net: openvswitch: IPv6: Add IPv6 extension header support
Subsystems (3)
PATCH v8 1/1 net: openvswitch: IPv6: Add IPv6 extension header support
This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and packets can be filtered using ipv6_ext flag.
Signed-off-by Toms Atteka <[email protected]>
--- include/uapi/linux/openvswitch.h | 6 ++ net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++ net/openvswitch/flow.h | 14 ++++ net/openvswitch/flow_netlink.c | 26 +++++- 4 files changed, 184 insertions(+), 2 deletions(-)
include/uapi/linux/openvswitch.h +6 -0
@@ -342,6 +342,7 @@ enum ovs_key_attr {OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4 ,/* struct ovs_key_ct_tuple_ipv4 */ OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6 ,/* struct ovs_key_ct_tuple_ipv6 */ OVS_KEY_ATTR_NSH ,/* Nested set of ovs_nsh_key_* */ +OVS_KEY_ATTR_IPV6_EXTHDRS ,/* struct ovs_key_ipv6_exthdr */ #ifdef __KERNEL__ OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
@@ -421,6 +422,11 @@ struct ovs_key_ipv6 {__u8 ipv6_frag;/* One of OVS_FRAG_TYPE_*. */ }; +/* separate structure to support backward compatibility with older user space */ +struct ovs_key_ipv6_exthdrs { +__u16 hdrs; +}; +struct ovs_key_tcp {__be16 tcp_src;__be16 tcp_dst;
net/openvswitch/flow.c +140 -0
152 lines not on this page · raw message
net/openvswitch/flow.h +14 -0
@@ -32,6 +32,19 @@ enum sw_flow_mac_proto {#define SW_FLOW_KEY_INVALID 0x80#define MPLS_LABEL_DEPTH 3 +/* Bit definitions for IPv6 Extension Header pseudo-field. */ +enum ofp12_ipv6exthdr_flags { +OFPIEH12_NONEXT =1 <<0 ,/* "No next header" encountered. */ +OFPIEH12_ESP =1 <<1 ,/* Encrypted Sec Payload header present. */ +OFPIEH12_AUTH =1 <<2 ,/* Authentication header present. */ +OFPIEH12_DEST =1 <<3 ,/* 1 or 2 dest headers present. */ +OFPIEH12_FRAG =1 <<4 ,/* Fragment header present. */ +OFPIEH12_ROUTER =1 <<5 ,/* Router header present. */ +OFPIEH12_HOP =1 <<6 ,/* Hop-by-hop header present. */ +OFPIEH12_UNREP =1 <<7 ,/* Unexpected repeats encountered. */ +OFPIEH12_UNSEQ =1 <<8 /* Unexpected sequencing encountered. */ +}; +/* Store options at the end of the array if they are less than the * maximum size. This allows us to get the benefits of variable length * matching for small options.
@@ -121,6 +134,7 @@ struct sw_flow_key {struct in6_addr dst;/* IPv6 destination address. */ } addr;__be32 label;/* IPv6 flow label. */ +u16 exthdrs;/* IPv6 extension header flags */ union { struct { struct in6_addr src;
net/openvswitch/flow_netlink.c +24 -2
@@ -344,7 +344,7 @@ size_t ovs_key_attr_size(void)/* Whenever adding new OVS_KEY_ FIELDS, we should consider * updating this function. */ -BUILD_BUG_ON (OVS_KEY_ATTR_TUNNEL_INFO !=29 ); +BUILD_BUG_ON (OVS_KEY_ATTR_TUNNEL_INFO !=30 );return nla_total_size (4 )/* OVS_KEY_ATTR_PRIORITY */ +nla_total_size (0 )/* OVS_KEY_ATTR_TUNNEL */
@@ -367,7 +367,8 @@ size_t ovs_key_attr_size(void) +nla_total_size (2 )/* OVS_KEY_ATTR_ETHERTYPE */ +nla_total_size (40 )/* OVS_KEY_ATTR_IPV6 */ +nla_total_size (2 )/* OVS_KEY_ATTR_ICMPV6 */ - +nla_total_size (28 );/* OVS_KEY_ATTR_ND */ + +nla_total_size (28 )/* OVS_KEY_ATTR_ND */ + +nla_total_size (2 );/* OVS_KEY_ATTR_IPV6_EXTHDRS */ }static const struct ovs_len_tbl ovs_vxlan_ext_key_lens[OVS_VXLAN_EXT_MAX +1 ] = {
@@ -435,6 +436,8 @@ static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = { .len = sizeof(struct ovs_key_ct_tuple_ipv6) }, [OVS_KEY_ATTR_NSH] = { .len = OVS_ATTR_NESTED, .next = ovs_nsh_key_attr_lens, }, + [OVS_KEY_ATTR_IPV6_EXTHDRS] = { + .len = sizeof(struct ovs_key_ipv6_exthdrs) }, };static bool check_attr_len (unsigned int attr_len,unsigned int expected_len)
