* [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users @ 2016-06-18 15:12 Jamal Hadi Salim 2016-06-18 15:12 ` [PATCH net-next 2/2] net sched actions: skbedit add support for mod-ing skb pkt_type Jamal Hadi Salim 2016-06-19 18:06 ` [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users Daniel Borkmann 0 siblings, 2 replies; 4+ messages in thread From: Jamal Hadi Salim @ 2016-06-18 15:12 UTC (permalink / raw) To: davem; +Cc: netdev, daniel, xiyou.wangcong, fw, Jamal Hadi Salim From: Jamal Hadi Salim <jhs@mojatatu.com> Suggested-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> --- include/linux/skbuff.h | 11 +++++++++++ net/netfilter/nft_meta.c | 9 +-------- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index dc0fca7..0b794de 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -37,6 +37,7 @@ #include <net/flow_dissector.h> #include <linux/splice.h> #include <linux/in6.h> +#include <linux/if_packet.h> #include <net/flow.h> /* The interface for checksum offload between the stack and networking drivers @@ -797,6 +798,7 @@ struct sk_buff { atomic_t users; }; + #ifdef __KERNEL__ /* * Handling routines are only of interest to the kernel @@ -881,6 +883,15 @@ static inline struct rtable *skb_rtable(const struct sk_buff *skb) return (struct rtable *)skb_dst(skb); } +/* For mangling skb->pkt_type from user space side from applications + * such as nft, tc, etc, we only allow a conservative subset of + * possible pkt_types to be set. +*/ +static inline bool skb_pkt_type_ok(u32 p) +{ + return p <= PACKET_OTHERHOST; +} + void kfree_skb(struct sk_buff *skb); void kfree_skb_list(struct sk_buff *segs); void skb_tx_error(struct sk_buff *skb); diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index 16c50b0..03e5e33 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -199,13 +199,6 @@ err: } EXPORT_SYMBOL_GPL(nft_meta_get_eval); -/* don't change or set _LOOPBACK, _USER, etc. */ -static bool pkt_type_ok(u32 p) -{ - return p == PACKET_HOST || p == PACKET_BROADCAST || - p == PACKET_MULTICAST || p == PACKET_OTHERHOST; -} - void nft_meta_set_eval(const struct nft_expr *expr, struct nft_regs *regs, const struct nft_pktinfo *pkt) @@ -223,7 +216,7 @@ void nft_meta_set_eval(const struct nft_expr *expr, break; case NFT_META_PKTTYPE: if (skb->pkt_type != value && - pkt_type_ok(value) && pkt_type_ok(skb->pkt_type)) + skb_pkt_type_ok(value) && skb_pkt_type_ok(skb->pkt_type)) skb->pkt_type = value; break; case NFT_META_NFTRACE: -- 1.9.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH net-next 2/2] net sched actions: skbedit add support for mod-ing skb pkt_type 2016-06-18 15:12 [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users Jamal Hadi Salim @ 2016-06-18 15:12 ` Jamal Hadi Salim 2016-06-19 18:09 ` Daniel Borkmann 2016-06-19 18:06 ` [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users Daniel Borkmann 1 sibling, 1 reply; 4+ messages in thread From: Jamal Hadi Salim @ 2016-06-18 15:12 UTC (permalink / raw) To: davem; +Cc: netdev, daniel, xiyou.wangcong, fw, Jamal Hadi Salim From: Jamal Hadi Salim <jhs@mojatatu.com> Extremely useful for setting packet type to host so i dont have to modify the dst mac address using pedit (which requires that i know the mac address) Example usage: tc filter add dev eth0 parent ffff: protocol ip pref 9 u32 \ match ip src 5.5.5.5/32 \ flowid 1:5 action skbedit ptype host This will tag all packets incoming from 5.5.5.5 with type PACKET_HOST Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> --- include/net/tc_act/tc_skbedit.h | 10 +++++----- include/uapi/linux/tc_act/tc_skbedit.h | 2 ++ net/sched/act_skbedit.c | 18 +++++++++++++++++- 3 files changed, 24 insertions(+), 6 deletions(-) diff --git a/include/net/tc_act/tc_skbedit.h b/include/net/tc_act/tc_skbedit.h