• Jamal Hadi Salim's avatar
    tc: introduce IFE action · d3e51122
    Jamal Hadi Salim authored
    This action allows for a sending side to encapsulate arbitrary metadata
    which is decapsulated by the receiving end.
    The sender runs in encoding mode and the receiver in decode mode.
    Both sender and receiver must specify the same ethertype.
    At some point we hope to have a registered ethertype and we'll
    then provide a default so the user doesnt have to specify it.
    For now we enforce the user specify it.
    
    Described in netdev01 paper:
       "Distributing Linux Traffic Control Classifier-Action Subsystem"
        Authors: Jamal Hadi Salim and Damascene M. Joachimpillai
    
    Also refer to IETF draft-ietf-forces-interfelfb-04.txt
    
    Lets show example usage where we encode icmp from a sender towards
    a receiver with an skbmark of 17; both sender and receiver use
    ethertype of 0xdead to interop.
    
    YYYY: Lets start with Receiver-side policy config:
    xxx: add an ingress qdisc
    sudo tc qdisc add dev $ETH ingress
    
    xxx: any packets with ethertype 0xdead will be subjected to ife decoding
    xxx: we then restart the classification so we can match on icmp at prio 3
    sudo $TC filter add dev $ETH parent ffff: prio 2 protocol 0xdead \
    u32 match u32 0 0 flowid 1:1 \
    action ife decode reclassify
    
    xxx: on restarting the classification from above if it was an icmp
    xxx: packet, then match it here and continue to the next rule at prio 4
    xxx: which will match based on skb mark of 17
    sudo tc filter add dev $ETH parent ffff: prio 3 protocol ip \
    u32 match ip protocol 1 0xff flowid 1:1 \
    action continue
    
    xxx: match on skbmark of 0x11 (decimal 17) and accept
    sudo tc filter add dev $ETH parent ffff: prio 4 protocol ip \
    handle 0x11 fw flowid 1:1 \
    action ok
    
    xxx: Lets show the decoding policy
    sudo tc -s filter ls dev $ETH parent ffff: protocol 0xdead
    xxx:
    filter pref 2 u32
    filter pref 2 u32 fh 800: ht divisor 1
    filter pref 2 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:1  (rule hit 0 success 0)
      match 00000000/00000000 at 0 (success 0 )
    	action order 1: ife decode action reclassify type 0x0
    	 allow mark allow prio
    	 index 11 ref 1 bind 1 installed 45 sec used 45 sec
    	Action statistics:
    	Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
    	backlog 0b 0p requeues 0
    
    xxx:
    Observe that above lists all metadatum it can decode. Typically these
    submodules will already be compiled into a monolithic kernel or
    loaded as modules
    
    YYYY: Lets show the sender side now ..
    xxx: Add an egress qdisc on the sender netdev
    sudo tc qdisc add dev $ETH root handle 1: prio
    xxx:
    xxx: Match all icmp packets to 192.168.122.237/24, then
    xxx: tag the packet with skb mark of decimal 17, then
    xxx: Encode it with:
    xxx:    ethertype 0xdead
    xxx:    add skb->mark to whitelist of metadatum to send
    xxx:    rewrite target dst MAC address to 02:15:15:15:15:15
    xxx:
    sudo $TC filter add dev $ETH parent 1: protocol ip prio 10  u32 \
    match ip dst 192.168.122.237/24 \
    match ip protocol 1 0xff \
    flowid 1:2 \
    action skbedit mark 17 \
    action ife encode \
    type 0xDEAD \
    allow mark \
    dst 02:15:15:15:15:15
    
    xxx: Lets show the encoding policy
    filter pref 10 u32
    filter pref 10 u32 fh 800: ht divisor 1
    filter pref 10 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:2  (rule hit 118 success 0)
      match c0a87a00/ffffff00 at 16 (success 0 )
      match 00010000/00ff0000 at 8 (success 0 )
    	action order 1:  skbedit mark 17
    	 index 11 ref 1 bind 1 installed 3 sec used 3 sec
     	Action statistics:
    	Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
    	backlog 0b 0p requeues 0
    
    	action order 2: ife encode action pipe type 0xDEAD
    	 allow mark dst 02:15:15:15:15:15
    	 index 12 ref 1 bind 1 installed 3 sec used 3 sec
    	Action statistics:
    	Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
    	backlog 0b 0p requeues 0
    xxx:
    
    Now test by sending ping from sender to destination
    Signed-off-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
    d3e51122
Makefile 4.06 KB