@@ -1595,6 +1598,17 @@ static int ovs_key_from_nlattrs(struct net *net, struct sw_flow_match *match, attrs &= ~(1 <<OVS_KEY_ATTR_IPV6 ); } +if (attrs & (1ULL <<OVS_KEY_ATTR_IPV6_EXTHDRS )) { +const struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key; + + ipv6_exthdrs_key =nla_data (a[OVS_KEY_ATTR_IPV6_EXTHDRS ]); + +SW_FLOW_KEY_PUT (match, ipv6.exthdrs, + ipv6_exthdrs_key->hdrs, is_mask); + + attrs &= ~(1ULL <<OVS_KEY_ATTR_IPV6_EXTHDRS ); + } +if (attrs & (1 <<OVS_KEY_ATTR_ARP )) {const struct ovs_key_arp *arp_key;
@@ -2097,6 +2111,7 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey, ipv4_key->ipv4_frag = output->ip.frag; }else if (swkey->eth.type ==htons (ETH_P_IPV6 )) {struct ovs_key_ipv6 *ipv6_key; +struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key; nla =nla_reserve (skb,OVS_KEY_ATTR_IPV6 ,sizeof (*ipv6_key));if (!nla)
@@ -2111,6 +2126,13 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey, ipv6_key->ipv6_tclass = output->ip.tos; ipv6_key->ipv6_hlimit = output->ip.ttl; ipv6_key->ipv6_frag = output->ip.frag; + + nla =nla_reserve (skb,OVS_KEY_ATTR_IPV6_EXTHDRS , +sizeof (*ipv6_exthdrs_key)); +if (!nla) + goto nla_put_failure; + ipv6_exthdrs_key =nla_data (nla); + ipv6_exthdrs_key->hdrs = output->ipv6.exthdrs; }else if (swkey->eth.type ==htons (ETH_P_NSH )) {if (nsh_key_to_nlattr (&output->nsh, is_mask, skb)) goto nla_put_failure;
Signature · 1 line
2.25.1
Quoted 89 lines · Toms Atteka
This change adds a new OpenFlow field
OFPXMT_OFB_IPV6_EXTHDRand packets can be filtered usingipv6_extflag.Signed-off-by Toms Atteka <[email protected]>--- include/uapi/linux/openvswitch.h | 6 ++ net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++ net/openvswitch/flow.h | 14 ++++ net/openvswitch/flow_netlink.c | 26 +++++- 4 files changed, 184 insertions(+), 2 deletions(-)include/uapi/linux/openvswitch.h +6
-0@@ -342,6 +342,7 @@ enum ovs_key_attr {OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4 ,/* struct ovs_key_ct_tuple_ipv4 */ OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6 ,/* struct ovs_key_ct_tuple_ipv6 */ OVS_KEY_ATTR_NSH ,/* Nested set of ovs_nsh_key_* */ +OVS_KEY_ATTR_IPV6_EXTHDRS ,/* struct ovs_key_ipv6_exthdr */ #ifdef __KERNEL__ OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */@@ -421,6 +422,11 @@ struct ovs_key_ipv6 {__u8 ipv6_frag;/* One of OVS_FRAG_TYPE_*. */ }; +/* separate structure to support backward compatibility with older user space */ +struct ovs_key_ipv6_exthdrs { +__u16 hdrs; +}; +struct ovs_key_tcp {__be16 tcp_src;__be16 tcp_dst;net/openvswitch/flow.c +45
-0@@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb) sizeof(struct icmphdr)); } +/** +* get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags. +* +* @skb: buffer where extension header data starts in packet +* @nh: ipv6 header +* @ext_hdrs: flags are stored here +* +* OFPIEH12_UNREP is set if more than one of a given IPv6 extension header +* is unexpectedly encountered. (Two destination options headers may be +* expected and would not cause this bit to be set.) +* +* OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order +* preferred (but not required) by RFC 2460: +* +* When more than one extension header is used in the same packet, it is +* recommended that those headers appear in the following order: +* IPv6 header +* Hop-by-Hop Options header +* Destination Options header +* Routing header +* Fragment header +* Authentication header +* Encapsulating Security Payload header +* Destination Options header +* upper-layer header +*/ +static void get_ipv6_ext_hdrs (struct sk_buff *skb,struct ipv6hdr *nh, +u16 *ext_hdrs) +{ +u8 next_type = nh->nexthdr; +unsigned int start =skb_network_offset (skb) +sizeof (struct ipv6hdr ); +int dest_options_header_count =0 ; + + *ext_hdrs =0 ; + +while (ipv6_ext_hdr (next_type)) { +struct ipv6_opt_hdr _hdr, *hp; + +switch (next_type) { +case IPPROTO_NONE : + *ext_hdrs |=OFPIEH12_NONEXT ; +/* stop parsing */ +return ; + +case IPPROTO_ESP :
net/openvswitch/flow.c static bool icmphdr_ok(struct sk_buff *skb) · line 296
Quoted 10 lines
net/openvswitch/flow.c +10
-0+if (*ext_hdrs &OFPIEH12_ESP ) + *ext_hdrs |=OFPIEH12_UNREP ; +if ((*ext_hdrs & ~(OFPIEH12_HOP |OFPIEH12_DEST | +OFPIEH12_ROUTER |IPPROTO_FRAGMENT | +OFPIEH12_AUTH |OFPIEH12_UNREP )) || + dest_options_header_count >=2 ) { + *ext_hdrs |=OFPIEH12_UNSEQ ; + } + *ext_hdrs |=OFPIEH12_ESP ; +break ;
you need to check_header() before looking into each extension header.
Quoted 94 lines · Pravin Shelar
Quoted 92 lines · Toms Atteka
This change adds a new OpenFlow field
OFPXMT_OFB_IPV6_EXTHDRand packets can be filtered usingipv6_extflag.Signed-off-by Toms Atteka <[email protected]>--- include/uapi/linux/openvswitch.h | 6 ++ net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++ net/openvswitch/flow.h | 14 ++++ net/openvswitch/flow_netlink.c | 26 +++++- 4 files changed, 184 insertions(+), 2 deletions(-)include/uapi/linux/openvswitch.h +6
-0@@ -342,6 +342,7 @@ enum ovs_key_attr {OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4 ,/* struct ovs_key_ct_tuple_ipv4 */ OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6 ,/* struct ovs_key_ct_tuple_ipv6 */ OVS_KEY_ATTR_NSH ,/* Nested set of ovs_nsh_key_* */ +OVS_KEY_ATTR_IPV6_EXTHDRS ,/* struct ovs_key_ipv6_exthdr */ #ifdef __KERNEL__ OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */@@ -421,6 +422,11 @@ struct ovs_key_ipv6 {__u8 ipv6_frag;/* One of OVS_FRAG_TYPE_*. */ }; +/* separate structure to support backward compatibility with older user space */ +struct ovs_key_ipv6_exthdrs { +__u16 hdrs; +}; +struct ovs_key_tcp {__be16 tcp_src;__be16 tcp_dst;net/openvswitch/flow.c +48
-0@@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb) sizeof(struct icmphdr)); } +/** +* get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags. +* +* @skb: buffer where extension header data starts in packet +* @nh: ipv6 header +* @ext_hdrs: flags are stored here +* +* OFPIEH12_UNREP is set if more than one of a given IPv6 extension header +* is unexpectedly encountered. (Two destination options headers may be +* expected and would not cause this bit to be set.) +* +* OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order +* preferred (but not required) by RFC 2460: +* +* When more than one extension header is used in the same packet, it is +* recommended that those headers appear in the following order: +* IPv6 header +* Hop-by-Hop Options header +* Destination Options header +* Routing header +* Fragment header +* Authentication header +* Encapsulating Security Payload header +* Destination Options header +* upper-layer header +*/ +static void get_ipv6_ext_hdrs (struct sk_buff *skb,struct ipv6hdr *nh, +u16 *ext_hdrs) +{ +u8 next_type = nh->nexthdr; +unsigned int start =skb_network_offset (skb) +sizeof (struct ipv6hdr ); +int dest_options_header_count =0 ; + + *ext_hdrs =0 ; + +while (ipv6_ext_hdr (next_type)) { +struct ipv6_opt_hdr _hdr, *hp; + +switch (next_type) { +case IPPROTO_NONE : + *ext_hdrs |=OFPIEH12_NONEXT ; +/* stop parsing */ +return ; + +case IPPROTO_ESP : +if (*ext_hdrs &OFPIEH12_ESP ) + *ext_hdrs |=OFPIEH12_UNREP ; + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
