matthias
/
iproute2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

tc/flower: Add match on encapsulating tos/ttl 

Add matching on tos/ttl of the IP tunnel headers.

For example, here's decap rule that matches on the tunnel tos:

tc filter add dev vxlan_sys_4789 protocol ip parent ffff: prio 10 flower \
   enc_src_ip 192.168.10.2 enc_dst_ip 192.168.10.1 enc_key_id 100 enc_dst_port 4789 enc_tos 0x30 \
   src_mac e4:11:22:33:44:70 dst_mac e4:11:22:33:44:50  \
   action tunnel_key unset \
   action mirred egress redirect dev eth0_0

Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
This commit is contained in:
Or Gerlitz 2018-07-19 14:02:15 +03:00 committed by David Ahern
parent 9f89b0cc0e
commit 761ec9e29f
2 changed files with 40 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
man/man8/tc-flower.8
View File

@ -76,6 +76,10 @@ flower \- flow based traffic control filter
.IR ipv4_address " | " ipv6_address " } | " .IR ipv4_address " | " ipv6_address " } | "
.B enc_dst_port .B enc_dst_port
.IR port_number " | " .IR port_number " | "
.B enc_tos
.IR TOS " | "
.B enc_ttl
.IR TTL " | "
.BR ip_flags .BR ip_flags
.IR IP_FLAGS .IR IP_FLAGS
.SH DESCRIPTION .SH DESCRIPTION
@ -275,6 +279,10 @@ bits is assumed.
.BI enc_src_ip " PREFIX" .BI enc_src_ip " PREFIX"
.TQ .TQ
.BI enc_dst_port " NUMBER" .BI enc_dst_port " NUMBER"
.TQ
.BI enc_tos " NUMBER"
.TQ
.BI enc_ttl " NUMBER"
Match on IP tunnel metadata. Key id Match on IP tunnel metadata. Key id
.I NUMBER .I NUMBER
is a 32 bit tunnel key id (e.g. VNI for VXLAN tunnel). is a 32 bit tunnel key id (e.g. VNI for VXLAN tunnel).
@ -283,7 +291,11 @@ must be a valid IPv4 or IPv6 address optionally followed by a slash and the
prefix length. If the prefix is missing, \fBtc\fR assumes a full-length prefix length. If the prefix is missing, \fBtc\fR assumes a full-length
host match. Dst port host match. Dst port
.I NUMBER .I NUMBER
is a 16 bit UDP dst port. is a 16 bit UDP dst port. Tos
.I NUMBER
is an 8 bit tos (dscp+ecn) value, ttl
.I NUMBER
is an 8 bit time-to-live value.
.TP .TP
.BI ip_flags " IP_FLAGS" .BI ip_flags " IP_FLAGS"
.I IP_FLAGS .I IP_FLAGS

27
tc/f_flower.c
View File

@ -77,6 +77,8 @@ static void explain(void)
" enc_dst_ip [ IPV4-ADDR | IPV6-ADDR ] |\n" " enc_dst_ip [ IPV4-ADDR | IPV6-ADDR ] |\n"
" enc_src_ip [ IPV4-ADDR | IPV6-ADDR ] |\n" " enc_src_ip [ IPV4-ADDR | IPV6-ADDR ] |\n"
" enc_key_id [ KEY-ID ] |\n" " enc_key_id [ KEY-ID ] |\n"
" enc_tos MASKED-IP_TOS |\n"
" enc_ttl MASKED-IP_TTL |\n"
" ip_flags IP-FLAGS | \n" " ip_flags IP-FLAGS | \n"
" enc_dst_port [ port_number ] }\n" " enc_dst_port [ port_number ] }\n"
" FILTERID := X:Y:Z\n" " FILTERID := X:Y:Z\n"
@ -1019,6 +1021,26 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
fprintf(stderr, "Illegal \"enc_dst_port\"\n"); fprintf(stderr, "Illegal \"enc_dst_port\"\n");
return -1; return -1;
} }
} else if (matches(*argv, "enc_tos") == 0) {
NEXT_ARG();
ret = flower_parse_ip_tos_ttl(*argv,
TCA_FLOWER_KEY_ENC_IP_TOS,
TCA_FLOWER_KEY_ENC_IP_TOS_MASK,
n);
if (ret < 0) {
fprintf(stderr, "Illegal \"enc_tos\"\n");
return -1;
}
} else if (matches(*argv, "enc_ttl") == 0) {
NEXT_ARG();
ret = flower_parse_ip_tos_ttl(*argv,
TCA_FLOWER_KEY_ENC_IP_TTL,
TCA_FLOWER_KEY_ENC_IP_TTL_MASK,
n);
if (ret < 0) {
fprintf(stderr, "Illegal \"enc_ttl\"\n");
return -1;
}
} else if (matches(*argv, "action") == 0) { } else if (matches(*argv, "action") == 0) {
NEXT_ARG(); NEXT_ARG();
ret = parse_action(&argc, &argv, TCA_FLOWER_ACT, n); ret = parse_action(&argc, &argv, TCA_FLOWER_ACT, n);
@ -1542,6 +1564,11 @@ static int flower_print_opt(struct filter_util *qu, FILE *f,
flower_print_port("enc_dst_port", tb[TCA_FLOWER_KEY_ENC_UDP_DST_PORT]); flower_print_port("enc_dst_port", tb[TCA_FLOWER_KEY_ENC_UDP_DST_PORT]);
flower_print_ip_attr("enc_tos", tb[TCA_FLOWER_KEY_ENC_IP_TOS],
tb[TCA_FLOWER_KEY_ENC_IP_TOS_MASK]);
flower_print_ip_attr("enc_ttl", tb[TCA_FLOWER_KEY_ENC_IP_TTL],
tb[TCA_FLOWER_KEY_ENC_IP_TTL_MASK]);
flower_print_matching_flags("ip_flags", FLOWER_IP_FLAGS, flower_print_matching_flags("ip_flags", FLOWER_IP_FLAGS,
tb[TCA_FLOWER_KEY_FLAGS], tb[TCA_FLOWER_KEY_FLAGS],
tb[TCA_FLOWER_KEY_FLAGS_MASK]); tb[TCA_FLOWER_KEY_FLAGS_MASK]);