This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
packets can be filtered using ipv6_ext flag.
Signed-off-by: Toms Atteka <[email protected]>
---
include/uapi/linux/openvswitch.h | 6 ++
net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
net/openvswitch/flow.h | 14 ++++
net/openvswitch/flow_netlink.c | 26 +++++-
4 files changed, 184 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index a87b44cd5590..43790f07e4a2 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -342,6 +342,7 @@ enum ovs_key_attr {
OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
+ OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */
#ifdef __KERNEL__
OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
@@ -421,6 +422,11 @@ struct ovs_key_ipv6 {
__u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */
};
+/* separate structure to support backward compatibility with older user space */
+struct ovs_key_ipv6_exthdrs {
+ __u16 hdrs;
+};
+
struct ovs_key_tcp {
__be16 tcp_src;
__be16 tcp_dst;
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 9d375e74b607..28acb40437ca 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb)
sizeof(struct icmphdr));
}
+/**
+ * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
+ *
+ * @skb: buffer where extension header data starts in packet
+ * @nh: ipv6 header
+ * @ext_hdrs: flags are stored here
+ *
+ * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
+ * is unexpectedly encountered. (Two destination options headers may be
+ * expected and would not cause this bit to be set.)
+ *
+ * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
+ * preferred (but not required) by RFC 2460:
+ *
+ * When more than one extension header is used in the same packet, it is
+ * recommended that those headers appear in the following order:
+ * IPv6 header
+ * Hop-by-Hop Options header
+ * Destination Options header
+ * Routing header
+ * Fragment header
+ * Authentication header
+ * Encapsulating Security Payload header
+ * Destination Options header
+ * upper-layer header
+ */
+static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
+ u16 *ext_hdrs)
+{
+ u8 next_type = nh->nexthdr;
+ unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
+ int dest_options_header_count = 0;
+
+ *ext_hdrs = 0;
+
+ while (ipv6_ext_hdr(next_type)) {
+ struct ipv6_opt_hdr _hdr, *hp;
+
+ switch (next_type) {
+ case IPPROTO_NONE:
+ *ext_hdrs |= OFPIEH12_NONEXT;
+ /* stop parsing */
+ return;
+
+ case IPPROTO_ESP:
+ if (*ext_hdrs & OFPIEH12_ESP)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
+ OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
+ OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_ESP;
+ break;
+
+ case IPPROTO_AH:
+ if (*ext_hdrs & OFPIEH12_AUTH)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs &
+ ~(OFPIEH12_HOP | OFPIEH12_DEST | OFPIEH12_ROUTER |
+ IPPROTO_FRAGMENT | OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_AUTH;
+ break;
+
+ case IPPROTO_DSTOPTS:
+ if (dest_options_header_count == 0) {
+ if (*ext_hdrs &
+ ~(OFPIEH12_HOP | OFPIEH12_UNREP))
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ *ext_hdrs |= OFPIEH12_DEST;
+ } else if (dest_options_header_count == 1) {
+ if (*ext_hdrs &
+ ~(OFPIEH12_HOP | OFPIEH12_DEST |
+ OFPIEH12_ROUTER | OFPIEH12_FRAG |
+ OFPIEH12_AUTH | OFPIEH12_ESP |
+ OFPIEH12_UNREP)) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ } else {
+ *ext_hdrs |= OFPIEH12_UNREP;
+ }
+ dest_options_header_count++;
+ break;
+
+ case IPPROTO_FRAGMENT:
+ if (*ext_hdrs & OFPIEH12_FRAG)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs & ~(OFPIEH12_HOP |
+ OFPIEH12_DEST |
+ OFPIEH12_ROUTER |
+ OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_FRAG;
+ break;
+
+ case IPPROTO_ROUTING:
+ if (*ext_hdrs & OFPIEH12_ROUTER)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ if ((*ext_hdrs & ~(OFPIEH12_HOP |
+ OFPIEH12_DEST |
+ OFPIEH12_UNREP)) ||
+ dest_options_header_count >= 2) {
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ }
+ *ext_hdrs |= OFPIEH12_ROUTER;
+ break;
+
+ case IPPROTO_HOPOPTS:
+ if (*ext_hdrs & OFPIEH12_HOP)
+ *ext_hdrs |= OFPIEH12_UNREP;
+ /* OFPIEH12_HOP is set to 1 if a hop-by-hop IPv6
+ * extension header is present as the first
+ * extension header in the packet.
