* [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users
@ 2016-06-18 15:12 Jamal Hadi Salim
2016-06-18 15:12 ` [PATCH net-next 2/2] net sched actions: skbedit add support for mod-ing skb pkt_type Jamal Hadi Salim
2016-06-19 18:06 ` [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users Daniel Borkmann
0 siblings, 2 replies; 4+ messages in thread
From: Jamal Hadi Salim @ 2016-06-18 15:12 UTC (permalink / raw)
To: davem; +Cc: netdev, daniel, xiyou.wangcong, fw, Jamal Hadi Salim
From: Jamal Hadi Salim <jhs@mojatatu•com>
Suggested-by: Daniel Borkmann <daniel@iogearbox•net>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu•com>
---
include/linux/skbuff.h | 11 +++++++++++
net/netfilter/nft_meta.c | 9 +--------
2 files changed, 12 insertions(+), 8 deletions(-)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index dc0fca7..0b794de 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -37,6 +37,7 @@
#include <net/flow_dissector.h>
#include <linux/splice.h>
#include <linux/in6.h>
+#include <linux/if_packet.h>
#include <net/flow.h>
/* The interface for checksum offload between the stack and networking drivers
@@ -797,6 +798,7 @@ struct sk_buff {
atomic_t users;
};
+
#ifdef __KERNEL__
/*
* Handling routines are only of interest to the kernel
@@ -881,6 +883,15 @@ static inline struct rtable *skb_rtable(const struct sk_buff *skb)
return (struct rtable *)skb_dst(skb);
}
+/* For mangling skb->pkt_type from user space side from applications
+ * such as nft, tc, etc, we only allow a conservative subset of
+ * possible pkt_types to be set.
+*/
+static inline bool skb_pkt_type_ok(u32 p)
+{
+ return p <= PACKET_OTHERHOST;
+}
+
void kfree_skb(struct sk_buff *skb);
void kfree_skb_list(struct sk_buff *segs);
void skb_tx_error(struct sk_buff *skb);
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 16c50b0..03e5e33 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -199,13 +199,6 @@ err:
}
EXPORT_SYMBOL_GPL(nft_meta_get_eval);
-/* don't change or set _LOOPBACK, _USER, etc. */
-static bool pkt_type_ok(u32 p)
-{
- return p == PACKET_HOST || p == PACKET_BROADCAST ||
- p == PACKET_MULTICAST || p == PACKET_OTHERHOST;
-}
-
void nft_meta_set_eval(const struct nft_expr *expr,
struct nft_regs *regs,
const struct nft_pktinfo *pkt)
@@ -223,7 +216,7 @@ void nft_meta_set_eval(const struct nft_expr *expr,
break;
case NFT_META_PKTTYPE:
if (skb->pkt_type != value &&
- pkt_type_ok(value) && pkt_type_ok(skb->pkt_type))
+ skb_pkt_type_ok(value) && skb_pkt_type_ok(skb->pkt_type))
skb->pkt_type = value;
break;
case NFT_META_NFTRACE:
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH net-next 2/2] net sched actions: skbedit add support for mod-ing skb pkt_type
2016-06-18 15:12 [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users Jamal Hadi Salim
@ 2016-06-18 15:12 ` Jamal Hadi Salim
2016-06-19 18:09 ` Daniel Borkmann
2016-06-19 18:06 ` [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users Daniel Borkmann
1 sibling, 1 reply; 4+ messages in thread
From: Jamal Hadi Salim @ 2016-06-18 15:12 UTC (permalink / raw)
To: davem; +Cc: netdev, daniel, xiyou.wangcong, fw, Jamal Hadi Salim
From: Jamal Hadi Salim <jhs@mojatatu•com>
Extremely useful for setting packet type to host so i dont
have to modify the dst mac address using pedit (which requires
that i know the mac address)
Example usage:
tc filter add dev eth0 parent ffff: protocol ip pref 9 u32 \
match ip src 5.5.5.5/32 \
flowid 1:5 action skbedit ptype host
This will tag all packets incoming from 5.5.5.5 with type
PACKET_HOST
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu•com>
---
include/net/tc_act/tc_skbedit.h | 10 +++++-----
include/uapi/linux/tc_act/tc_skbedit.h | 2 ++
net/sched/act_skbedit.c | 18 +++++++++++++++++-
3 files changed, 24 insertions(+), 6 deletions(-)
diff --git a/include/net/tc_act/tc_skbedit.h b/include/net/tc_act/tc_skbedit.h
index b496d5a..d01a5d4 100644
--- a/include/net/tc_act/tc_skbedit.h
+++ b/include/net/tc_act/tc_skbedit.h
@@ -24,11 +24,11 @@
struct tcf_skbedit {
struct tcf_common common;
- u32 flags;
- u32 priority;
- u32 mark;
- u16 queue_mapping;
- /* XXX: 16-bit pad here? */
+ u32 flags;
+ u32 priority;
+ u32 mark;
+ u16 queue_mapping;
+ u16 ptype;
};
#define to_skbedit(a) \
container_of(a->priv, struct tcf_skbedit, common)
diff --git a/include/uapi/linux/tc_act/tc_skbedit.h b/include/uapi/linux/tc_act/tc_skbedit.h
index fecb5cc..a4d00c6 100644
--- a/include/uapi/linux/tc_act/tc_skbedit.h
+++ b/include/uapi/linux/tc_act/tc_skbedit.h
@@ -27,6 +27,7 @@
#define SKBEDIT_F_PRIORITY 0x1
#define SKBEDIT_F_QUEUE_MAPPING 0x2
#define SKBEDIT_F_MARK 0x4
+#define SKBEDIT_F_PTYPE 0x8
struct tc_skbedit {
tc_gen;
@@ -40,6 +41,7 @@ enum {
TCA_SKBEDIT_QUEUE_MAPPING,
TCA_SKBEDIT_MARK,
TCA_SKBEDIT_PAD,
+ TCA_SKBEDIT_PTYPE,
__TCA_SKBEDIT_MAX
};
#define TCA_SKBEDIT_MAX (__TCA_SKBEDIT_MAX - 1)
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 53d1486..1c4c924 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -47,6 +47,8 @@ static int tcf_skbedit(struct sk_buff *skb, const struct tc_action *a,
skb_set_queue_mapping(skb, d->queue_mapping);
if (d->flags & SKBEDIT_F_MARK)
skb->mark = d->mark;
+ if (d->flags & SKBEDIT_F_PTYPE)
+ skb->pkt_type = d->ptype;
spin_unlock(&d->tcf_lock);
return d->tcf_action;
@@ -57,6 +59,7 @@ static const struct nla_policy skbedit_policy[TCA_SKBEDIT_MAX + 1] = {
[TCA_SKBEDIT_PRIORITY] = { .len = sizeof(u32) },
[TCA_SKBEDIT_QUEUE_MAPPING] = { .len = sizeof(u16) },
[TCA_SKBEDIT_MARK] = { .len = sizeof(u32) },
+ [TCA_SKBEDIT_PTYPE] = { .len = sizeof(u16) },
};
static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
@@ -68,7 +71,7 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
struct tc_skbedit *parm;
struct tcf_skbedit *d;
u32 flags = 0, *priority = NULL, *mark = NULL;
- u16 *queue_mapping = NULL;
+ u16 *queue_mapping = NULL, *ptype = NULL;
bool exists = false;
int ret = 0, err;
@@ -92,6 +95,13 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
queue_mapping = nla_data(tb[TCA_SKBEDIT_QUEUE_MAPPING]);
}
+ if (tb[TCA_SKBEDIT_PTYPE] != NULL) {
+ ptype = nla_data(tb[TCA_SKBEDIT_PTYPE]);
+ if (!skb_pkt_type_ok(*ptype))
+ return -EINVAL;
+ flags |= SKBEDIT_F_PTYPE;
+ }
+
if (tb[TCA_SKBEDIT_MARK] != NULL) {
flags |= SKBEDIT_F_MARK;
mark = nla_data(tb[TCA_SKBEDIT_MARK]);
@@ -132,6 +142,8 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
d->queue_mapping = *queue_mapping;
if (flags & SKBEDIT_F_MARK)
d->mark = *mark;
+ if (flags & SKBEDIT_F_PTYPE)
+ d->ptype = *ptype;
d->tcf_action = parm->action;
@@ -169,6 +181,10 @@ static int tcf_skbedit_dump(struct sk_buff *skb, struct tc_action *a,
nla_put(skb, TCA_SKBEDIT_MARK, sizeof(d->mark),
&d->mark))
goto nla_put_failure;
+ if ((d->flags & SKBEDIT_F_PTYPE) &&
+ nla_put(skb, TCA_SKBEDIT_PTYPE, sizeof(d->ptype),
+ &d->ptype))
+ goto nla_put_failure;
tcf_tm_dump(&t, &d->tcf_tm);
if (nla_put_64bit(skb, TCA_SKBEDIT_TM, sizeof(t), &t, TCA_SKBEDIT_PAD))
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users
2016-06-18 15:12 [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users Jamal Hadi Salim
2016-06-18 15:12 ` [PATCH net-next 2/2] net sched actions: skbedit add support for mod-ing skb pkt_type Jamal Hadi Salim
@ 2016-06-19 18:06 ` Daniel Borkmann
1 sibling, 0 replies; 4+ messages in thread
From: Daniel Borkmann @ 2016-06-19 18:06 UTC (permalink / raw)
To: Jamal Hadi Salim, davem; +Cc: netdev, xiyou.wangcong, fw
Hi Jamal,
On 06/18/2016 05:12 PM, Jamal Hadi Salim wrote:
> From: Jamal Hadi Salim <jhs@mojatatu•com>
>
> Suggested-by: Daniel Borkmann <daniel@iogearbox•net>
> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu•com>
> ---
> include/linux/skbuff.h | 11 +++++++++++
> net/netfilter/nft_meta.c | 9 +--------
> 2 files changed, 12 insertions(+), 8 deletions(-)
>
> diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
> index dc0fca7..0b794de 100644
> --- a/include/linux/skbuff.h
> +++ b/include/linux/skbuff.h
> @@ -37,6 +37,7 @@
> #include <net/flow_dissector.h>
> #include <linux/splice.h>
> #include <linux/in6.h>
> +#include <linux/if_packet.h>
> #include <net/flow.h>
>
> /* The interface for checksum offload between the stack and networking drivers
> @@ -797,6 +798,7 @@ struct sk_buff {
> atomic_t users;
> };
>
> +
Why the extra newline here (the rest looks good)?
> #ifdef __KERNEL__
> /*
> * Handling routines are only of interest to the kernel
> @@ -881,6 +883,15 @@ static inline struct rtable *skb_rtable(const struct sk_buff *skb)
> return (struct rtable *)skb_dst(skb);
> }
>
> +/* For mangling skb->pkt_type from user space side from applications
> + * such as nft, tc, etc, we only allow a conservative subset of
> + * possible pkt_types to be set.
> +*/
> +static inline bool skb_pkt_type_ok(u32 p)
> +{
> + return p <= PACKET_OTHERHOST;
Just a small nit: I would probably rename 'p' into 'type'.