index b496d5a..d01a5d4 100644 --- a/include/net/tc_act/tc_skbedit.h +++ b/include/net/tc_act/tc_skbedit.h @@ -24,11 +24,11 @@ struct tcf_skbedit { struct tcf_common common; - u32 flags; - u32 priority; - u32 mark; - u16 queue_mapping; - /* XXX: 16-bit pad here? */ + u32 flags; + u32 priority; + u32 mark; + u16 queue_mapping; + u16 ptype; }; #define to_skbedit(a) \ container_of(a->priv, struct tcf_skbedit, common) diff --git a/include/uapi/linux/tc_act/tc_skbedit.h b/include/uapi/linux/tc_act/tc_skbedit.h index fecb5cc..a4d00c6 100644 --- a/include/uapi/linux/tc_act/tc_skbedit.h +++ b/include/uapi/linux/tc_act/tc_skbedit.h @@ -27,6 +27,7 @@ #define SKBEDIT_F_PRIORITY 0x1 #define SKBEDIT_F_QUEUE_MAPPING 0x2 #define SKBEDIT_F_MARK 0x4 +#define SKBEDIT_F_PTYPE 0x8 struct tc_skbedit { tc_gen; @@ -40,6 +41,7 @@ enum { TCA_SKBEDIT_QUEUE_MAPPING, TCA_SKBEDIT_MARK, TCA_SKBEDIT_PAD, + TCA_SKBEDIT_PTYPE, __TCA_SKBEDIT_MAX }; #define TCA_SKBEDIT_MAX (__TCA_SKBEDIT_MAX - 1) diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c index 53d1486..1c4c924 100644 --- a/net/sched/act_skbedit.c +++ b/net/sched/act_skbedit.c @@ -47,6 +47,8 @@ static int tcf_skbedit(struct sk_buff *skb, const struct tc_action *a, skb_set_queue_mapping(skb, d->queue_mapping); if (d->flags & SKBEDIT_F_MARK) skb->mark = d->mark; + if (d->flags & SKBEDIT_F_PTYPE) + skb->pkt_type = d->ptype; spin_unlock(&d->tcf_lock); return d->tcf_action; @@ -57,6 +59,7 @@ static const struct nla_policy skbedit_policy[TCA_SKBEDIT_MAX + 1] = { [TCA_SKBEDIT_PRIORITY] = { .len = sizeof(u32) }, [TCA_SKBEDIT_QUEUE_MAPPING] = { .len = sizeof(u16) }, [TCA_SKBEDIT_MARK] = { .len = sizeof(u32) }, + [TCA_SKBEDIT_PTYPE] = { .len = sizeof(u16) }, }; static int tcf_skbedit_init(struct net *net, struct nlattr *nla, @@ -68,7 +71,7 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla, struct tc_skbedit *parm; struct tcf_skbedit *d; u32 flags = 0, *priority = NULL, *mark = NULL; - u16 *queue_mapping = NULL; + u16 *queue_mapping = NULL, *ptype = NULL; bool exists = false; int ret = 0, err; @@ -92,6 +95,13 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla, queue_mapping = nla_data(tb[TCA_SKBEDIT_QUEUE_MAPPING]); } + if (tb[TCA_SKBEDIT_PTYPE] != NULL) { + ptype = nla_data(tb[TCA_SKBEDIT_PTYPE]); + if (!skb_pkt_type_ok(*ptype)) + return -EINVAL; + flags |= SKBEDIT_F_PTYPE; + } + if (tb[TCA_SKBEDIT_MARK] != NULL) { flags |= SKBEDIT_F_MARK; mark = nla_data(tb[TCA_SKBEDIT_MARK]); @@ -132,6 +142,8 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla, d->queue_mapping = *queue_mapping; if (flags & SKBEDIT_F_MARK) d->mark = *mark; + if (flags & SKBEDIT_F_PTYPE) + d->ptype = *ptype; d->tcf_action = parm->action; @@ -169,6 +181,10 @@ static int tcf_skbedit_dump(struct sk_buff *skb, struct tc_action *a, nla_put(skb, TCA_SKBEDIT_MARK, sizeof(d->mark), &d->mark)) goto nla_put_failure; + if ((d->flags & SKBEDIT_F_PTYPE) && + nla_put(skb, TCA_SKBEDIT_PTYPE, sizeof(d->ptype), + &d->ptype)) + goto nla_put_failure; tcf_tm_dump(&t, &d->tcf_tm); if (nla_put_64bit(skb, TCA_SKBEDIT_TM, sizeof(t), &t, TCA_SKBEDIT_PAD)) -- 1.9.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net-next 2/2] net sched actions: skbedit add support for mod-ing skb pkt_type 2016-06-18 15:12 ` [PATCH net-next 2/2] net sched actions: skbedit add support for mod-ing skb pkt_type Jamal Hadi Salim @ 2016-06-19 18:09 ` Daniel Borkmann 0 siblings, 0 replies; 4+ messages in thread From: Daniel Borkmann @ 2016-06-19 18:09 UTC (permalink / raw) To: Jamal Hadi Salim, davem; +Cc: netdev, xiyou.wangcong, fw On 06/18/2016 05:12 PM, Jamal Hadi Salim wrote: > From: Jamal Hadi Salim <jhs@mojatatu.com> > > Extremely useful for setting packet type to host so i dont > have to modify the dst mac address using pedit (which requires > that i know the mac address) > > Example usage: > tc filter add dev eth0 parent ffff: protocol ip pref 9 u32 \ > match ip src 5.5.5.5/32 \ > flowid 1:5 action skbedit ptype host > > This will tag all packets incoming from 5.5.5.5 with type > PACKET_HOST > > Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> > --- > include/net/tc_act/tc_skbedit.h | 10 +++++----- > include/uapi/linux/tc_act/tc_skbedit.h | 2 ++ > net/sched/act_skbedit.c | 18 +++++++++++++++++- > 3 files changed, 24 insertions(+), 6 deletions(-) > > diff --git a/include/net/tc_act/tc_skbedit.h b/include/net/tc_act/tc_skbedit.h > index b496d5a..d01a5d4 100644 > --- a/include/net/tc_act/tc_skbedit.h > +++ b/include/net/tc_act/tc_skbedit.h > @@ -24,11 +24,11 @@ > > struct tcf_skbedit { > struct tcf_common common; > - u32 flags; > - u32 priority; > - u32 mark; > - u16 queue_mapping; > - /* XXX: 16-bit pad here? */ > + u32 flags; > + u32 priority; > + u32 mark; > + u16 queue_mapping; > + u16 ptype; > }; > #define to_skbedit(a) \ > container_of(a->priv, struct tcf_skbedit, common) > diff --git a/include/uapi/linux/tc_act/tc_skbedit.h b/include/uapi/linux/tc_act/tc_skbedit.h > index fecb5cc..a4d00c6 100644 > --- a/include/uapi/linux/tc_act/tc_skbedit.h > +++ b/include/uapi/linux/tc_act/tc_skbedit.h > @@ -27,6 +27,7 @@ > #define SKBEDIT_F_PRIORITY 0x1 > #define SKBEDIT_F_QUEUE_MAPPING 0x2 > #define SKBEDIT_F_MARK 0x4 > +#define SKBEDIT_F_PTYPE 0x8 > > struct tc_skbedit { > tc_gen; > @@ -40,6 +41,7 @@ enum { > TCA_SKBEDIT_QUEUE_MAPPING, > TCA_SKBEDIT_MARK, > TCA_SKBEDIT_PAD, > + TCA_SKBEDIT_PTYPE, > __TCA_SKBEDIT_MAX > }; > #define TCA_SKBEDIT_MAX (__TCA_SKBEDIT_MAX - 1) > diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c > index 53d1486..1c4c924 100644 > --- a/net/sched/act_skbedit.c > +++ b/net/sched/act_skbedit.c > @@ -47,6 +47,8 @@ static int tcf_skbedit(struct sk_buff *skb, const struct tc_action *a, > skb_set_queue_mapping(skb, d->queue_mapping); > if (d->flags & SKBEDIT_F_MARK) > skb->mark = d->mark; > + if (d->flags & SKBEDIT_F_PTYPE) > + skb->pkt_type = d->ptype; > > spin_unlock(&d->tcf_lock); > return d->tcf_action; > @@ -57,6 +59,7 @@ static const struct nla_policy skbedit_policy[TCA_SKBEDIT_MAX + 1] = { > [TCA_SKBEDIT_PRIORITY] = { .len = sizeof(u32) }, > [TCA_SKBEDIT_QUEUE_MAPPING] = { .len = sizeof(u16) }, > [TCA_SKBEDIT_MARK] = { .len = sizeof(u32) }, > + [TCA_SKBEDIT_PTYPE] = { .len = sizeof(u16) }, > }; > > static int tcf_skbedit_init(struct net *net, struct nlattr *nla, > @@ -68,7 +71,7 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla, > struct tc_skbedit *parm; > struct tcf_skbedit *d; > u32 flags = 0, *priority = NULL, *mark = NULL; > - u16 *queue_mapping = NULL; > + u16 *queue_mapping = NULL, *ptype = NULL; > bool exists = false; > int ret = 0, err; > > @@ -92,6 +95,13 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla, > queue_mapping = nla_data(tb[TCA_SKBEDIT_QUEUE_MAPPING]); > } > > + if (tb[TCA_SKBEDIT_PTYPE] != NULL) { > + ptype = nla_data(tb[TCA_SKBEDIT_PTYPE]); > + if (!skb_pkt_type_ok(*ptype)) > + return -EINVAL; > + flags |= SKBEDIT_F_PTYPE; > + } > + > if (tb[TCA_SKBEDIT_MARK] != NULL) { > flags |= SKBEDIT_F_MARK; > mark = nla_data(tb[TCA_SKBEDIT_MARK]); > @@ -132,6 +142,8 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla, > d->queue_mapping = *queue_mapping; > if (flags & SKBEDIT_F_MARK) > d->mark = *mark; > + if (flags & SKBEDIT_F_PTYPE) > + d->ptype = *ptype; > > d->tcf_action = parm->action; > > @@ -169,6 +181,10 @@ static int tcf_skbedit_dump(struct sk_buff *skb, struct tc_action *a, > nla_put(skb, TCA_SKBEDIT_MARK, sizeof(d->mark), > &d->mark)) > goto nla_put_failure; > + if ((d->flags & SKBEDIT_F_PTYPE) && > + nla_put(skb, TCA_SKBEDIT_PTYPE, sizeof(d->ptype), > + &d->ptype)) We