net/sched: cls_flower: Support matching on ICMP type and code

Support matching on ICMP type and code.

Example usage:

tc qdisc add dev eth0 ingress

tc filter add dev eth0 protocol ip parent ffff: flower \
	indev eth0 ip_proto icmp type 8 code 0 action drop

tc filter add dev eth0 protocol ipv6 parent ffff: flower \
	indev eth0 ip_proto icmpv6 type 128 code 0 action drop

Signed-off-by: Simon Horman <simon.horman@netronome.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index 0ad9f0bce0437ab9a2c525d04e8c27250e3ea389..cb4bcdc5854372e514865c30315e65ae30080527 100644 (file)
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h
@@ -461,6 +461,16 @@ enum {
 
        TCA_FLOWER_KEY_FLAGS,           /* be32 */
        TCA_FLOWER_KEY_FLAGS_MASK,      /* be32 */
+
+       TCA_FLOWER_KEY_ICMPV4_CODE,     /* u8 */
+       TCA_FLOWER_KEY_ICMPV4_CODE_MASK,/* u8 */
+       TCA_FLOWER_KEY_ICMPV4_TYPE,     /* u8 */
+       TCA_FLOWER_KEY_ICMPV4_TYPE_MASK,/* u8 */
+       TCA_FLOWER_KEY_ICMPV6_CODE,     /* u8 */
+       TCA_FLOWER_KEY_ICMPV6_CODE_MASK,/* u8 */
+       TCA_FLOWER_KEY_ICMPV6_TYPE,     /* u8 */
+       TCA_FLOWER_KEY_ICMPV6_TYPE_MASK,/* u8 */
+
        __TCA_FLOWER_MAX,
 };
 

diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 6c7e1f5052c94319534ccf3bb900a6bd6282c908..e040c5140f61f88257137651b0e547543253d8d8 100644 (file)
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -39,6 +39,7 @@ struct fl_flow_key {
                struct flow_dissector_key_ipv6_addrs ipv6;
        };
        struct flow_dissector_key_ports tp;
+       struct flow_dissector_key_icmp icmp;
        struct flow_dissector_key_keyid enc_key_id;
        union {
                struct flow_dissector_key_ipv4_addrs enc_ipv4;
@@ -388,6 +389,14 @@ static const struct nla_policy fl_policy[TCA_FLOWER_MAX + 1] = {
        [TCA_FLOWER_KEY_ENC_UDP_DST_PORT_MASK]  = { .type = NLA_U16 },
        [TCA_FLOWER_KEY_FLAGS]          = { .type = NLA_U32 },
        [TCA_FLOWER_KEY_FLAGS_MASK]     = { .type = NLA_U32 },
+       [TCA_FLOWER_KEY_ICMPV4_TYPE]    = { .type = NLA_U8 },
+       [TCA_FLOWER_KEY_ICMPV4_TYPE_MASK] = { .type = NLA_U8 },
+       [TCA_FLOWER_KEY_ICMPV4_CODE]    = { .type = NLA_U8 },
+       [TCA_FLOWER_KEY_ICMPV4_CODE_MASK] = { .type = NLA_U8 },
+       [TCA_FLOWER_KEY_ICMPV6_TYPE]    = { .type = NLA_U8 },
+       [TCA_FLOWER_KEY_ICMPV6_TYPE_MASK] = { .type = NLA_U8 },
+       [TCA_FLOWER_KEY_ICMPV6_CODE]    = { .type = NLA_U8 },
+       [TCA_FLOWER_KEY_ICMPV6_CODE_MASK] = { .type = NLA_U8 },
 };
 
