->hard_header_len + IFE_METAHDRLEN; > + unsigned int skboff = skb->dev->hard_header_len; > + u32 at = G_TC_AT(skb->tc_verd); > + int new_len = skb->len + hdrm; > + int exceed_mtu = 0; Boolean? > + int err; > + > + if (at & AT_EGRESS) { > + if (new_len > skb->dev->mtu) > + exceed_mtu = 1; > + } > + > + spin_lock(&ife->tcf_lock); > + bstats_update(&ife->tcf_bstats, skb); > + ife->tcf_tm.lastuse = jiffies; > + > + if (!metalen) { /* no metadata to send */ > + spin_unlock(&ife->tcf_lock); > + /* abuse overlimits to count when we allow packet > + * with no metadata > + */ > + ife->tcf_qstats.overlimits++; Update before unlocking? > + return action; > + } > + /* could be stupid policy setup or mtu config > + * so lets be conservative.. */ > + if ((action == TC_ACT_SHOT) || exceed_mtu) { > + ife->tcf_qstats.drops++; > + spin_unlock(&ife->tcf_lock); > + return TC_ACT_SHOT; > + } > + > + iethh = eth_hdr(skb); > + > + err = skb_cow_head(skb, hdrm); > + if (unlikely(err)) { > + ife->tcf_qstats.drops++; > + spin_unlock(&ife->tcf_lock); > + return TC_ACT_SHOT; > + } > + > + if (!(at & AT_EGRESS)) { > + skb_push(skb, skb->dev->hard_header_len); > + } braces {} are not necessary for single statement blocks > + > + __skb_push(skb, hdrm); > + memcpy(skb->data, iethh, skb->mac_len); > + skb_reset_mac_header(skb); > + oethh = eth_hdr(skb); > + > + /*total metadata length */ > + metalen += IFE_METAHDRLEN; > + metalen = htons(metalen); > + memcpy((void *)(skb->data + skboff), &metalen, IFE_METAHDRLEN); Unnecessary cast to void* ? > + skboff += IFE_METAHDRLEN; > + > + /* XXX: we dont have a clever way of telling encode to > + * not repeat some of the computations that are done by > + * ops->presence_check... > + */ > + list_for_each_entry(e, &ife->metalist, metalist) { > + if (e->ops->encode) { > + err = e->ops->encode(skb, (void *)(skb->data + skboff), > + e); > + } > + if (err < 0) { > + /* too corrupt to keep around if overwritten */ > + ife->tcf_qstats.drops++; > + spin_unlock(&ife->tcf_lock); > + return TC_ACT_SHOT; > + } > + skboff += err; > + } > + > + if (!is_zero_ether_addr(ife->eth_src)) > + ether_addr_copy(oethh->h_source, ife->eth_src); > + else > + ether_addr_copy(oethh->h_source, iethh->h_source); > + if (!is_zero_ether_addr(ife->eth_dst)) > + ether_addr_copy(oethh->h_dest, ife->eth_dst); > + else > + ether_addr_copy(oethh->h_dest, iethh->h_dest); > + oethh->h_proto = htons(ife->eth_type); > + > + if (!(at & AT_EGRESS)) > + skb_pull(skb, skb->dev->hard_header_len); > + > + spin_unlock(&ife->tcf_lock); > + > + return action; > +} > + > +static int tcf_ife_act(struct sk_buff *skb, const struct tc_action *a, > + struct tcf_result *res) > +{ > + struct tcf_ife_info *ife = a->priv; > + > + if (ife->flags & IFE_ENCODE) > + return tcf_ife_encode(skb, a, res); > + > + if (!