Netdev Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Jamal Hadi Salim <jhs@mojatatu.com>
To: Boris Sukholitko <boris.sukholitko@broadcom.com>,
	netdev@vger.kernel.org, Jiri Pirko <jiri@resnulli.us>,
	Cong Wang <xiyou.wangcong@gmail.com>
Cc: "David S . Miller" <davem@davemloft.net>,
	Jakub Kicinski <kuba@kernel.org>,
	Vladimir Oltean <olteanv@gmail.com>,
	Vadym Kochan <vadym.kochan@plvision.eu>,
	Ilya Lifshits <ilya.lifshits@broadcom.com>,
	tom Herbert <tom@sipanda.io>,
	Felipe Magno de Almeida <felipe@expertise.dev>,
	Pedro Tammela <pctammela@mojatatu.com>
Subject: Re: [PATCH net-next] net/sched: cls_flower: Add orig_ethtype
Date: Mon, 30 Aug 2021 21:48:38 -0400	[thread overview]
Message-ID: <b05f2736-fa76-4071-3d52-92ac765ca405@mojatatu.com> (raw)
In-Reply-To: <20210830080800.18591-1-boris.sukholitko@broadcom.com>

On 2021-08-30 4:08 a.m., Boris Sukholitko wrote:
> The following flower filter fails to match packets:
> 
> tc filter add dev eth0 ingress protocol 0x8864 flower \
>      action simple sdata hi64
> 
> The protocol 0x8864 (ETH_P_PPP_SES) is a tunnel protocol. As such, it is
> being dissected by __skb_flow_dissect and it's internal protocol is
> being set as key->basic.n_proto. IOW, the existence of ETH_P_PPP_SES
> tunnel is transparent to the callers of __skb_flow_dissect.
> 
> OTOH, in the filters above, cls_flower configures its key->basic.n_proto
> to the ETH_P_PPP_SES value configured by the user. Matching on this key
> fails because of __skb_flow_dissect "transparency" mentioned above.
> 
> Therefore there is no way currently to match on such packets using
> flower.
> 
> To fix the issue add new orig_ethtype key to the flower along with the
> necessary changes to the flow dissector etc.
> 
> To filter the ETH_P_PPP_SES packets the command becomes:
> 
> tc filter add dev eth0 ingress flower orig_ethtype 0x8864 \
>      action simple sdata hi64

Where's "protocol" on the above command line is. Probably a typo?

The main culprit is clearly the flow dissector parsing. I am not sure
if in general flowdisc to deal with deeper hierarchies/tunnels
without constantly adding a lot more hacks. Imagine if you had an
ethernet packet with double vlan tags and encapsulating a pppoe packet
(i.e 3 or more layers of ethernet) - that would be a nightmare.
IMO, your approach is adding yet another bandaid.

Would it make sense for the setting of the
skb_key.basic.n_proto  to be from tp->protocol for
your specific case in classify().

Which means your original setup:
  tc filter add dev eth0 ingress protocol 0x8864 flower \
      action simple sdata hi64

should continue to work if i am not mistaken. Vlans would
continue to be a speacial case.

I dont know what that would break though...

cheers,
jamal

  parent reply	other threads:[~2021-08-31  1:48 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-30  8:08 Boris Sukholitko
2021-08-30  9:00 ` Vladimir Oltean
2021-08-30  9:04   ` Vladimir Oltean
2021-08-30  9:18   ` Boris Sukholitko
2021-08-30  9:21     ` Vladimir Oltean
2021-08-30  9:42       ` Boris Sukholitko
2021-08-30 10:13         ` Vladimir Oltean
2021-08-31  1:48 ` Jamal Hadi Salim [this message]
2021-08-31 12:04   ` Boris Sukholitko
2021-08-31 13:18     ` Jamal Hadi Salim
2021-08-31 14:03       ` Boris Sukholitko
2021-09-02  6:48       ` Ido Schimmel
2021-09-03 22:52         ` Jamal Hadi Salim
2021-09-04 14:08       ` Tom Herbert

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=b05f2736-fa76-4071-3d52-92ac765ca405@mojatatu.com \
    --to=jhs@mojatatu.com \
    --cc=boris.sukholitko@broadcom.com \
    --cc=davem@davemloft.net \
    --cc=felipe@expertise.dev \
    --cc=ilya.lifshits@broadcom.com \
    --cc=jiri@resnulli.us \
    --cc=kuba@kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=olteanv@gmail.com \
    --cc=pctammela@mojatatu.com \
    --cc=tom@sipanda.io \
    --cc=vadym.kochan@plvision.eu \
    --cc=xiyou.wangcong@gmail.com \
    --subject='Re: [PATCH net-next] net/sched: cls_flower: Add orig_ethtype' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).