flow_dissector: Add PPPoE dissectors

Allow to dissect PPPoE specific fields which are:
- session ID (16 bits)
- ppp protocol (16 bits)
- type (16 bits) - this is PPPoE ethertype, for now only
  ETH_P_PPP_SES is supported, possible ETH_P_PPP_DISC
  in the future

The goal is to make the following TC command possible:

  # tc filter add dev ens6f0 ingress prio 1 protocol ppp_ses \
      flower \
        pppoe_sid 12 \
        ppp_proto ip \
      action drop

Note that only PPPoE Session is supported.

Signed-off-by: Wojciech Drewek <wojciech.drewek@intel.com>
Acked-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>

diff --git a/include/linux/ppp_defs.h b/include/linux/ppp_defs.h
index 9d2b388fae1a40e0d781041ea8f0434ea9db5412..b7e57fdbd4139a5fb98ad2b473ff4df64f5a7375 100644 (file)
--- a/include/linux/ppp_defs.h
+++ b/include/linux/ppp_defs.h
@@ -11,4 +11,18 @@
 #include <uapi/linux/ppp_defs.h>
 
 #define PPP_FCS(fcs, c) crc_ccitt_byte(fcs, c)
+
+/**
+ * ppp_proto_is_valid - checks if PPP protocol is valid
+ * @proto: PPP protocol
+ *
+ * Assumes proto is not compressed.
+ * Protocol is valid if the value is odd and the least significant bit of the
+ * most significant octet is 0 (see RFC 1661, section 2).
+ */
+static inline bool ppp_proto_is_valid(u16 proto)
+{
+       return !!((proto & 0x0101) == 0x0001);
+}
+
 #endif /* _PPP_DEFS_H_ */

diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h
index 0f9544a9bb9e6069144181513d658e05251591a4..6c74812d64b2629c3ade83ce520408a78d7e2510 100644 (file)
--- a/include/net/flow_dissector.h
+++ b/include/net/flow_dissector.h
@@ -277,6 +277,18 @@ struct flow_dissector_key_num_of_vlans {
        u8 num_of_vlans;
 };
 
+/**
+ * struct flow_dissector_key_pppoe:
+ * @session_id: pppoe session id
+ * @ppp_proto: ppp protocol
+ * @type: pppoe eth type
+ */
+struct flow_dissector_key_pppoe {
+       __be16 session_id;
+       __be16 ppp_proto;
+       __be16 type;
+};
+
 enum flow_dissector_key_id {
        FLOW_DISSECTOR_KEY_CONTROL, /* struct flow_dissector_key_control */
        FLOW_DISSECTOR_KEY_BASIC, /* struct flow_dissector_key_basic */
@@ -307,6 +319,7 @@ enum flow_dissector_key_id {
        FLOW_DISSECTOR_KEY_CT, /* struct flow_dissector_key_ct */
        FLOW_DISSECTOR_KEY_HASH, /* struct flow_dissector_key_hash */
        FLOW_DISSECTOR_KEY_NUM_OF_VLANS, /* struct flow_dissector_key_num_of_vlans */
+       FLOW_DISSECTOR_KEY_PPPOE, /* struct flow_dissector_key_pppoe */
 
        FLOW_DISSECTOR_KEY_MAX,
 };

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 6aee04f75e3e4128839e064291dccdcaa311e15c..237d396b6e41780fbde475fe143b53af8c4d3956 100644 (file)
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -895,6 +895,11 @@ bool bpf_flow_dissect(struct bpf_prog *prog, struct bpf_flow_dissector *ctx,
        return result == BPF_OK;
 }
 
+static bool is_pppoe_ses_hdr_valid(struct pppoe_hdr hdr)
+{
+       return hdr.ver == 1 && hdr.type == 1 && hdr.code == 0;
+}
+
 /**
  * __skb_flow_dissect - extract the flow_keys struct and return it
  * @net: associated network namespace, derived from @skb if NULL
@@ -1214,26 +1219,60 @@ proto_again:
                        struct pppoe_hdr hdr;
                        __be16 proto;
                } *hdr, _hdr;
+               u16 ppp_proto;
+
                hdr = __skb_header_pointer(skb, nhoff, sizeof(_hdr), data, hlen, &_hdr);
                if (!hdr) {
                        fdret = FLOW_DISSECT_RET_OUT_BAD;
                        break;
                }
 
-               nhoff += PPPOE_SES_HLEN;
-               switch (hdr->proto) {
-               case htons(PPP_IP):
+               if (!is_pppoe_ses_hdr_valid(hdr->hdr)) {
+                       fdret = FLOW_DISSECT_RET_OUT_BAD;
+                       break;
+               }
+
+               /* least significant bit of the most significant octet
+                * indicates if protocol field was compressed
+                */
+               ppp_proto = ntohs(hdr->proto);
+               if (ppp_proto & 0x0100) {
+                       ppp_proto = ppp_proto >> 8;
+                       nhoff += PPPOE_SES_HLEN - 1;
+               } else {
+                       nhoff += PPPOE_SES_HLEN;
+               }
+
+               if (ppp_proto == PPP_IP) {
                        proto = htons(ETH_P_IP);
                        fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
-                       break;
-               case htons(PPP_IPV6):
+               } else if (ppp_proto == PPP_IPV6) {
                        proto = htons(ETH_P_IPV6);
                        fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
-                       break;
-               default:
+               } else if (ppp_proto == PPP_MPLS_UC) {
+                       proto = htons(ETH_P_MPLS_UC);
+                       fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
+               } else if (ppp_proto == PPP_MPLS_MC) {
+                       proto = htons(ETH_P_MPLS_MC);
+                       fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
+               } else if (ppp_proto_is_valid(ppp_proto)) {
+                       fdret = FLOW_DISSECT_RET_OUT_GOOD;
+               } else {
                        fdret = FLOW_DISSECT_RET_OUT_BAD;
                        break;
                }
+
+               if (dissector_uses_key(flow_dissector,
+                                      FLOW_DISSECTOR_KEY_PPPOE)) {
+                       struct flow_dissector_key_pppoe *key_pppoe;
+
+                       key_pppoe = skb_flow_dissector_target(flow_dissector,
+                                                             FLOW_DISSECTOR_KEY_PPPOE,
+                                                             target_container);
+                       key_pppoe->session_id = hdr->hdr.sid;
+                       key_pppoe->ppp_proto = htons(ppp_proto);
+                       key_pppoe->type = htons(ETH_P_PPP_SES);
+               }
                break;
        }
        case htons(ETH_P_TIPC): {