+ */
+ if (*ext_hdrs == 0)
+ *ext_hdrs |= OFPIEH12_HOP;
+ else
+ *ext_hdrs |= OFPIEH12_UNSEQ;
+ break;
+
+ default:
+ return;
+ }
+
+ hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
+ if (!hp)
+ break;
+ next_type = hp->nexthdr;
+ start += ipv6_optlen(hp);
+ };
+}
+
static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key)
{
unsigned short frag_off;
@@ -254,6 +392,8 @@ static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key)
nh = ipv6_hdr(skb);
+ get_ipv6_ext_hdrs(skb, nh, &key->ipv6.exthdrs);
+
key->ip.proto = NEXTHDR_NONE;
key->ip.tos = ipv6_get_dsfield(nh);
key->ip.ttl = nh->hop_limit;
diff --git a/net/openvswitch/flow.h b/net/openvswitch/flow.h
index 758a8c77f736..073ab73ffeaa 100644
--- a/net/openvswitch/flow.h
+++ b/net/openvswitch/flow.h
@@ -32,6 +32,19 @@ enum sw_flow_mac_proto {
#define SW_FLOW_KEY_INVALID 0x80
#define MPLS_LABEL_DEPTH 3
+/* Bit definitions for IPv6 Extension Header pseudo-field. */
+enum ofp12_ipv6exthdr_flags {
+ OFPIEH12_NONEXT = 1 << 0, /* "No next header" encountered. */
+ OFPIEH12_ESP = 1 << 1, /* Encrypted Sec Payload header present. */
+ OFPIEH12_AUTH = 1 << 2, /* Authentication header present. */
+ OFPIEH12_DEST = 1 << 3, /* 1 or 2 dest headers present. */
+ OFPIEH12_FRAG = 1 << 4, /* Fragment header present. */
+ OFPIEH12_ROUTER = 1 << 5, /* Router header present. */
+ OFPIEH12_HOP = 1 << 6, /* Hop-by-hop header present. */
+ OFPIEH12_UNREP = 1 << 7, /* Unexpected repeats encountered. */
+ OFPIEH12_UNSEQ = 1 << 8 /* Unexpected sequencing encountered. */
+};
+
/* Store options at the end of the array if they are less than the
* maximum size. This allows us to get the benefits of variable length
* matching for small options.
@@ -121,6 +134,7 @@ struct sw_flow_key {
struct in6_addr dst; /* IPv6 destination address. */
} addr;
__be32 label; /* IPv6 flow label. */
+ u16 exthdrs; /* IPv6 extension header flags */
union {
struct {
struct in6_addr src;
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 65c2e3458ff5..0aeaf28594ce 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -344,7 +344,7 @@ size_t ovs_key_attr_size(void)
/* Whenever adding new OVS_KEY_ FIELDS, we should consider
* updating this function.
*/
- BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 29);
+ BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 30);
return nla_total_size(4) /* OVS_KEY_ATTR_PRIORITY */
+ nla_total_size(0) /* OVS_KEY_ATTR_TUNNEL */
@@ -367,7 +367,8 @@ size_t ovs_key_attr_size(void)
+ nla_total_size(2) /* OVS_KEY_ATTR_ETHERTYPE */
+ nla_total_size(40) /* OVS_KEY_ATTR_IPV6 */
+ nla_total_size(2) /* OVS_KEY_ATTR_ICMPV6 */
- + nla_total_size(28); /* OVS_KEY_ATTR_ND */
+ + nla_total_size(28) /* OVS_KEY_ATTR_ND */
+ + nla_total_size(2); /* OVS_KEY_ATTR_IPV6_EXTHDRS */
}
static const struct ovs_len_tbl ovs_vxlan_ext_key_lens[OVS_VXLAN_EXT_MAX + 1] = {
@@ -435,6 +436,8 @@ static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = {
.len = sizeof(struct ovs_key_ct_tuple_ipv6) },
[OVS_KEY_ATTR_NSH] = { .len = OVS_ATTR_NESTED,
.next = ovs_nsh_key_attr_lens, },
+ [OVS_KEY_ATTR_IPV6_EXTHDRS] = {
+ .len = sizeof(struct ovs_key_ipv6_exthdrs) },
};
static bool check_attr_len(unsigned int attr_len, unsigned int expected_len)
@@ -1595,6 +1598,17 @@ static int ovs_key_from_nlattrs(struct net *net, struct sw_flow_match *match,
attrs &= ~(1 << OVS_KEY_ATTR_IPV6);
}
+ if (attrs & (1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS)) {
+ const struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key;
+
+ ipv6_exthdrs_key = nla_data(a[OVS_KEY_ATTR_IPV6_EXTHDRS]);
+
+ SW_FLOW_KEY_PUT(match, ipv6.exthdrs,
+ ipv6_exthdrs_key->hdrs, is_mask);
+
+ attrs &= ~(1ULL << OVS_KEY_ATTR_IPV6_EXTHDRS);
+ }
+
if (attrs & (1 << OVS_KEY_ATTR_ARP)) {
const struct ovs_key_arp *arp_key;
@@ -2097,6 +2111,7 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
ipv4_key->ipv4_frag = output->ip.frag;
} else if (swkey->eth.type == htons(ETH_P_IPV6)) {
struct ovs_key_ipv6 *ipv6_key;
+ struct ovs_key_ipv6_exthdrs *ipv6_exthdrs_key;
nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6, sizeof(*ipv6_key));
if (!nla)
@@ -2111,6 +2126,13 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
ipv6_key->ipv6_tclass = output->ip.tos;
ipv6_key->ipv6_hlimit = output->ip.ttl;
ipv6_key->ipv6_frag = output->ip.frag;
+
+ nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6_EXTHDRS,
+ sizeof(*ipv6_exthdrs_key));
+ if (!nla)
+ goto nla_put_failure;
+ ipv6_exthdrs_key = nla_data(nla);
+ ipv6_exthdrs_key->hdrs = output->ipv6.exthdrs;
} else if (swkey->eth.type == htons(ETH_P_NSH)) {
if (nsh_key_to_nlattr(&output->nsh, is_mask, skb))
goto nla_put_failure;
--
2.25.1
On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <[email protected]> wrote:
>
> This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
> packets can be filtered using ipv6_ext flag.