already have things like nla_put_u16() etc, would be good to use them here, doesn't have to be in this set, though, but rather as follow-up since it's used like this also for other attributes. > + goto nla_put_failure; > > tcf_tm_dump(&t, &d->tcf_tm); > if (nla_put_64bit(skb, TCA_SKBEDIT_TM, sizeof(t), &t, TCA_SKBEDIT_PAD)) > ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users 2016-06-18 15:12 [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users Jamal Hadi Salim 2016-06-18 15:12 ` [PATCH net-next 2/2] net sched actions: skbedit add support for mod-ing skb pkt_type Jamal Hadi Salim @ 2016-06-19 18:06 ` Daniel Borkmann 1 sibling, 0 replies; 4+ messages in thread From: Daniel Borkmann @ 2016-06-19 18:06 UTC (permalink / raw) To: Jamal Hadi Salim, davem; +Cc: netdev, xiyou.wangcong, fw Hi Jamal, On 06/18/2016 05:12 PM, Jamal Hadi Salim wrote: > From: Jamal Hadi Salim <jhs@mojatatu.com> > > Suggested-by: Daniel Borkmann <daniel@iogearbox.net> > Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> > --- > include/linux/skbuff.h | 11 +++++++++++ > net/netfilter/nft_meta.c | 9 +-------- > 2 files changed, 12 insertions(+), 8 deletions(-) > > diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h > index dc0fca7..0b794de 100644 > --- a/include/linux/skbuff.h > +++ b/include/linux/skbuff.h > @@ -37,6 +37,7 @@ > #include <net/flow_dissector.h> > #include <linux/splice.h> > #include <linux/in6.h> > +#include <linux/if_packet.h> > #include <net/flow.h> > > /* The interface for checksum offload between the stack and networking drivers > @@ -797,6 +798,7 @@ struct sk_buff { > atomic_t users; > }; > > + Why the extra newline here (the rest looks good)? > #ifdef __KERNEL__ > /* > * Handling routines are only of interest to the kernel > @@ -881,6 +883,15 @@ static inline struct rtable *skb_rtable(const struct sk_buff *skb) > return (struct rtable *)skb_dst(skb); > } > > +/* For mangling skb->pkt_type from user space side from applications > + * such as nft, tc, etc, we only allow a conservative subset of > + * possible pkt_types to be set. > +*/ > +static inline bool skb_pkt_type_ok(u32 p) > +{ > + return p <= PACKET_OTHERHOST; Just a small nit: I would probably rename 'p' into 'type'. > +} > + > void kfree_skb(struct sk_buff *skb); > void kfree_skb_list(struct sk_buff *segs); > void skb_tx_error(struct sk_buff *skb); > diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c > index 16c50b0..03e5e33 100644 > --- a/net/netfilter/nft_meta.c > +++ b/net/netfilter/nft_meta.c > @@ -199,13 +199,6 @@ err: > } > EXPORT_SYMBOL_GPL(nft_meta_get_eval); > > -/* don't change or set _LOOPBACK, _USER, etc. */ > -static bool pkt_type_ok(u32 p) > -{ > - return p == PACKET_HOST || p == PACKET_BROADCAST || > - p == PACKET_MULTICAST || p == PACKET_OTHERHOST; > -} > - > void nft_meta_set_eval(const struct nft_expr *expr, > struct nft_regs *regs, > const struct nft_pktinfo *pkt) > @@ -223,7 +216,7 @@ void nft_meta_set_eval(const struct nft_expr *expr, > break; > case NFT_META_PKTTYPE: > if (skb->pkt_type != value && > - pkt_type_ok(value) && pkt_type_ok(skb->pkt_type)) > + skb_pkt_type_ok(value) && skb_pkt_type_ok(skb->pkt_type)) > skb->pkt_type = value; > break; > case NFT_META_NFTRACE: > ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-06-19 18:11 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2016-06-18 15:12 [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users Jamal Hadi Salim 2016-06-18 15:12 ` [PATCH net-next 2/2] net sched actions: skbedit add support for mod-ing skb pkt_type Jamal Hadi Salim 2016-06-19 18:09 ` Daniel Borkmann 2016-06-19 18:06 ` [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users Daniel Borkmann
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).