On Thu, Feb 22, 2024 at 01:39:56PM +0100, Michal Swiatkowski wrote:
> Add new matching type for ip_proto.
>
> Use it in the same lookup type as for TTL. In hardware it has the same
> protocol ID, but different offset.
>
> Example command to add filter with ip_proto:
> $tc filter add dev eth10 ingress protocol ip flower ip_proto icmp \
> skip_sw action mirred egress redirect dev eth0
>
> Reviewed-by: Jedrzej Jagielski <[email protected]>
> Signed-off-by: Michal Swiatkowski <[email protected]>
> ---
> drivers/net/ethernet/intel/ice/ice_tc_lib.c | 17 +++++++++++++++--
> drivers/net/ethernet/intel/ice/ice_tc_lib.h | 1 +
> 2 files changed, 16 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.c
> b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
> index 49ed5fd7db10..f7c0f62fb730 100644
> --- a/drivers/net/ethernet/intel/ice/ice_tc_lib.c
> +++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
> @@ -78,7 +78,8 @@ ice_tc_count_lkups(u32 flags, struct
> ice_tc_flower_lyr_2_4_hdrs *headers,
> ICE_TC_FLWR_FIELD_DEST_IPV6 | ICE_TC_FLWR_FIELD_SRC_IPV6))
> lkups_cnt++;
>
> - if (flags & (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL))
> + if (flags & (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL |
> + ICE_TC_FLWR_FIELD_IP_PROTO))
> lkups_cnt++;
There is an issue here. In case of ipv6 it shouldn't be count as there is no
support for next header in ipv6.
Example command to reproduce the problem:
tc filter add dev eth0 ingress protocol ipv6 prio 103 flower skip_sw \
dst_mac fa:16:3e:13:e9:a1 ip_proto udp src_port 547 dst_port 546 \
dst_ip fe80::/64 action drop
Filter won't be added because of mismatch between filled and counted
lookups.
I will send v3 with fix.
Thanks,
Michal
>
> /* are L2TPv3 options specified? */
> @@ -530,7 +531,8 @@ ice_tc_fill_rules(struct ice_hw *hw, u32 flags,
> }
>
> if (headers->l2_key.n_proto == htons(ETH_P_IP) &&
> - (flags & (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL))) {
> + (flags & (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL |
> + ICE_TC_FLWR_FIELD_IP_PROTO))) {
> list[i].type = ice_proto_type_from_ipv4(inner);
>
> if (flags & ICE_TC_FLWR_FIELD_IP_TOS) {
> @@ -545,6 +547,13 @@ ice_tc_fill_rules(struct ice_hw *hw, u32 flags,
> headers->l3_mask.ttl;
> }
>
> + if (flags & ICE_TC_FLWR_FIELD_IP_PROTO) {
> + list[i].h_u.ipv4_hdr.protocol =
> + headers->l3_key.ip_proto;
> + list[i].m_u.ipv4_hdr.protocol =
> + headers->l3_mask.ip_proto;
> + }
> +
> i++;
> }
>
> @@ -1515,7 +1524,11 @@ ice_parse_cls_flower(struct net_device *filter_dev,
> struct ice_vsi *vsi,
>
> headers->l2_key.n_proto = cpu_to_be16(n_proto_key);
> headers->l2_mask.n_proto = cpu_to_be16(n_proto_mask);
> +
> + if (match.key->ip_proto)
> + fltr->flags |= ICE_TC_FLWR_FIELD_IP_PROTO;
> headers->l3_key.ip_proto = match.key->ip_proto;
> + headers->l3_mask.ip_proto = match.mask->ip_proto;
> }
>
> if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
> diff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.h
> b/drivers/net/ethernet/intel/ice/ice_tc_lib.h
> index 65d387163a46..856f371d0687 100644
> --- a/drivers/net/ethernet/intel/ice/ice_tc_lib.h
> +++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.h
> @@ -34,6 +34,7 @@
> #define ICE_TC_FLWR_FIELD_VLAN_PRIO BIT(27)
> #define ICE_TC_FLWR_FIELD_CVLAN_PRIO BIT(28)
> #define ICE_TC_FLWR_FIELD_VLAN_TPID BIT(29)
> +#define ICE_TC_FLWR_FIELD_IP_PROTO BIT(30)
>
> #define ICE_TC_FLOWER_MASK_32 0xFFFFFFFF
>
> --
> 2.42.0
>