> +}
> +
> void kfree_skb(struct sk_buff *skb);
> void kfree_skb_list(struct sk_buff *segs);
> void skb_tx_error(struct sk_buff *skb);
> diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
> index 16c50b0..03e5e33 100644
> --- a/net/netfilter/nft_meta.c
> +++ b/net/netfilter/nft_meta.c
> @@ -199,13 +199,6 @@ err:
> }
> EXPORT_SYMBOL_GPL(nft_meta_get_eval);
>
> -/* don't change or set _LOOPBACK, _USER, etc. */
> -static bool pkt_type_ok(u32 p)
> -{
> - return p == PACKET_HOST || p == PACKET_BROADCAST ||
> - p == PACKET_MULTICAST || p == PACKET_OTHERHOST;
> -}
> -
> void nft_meta_set_eval(const struct nft_expr *expr,
> struct nft_regs *regs,
> const struct nft_pktinfo *pkt)
> @@ -223,7 +216,7 @@ void nft_meta_set_eval(const struct nft_expr *expr,
> break;
> case NFT_META_PKTTYPE:
> if (skb->pkt_type != value &&
> - pkt_type_ok(value) && pkt_type_ok(skb->pkt_type))
> + skb_pkt_type_ok(value) && skb_pkt_type_ok(skb->pkt_type))
> skb->pkt_type = value;
> break;
> case NFT_META_NFTRACE:
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net-next 2/2] net sched actions: skbedit add support for mod-ing skb pkt_type
2016-06-18 15:12 ` [PATCH net-next 2/2] net sched actions: skbedit add support for mod-ing skb pkt_type Jamal Hadi Salim
@ 2016-06-19 18:09 ` Daniel Borkmann
0 siblings, 0 replies; 4+ messages in thread
From: Daniel Borkmann @ 2016-06-19 18:09 UTC (permalink / raw)
To: Jamal Hadi Salim, davem; +Cc: netdev, xiyou.wangcong, fw
On 06/18/2016 05:12 PM, Jamal Hadi Salim wrote:
> From: Jamal Hadi Salim <jhs@mojatatu•com>
>
> Extremely useful for setting packet type to host so i dont
> have to modify the dst mac address using pedit (which requires
> that i know the mac address)
>
> Example usage:
> tc filter add dev eth0 parent ffff: protocol ip pref 9 u32 \
> match ip src 5.5.5.5/32 \
> flowid 1:5 action skbedit ptype host
>
> This will tag all packets incoming from 5.5.5.5 with type
> PACKET_HOST
>
> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu•com>
> ---
> include/net/tc_act/tc_skbedit.h | 10 +++++-----
> include/uapi/linux/tc_act/tc_skbedit.h | 2 ++
> net/sched/act_skbedit.c | 18 +++++++++++++++++-
> 3 files changed, 24 insertions(+), 6 deletions(-)
>
> diff --git a/include/net/tc_act/tc_skbedit.h b/include/net/tc_act/tc_skbedit.h
> index b496d5a..d01a5d4 100644
> --- a/include/net/tc_act/tc_skbedit.h
> +++ b/include/net/tc_act/tc_skbedit.h
> @@ -24,11 +24,11 @@
>
> struct tcf_skbedit {
> struct tcf_common common;
> - u32 flags;
> - u32 priority;
> - u32 mark;
> - u16 queue_mapping;
> - /* XXX: 16-bit pad here? */
> + u32 flags;
> + u32 priority;
> + u32 mark;
> + u16 queue_mapping;
> + u16 ptype;
> };
> #define to_skbedit(a) \
> container_of(a->priv, struct tcf_skbedit, common)
> diff --git a/include/uapi/linux/tc_act/tc_skbedit.h b/include/uapi/linux/tc_act/tc_skbedit.h
> index fecb5cc..a4d00c6 100644
> --- a/include/uapi/linux/tc_act/tc_skbedit.h
> +++ b/include/uapi/linux/tc_act/tc_skbedit.h
> @@ -27,6 +27,7 @@
> #define SKBEDIT_F_PRIORITY 0x1
> #define SKBEDIT_F_QUEUE_MAPPING 0x2
> #define SKBEDIT_F_MARK 0x4
> +#define SKBEDIT_F_PTYPE 0x8
>
> struct tc_skbedit {
> tc_gen;
> @@ -40,6 +41,7 @@ enum {
> TCA_SKBEDIT_QUEUE_MAPPING,
> TCA_SKBEDIT_MARK,
> TCA_SKBEDIT_PAD,
> + TCA_SKBEDIT_PTYPE,
> __TCA_SKBEDIT_MAX
> };
> #define TCA_SKBEDIT_MAX (__TCA_SKBEDIT_MAX - 1)
> diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
> index 53d1486..1c4c924 100644
> --- a/net/sched/act_skbedit.c
> +++ b/net/sched/act_skbedit.c
> @@ -47,6 +47,8 @@ static int tcf_skbedit(struct sk_buff *skb, const struct tc_action *a,
> skb_set_queue_mapping(skb, d->queue_mapping);
> if (d->flags & SKBEDIT_F_MARK)
> skb->mark = d->mark;
> + if (d->flags & SKBEDIT_F_PTYPE)
> + skb->pkt_type = d->ptype;
>
> spin_unlock(&d->tcf_lock);
> return d->tcf_action;
> @@ -57,6 +59,7 @@ static const struct nla_policy skbedit_policy[TCA_SKBEDIT_MAX + 1] = {
> [TCA_SKBEDIT_PRIORITY] = { .len = sizeof(u32) },
> [TCA_SKBEDIT_QUEUE_MAPPING] = { .len = sizeof(u16) },
> [TCA_SKBEDIT_MARK] = { .len = sizeof(u32) },
> + [TCA_SKBEDIT_PTYPE] = { .len = sizeof(u16) },
> };
>
> static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
> @@ -68,7 +71,7 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
> struct tc_skbedit *parm;
> struct tcf_skbedit *d;
> u32 flags = 0, *priority = NULL, *mark = NULL;
> - u16 *queue_mapping = NULL;
> + u16 *queue_mapping = NULL, *ptype = NULL;
> bool exists = false;
> int ret = 0, err;
>
> @@ -92,6 +95,13 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
> queue_mapping = nla_data(tb[TCA_SKBEDIT_QUEUE_MAPPING]);
> }
>
> + if (tb[TCA_SKBEDIT_PTYPE] != NULL) {
> + ptype = nla_data(tb[TCA_SKBEDIT_PTYPE]);
> + if (!skb_pkt_type_ok(*ptype))
> + return -EINVAL;
> + flags |= SKBEDIT_F_PTYPE;
> + }
> +
> if (tb[TCA_SKBEDIT_MARK] != NULL) {
> flags |= SKBEDIT_F_MARK;
> mark = nla_data(tb[TCA_SKBEDIT_MARK]);
> @@ -132,6 +142,8 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
> d->queue_mapping = *queue_mapping;
> if (flags & SKBEDIT_F_MARK)
> d->mark = *mark;
> + if (flags & SKBEDIT_F_PTYPE)
> + d->ptype = *ptype;
>
> d->tcf_action = parm->action;
>
> @@ -169,6 +181,10 @@ static int tcf_skbedit_dump(struct sk_buff *skb, struct tc_action *a,
> nla_put(skb, TCA_SKBEDIT_MARK, sizeof(d->mark),
> &d->mark))
> goto nla_put_failure;
> + if ((d->flags & SKBEDIT_F_PTYPE) &&
> + nla_put(skb, TCA_SKBEDIT_PTYPE, sizeof(d->ptype),
> + &d->ptype))
We already have things like nla_put_u16() etc, would be good to use them here,
doesn't have to be in this set, though, but rather as follow-up since it's used
like this also for other attributes.
> + goto nla_put_failure;
>
> tcf_tm_dump(&t, &d->tcf_tm);
> if (nla_put_64bit(skb, TCA_SKBEDIT_TM, sizeof(t), &t, TCA_SKBEDIT_PAD))
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-06-19 18:11 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-06-18 15:12 [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users Jamal Hadi Salim
2016-06-18 15:12 ` [PATCH net-next 2/2] net sched actions: skbedit add support for mod-ing skb pkt_type Jamal Hadi Salim
2016-06-19 18:09 ` Daniel Borkmann
2016-06-19 18:06 ` [PATCH net-next 1/2] net: simplify and make pkt_type_ok() available for other users Daniel Borkmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox