Allow matching on Neighbour Discovery target IP, and source and
destination link-layer addresses for neighbour solicitation and
advertisement messages.
Sample usage:
tc qdisc add dev eth0 ingress
tc filter add dev eth0 protocol ipv6 parent ffff: flower \
indev eth0 ip_proto icmpv6 type 136 code 0 \
nd_target 2001:470:7eb3:403:201:8eff:fe22:8fea \
nd_tll 00:01:8e:22:8f:ea action drop
Signed-off-by: Simon Horman <[email protected]>
---
include/uapi/linux/pkt_cls.h | 7 +++++++
net/core/flow_dissector.c | 6 +++---
net/sched/cls_flower.c | 42 +++++++++++++++++++++++++++++++++++++++++-
3 files changed, 51 insertions(+), 4 deletions(-)
diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index 345551e71410..fc9e9bef726e 100644
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h
@@ -430,6 +430,13 @@ enum {
TCA_FLOWER_KEY_ARP_THA, /* ETH_ALEN */
TCA_FLOWER_KEY_ARP_THA_MASK, /* ETH_ALEN */
+ TCA_FLOWER_KEY_ND_TARGET, /* struct in6_addr */
+ TCA_FLOWER_KEY_ND_TARGET_MASK, /* struct in6_addr */
+ TCA_FLOWER_KEY_ND_SLL, /* ETH_ALEN */
+ TCA_FLOWER_KEY_ND_SLL_MASK, /* ETH_ALEN */
+ TCA_FLOWER_KEY_ND_TLL, /* ETH_ALEN */
+ TCA_FLOWER_KEY_ND_TLL_MASK, /* ETH_ALEN */
+
__TCA_FLOWER_MAX,
};
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 745e03f180d0..513193825268 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -119,7 +119,7 @@ static bool skb_flow_dissect_nd(const struct sk_buff *skb,
int icmp_len)
{
const struct nd_msg *nd;
- struct nd_msg *_nd;
+ struct nd_msg _nd;
int off;
nd = __skb_header_pointer(skb, nhoff, sizeof(_nd), data, hlen, &_nd);
@@ -131,7 +131,7 @@ static bool skb_flow_dissect_nd(const struct sk_buff *skb,
off = sizeof(_nd);
while (icmp_len - off >= sizeof(struct nd_opt_hdr) + ETH_ALEN) {
const struct nd_opt_hdr *opt_hdr;
- struct nd_opt_hdr *_opt_hdr;
+ struct nd_opt_hdr _opt_hdr;
unsigned char *ll_addr = NULL;
int opt_data_len;
@@ -704,7 +704,7 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
key_icmp->icmp = skb_flow_get_be16(skb, nhoff, data, hlen);
if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ND) &&
- ip_proto == IPPROTO_IPV6 && key_icmp->code == 0 &&
+ ip_proto == IPPROTO_ICMPV6 && key_icmp->code == 0 &&
(key_icmp->type == NDISC_NEIGHBOUR_SOLICITATION ||
key_icmp->type == NDISC_NEIGHBOUR_ADVERTISEMENT)) {
key_nd = skb_flow_dissector_target(flow_dissector,
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 23c4d224dcb1..49337091a015 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -40,6 +40,7 @@ struct fl_flow_key {
};
struct flow_dissector_key_ports tp;
struct flow_dissector_key_icmp icmp;
+ struct flow_dissector_key_nd nd;
struct flow_dissector_key_arp arp;
struct flow_dissector_key_keyid enc_key_id;
union {
@@ -418,6 +419,12 @@ static const struct nla_policy fl_policy[TCA_FLOWER_MAX +
1] = {
[TCA_FLOWER_KEY_ARP_SHA_MASK] = { .len = ETH_ALEN },
[TCA_FLOWER_KEY_ARP_THA] = { .len = ETH_ALEN },
[TCA_FLOWER_KEY_ARP_THA_MASK] = { .len = ETH_ALEN },
+ [TCA_FLOWER_KEY_ND_TARGET] = { .len = sizeof(struct in6_addr) },
+ [TCA_FLOWER_KEY_ND_TARGET_MASK] = { .len = sizeof(struct in6_addr) },
+ [TCA_FLOWER_KEY_ND_SLL] = { .len = ETH_ALEN },
+ [TCA_FLOWER_KEY_ND_SLL_MASK] = { .len = ETH_ALEN },
+ [TCA_FLOWER_KEY_ND_TLL] = { .len = ETH_ALEN },
+ [TCA_FLOWER_KEY_ND_TLL_MASK] = { .len = ETH_ALEN },
};
static void fl_set_key_val(struct nlattr **tb,
@@ -589,6 +596,22 @@ static int fl_set_key(struct net *net, struct nlattr **tb,
&mask->icmp.code,
TCA_FLOWER_KEY_ICMPV6_CODE_MASK,
sizeof(key->icmp.code));
+ if (key->icmp.code == 0 && mask->icmp.code == 0xff &&
+ (key->icmp.type == NDISC_NEIGHBOUR_SOLICITATION ||
+ key->icmp.type == NDISC_NEIGHBOUR_ADVERTISEMENT) &&
+ mask->icmp.type == 0xff) {
+ fl_set_key_val(tb, &key->nd.target,
+ TCA_FLOWER_KEY_ND_TARGET,
+ &mask->nd.target,
+ TCA_FLOWER_KEY_ND_TARGET_MASK,
+ sizeof(key->nd.target));
+ fl_set_key_val(tb, key->nd.sll, TCA_FLOWER_KEY_ND_SLL,
+ mask->nd.sll, TCA_FLOWER_KEY_ND_SLL_MASK,
+ sizeof(key->nd.sll));
+ fl_set_key_val(tb, key->nd.tll, TCA_FLOWER_KEY_ND_TLL,
+ mask->nd.tll, TCA_FLOWER_KEY_ND_TLL_MASK,
+ sizeof(key->nd.tll));
+ }
} else if (key->basic.n_proto == htons(ETH_P_ARP) ||
key->basic.n_proto == htons(ETH_P_RARP)) {
fl_set_key_val(tb, &key->arp.sip, TCA_FLOWER_KEY_ARP_SIP,
@@ -725,6 +748,8 @@ static void fl_init_dissector(struct cls_fl_head *head,
FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,
FLOW_DISSECTOR_KEY_ARP, arp);
FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,
+ FLOW_DISSECTOR_KEY_ND, nd);
+ FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,
FLOW_DISSECTOR_KEY_VLAN, vlan);
FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,
FLOW_DISSECTOR_KEY_ENC_KEYID, enc_key_id);
@@ -1162,7 +1187,22 @@ static int fl_dump(struct net *net, struct tcf_proto
*tp, unsigned long fh,
fl_dump_key_val(skb, &key->icmp.code,
TCA_FLOWER_KEY_ICMPV6_CODE, &mask->icmp.code,
TCA_FLOWER_KEY_ICMPV6_CODE_MASK,
- sizeof(key->icmp.code))))
+ sizeof(key->icmp.code)) ||
+ (key->icmp.code == 0 && mask->icmp.code == 0xff &&
+ (key->icmp.type == NDISC_NEIGHBOUR_SOLICITATION ||
+ key->icmp.type == NDISC_NEIGHBOUR_ADVERTISEMENT) &&
+ mask->icmp.type == 0xff &&
+ (fl_dump_key_val(skb, &key->nd.target,
+ TCA_FLOWER_KEY_ND_TARGET,
+ &mask->nd.target,
+ TCA_FLOWER_KEY_ND_TARGET_MASK,
+ sizeof(key->nd.target)) ||
+ fl_dump_key_val(skb, key->nd.sll, TCA_FLOWER_KEY_ND_SLL,
+ mask->nd.sll, TCA_FLOWER_KEY_ND_SLL_MASK,
+ sizeof(key->nd.sll)) ||
+ fl_dump_key_val(skb, key->nd.tll, TCA_FLOWER_KEY_ND_TLL,
+ mask->nd.tll, TCA_FLOWER_KEY_ND_TLL_MASK,
+ sizeof(key->nd.tll))))))
goto nla_put_failure;
else if ((key->basic.n_proto == htons(ETH_P_ARP) ||
key->basic.n_proto == htons(ETH_P_RARP)) &&
--
2.7.0.rc3.207.g0ac5344