(ife->flags & IFE_ENCODE)) > + return tcf_ife_decode(skb, a, res); > + > + pr_info("unknown failure(policy neither de/encode\n"); ratelimit? > + spin_lock(&ife->tcf_lock); > + bstats_update(&ife->tcf_bstats, skb); > + ife->tcf_tm.lastuse = jiffies; > + ife->tcf_qstats.drops++; > + spin_unlock(&ife->tcf_lock); > + > + return TC_ACT_SHOT; > +} > + > +static int tcf_ife_walker(struct net *net, struct sk_buff *skb, > + struct netlink_callback *cb, int type, > + struct tc_action *a) > +{ > + struct tc_action_net *tn = net_generic(net, ife_net_id); > + > + return tcf_generic_walker(tn, skb, cb, type, a); > +} > + > +static int tcf_ife_search(struct net *net, struct tc_action *a, u32 index) > +{ > + struct tc_action_net *tn = net_generic(net, ife_net_id); > + > + return tcf_hash_search(tn, a, index); > +} > + > +static struct tc_action_ops act_ife_ops = { > + .kind = "ife", > + .type = TCA_ACT_IFE, > + .owner = THIS_MODULE, > + .act = tcf_ife_act, > + .dump = tcf_ife_dump, > + .cleanup = tcf_ife_cleanup, > + .init = tcf_ife_init, > + .walk = tcf_ife_walker, > + .lookup = tcf_ife_search, > +}; > + > +static __net_init int ife_init_net(struct net *net) > +{ > + struct tc_action_net *tn = net_generic(net, ife_net_id); > + > + return tc_action_net_init(tn, &act_ife_ops, IFE_TAB_MASK); > +} > + > +static void __net_exit ife_exit_net(struct net *net) > +{ > + struct tc_action_net *tn = net_generic(net, ife_net_id); > + > + tc_action_net_exit(tn); > +} > + > +static struct pernet_operations ife_net_ops = { > + .init = ife_init_net, > + .exit = ife_exit_net, > + .id = &ife_net_id, > + .size = sizeof(struct tc_action_net), > +}; > + > +MODULE_AUTHOR("Jamal Hadi Salim(2015)"); > +MODULE_DESCRIPTION("Inter-FE LFB action"); > +MODULE_LICENSE("GPL"); Move these to the bottom? > + > +static int __init ife_init_module(void) > +{ > + return tcf_register_action(&act_ife_ops, &ife_net_ops); > +} > + > +static void __exit ife_cleanup_module(void) > +{ > + tcf_unregister_action(&act_ife_ops, &ife_net_ops); > +} > + > +module_init(ife_init_module); > +module_exit(ife_cleanup_module); Thanks! ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [net-next-2.6 v3 1/3] introduce IFE action 2016-02-26 23:49 ` Cong Wang @ 2016-02-27 12:27 ` Jamal Hadi Salim 0 siblings, 0 replies; 6+ messages in thread From: Jamal Hadi Salim @ 2016-02-27 12:27 UTC (permalink / raw) To: Cong Wang; +Cc: David Miller, Linux Kernel Network Developers, Daniel Borkmann On 16-02-26 06:49 PM, Cong Wang wrote: > On Fri, Feb 26, 2016 at 2:43 PM, Jamal Hadi Salim <jhs@mojatatu.com> wrote: > > [...] > > > Just some quick reviews... ;) ;-> Ok, update in a little while after some basic testing... cheers, jamal ^ permalink raw reply [flat|nested] 6+ messages in thread
* [net-next-2.6 v3 2/3] Support to encoding decoding skb mark on IFE action 2016-02-26 22:43 [net-next-2.6 v3 0/3] net_sched: Add support for IFE action Jamal Hadi Salim 2016-02-26 22:43 ` [net-next-2.6 v3 1/3] introduce " Jamal Hadi Salim @ 2016-02-26 22:43 ` Jamal Hadi Salim 2016-02-26 22:43 ` [net-next-2.6 v3 3/3] Support to encoding decoding skb prio " Jamal Hadi Salim 2 siblings, 0 replies; 6+ messages in thread From: Jamal Hadi Salim @ 2016-02-26 22:43 UTC (permalink / raw) To: davem; +Cc: netdev, daniel, xiyou.wangcong, Jamal Hadi Salim From: Jamal Hadi Salim <jhs@mojatatu.com> Example