>
> Signed-off-by: Toms Atteka <[email protected]>
> ---
> include/uapi/linux/openvswitch.h | 6 ++
> net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
> net/openvswitch/flow.h | 14 ++++
> net/openvswitch/flow_netlink.c | 26 +++++-
> 4 files changed, 184 insertions(+), 2 deletions(-)
>
> diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
> index a87b44cd5590..43790f07e4a2 100644
> --- a/include/uapi/linux/openvswitch.h
> +++ b/include/uapi/linux/openvswitch.h
> @@ -342,6 +342,7 @@ enum ovs_key_attr {
> OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
> OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
> OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
> + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */
>
> #ifdef __KERNEL__
> OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
> @@ -421,6 +422,11 @@ struct ovs_key_ipv6 {
> __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */
> };
>
> +/* separate structure to support backward compatibility with older user space */
> +struct ovs_key_ipv6_exthdrs {
> + __u16 hdrs;
> +};
> +
> struct ovs_key_tcp {
> __be16 tcp_src;
> __be16 tcp_dst;
> diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
> index 9d375e74b607..28acb40437ca 100644
> --- a/net/openvswitch/flow.c
> +++ b/net/openvswitch/flow.c
> @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb)
> sizeof(struct icmphdr));
> }
>
> +/**
> + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
> + *
> + * @skb: buffer where extension header data starts in packet
> + * @nh: ipv6 header
> + * @ext_hdrs: flags are stored here
> + *
> + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
> + * is unexpectedly encountered. (Two destination options headers may be
> + * expected and would not cause this bit to be set.)
> + *
> + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
> + * preferred (but not required) by RFC 2460:
> + *
> + * When more than one extension header is used in the same packet, it is
> + * recommended that those headers appear in the following order:
> + * IPv6 header
> + * Hop-by-Hop Options header
> + * Destination Options header
> + * Routing header
> + * Fragment header
> + * Authentication header
> + * Encapsulating Security Payload header
> + * Destination Options header
> + * upper-layer header
> + */
> +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
> + u16 *ext_hdrs)
> +{
> + u8 next_type = nh->nexthdr;
> + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
> + int dest_options_header_count = 0;
> +
> + *ext_hdrs = 0;
> +
> + while (ipv6_ext_hdr(next_type)) {
> + struct ipv6_opt_hdr _hdr, *hp;
> +
> + switch (next_type) {
> + case IPPROTO_NONE:
> + *ext_hdrs |= OFPIEH12_NONEXT;
> + /* stop parsing */
> + return;
> +
> + case IPPROTO_ESP:
> + if (*ext_hdrs & OFPIEH12_ESP)
> + *ext_hdrs |= OFPIEH12_UNREP;
> + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
> + OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
> + OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
> + dest_options_header_count >= 2) {
> + *ext_hdrs |= OFPIEH12_UNSEQ;
> + }
> + *ext_hdrs |= OFPIEH12_ESP;
> + break;
you need to check_header() before looking into each extension header.
On Wed, Dec 1, 2021 at 11:34 PM Pravin Shelar <[email protected]> wrote:
>
> On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <[email protected]> wrote:
> >
> > This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
> > packets can be filtered using ipv6_ext flag.
> >
> > Signed-off-by: Toms Atteka <[email protected]>
> > ---
> > include/uapi/linux/openvswitch.h | 6 ++
> > net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
> > net/openvswitch/flow.h | 14 ++++
> > net/openvswitch/flow_netlink.c | 26 +++++-
> > 4 files changed, 184 insertions(+), 2 deletions(-)
> >
> > diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
> > index a87b44cd5590..43790f07e4a2 100644
> > --- a/include/uapi/linux/openvswitch.h
> > +++ b/include/uapi/linux/openvswitch.h
> > @@ -342,6 +342,7 @@ enum ovs_key_attr {
> > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
> > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
> > OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
> > + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */
> >
> > #ifdef __KERNEL__
> > OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
> > @@ -421,6 +422,11 @@ struct ovs_key_ipv6 {
> > __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */
> > };
> >
> > +/* separate structure to support backward compatibility with older user space */
> > +struct ovs_key_ipv6_exthdrs {
> > + __u16 hdrs;
> > +};
> > +
> > struct ovs_key_tcp {
> > __be16 tcp_src;
> > __be16 tcp_dst;
> > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
> > index 9d375e74b607..28acb40437ca 100644
> > --- a/net/openvswitch/flow.c
> > +++ b/net/openvswitch/flow.c
> > @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb)
> > sizeof(struct icmphdr));
> > }
> >
> > +/**
> > + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
> > + *
> > + * @skb: buffer where extension header data starts in packet
> > + * @nh: ipv6 header
> > + * @ext_hdrs: flags are stored here
> > + *
> > + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
> > + * is unexpectedly encountered. (Two destination options headers may be
> > + * expected and would not cause this bit to be set.)
> > + *
> > + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
> > + * preferred (but not required) by RFC 2460:
> > + *
> > + * When more than one extension header is used in the same packet, it is
> > + * recommended that those headers appear in the following order:
> > + * IPv6 header
> > + * Hop-by-Hop Options header
> > + * Destination Options header
> > + * Routing header
> > + * Fragment header
> > + * Authentication header
> > + * Encapsulating Security Payload header
> > + * Destination Options header
> > + * upper-layer header
> > + */
> > +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
> > + u16 *ext_hdrs)
> > +{
> > + u8 next_type = nh->nexthdr;
> > + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
> > + int dest_options_header_count = 0;
> > +
> > + *ext_hdrs = 0;
> > +
> > + while (ipv6_ext_hdr(next_type)) {
> > + struct ipv6_opt_hdr _hdr, *hp;
> > +
> > + switch (next_type) {
> > + case IPPROTO_NONE:
> > + *ext_hdrs |= OFPIEH12_NONEXT;
> > + /* stop parsing */
> > + return;
> > +
> > + case IPPROTO_ESP:
> > + if (*ext_hdrs & OFPIEH12_ESP)
> > + *ext_hdrs |= OFPIEH12_UNREP;
> > + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
> > + OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
> > + OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
> > + dest_options_header_count >= 2) {
> > + *ext_hdrs |= OFPIEH12_UNSEQ;
> > + }
> > + *ext_hdrs |= OFPIEH12_ESP;
> > + break;
> you need to check_header() before looking into each extension header.