 static void fl_set_key_val(struct nlattr **tb,
@@ -537,6 +546,26 @@ static int fl_set_key(struct net *net, struct nlattr **tb,
                fl_set_key_val(tb, &key->tp.dst, TCA_FLOWER_KEY_SCTP_DST,
                               &mask->tp.dst, TCA_FLOWER_KEY_SCTP_DST_MASK,
                               sizeof(key->tp.dst));
+       } else if (key->basic.n_proto == htons(ETH_P_IP) &&
+                  key->basic.ip_proto == IPPROTO_ICMP) {
+               fl_set_key_val(tb, &key->icmp.type, TCA_FLOWER_KEY_ICMPV4_TYPE,
+                              &mask->icmp.type,
+                              TCA_FLOWER_KEY_ICMPV4_TYPE_MASK,
+                              sizeof(key->icmp.type));
+               fl_set_key_val(tb, &key->icmp.code, TCA_FLOWER_KEY_ICMPV4_CODE,
+                              &mask->icmp.code,
+                              TCA_FLOWER_KEY_ICMPV4_CODE_MASK,
+                              sizeof(key->icmp.code));
+       } else if (key->basic.n_proto == htons(ETH_P_IPV6) &&
+                  key->basic.ip_proto == IPPROTO_ICMPV6) {
+               fl_set_key_val(tb, &key->icmp.type, TCA_FLOWER_KEY_ICMPV6_TYPE,
+                              &mask->icmp.type,
+                              TCA_FLOWER_KEY_ICMPV6_TYPE_MASK,
+                              sizeof(key->icmp.type));
+               fl_set_key_val(tb, &key->icmp.code, TCA_FLOWER_KEY_ICMPV4_CODE,
+                              &mask->icmp.code,
+                              TCA_FLOWER_KEY_ICMPV4_CODE_MASK,
+                              sizeof(key->icmp.code));
        }
 
        if (tb[TCA_FLOWER_KEY_ENC_IPV4_SRC] ||
@@ -648,6 +677,8 @@ static void fl_init_dissector(struct cls_fl_head *head,
                             FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6);
        FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,
                             FLOW_DISSECTOR_KEY_PORTS, tp);
+       FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,
+                            FLOW_DISSECTOR_KEY_ICMP, icmp);
        FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,
                             FLOW_DISSECTOR_KEY_VLAN, vlan);
        FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,
@@ -1050,6 +1081,28 @@ static int fl_dump(struct net *net, struct tcf_proto *tp, unsigned long fh,
                                  &mask->tp.dst, TCA_FLOWER_KEY_SCTP_DST_MASK,
                                  sizeof(key->tp.dst))))
                goto nla_put_failure;
+       else if (key->basic.n_proto == htons(ETH_P_IP) &&
+                key->basic.ip_proto == IPPROTO_ICMP &&
+                (fl_dump_key_val(skb, &key->icmp.type,
+                                 TCA_FLOWER_KEY_ICMPV4_TYPE, &mask->icmp.type,
+                                 TCA_FLOWER_KEY_ICMPV4_TYPE_MASK,
+                                 sizeof(key->icmp.type)) ||
+                 fl_dump_key_val(skb, &key->icmp.code,
+                                 TCA_FLOWER_KEY_ICMPV4_CODE, &mask->icmp.code,
+                                 TCA_FLOWER_KEY_ICMPV4_CODE_MASK,
+                                 sizeof(key->icmp.code))))
+               goto nla_put_failure;
+       else if (key->basic.n_proto == htons(ETH_P_IPV6) &&
+                key->basic.ip_proto == IPPROTO_ICMPV6 &&
+                (fl_dump_key_val(skb, &key->icmp.type,
+                                 TCA_FLOWER_KEY_ICMPV6_TYPE, &mask->icmp.type,
+                                 TCA_FLOWER_KEY_ICMPV6_TYPE_MASK,
+                                 sizeof(key->icmp.type)) ||
+                 fl_dump_key_val(skb, &key->icmp.code,
+                                 TCA_FLOWER_KEY_ICMPV6_CODE, &mask->icmp.code,
+                                 TCA_FLOWER_KEY_ICMPV6_CODE_MASK,
+                                 sizeof(key->icmp.code))))
+               goto nla_put_failure;
 
        if (key->enc_control.addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS &&
            (fl_dump_key_val(skb, &key->enc_ipv4.src,