usage: Set the skb using skbedit then allow it to be encoded sudo tc qdisc add dev $ETH root handle 1: prio sudo tc filter add dev $ETH parent 1: protocol ip prio 10 \ u32 match ip protocol 1 0xff flowid 1:2 \ action skbedit mark 17 \ action ife encode \ allow mark \ dst 02:15:15:15:15:15 Note: You dont need the skbedit action if you are already encoding the skb mark earlier. A zero skb mark, when seen, will not be encoded. Alternative hard code static mark of 0x12 every time the filter matches sudo $TC filter add dev $ETH parent 1: protocol ip prio 10 \ u32 match ip protocol 1 0xff flowid 1:2 \ action ife encode \ type 0xDEAD \ use mark 0x12 \ dst 02:15:15:15:15:15 Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> --- net/sched/Kconfig | 5 +++ net/sched/Makefile | 1 + net/sched/act_meta_mark.c | 79 +++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 85 insertions(+) create mode 100644 net/sched/act_meta_mark.c diff --git a/net/sched/Kconfig b/net/sched/Kconfig index 4d48ef5..85854c0 100644 --- a/net/sched/Kconfig +++ b/net/sched/Kconfig @@ -751,6 +751,11 @@ config NET_ACT_IFE To compile this code as a module, choose M here: the module will be called act_ife. +config NET_IFE_SKBMARK + tristate "Support to encoding decoding skb mark on IFE action" + depends on NET_ACT_IFE + ---help--- + config NET_CLS_IND bool "Incoming device classification" depends on NET_CLS_U32 || NET_CLS_FW diff --git a/net/sched/Makefile b/net/sched/Makefile index 3d17667..3f7a182 100644 --- a/net/sched/Makefile +++ b/net/sched/Makefile @@ -20,6 +20,7 @@ obj-$(CONFIG_NET_ACT_VLAN) += act_vlan.o obj-$(CONFIG_NET_ACT_BPF) += act_bpf.o obj-$(CONFIG_NET_ACT_CONNMARK) += act_connmark.o obj-$(CONFIG_NET_ACT_IFE) += act_ife.o +obj-$(CONFIG_NET_IFE_SKBMARK) += act_meta_mark.o obj-$(CONFIG_NET_SCH_FIFO) += sch_fifo.o obj-$(CONFIG_NET_SCH_CBQ) += sch_cbq.o obj-$(CONFIG_NET_SCH_HTB) += sch_htb.o diff --git a/net/sched/act_meta_mark.c b/net/sched/act_meta_mark.c new file mode 100644 index 0000000..8289217 --- /dev/null +++ b/net/sched/act_meta_mark.c @@ -0,0 +1,79 @@ +/* + * net/sched/act_meta_mark.c IFE skb->mark metadata module + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version + * 2 of the License, or (at your option) any later version. + * + * copyright Jamal Hadi Salim (2015) + * +*/ + +#include <linux/types.h> +#include <linux/kernel.h> +#include <linux/string.h> +#include <linux/errno.h> +#include <linux/skbuff.h> +#include <linux/rtnetlink.h> +#include <linux/module.h> +#include <linux/init.h> +#include <net/netlink.h> +#include <net/pkt_sched.h> +#include <uapi/linux/tc_act/tc_ife.h> +#include <net/tc_act/tc_ife.h> +#include <linux/rtnetlink.h> + +static int skbmark_encode(struct sk_buff *skb, void *skbdata, + struct tcf_meta_info *e) +{ + u32 ifemark = skb->mark; + + return ife_encode_meta_u32(ifemark, skbdata, e); +} + +static int skbmark_decode(struct sk_buff *skb, void *data, u16 len) +{ + u32 ifemark = *(u32 *)data; + + skb->mark = ntohl(ifemark); + return 0; +} + +static int skbmark_check(struct sk_buff *skb, struct