Could you elaborate why I need to add check_header(),
skb_header_pointer() is doing sanitization.
On Thu, Dec 2, 2021 at 12:20 PM Cpp Code <[email protected]> wrote:
>
> On Wed, Dec 1, 2021 at 11:34 PM Pravin Shelar <[email protected]> wrote:
> >
> > On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <[email protected]> wrote:
> > >
> > > This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
> > > packets can be filtered using ipv6_ext flag.
> > >
> > > Signed-off-by: Toms Atteka <[email protected]>
> > > ---
> > > include/uapi/linux/openvswitch.h | 6 ++
> > > net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
> > > net/openvswitch/flow.h | 14 ++++
> > > net/openvswitch/flow_netlink.c | 26 +++++-
> > > 4 files changed, 184 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
> > > index a87b44cd5590..43790f07e4a2 100644
> > > --- a/include/uapi/linux/openvswitch.h
> > > +++ b/include/uapi/linux/openvswitch.h
> > > @@ -342,6 +342,7 @@ enum ovs_key_attr {
> > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
> > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
> > > OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
> > > + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */
> > >
> > > #ifdef __KERNEL__
> > > OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
> > > @@ -421,6 +422,11 @@ struct ovs_key_ipv6 {
> > > __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */
> > > };
> > >
> > > +/* separate structure to support backward compatibility with older user space */
> > > +struct ovs_key_ipv6_exthdrs {
> > > + __u16 hdrs;
> > > +};
> > > +
> > > struct ovs_key_tcp {
> > > __be16 tcp_src;
> > > __be16 tcp_dst;
> > > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
> > > index 9d375e74b607..28acb40437ca 100644
> > > --- a/net/openvswitch/flow.c
> > > +++ b/net/openvswitch/flow.c
> > > @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb)
> > > sizeof(struct icmphdr));
> > > }
> > >
> > > +/**
> > > + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
> > > + *
> > > + * @skb: buffer where extension header data starts in packet
> > > + * @nh: ipv6 header
> > > + * @ext_hdrs: flags are stored here
> > > + *
> > > + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
> > > + * is unexpectedly encountered. (Two destination options headers may be
> > > + * expected and would not cause this bit to be set.)
> > > + *
> > > + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
> > > + * preferred (but not required) by RFC 2460:
> > > + *
> > > + * When more than one extension header is used in the same packet, it is
> > > + * recommended that those headers appear in the following order:
> > > + * IPv6 header
> > > + * Hop-by-Hop Options header
> > > + * Destination Options header
> > > + * Routing header
> > > + * Fragment header
> > > + * Authentication header
> > > + * Encapsulating Security Payload header
> > > + * Destination Options header
> > > + * upper-layer header
> > > + */
> > > +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
> > > + u16 *ext_hdrs)
> > > +{
> > > + u8 next_type = nh->nexthdr;
> > > + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
> > > + int dest_options_header_count = 0;
> > > +
> > > + *ext_hdrs = 0;
> > > +
> > > + while (ipv6_ext_hdr(next_type)) {
> > > + struct ipv6_opt_hdr _hdr, *hp;
> > > +
> > > + switch (next_type) {
> > > + case IPPROTO_NONE:
> > > + *ext_hdrs |= OFPIEH12_NONEXT;
> > > + /* stop parsing */
> > > + return;
> > > +
> > > + case IPPROTO_ESP:
> > > + if (*ext_hdrs & OFPIEH12_ESP)
> > > + *ext_hdrs |= OFPIEH12_UNREP;
> > > + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
> > > + OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
> > > + OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
> > > + dest_options_header_count >= 2) {
> > > + *ext_hdrs |= OFPIEH12_UNSEQ;
> > > + }
> > > + *ext_hdrs |= OFPIEH12_ESP;
> > > + break;
> > you need to check_header() before looking into each extension header.
>
> Could you elaborate why I need to add check_header(),
> skb_header_pointer() is doing sanitization.
I mean check_header() would allow you to read the header without
copying the bits, it is used in ovs flow extraction so its usual
check.
On Thu, Dec 2, 2021 at 9:28 PM Pravin Shelar <[email protected]> wrote:
>
> On Thu, Dec 2, 2021 at 12:20 PM Cpp Code <[email protected]> wrote:
> >
> > On Wed, Dec 1, 2021 at 11:34 PM Pravin Shelar <[email protected]> wrote:
> > >
> > > On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <[email protected]> wrote:
> > > >
> > > > This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
> > > > packets can be filtered using ipv6_ext flag.
> > > >
> > > > Signed-off-by: Toms Atteka <[email protected]>
> > > > ---
> > > > include/uapi/linux/openvswitch.h | 6 ++
> > > > net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
> > > > net/openvswitch/flow.h | 14 ++++
> > > > net/openvswitch/flow_netlink.c | 26 +++++-
> > > > 4 files changed, 184 insertions(+), 2 deletions(-)
> > > >
> > > > diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
> > > > index a87b44cd5590..43790f07e4a2 100644
> > > > --- a/include/uapi/linux/openvswitch.h
> > > > +++ b/include/uapi/linux/openvswitch.h
> > > > @@ -342,6 +342,7 @@ enum ovs_key_attr {
> > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
> > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
> > > > OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
> > > > + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */
> > > >
> > > > #ifdef __KERNEL__
> > > > OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
> > > > @@ -421,6 +422,11 @@ struct ovs_key_ipv6 {
> > > > __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */
> > > > };
> > > >
> > > > +/* separate structure to support backward compatibility with older user space */
> > > > +struct ovs_key_ipv6_exthdrs {
> > > > + __u16 hdrs;
> > > > +};
> > > > +
> > > > struct ovs_key_tcp {
> > > > __be16 tcp_src;
> > > > __be16 tcp_dst;
> > > > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
> > > > index 9d375e74b607..28acb40437ca 100644
> > > > --- a/net/openvswitch/flow.c
> > > > +++ b/net/openvswitch/flow.c
> > > > @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb)
> > > > sizeof(struct icmphdr));
> > > > }
> > > >
> > > > +/**
> > > > + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
> > > > + *
> > > > + * @skb: buffer where extension header data starts in packet
> > > > + * @nh: ipv6 header
> > > > + * @ext_hdrs: flags are stored here
> > > > + *
> > > > + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
> > > > + * is unexpectedly encountered. (Two destination options headers may be
> > > > + * expected and would not cause this bit to be set.)
> > > > + *
> > > > + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
> > > > + * preferred (but not required) by RFC 2460:
> > > > + *
> > > > + * When more than one extension header is used in the same packet, it is
> > > > + * recommended that those headers appear in the following order:
> > > > + * IPv6 header
> > > > + * Hop-by-Hop Options header
> > > > + * Destination Options header
> > > > + * Routing header
> > > > + * Fragment header
> > > > + * Authentication header
> > > > + * Encapsulating Security Payload header
> > > > + * Destination Options header
> > > > + * upper-layer header
> > > > + */
> > > > +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
> > > > + u16 *ext_hdrs)
> > > > +{
> > > > + u8 next_type = nh->nexthdr;
> > > > + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
> > > > + int dest_options_header_count = 0;
> > > > +
> > > > + *ext_hdrs = 0;
> > > > +
> > > > + while (ipv6_ext_hdr(next_type)) {
> > > > + struct ipv6_opt_hdr _hdr, *hp;
> > > > +
> > > > + switch (next_type) {
> > > > + case IPPROTO_NONE:
> > > > + *ext_hdrs |= OFPIEH12_NONEXT;
> > > > + /* stop parsing */
> > > > + return;
> > > > +
> > > > + case IPPROTO_ESP:
> > > > + if (*ext_hdrs & OFPIEH12_ESP)
> > > > + *ext_hdrs |= OFPIEH12_UNREP;
> > > > + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
> > > > + OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
> > > > + OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
> > > > + dest_options_header_count >= 2) {
> > > > + *ext_hdrs |= OFPIEH12_UNSEQ;
> > > > + }
> > > > + *ext_hdrs |= OFPIEH12_ESP;
> > > > + break;
> > > you need to check_header() before looking into each extension header.
> >
> > Could you elaborate why I need to add check_header(),
> > skb_header_pointer() is doing sanitization.
>
> I mean check_header() would allow you to read the header without
> copying the bits, it is used in ovs flow extraction so its usual
> check.
But check_header() will call *__pskb_pull_tail which in turn will copy
bits if data will be fragmented.
/* Moves tail of skb head forward, copying data from fragmented part,
* when it is necessary.
* 1. It may fail due to malloc failure.
* 2. It may change skb pointers.
*
* It is pretty complicated. Luckily, it is called only in exceptional cases.
*/
void *__pskb_pull_tail(struct sk_buff *skb, int delta)
as well I noticed that for example commit
4a06fa67c4da20148803525151845276cdb995c1 is moving from
pskb_may_pull() to skb_header_pointer()
()
On Mon, Dec 6, 2021 at 3:00 PM Cpp Code <[email protected]> wrote:
>
> On Thu, Dec 2, 2021 at 9:28 PM Pravin Shelar <[email protected]> wrote:
> >
> > On Thu, Dec 2, 2021 at 12:20 PM Cpp Code <[email protected]> wrote:
> > >
> > > On Wed, Dec 1, 2021 at 11:34 PM Pravin Shelar <[email protected]> wrote:
> > > >
> > > > On Wed, Nov 24, 2021 at 11:33 AM Toms Atteka <[email protected]> wrote:
> > > > >
> > > > > This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
> > > > > packets can be filtered using ipv6_ext flag.
> > > > >
> > > > > Signed-off-by: Toms Atteka <[email protected]>
> > > > > ---
> > > > > include/uapi/linux/openvswitch.h | 6 ++
> > > > > net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
> > > > > net/openvswitch/flow.h | 14 ++++
> > > > > net/openvswitch/flow_netlink.c | 26 +++++-
> > > > > 4 files changed, 184 insertions(+), 2 deletions(-)
> > > > >
> > > > > diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
> > > > > index a87b44cd5590..43790f07e4a2 100644
> > > > > --- a/include/uapi/linux/openvswitch.h
> > > > > +++ b/include/uapi/linux/openvswitch.h
> > > > > @@ -342,6 +342,7 @@ enum ovs_key_attr {
> > > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
> > > > > OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
> > > > > OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
> > > > > + OVS_KEY_ATTR_IPV6_EXTHDRS, /* struct ovs_key_ipv6_exthdr */
> > > > >
> > > > > #ifdef __KERNEL__
> > > > > OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
> > > > > @@ -421,6 +422,11 @@ struct ovs_key_ipv6 {
> > > > > __u8 ipv6_frag; /* One of OVS_FRAG_TYPE_*. */
> > > > > };
> > > > >
> > > > > +/* separate structure to support backward compatibility with older user space */
> > > > > +struct ovs_key_ipv6_exthdrs {
> > > > > + __u16 hdrs;
> > > > > +};
> > > > > +
> > > > > struct ovs_key_tcp {
> > > > > __be16 tcp_src;
> > > > > __be16 tcp_dst;
> > > > > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
> > > > > index 9d375e74b607..28acb40437ca 100644
> > > > > --- a/net/openvswitch/flow.c
> > > > > +++ b/net/openvswitch/flow.c
> > > > > @@ -239,6 +239,144 @@ static bool icmphdr_ok(struct sk_buff *skb)
> > > > > sizeof(struct icmphdr));
> > > > > }
> > > > >
> > > > > +/**
> > > > > + * get_ipv6_ext_hdrs() - Parses packet and sets IPv6 extension header flags.
> > > > > + *
> > > > > + * @skb: buffer where extension header data starts in packet
> > > > > + * @nh: ipv6 header
> > > > > + * @ext_hdrs: flags are stored here
> > > > > + *
> > > > > + * OFPIEH12_UNREP is set if more than one of a given IPv6 extension header
> > > > > + * is unexpectedly encountered. (Two destination options headers may be
> > > > > + * expected and would not cause this bit to be set.)
> > > > > + *
> > > > > + * OFPIEH12_UNSEQ is set if IPv6 extension headers were not in the order
> > > > > + * preferred (but not required) by RFC 2460:
> > > > > + *
> > > > > + * When more than one extension header is used in the same packet, it is
> > > > > + * recommended that those headers appear in the following order:
> > > > > + * IPv6 header
> > > > > + * Hop-by-Hop Options header
> > > > > + * Destination Options header
> > > > > + * Routing header
> > > > > + * Fragment header
> > > > > + * Authentication header
> > > > > + * Encapsulating Security Payload header
> > > > > + * Destination Options header
> > > > > + * upper-layer header
> > > > > + */
> > > > > +static void get_ipv6_ext_hdrs(struct sk_buff *skb, struct ipv6hdr *nh,
> > > > > + u16 *ext_hdrs)
> > > > > +{
> > > > > + u8 next_type = nh->nexthdr;
> > > > > + unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
> > > > > + int dest_options_header_count = 0;
> > > > > +
> > > > > + *ext_hdrs = 0;
> > > > > +
> > > > > + while (ipv6_ext_hdr(next_type)) {
> > > > > + struct ipv6_opt_hdr _hdr, *hp;
> > > > > +
> > > > > + switch (next_type) {
> > > > > + case IPPROTO_NONE:
> > > > > + *ext_hdrs |= OFPIEH12_NONEXT;
> > > > > + /* stop parsing */
> > > > > + return;
> > > > > +
> > > > > + case IPPROTO_ESP:
> > > > > + if (*ext_hdrs & OFPIEH12_ESP)
> > > > > + *ext_hdrs |= OFPIEH12_UNREP;
> > > > > + if ((*ext_hdrs & ~(OFPIEH12_HOP | OFPIEH12_DEST |
> > > > > + OFPIEH12_ROUTER | IPPROTO_FRAGMENT |
> > > > > + OFPIEH12_AUTH | OFPIEH12_UNREP)) ||
> > > > > + dest_options_header_count >= 2) {
> > > > > + *ext_hdrs |= OFPIEH12_UNSEQ;
> > > > > + }
> > > > > + *ext_hdrs |= OFPIEH12_ESP;
> > > > > + break;
> > > > you need to check_header() before looking into each extension header.
> > >
> > > Could you elaborate why I need to add check_header(),
> > > skb_header_pointer() is doing sanitization.
> >
> > I mean check_header() would allow you to read the header without
> > copying the bits, it is used in ovs flow extraction so its usual
> > check.
>
> But check_header() will call *__pskb_pull_tail which in turn will copy
> bits if data will be fragmented.
>
OVS flow extract uses this function to extract flow upto L4, so
skb_header_pointer() is not saving any copy operation.
> /* Moves tail of skb head forward, copying data from fragmented part,
> * when it is necessary.
> * 1. It may fail due to malloc failure.
> * 2. It may change skb pointers.
> *
> * It is pretty complicated. Luckily, it is called only in exceptional cases.
> */
> void *__pskb_pull_tail(struct sk_buff *skb, int delta)
>
> as well I noticed that for example commit
> 4a06fa67c4da20148803525151845276cdb995c1 is moving from
> pskb_may_pull() to skb_header_pointer()
ok, I see advantage of using skb_header_pointer() in this case, but
replacing all check_header() with skb_header_pointer() would add lot
of copy operation in flow extract. Anyways for this use case
skb_header_pointer() is fine.
Acked-by: Pravin B Shelar <[email protected]>
On Wed, 9 Feb 2022 12:46:01 -0800 Cpp Code wrote:
> > ok, I see advantage of using skb_header_pointer() in this case, but
> > replacing all check_header() with skb_header_pointer() would add lot
> > of copy operation in flow extract. Anyways for this use case
> > skb_header_pointer() is fine.
> >
> > Acked-by: Pravin B Shelar <[email protected]>
>
> Could this be applied please.
Please repost with Pravin's ack included.
Hello:
This patch was applied to netdev/net-next.git (master)
by David S. Miller <[email protected]>:
On Wed, 23 Feb 2022 16:54:09 -0800 you wrote:
> This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
> packets can be filtered using ipv6_ext flag.
>
> Signed-off-by: Toms Atteka <[email protected]>
> Acked-by: Pravin B Shelar <[email protected]>
> ---
> include/uapi/linux/openvswitch.h | 6 ++
> net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
> net/openvswitch/flow.h | 14 ++++
> net/openvswitch/flow_netlink.c | 26 +++++-
> 4 files changed, 184 insertions(+), 2 deletions(-)
Here is the summary with links:
- [net-next,v8] net: openvswitch: IPv6: Add IPv6 extension header support
https://git.kernel.org/netdev/net-next/c/28a3f0601727
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
On 2022-02-25 12:40 PM, [email protected] wrote:
> Hello:
>
> This patch was applied to netdev/net-next.git (master)
> by David S. Miller <[email protected]>:
>
> On Wed, 23 Feb 2022 16:54:09 -0800 you wrote:
>> This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
>> packets can be filtered using ipv6_ext flag.
>>
>> Signed-off-by: Toms Atteka <[email protected]>
>> Acked-by: Pravin B Shelar <[email protected]>
>> ---
>> include/uapi/linux/openvswitch.h | 6 ++
>> net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
>> net/openvswitch/flow.h | 14 ++++
>> net/openvswitch/flow_netlink.c | 26 +++++-
>> 4 files changed, 184 insertions(+), 2 deletions(-)
>
> Here is the summary with links:
> - [net-next,v8] net: openvswitch: IPv6: Add IPv6 extension header support
> https://git.kernel.org/netdev/net-next/c/28a3f0601727
>
> You are awesome, thank you!
Hi,
After the merge of this patch I fail to do ipv6 traffic in ovs.
Am I missing something?
ovs-vswitchd.log has this msg
2022-03-02T09:52:26.604Z|00013|odp_util(handler1)|WARN|attribute
packet_type has length 2 but should have length 4
Thanks,
Roi
On 2022-03-02 12:03 PM, Roi Dayan wrote:
>
>
> On 2022-02-25 12:40 PM, [email protected] wrote:
>> Hello:
>>
>> This patch was applied to netdev/net-next.git (master)
>> by David S. Miller <[email protected]>:
>>
>> On Wed, 23 Feb 2022 16:54:09 -0800 you wrote:
>>> This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
>>> packets can be filtered using ipv6_ext flag.
>>>
>>> Signed-off-by: Toms Atteka <[email protected]>
>>> Acked-by: Pravin B Shelar <[email protected]>
>>> ---
>>> include/uapi/linux/openvswitch.h | 6 ++
>>> net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
>>> net/openvswitch/flow.h | 14 ++++
>>> net/openvswitch/flow_netlink.c | 26 +++++-
>>> 4 files changed, 184 insertions(+), 2 deletions(-)
>>
>> Here is the summary with links:
>> - [net-next,v8] net: openvswitch: IPv6: Add IPv6 extension header
>> support
>> https://git.kernel.org/netdev/net-next/c/28a3f0601727
>>
>> You are awesome, thank you!
>
> Hi,
>
> After the merge of this patch I fail to do ipv6 traffic in ovs.
> Am I missing something?
>
> ovs-vswitchd.log has this msg
>
> 2022-03-02T09:52:26.604Z|00013|odp_util(handler1)|WARN|attribute
> packet_type has length 2 but should have length 4
>
> Thanks,
> Roi
I think there is a missing userspace fix. didnt verify yet.
but in ovs userspace odp-netlink.h created from
datapath/linux/compat/include/linux/openvswitch.h
and that file is not synced the change here.
So the new enum OVS_KEY_ATTR_IPV6_EXTHDRS is missing and also struct
ovs_key_ipv6_exthdrs which is needed in lib/udp-util.c
in struct ovs_flow_key_attr_lens to add expected len for
OVS_KEY_ATTR_IPV6_EXTHDR.
On 2 Mar 2022, at 11:50, Roi Dayan wrote:
> On 2022-03-02 12:03 PM, Roi Dayan wrote:
>>
>>
>> On 2022-02-25 12:40 PM, [email protected] wrote:
>>> Hello:
>>>
>>> This patch was applied to netdev/net-next.git (master)
>>> by David S. Miller <[email protected]>:
>>>
>>> On Wed, 23 Feb 2022 16:54:09 -0800 you wrote:
>>>> This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
>>>> packets can be filtered using ipv6_ext flag.
>>>>
>>>> Signed-off-by: Toms Atteka <[email protected]>
>>>> Acked-by: Pravin B Shelar <[email protected]>
>>>> ---
>>>> include/uapi/linux/openvswitch.h | 6 ++
>>>> net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
>>>> net/openvswitch/flow.h | 14 ++++
>>>> net/openvswitch/flow_netlink.c | 26 +++++-
>>>> 4 files changed, 184 insertions(+), 2 deletions(-)
>>>
>>> Here is the summary with links:
>>> - [net-next,v8] net: openvswitch: IPv6: Add IPv6 extension header support
>>> https://git.kernel.org/netdev/net-next/c/28a3f0601727
>>>
>>> You are awesome, thank you!
>>
>> Hi,
>>
>> After the merge of this patch I fail to do ipv6 traffic in ovs.
>> Am I missing something?
>>
>> ovs-vswitchd.log has this msg
>>
>> 2022-03-02T09:52:26.604Z|00013|odp_util(handler1)|WARN|attribute packet_type has length 2 but should have length 4
>>
>> Thanks,
>> Roi
>
>
> I think there is a missing userspace fix. didnt verify yet.
> but in ovs userspace odp-netlink.h created from datapath/linux/compat/include/linux/openvswitch.h
> and that file is not synced the change here.
> So the new enum OVS_KEY_ATTR_IPV6_EXTHDRS is missing and also struct
> ovs_key_ipv6_exthdrs which is needed in lib/udp-util.c
> in struct ovs_flow_key_attr_lens to add expected len for
> OVS_KEY_ATTR_IPV6_EXTHDR.
I guess if this is creating backward compatibility issues, this patch should be reverted/fixed. As a kmod upgrade should not break existing deployments.
On 2022-03-02 3:59 PM, Eelco Chaudron wrote:
>
>
> On 2 Mar 2022, at 11:50, Roi Dayan wrote:
>
>> On 2022-03-02 12:03 PM, Roi Dayan wrote:
>>>
>>>
>>> On 2022-02-25 12:40 PM, [email protected] wrote:
>>>> Hello:
>>>>
>>>> This patch was applied to netdev/net-next.git (master)
>>>> by David S. Miller <[email protected]>:
>>>>
>>>> On Wed, 23 Feb 2022 16:54:09 -0800 you wrote:
>>>>> This change adds a new OpenFlow field OFPXMT_OFB_IPV6_EXTHDR and
>>>>> packets can be filtered using ipv6_ext flag.
>>>>>
>>>>> Signed-off-by: Toms Atteka <[email protected]>
>>>>> Acked-by: Pravin B Shelar <[email protected]>
>>>>> ---
>>>>> include/uapi/linux/openvswitch.h | 6 ++
>>>>> net/openvswitch/flow.c | 140 +++++++++++++++++++++++++++++++
>>>>> net/openvswitch/flow.h | 14 ++++
>>>>> net/openvswitch/flow_netlink.c | 26 +++++-
>>>>> 4 files changed, 184 insertions(+), 2 deletions(-)
>>>>
>>>> Here is the summary with links:
>>>> - [net-next,v8] net: openvswitch: IPv6: Add IPv6 extension header support
>>>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit.kernel.org%2Fnetdev%2Fnet-next%2Fc%2F28a3f0601727&data=04%7C01%7Croid%40nvidia.com%7C41e35b6733e34dcf628708d9fc54dc9b%7C43083d15727340c1b7db39efd9ccc17a%7C0%7C0%7C637818263683241778%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=iaysgYLANYFQo87ELcK9KMesF6u7pWF3cGAHiKB%2FM1E%3D&reserved=0
>>>>
>>>> You are awesome, thank you!
>>>
>>> Hi,
>>>
>>> After the merge of this patch I fail to do ipv6 traffic in ovs.
>>> Am I missing something?
>>>
>>> ovs-vswitchd.log has this msg
>>>
>>> 2022-03-02T09:52:26.604Z|00013|odp_util(handler1)|WARN|attribute packet_type has length 2 but should have length 4
>>>
>>> Thanks,
>>> Roi
>>
>>
>> I think there is a missing userspace fix. didnt verify yet.
>> but in ovs userspace odp-netlink.h created from datapath/linux/compat/include/linux/openvswitch.h
>> and that file is not synced the change here.
>> So the new enum OVS_KEY_ATTR_IPV6_EXTHDRS is missing and also struct
>> ovs_key_ipv6_exthdrs which is needed in lib/udp-util.c
>> in struct ovs_flow_key_attr_lens to add expected len for
>> OVS_KEY_ATTR_IPV6_EXTHDR.
>
> I guess if this is creating backward compatibility issues, this patch should be reverted/fixed. As a kmod upgrade should not break existing deployments.
>
it looks like it does. we can't work with ovs without reverting this.
can we continue with reverting this commit please?
On Mon, 7 Mar 2022 10:49:31 +0200 Roi Dayan wrote:
> >> I think there is a missing userspace fix. didnt verify yet.
> >> but in ovs userspace odp-netlink.h created from datapath/linux/compat/include/linux/openvswitch.h
> >> and that file is not synced the change here.
> >> So the new enum OVS_KEY_ATTR_IPV6_EXTHDRS is missing and also struct
> >> ovs_key_ipv6_exthdrs which is needed in lib/udp-util.c
> >> in struct ovs_flow_key_attr_lens to add expected len for
> >> OVS_KEY_ATTR_IPV6_EXTHDR.
> >
> > I guess if this is creating backward compatibility issues, this
> > patch should be reverted/fixed. As a kmod upgrade should not break
> > existing deployments.
>
> it looks like it does. we can't work with ovs without reverting this.
> can we continue with reverting this commit please?
Sure, can someone ELI5 what the problem is?
What's "kmod upgrade" in this context a kernel upgrade or loading
a newer module in older kernel?
How can adding a new nl attr break user space? Does the user space
actually care about the OVS_KEY_ATTR_TUNNEL_INFO wart?