Quoted 8 lines
net/openvswitch/flow.c static bool icmphdr_ok(struct sk_buff *skb) · line 296
Quoted 7 lines
net/openvswitch/flow.c +7
-0+OFPIEH12_ROUTER |IPPROTO_FRAGMENT | + OFPIEH12_AUTH | OFPIEH12_UNREP)) || + dest_options_header_count >= 2) { + *ext_hdrs |=OFPIEH12_UNSEQ ; + } + *ext_hdrs |=OFPIEH12_ESP ; +break ;you need to
check_header()before looking into each extension header.
Could you elaborate why I need to add check_header(), skb_header_pointer() is doing sanitization.
Quoted 105 lines · Cpp Code
Quoted 94 lines · Pravin Shelar
Quoted 92 lines · Toms Atteka
This change adds a new OpenFlow field
OFPXMT_OFB_IPV6_EXTHDRand packets can be filtered usingipv6_extflag.Signed-off-by Toms Atteka <[email protected]>--- include/uapi/linux/openvswitch.h | 6 ++ net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++ net/openvswitch/flow.h | 14 ++++ net/openvswitch/flow_netlink.c | 26 +++++- 4 files changed, 184 insertions(+), 2 deletions(-)include/uapi/linux/openvswitch.h +6
-0@@ -342,6 +342,7 @@ enum ovs_key_attr {OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4 ,/* struct ovs_key_ct_tuple_ipv4 */ OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6 ,/* struct ovs_key_ct_tuple_ipv6 */ OVS_KEY_ATTR_NSH ,/* Nested set of ovs_nsh_key_* */ +OVS_KEY_ATTR_IPV6_EXTHDRS ,/* struct ovs_key_ipv6_exthdr */ #ifdef __KERNEL__ OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */@@ -421,6 +422,11 @@ struct ovs_key_ipv6 {__u8 ipv6_frag;/* One of OVS_FRAG_TYPE_*. */ }; +/* separate structure to support backward compatibility with older user space */ +struct ovs_key_ipv6_exthdrs { +__u16 hdrs; +}; +struct ovs_key_tcp {__be16 tcp_src;__be16 tcp_dst;net/openvswitch/flow.c +48
-0@@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb) sizeof(struct icmphdr)); } +/** +* get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags. +* +* @skb: buffer where extension header data starts in packet +* @nh: ipv6 header +* @ext_hdrs: flags are stored here +* +* OFPIEH12_UNREP is set if more than one of a given IPv6 extension header +* is unexpectedly encountered. (Two destination options headers may be +* expected and would not cause this bit to be set.) +* +* OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order +* preferred (but not required) by RFC 2460: +* +* When more than one extension header is used in the same packet, it is +* recommended that those headers appear in the following order: +* IPv6 header +* Hop-by-Hop Options header +* Destination Options header +* Routing header +* Fragment header +* Authentication header +* Encapsulating Security Payload header +* Destination Options header +* upper-layer header +*/ +static void get_ipv6_ext_hdrs (struct sk_buff *skb,struct ipv6hdr *nh, +u16 *ext_hdrs) +{ +u8 next_type = nh->nexthdr; +unsigned int start =skb_network_offset (skb) +sizeof (struct ipv6hdr ); +int dest_options_header_count =0 ; + + *ext_hdrs =0 ; + +while (ipv6_ext_hdr (next_type)) { +struct ipv6_opt_hdr _hdr, *hp; + +switch (next_type) { +case IPPROTO_NONE : + *ext_hdrs |=OFPIEH12_NONEXT ; +/* stop parsing */ +return ; + +case IPPROTO_ESP : +if (*ext_hdrs &OFPIEH12_ESP ) + *ext_hdrs |=OFPIEH12_UNREP ; + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |Quoted 8 lines
net/openvswitch/flow.c static bool icmphdr_ok(struct sk_buff *skb) · line 296
Quoted 7 lines
net/openvswitch/flow.c +7