tcf_meta_info *e) +{ + return ife_check_meta_u32(skb->mark, e); +} + +static struct tcf_meta_ops ife_skbmark_ops = { + .metaid = IFE_META_SKBMARK, + .metatype = NLA_U32, + .name = "skbmark", + .synopsis = "skb mark 32 bit metadata", + .check_presence = skbmark_check, + .encode = skbmark_encode, + .decode = skbmark_decode, + .get = ife_get_meta_u32, + .alloc = ife_alloc_meta_u32, + .release = ife_release_meta_gen, + .validate = ife_validate_meta_u32, + .owner = THIS_MODULE, +}; + +static int __init ifemark_init_module(void) +{ + return register_ife_op(&ife_skbmark_ops); +} + +static void __exit ifemark_cleanup_module(void) +{ + unregister_ife_op(&ife_skbmark_ops); +} + +module_init(ifemark_init_module); +module_exit(ifemark_cleanup_module); + +MODULE_AUTHOR("Jamal Hadi Salim(2015)"); +MODULE_DESCRIPTION("Inter-FE skb mark metadata module"); +MODULE_LICENSE("GPL"); +MODULE_ALIAS_IFE_META(IFE_META_SKBMARK); -- 1.9.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* [net-next-2.6 v3 3/3] Support to encoding decoding skb prio on IFE action 2016-02-26 22:43 [net-next-2.6 v3 0/3] net_sched: Add support for IFE action Jamal Hadi Salim 2016-02-26 22:43 ` [net-next-2.6 v3 1/3] introduce " Jamal Hadi Salim 2016-02-26 22:43 ` [net-next-2.6 v3 2/3] Support to encoding decoding skb mark on " Jamal Hadi Salim @ 2016-02-26 22:43 ` Jamal Hadi Salim 2 siblings, 0 replies; 6+ messages in thread From: Jamal Hadi Salim @ 2016-02-26 22:43 UTC (permalink / raw) To: davem; +Cc: netdev, daniel, xiyou.wangcong, Jamal Hadi Salim From: Jamal Hadi Salim <jhs@mojatatu.com> Example usage: xxx: Set the skb priority using skbedit then allow it to be encoded sudo tc qdisc add dev $ETH root handle 1: prio sudo tc filter add dev $ETH parent 1: protocol ip prio 10 \ u32 match ip protocol 1 0xff flowid 1:2 \ action skbedit prio 17 \ action ife encode \ allow prio \ dst 02:15:15:15:15:15 Note: You dont need the skbedit action if you are already encoding the skb priority earlier. A zero skb priority will not be sent Alternative hard code static priority of decimal 33 (unlike skbedit) then mark of 0x12 every time the filter matches sudo $TC filter add dev $ETH parent 1: protocol ip prio 10 \ u32 match ip protocol 1 0xff flowid 1:2 \ action ife encode \ type 0xDEAD \ use prio 33 \ use mark 0x12 \ dst 02:15:15:15:15:15 Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> --- net/sched/Kconfig | 5 +++ net/sched/Makefile | 1 + net/sched/act_meta_skbprio.c | 76 ++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 82 insertions(+) create mode 100644 net/sched/act_meta_skbprio.c diff --git a/net/sched/Kconfig b/net/sched/Kconfig index 85854c0..b148302 100644 --- a/net/sched/Kconfig +++ b/net/sched/Kconfig @@ -756,6 +756,11 @@ config NET_IFE_SKBMARK depends on NET_ACT_IFE ---help--- +config NET_IFE_SKBPRIO + tristate "Support to encoding decoding skb prio on IFE action" + depends on NET_ACT_IFE + ---help--- + config NET_CLS_IND bool "Incoming device classification" depends on NET_CLS_U32 || NET_CLS_FW diff --git a/net/sched/Makefile b/net/sched/Makefile index 3f7a182..84bddb3 100644 --- a/net/sched/Makefile +++ b/net/sched/Makefile @@ -21,6 +21,7 @@ obj-$(CONFIG_NET_ACT_BPF) += act_bpf.o obj-$(CONFIG_NET_ACT_CONNMARK) += act_connmark.o obj-$(CONFIG_NET_ACT_IFE) += act_ife.o obj-$(CONFIG_NET_IFE_SKBMARK) += act_meta_mark.o +obj-$(CONFIG_NET_IFE_SKBPRIO) += act_meta_skbprio.o obj-$(CONFIG_NET_SCH_FIFO) += sch_fifo.o obj-$(CONFIG_NET_SCH_CBQ) += sch_cbq.o obj-$(CONFIG_NET_SCH_HTB) += sch_htb.o diff --git a/net/sched/act_meta_skbprio.c b/net/sched/act_meta_skbprio.c new file mode 100644 index 0000000..26bf4d8 --- /dev/null +++ b/net/sched/act_meta_skbprio.c @@ -0,0 +1,76 @@ +/* + * net/sched/act_meta_prio.c IFE skb->priority metadata module + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version + * 2 of the License, or (at your option) any later version. + * + * copyright Jamal Hadi Salim (2015) + * +*/ + +#include <linux/types.h> +#include <linux/kernel.h> +#include <linux/string.h> +#include <linux/errno.h> +#include <linux/skbuff.h> +#include <linux/rtnetlink.h> +#include <linux/module.h> +#include <linux/init.h> +#include <net/netlink.h> +#include <net/pkt_sched.h> +#include <uapi/linux/tc_act/tc_ife.h> +#include <net/tc_act/tc_ife.h> + +static int skbprio_check(struct sk_buff *skb, struct tcf_meta_info *e) +{ + return ife_check_meta_u32(skb->priority, e); +} + +static int skbprio_encode(struct sk_buff *skb, void *skbdata, + struct tcf_meta_info *e) +{ + u32 ifeprio = skb->priority; /* avoid having to cast skb->priority*/ + + return ife_encode_meta_u32(ifeprio, skbdata, e); +} + +static int skbprio_decode(struct sk_buff *skb, void *data, u16 len) +{ + u32 ifeprio = *(u32 *)data; + + skb->priority = ntohl(ifeprio); + return 0; +} + +static struct tcf_meta_ops ife_prio_ops = { + .metaid = IFE_META_PRIO, + .metatype = NLA_U32, + .name = "skbprio", + .synopsis = "skb prio metadata", + .check_presence = skbprio_check, + .encode = skbprio_encode, + .decode = skbprio_decode, + .get = ife_get_meta_u32, + .alloc = ife_alloc_meta_u32, + .owner = THIS_MODULE, +}; + +static int __init ifeprio_init_module(void) +{ + return register_ife_op(&ife_prio_ops); +} + +static void __exit ifeprio_cleanup_module(void) +{ + unregister_ife_op(&ife_prio_ops); +} + +module_init(ifeprio_init_module); +module_exit(ifeprio_cleanup_module); + +MODULE_AUTHOR("Jamal Hadi Salim(2015)"); +MODULE_DESCRIPTION("Inter-FE skb prio metadata action"); +MODULE_LICENSE("GPL"); +MODULE_ALIAS_IFE_META(IFE_META_PRIO); -- 1.9.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-02-27 12:27 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2016-02-26 22:43 [net-next-2.6 v3 0/3] net_sched: Add support for IFE action Jamal Hadi Salim 2016-02-26 22:43 ` [net-next-2.6 v3 1/3] introduce " Jamal Hadi Salim 2016-02-26 23:49 ` Cong Wang 2016-02-27 12:27 ` Jamal Hadi Salim 2016-02-26 22:43 ` [net-next-2.6 v3 2/3] Support to encoding decoding skb mark on " Jamal Hadi Salim 2016-02-26 22:43 ` [net-next-2.6 v3 3/3] Support to encoding decoding skb prio " Jamal Hadi Salim
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox