Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7b684884 authored by Simon Horman's avatar Simon Horman Committed by David S. Miller
Browse files

net/sched: cls_flower: Support matching on ICMP type and code 



Support matching on ICMP type and code.

Example usage:

tc qdisc add dev eth0 ingress

tc filter add dev eth0 protocol ip parent ffff: flower \
	indev eth0 ip_proto icmp type 8 code 0 action drop

tc filter add dev eth0 protocol ipv6 parent ffff: flower \
	indev eth0 ip_proto icmpv6 type 128 code 0 action drop

Signed-off-by: default avatarSimon Horman <simon.horman@netronome.com>
Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 972d3876

include/uapi/linux/pkt_cls.h

+10 −0
Original line number Diff line number Diff line
@@ -461,6 +461,16 @@ enum { 


	TCA_FLOWER_KEY_FLAGS,		/* be32 */

	TCA_FLOWER_KEY_FLAGS_MASK,	/* be32 */



	TCA_FLOWER_KEY_ICMPV4_CODE,	/* u8 */

	TCA_FLOWER_KEY_ICMPV4_CODE_MASK,/* u8 */

	TCA_FLOWER_KEY_ICMPV4_TYPE,	/* u8 */

	TCA_FLOWER_KEY_ICMPV4_TYPE_MASK,/* u8 */

	TCA_FLOWER_KEY_ICMPV6_CODE,	/* u8 */

	TCA_FLOWER_KEY_ICMPV6_CODE_MASK,/* u8 */

	TCA_FLOWER_KEY_ICMPV6_TYPE,	/* u8 */

	TCA_FLOWER_KEY_ICMPV6_TYPE_MASK,/* u8 */



	__TCA_FLOWER_MAX,

};

net/sched/cls_flower.c

+53 −0
Original line number Diff line number Diff line
@@ -39,6 +39,7 @@ struct fl_flow_key { 
		struct flow_dissector_key_ipv6_addrs ipv6;

	};

	struct flow_dissector_key_ports tp;

	struct flow_dissector_key_icmp icmp;

	struct flow_dissector_key_keyid enc_key_id;

	union {

		struct flow_dissector_key_ipv4_addrs enc_ipv4;
@@ -388,6 +389,14 @@ static const struct nla_policy fl_policy[TCA_FLOWER_MAX + 1] = { 
	[TCA_FLOWER_KEY_ENC_UDP_DST_PORT_MASK]	= { .type = NLA_U16 },

	[TCA_FLOWER_KEY_FLAGS]		= { .type = NLA_U32 },

	[TCA_FLOWER_KEY_FLAGS_MASK]	= { .type = NLA_U32 },

	[TCA_FLOWER_KEY_ICMPV4_TYPE]	= { .type = NLA_U8 },

	[TCA_FLOWER_KEY_ICMPV4_TYPE_MASK] = { .type = NLA_U8 },

	[TCA_FLOWER_KEY_ICMPV4_CODE]	= { .type = NLA_U8 },

	[TCA_FLOWER_KEY_ICMPV4_CODE_MASK] = { .type = NLA_U8 },

	[TCA_FLOWER_KEY_ICMPV6_TYPE]	= { .type = NLA_U8 },

	[TCA_FLOWER_KEY_ICMPV6_TYPE_MASK] = { .type = NLA_U8 },

	[TCA_FLOWER_KEY_ICMPV6_CODE]	= { .type = NLA_U8 },

	[TCA_FLOWER_KEY_ICMPV6_CODE_MASK] = { .type = NLA_U8 },

};



static void fl_set_key_val(struct nlattr **tb,
@@ -537,6 +546,26 @@ static int fl_set_key(struct net *net, struct nlattr **tb, 
		fl_set_key_val(tb, &key->tp.dst, TCA_FLOWER_KEY_SCTP_DST,

			       &mask->tp.dst, TCA_FLOWER_KEY_SCTP_DST_MASK,

			       sizeof(key->tp.dst));

	} else if (key->basic.n_proto == htons(ETH_P_IP) &&

		   key->basic.ip_proto == IPPROTO_ICMP) {

		fl_set_key_val(tb, &key->icmp.type, TCA_FLOWER_KEY_ICMPV4_TYPE,

			       &mask->icmp.type,

			       TCA_FLOWER_KEY_ICMPV4_TYPE_MASK,

			       sizeof(key->icmp.type));

		fl_set_key_val(tb, &key->icmp.code, TCA_FLOWER_KEY_ICMPV4_CODE,

			       &mask->icmp.code,

			       TCA_FLOWER_KEY_ICMPV4_CODE_MASK,

			       sizeof(key->icmp.code));

	} else if (key->basic.n_proto == htons(ETH_P_IPV6) &&

		   key->basic.ip_proto == IPPROTO_ICMPV6) {

		fl_set_key_val(tb, &key->icmp.type, TCA_FLOWER_KEY_ICMPV6_TYPE,

			       &mask->icmp.type,

			       TCA_FLOWER_KEY_ICMPV6_TYPE_MASK,

			       sizeof(key->icmp.type));

		fl_set_key_val(tb, &key->icmp.code, TCA_FLOWER_KEY_ICMPV4_CODE,

			       &mask->icmp.code,

			       TCA_FLOWER_KEY_ICMPV4_CODE_MASK,

			       sizeof(key->icmp.code));

	}



	if (tb[TCA_FLOWER_KEY_ENC_IPV4_SRC] ||
@@ -648,6 +677,8 @@ static void fl_init_dissector(struct cls_fl_head *head, 
			     FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6);

	FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,

			     FLOW_DISSECTOR_KEY_PORTS, tp);

	FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,

			     FLOW_DISSECTOR_KEY_ICMP, icmp);

	FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,

			     FLOW_DISSECTOR_KEY_VLAN, vlan);

	FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,
@@ -1050,6 +1081,28 @@ static int fl_dump(struct net *net, struct tcf_proto *tp, unsigned long fh, 
				  &mask->tp.dst, TCA_FLOWER_KEY_SCTP_DST_MASK,

				  sizeof(key->tp.dst))))

		goto nla_put_failure;

	else if (key->basic.n_proto == htons(ETH_P_IP) &&

		 key->basic.ip_proto == IPPROTO_ICMP &&

		 (fl_dump_key_val(skb, &key->icmp.type,

				  TCA_FLOWER_KEY_ICMPV4_TYPE, &mask->icmp.type,

				  TCA_FLOWER_KEY_ICMPV4_TYPE_MASK,

				  sizeof(key->icmp.type)) ||

		  fl_dump_key_val(skb, &key->icmp.code,

				  TCA_FLOWER_KEY_ICMPV4_CODE, &mask->icmp.code,

				  TCA_FLOWER_KEY_ICMPV4_CODE_MASK,

				  sizeof(key->icmp.code))))

		goto nla_put_failure;

	else if (key->basic.n_proto == htons(ETH_P_IPV6) &&

		 key->basic.ip_proto == IPPROTO_ICMPV6 &&

		 (fl_dump_key_val(skb, &key->icmp.type,

				  TCA_FLOWER_KEY_ICMPV6_TYPE, &mask->icmp.type,

				  TCA_FLOWER_KEY_ICMPV6_TYPE_MASK,

				  sizeof(key->icmp.type)) ||

		  fl_dump_key_val(skb, &key->icmp.code,

				  TCA_FLOWER_KEY_ICMPV6_CODE, &mask->icmp.code,

				  TCA_FLOWER_KEY_ICMPV6_CODE_MASK,

				  sizeof(key->icmp.code))))

		goto nla_put_failure;



	if (key->enc_control.addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS &&

	    (fl_dump_key_val(skb, &key->enc_ipv4.src,