-0+OFPIEH12_ROUTER |IPPROTO_FRAGMENT | + OFPIEH12_AUTH | OFPIEH12_UNREP)) || + dest_options_header_count >= 2) { + *ext_hdrs |=OFPIEH12_UNSEQ ; + } + *ext_hdrs |=OFPIEH12_ESP ; +break ;you need to
check_header()before looking into each extension header.
Quoted 2 lines
Could you elaborate why I need to add
check_header(),skb_header_pointer()is doing sanitization.
I mean check_header() would allow you to read the header without copying the bits, it is used in ovs flow extraction so its usual check.
Quoted 107 lines · Pravin Shelar
Quoted 105 lines · Cpp Code
Quoted 102 lines · Pravin Shelar
Quoted 89 lines · Toms Atteka
This change adds a new OpenFlow field
OFPXMT_OFB_IPV6_EXTHDRand packets can be filtered usingipv6_extflag.Signed-off-by Toms Atteka <[email protected]>--- include/uapi/linux/openvswitch.h | 6 ++ net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++ net/openvswitch/flow.h | 14 ++++ net/openvswitch/flow_netlink.c | 26 +++++- 4 files changed, 184 insertions(+), 2 deletions(-)include/uapi/linux/openvswitch.h +6
-0@@ -342,6 +342,7 @@ enum ovs_key_attr {OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4 ,/* struct ovs_key_ct_tuple_ipv4 */ OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6 ,/* struct ovs_key_ct_tuple_ipv6 */ OVS_KEY_ATTR_NSH ,/* Nested set of ovs_nsh_key_* */ +OVS_KEY_ATTR_IPV6_EXTHDRS ,/* struct ovs_key_ipv6_exthdr */ #ifdef __KERNEL__ OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */@@ -421,6 +422,11 @@ struct ovs_key_ipv6 {__u8 ipv6_frag;/* One of OVS_FRAG_TYPE_*. */ }; +/* separate structure to support backward compatibility with older user space */ +struct ovs_key_ipv6_exthdrs { +__u16 hdrs; +}; +struct ovs_key_tcp {__be16 tcp_src;__be16 tcp_dst;net/openvswitch/flow.c +45
-0@@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb) sizeof(struct icmphdr)); } +/** +* get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags. +* +* @skb: buffer where extension header data starts in packet +* @nh: ipv6 header +* @ext_hdrs: flags are stored here +* +* OFPIEH12_UNREP is set if more than one of a given IPv6 extension header +* is unexpectedly encountered. (Two destination options headers may be +* expected and would not cause this bit to be set.) +* +* OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order +* preferred (but not required) by RFC 2460: +* +* When more than one extension header is used in the same packet, it is +* recommended that those headers appear in the following order: +* IPv6 header +* Hop-by-Hop Options header +* Destination Options header +* Routing header +* Fragment header +* Authentication header +* Encapsulating Security Payload header +* Destination Options header +* upper-layer header +*/ +static void get_ipv6_ext_hdrs (struct sk_buff *skb,struct ipv6hdr *nh, +u16 *ext_hdrs) +{ +u8 next_type = nh->nexthdr; +unsigned int start =skb_network_offset (skb) +sizeof (struct ipv6hdr ); +int dest_options_header_count =0 ; + + *ext_hdrs =0 ; + +while (ipv6_ext_hdr (next_type)) { +struct ipv6_opt_hdr _hdr, *hp; + +switch (next_type) { +case IPPROTO_NONE : + *ext_hdrs |=OFPIEH12_NONEXT ; +/* stop parsing */ +return ; + +case IPPROTO_ESP :net/openvswitch/flow.c static bool icmphdr_ok(struct sk_buff *skb) · line 296
Quoted 10 lines
net/openvswitch/flow.c +10
-0+if (*ext_hdrs &OFPIEH12_ESP ) + *ext_hdrs |=OFPIEH12_UNREP ; +if ((*ext_hdrs & ~(OFPIEH12_HOP |OFPIEH12_DEST | +OFPIEH12_ROUTER |IPPROTO_FRAGMENT | +OFPIEH12_AUTH |OFPIEH12_UNREP )) || + dest_options_header_count >=2 ) { + *ext_hdrs |=OFPIEH12_UNSEQ ; + } + *ext_hdrs |=OFPIEH12_ESP ; +break ;you need to
check_header()before looking into each extension header.
Quoted 6 lines
Quoted 2 lines
Could you elaborate why I need to add
check_header(),skb_header_pointer()is doing sanitization.I mean
check_header()would allow you to read the header without copying the bits, it is used in ovs flow extraction so its usual check.
But check_header() will call *__pskb_pull_tail which in turn will copy bits if data will be fragmented.
/* Moves tail of skb head forward, copying data from fragmented part,
* when it is necessary.
* 1. It may fail due to malloc failure.
* 2. It may change skb pointers.
*
* It is pretty complicated. Luckily, it is called only in exceptional cases. */
void *__pskb_pull_tail(struct sk_buff *skb, int delta)
as well I noticed that for example commit 4a06fa67c4da20148803525151845276cdb995c1 is moving from pskb_may_pull() to skb_header_pointer()
Pravin Shelar
Acked-by Pravin B Shelar()
Quoted 112 lines · Cpp Code
Quoted 110 lines · Pravin Shelar
Quoted 107 lines · Cpp Code
Quoted 94 lines · Pravin Shelar
Quoted 92 lines · Toms Atteka
This change adds a new OpenFlow field
OFPXMT_OFB_IPV6_EXTHDRand packets can be filtered usingipv6_extflag.Signed-off-by Toms Atteka <[email protected]>--- include/uapi/linux/openvswitch.h | 6 ++ net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++ net/openvswitch/flow.h | 14 ++++ net/openvswitch/flow_netlink.c | 26 +++++- 4 files changed, 184 insertions(+), 2 deletions(-)include/uapi/linux/openvswitch.h +6
-0@@ -342,6 +342,7 @@ enum ovs_key_attr {OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4 ,/* struct ovs_key_ct_tuple_ipv4 */ OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6 ,/* struct ovs_key_ct_tuple_ipv6 */ OVS_KEY_ATTR_NSH ,/* Nested set of ovs_nsh_key_* */ +OVS_KEY_ATTR_IPV6_EXTHDRS ,/* struct ovs_key_ipv6_exthdr */ #ifdef __KERNEL__ OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */@@ -421,6 +422,11 @@ struct ovs_key_ipv6 {__u8 ipv6_frag;/* One of OVS_FRAG_TYPE_*. */ }; +/* separate structure to support backward compatibility with older user space */ +struct ovs_key_ipv6_exthdrs { +__u16 hdrs; +}; +struct ovs_key_tcp {__be16 tcp_src;__be16 tcp_dst;net/openvswitch/flow.c +48
-0@@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb) sizeof(struct icmphdr)); } +/** +* get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags. +* +* @skb: buffer where extension header data starts in packet +* @nh: ipv6 header +* @ext_hdrs: flags are stored here +* +* OFPIEH12_UNREP is set if more than one of a given IPv6 extension header +* is unexpectedly encountered. (Two destination options headers may be +* expected and would not cause this bit to be set.) +* +* OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order +* preferred (but not required) by RFC 2460: +* +* When more than one extension header is used in the same packet, it is +* recommended that those headers appear in the following order: +* IPv6 header +* Hop-by-Hop Options header +* Destination Options header +* Routing header +* Fragment header +* Authentication header +* Encapsulating Security Payload header +* Destination Options header +* upper-layer header +*/ +static void get_ipv6_ext_hdrs (struct sk_buff *skb,struct ipv6hdr *nh, +u16 *ext_hdrs) +{ +u8 next_type = nh->nexthdr; +unsigned int start =skb_network_offset (skb) +sizeof (struct ipv6hdr ); +int dest_options_header_count =0 ; + + *ext_hdrs =0 ; + +while (ipv6_ext_hdr (next_type)) { +struct ipv6_opt_hdr _hdr, *hp; + +switch (next_type) { +case IPPROTO_NONE : + *ext_hdrs |=OFPIEH12_NONEXT ; +/* stop parsing */ +return ; + +case IPPROTO_ESP : +if (*ext_hdrs &OFPIEH12_ESP ) + *ext_hdrs |=OFPIEH12_UNREP ; + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |Quoted 8 lines
net/openvswitch/flow.c static bool icmphdr_ok(struct sk_buff *skb) · line 296
Quoted 7 lines
net/openvswitch/flow.c +7
-0+OFPIEH12_ROUTER |IPPROTO_FRAGMENT | + OFPIEH12_AUTH | OFPIEH12_UNREP)) || + dest_options_header_count >= 2) { + *ext_hdrs |=OFPIEH12_UNSEQ ; + } + *ext_hdrs |=OFPIEH12_ESP ; +break ;you need to
check_header()before looking into each extension header.Could you elaborate why I need to add
check_header(),skb_header_pointer()is doing sanitization.
Quoted 7 lines
Quoted 3 lines
I mean
check_header()would allow you to read the header without copying the bits, it is used in ovs flow extraction so its usual check.But
check_header()will call*__pskb_pull_tailwhich in turn will copy bits if data will be fragmented.
OVS flow extract uses this function to extract flow upto L4, so skb_header_pointer() is not saving any copy operation.
Quoted 9 lines
/* Moves tail of skb head forward, copying data from fragmented part,
* when it is necessary.
* 1. It may fail due to malloc failure.
* 2. It may change skb pointers.
*
* It is pretty complicated. Luckily, it is called only in exceptional cases. */
void *__pskb_pull_tail(structsk_buff*skb, int delta)
Quoted 3 lines
as well I noticed that for example commit
4a06fa67c4da20148803525151845276cdb995c1is moving frompskb_may_pull()toskb_header_pointer()
ok, I see advantage of using skb_header_pointer() in this case, but replacing all check_header() with skb_header_pointer() would add lot of copy operation in flow extract. Anyways for this use case skb_header_pointer() is fine.
Acked-by Pravin B Shelar <[email protected]>
Quoted 138 lines · Pravin Shelar
()
Quoted 112 lines · Cpp Code
Quoted 110 lines · Pravin Shelar
Quoted 107 lines · Cpp Code
Quoted 94 lines · Pravin Shelar
Quoted 92 lines · Toms Atteka
This change adds a new OpenFlow field
OFPXMT_OFB_IPV6_EXTHDRand packets can be filtered usingipv6_extflag.Signed-off-by Toms Atteka <[email protected]>--- include/uapi/linux/openvswitch.h | 6 ++ net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++ net/openvswitch/flow.h | 14 ++++ net/openvswitch/flow_netlink.c | 26 +++++- 4 files changed, 184 insertions(+), 2 deletions(-)include/uapi/linux/openvswitch.h +6
-0@@ -342,6 +342,7 @@ enum ovs_key_attr {OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4 ,/* struct ovs_key_ct_tuple_ipv4 */ OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6 ,/* struct ovs_key_ct_tuple_ipv6 */ OVS_KEY_ATTR_NSH ,/* Nested set of ovs_nsh_key_* */ +OVS_KEY_ATTR_IPV6_EXTHDRS ,/* struct ovs_key_ipv6_exthdr */ #ifdef __KERNEL__ OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */@@ -421,6 +422,11 @@ struct ovs_key_ipv6 {__u8 ipv6_frag;/* One of OVS_FRAG_TYPE_*. */ }; +/* separate structure to support backward compatibility with older user space */ +struct ovs_key_ipv6_exthdrs { +__u16 hdrs; +}; +struct ovs_key_tcp {__be16 tcp_src;__be16 tcp_dst;net/openvswitch/flow.c +48
-0@@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb) sizeof(struct icmphdr)); } +/** +* get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags. +* +* @skb: buffer where extension header data starts in packet +* @nh: ipv6 header +* @ext_hdrs: flags are stored here +* +* OFPIEH12_UNREP is set if more than one of a given IPv6 extension header +* is unexpectedly encountered. (Two destination options headers may be +* expected and would not cause this bit to be set.) +* +* OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order +* preferred (but not required) by RFC 2460: +* +* When more than one extension header is used in the same packet, it is +* recommended that those headers appear in the following order: +* IPv6 header +* Hop-by-Hop Options header +* Destination Options header +* Routing header +* Fragment header +* Authentication header +* Encapsulating Security Payload header +* Destination Options header +* upper-layer header +*/ +static void get_ipv6_ext_hdrs (struct sk_buff *skb,struct ipv6hdr *nh, +u16 *ext_hdrs) +{ +u8 next_type = nh->nexthdr; +unsigned int start =skb_network_offset (skb) +sizeof (struct ipv6hdr ); +int dest_options_header_count =0 ; + + *ext_hdrs =0 ; + +while (ipv6_ext_hdr (next_type)) { +struct ipv6_opt_hdr _hdr, *hp; + +switch (next_type) { +case IPPROTO_NONE : + *ext_hdrs |=OFPIEH12_NONEXT ; +/* stop parsing */ +return ; + +case IPPROTO_ESP : +if (*ext_hdrs &OFPIEH12_ESP ) + *ext_hdrs |=OFPIEH12_UNREP ; + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |Quoted 8 lines
net/openvswitch/flow.c static bool icmphdr_ok(struct sk_buff *skb) · line 296
Quoted 7 lines
net/openvswitch/flow.c +7
-0+OFPIEH12_ROUTER |IPPROTO_FRAGMENT | + OFPIEH12_AUTH | OFPIEH12_UNREP)) || + dest_options_header_count >= 2) { + *ext_hdrs |=OFPIEH12_UNSEQ ; + } + *ext_hdrs |=OFPIEH12_ESP ; +break ;you need to
check_header()before looking into each extension header.Could you elaborate why I need to add
check_header(),skb_header_pointer()is doing sanitization.Quoted 7 lines
Quoted 3 lines
I mean
check_header()would allow you to read the header without copying the bits, it is used in ovs flow extraction so its usual check.But
check_header()will call*__pskb_pull_tailwhich in turn will copy bits if data will be fragmented.OVS flow extract uses this function to extract flow upto L4, so
skb_header_pointer()is not saving any copy operation.Quoted 9 lines
/* Moves tail of skb head forward, copying data from fragmented part,
* when it is necessary.
* 1. It may fail due to malloc failure.
* 2. It may change skb pointers.
*
* It is pretty complicated. Luckily, it is called only in exceptional cases. */
void *__pskb_pull_tail(structsk_buff*skb, int delta)Quoted 3 lines
as well I noticed that for example commit
4a06fa67c4da20148803525151845276cdb995c1is moving frompskb_may_pull()toskb_header_pointer()
Quoted 6 lines
ok, I see advantage of using
skb_header_pointer()in this case, but replacing allcheck_header()withskb_header_pointer()would add lot of copy operation in flow extract. Anyways for this use caseskb_header_pointer()is fine.Acked-by Pravin B Shelar <[email protected]>
Hi,
Could this be applied please.
Thanks,
Tom
Jakub Kicinski
maintainerQuoted 8 lines · On Wed, 9 Feb 2022 12:46:01 -0800 Cpp Code wrote:
Quoted 6 lines
ok, I see advantage of using
skb_header_pointer()in this case, but replacing allcheck_header()withskb_header_pointer()would add lot of copy operation in flow extract. Anyways for this use caseskb_header_pointer()is fine.Acked-by Pravin B Shelar <[email protected]>Could this be applied please.
Please repost with Pravin's ack included.