m_mirred: Allow mirred to block

So far the mirred action has dealt with syntax that handles
mirror/redirection for netdev. A matching packet is redirected or mirrored
to a target netdev.

In this patch we enable mirred to mirror to a tc block as well.
IOW, the new syntax looks as follows:
... mirred <ingress | egress> <mirror | redirect> [index INDEX] < <blockid BLOCKID> | <dev <devname>> >

Examples of mirroring or redirecting to a tc block:
$ tc filter add block 22 protocol ip pref 25 \
  flower dst_ip 192.168.0.0/16 action mirred egress mirror blockid 22

$ tc filter add block 22 protocol ip pref 25 \
  flower dst_ip 10.10.10.10/32 action mirred egress redirect blockid 22

Co-developed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Co-developed-by: Pedro Tammela <pctammela@mojatatu.com>
Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: David Ahern <dsahern@kernel.org>

diff --git a/man/man8/tc-mirred.8 b/man/man8/tc-mirred.8
index e529fa6a0930dc34c496dfec48b94e50f11bb4d3..ea408467fd14391beccc6aed6f2397edfa649bae 100644 (file)
--- a/man/man8/tc-mirred.8
+++ b/man/man8/tc-mirred.8
@@ -9,12 +9,23 @@ mirred - mirror/redirect action
 .I DIRECTION ACTION
 .RB "[ " index
 .IR INDEX " ] "
-.BI dev " DEVICENAME"
+.I TARGET
 
 .ti -8
 .IR DIRECTION " := { "
 .BR ingress " | " egress " }"
 
+.ti -8
+.IR TARGET " := { " DEV " | " BLOCK " }"
+
+.ti -8
+.IR DEV " :=  "
+.BI dev " DEVICENAME"
+
+.ti -8
+.IR BLOCK " :=  "
+.BI blockid " BLOCKID"
+
 .ti -8
 .IR ACTION " := { "
 .BR mirror " | " redirect " }"
@@ -24,6 +35,12 @@ The
 action allows packet mirroring (copying) or redirecting (stealing) the packet it
 receives. Mirroring is what is sometimes referred to as Switch Port Analyzer
 (SPAN) and is commonly used to analyze and/or debug flows.
+When mirroring to a tc block, the packet will be mirrored to all the ports in
+the block with exception of the port where the packet ingressed, if that port is
+part of the tc block. Redirecting is simillar to mirroring except that the
+behaviour is to mirror to the first N - 1 ports in the block and redirect to the
+last one (note that the port in which the packet arrived is not going to be
+mirrored or redirected to).
 .SH OPTIONS
 .TP
 .B ingress
@@ -39,7 +56,7 @@ Define whether the packet should be copied
 .RB ( mirror )
 or moved
 .RB ( redirect )
-to the destination interface.
+to the destination interface or block.
 .TP
 .BI index " INDEX"
 Assign a unique ID to this action instead of letting the kernel choose one
@@ -49,6 +66,9 @@ is a 32bit unsigned integer greater than zero.
 .TP
 .BI dev " DEVICENAME"
 Specify the network interface to redirect or mirror to.
+.TP
+.BI blockid " BLOCKID"
+Specify the tc block to redirect or mirror to.
 .SH EXAMPLES
 Limit ingress bandwidth on eth0 to 1mbit/s, redirect exceeding traffic to lo for
 debugging purposes:

diff --git a/tc/m_mirred.c b/tc/m_mirred.c
index e5653e67f791c8178293f6003ef3b036c3689658..60bd90452ccbf7d036e1e83e3db6e6f4c026825c 100644 (file)
--- a/tc/m_mirred.c
+++ b/tc/m_mirred.c
@@ -24,12 +24,16 @@ static void
 explain(void)
 {
        fprintf(stderr,
-               "Usage: mirred <DIRECTION> <ACTION> [index INDEX] <dev DEVICENAME>\n"
+               "Usage: mirred <DIRECTION> <ACTION> [index INDEX] <TARGET>\n"
                "where:\n"
                "\tDIRECTION := <ingress | egress>\n"
                "\tACTION := <mirror | redirect>\n"
                "\tINDEX  is the specific policy instance id\n"
-               "\tDEVICENAME is the devicename\n");
+               "\tTARGET := <BLOCK | DEVICE>\n"
+               "\tDEVICE := dev DEVICENAME\n"
+               "\tDEVICENAME is the devicename\n"
+               "\tBLOCK := blockid BLOCKID\n"
+               "\tBLOCKID := 32-bit unsigned block ID\n");
 }
 
 static void
@@ -94,6 +98,7 @@ parse_direction(struct action_util *a, int *argc_p, char ***argv_p,
        struct tc_mirred p = {};
        struct rtattr *tail;
        char d[IFNAMSIZ] = {};
+       __u32 blockid = 0;
 
        while (argc > 0) {
 
@@ -162,15 +167,37 @@ parse_direction(struct action_util *a, int *argc_p, char ***argv_p,
                                        TCA_INGRESS_REDIR;
                                p.action = TC_ACT_STOLEN;
                                ok++;
-                       } else if ((redir || mirror) &&
-                                  matches(*argv, "dev") == 0) {
-                               NEXT_ARG();
-                               if (strlen(d))
-                                       duparg("dev", *argv);
-
-                               strncpy(d, *argv, sizeof(d)-1);
-                               argc--;
-                               argv++;
+                       } else if ((redir || mirror)) {
+                               if (strcmp(*argv, "blockid") == 0) {
+                                       if (strlen(d)) {
+                                               fprintf(stderr,
+                                                       "blockid and device are mutually exclusive.\n");
+                                               return -1;
+                                       }
+                                       NEXT_ARG();
+                                       if (get_u32(&blockid, *argv, 0) ||
+                                           !blockid) {
+                                               fprintf(stderr,
+                                                       "invalid block ID");
+                                               return -1;
+                                       }
+                                       argc--;
+                                       argv++;
+                               }
+                               if (argc && matches(*argv, "dev") == 0) {
+                                       if (blockid) {
+                                               fprintf(stderr,
+                                                       "blockid and device are mutually exclusive.\n");
+                                               return -1;
+                                       }
+                                       NEXT_ARG();
+                                       if (strlen(d))
+                                               duparg("dev", *argv);
+
+                                       strncpy(d, *argv, sizeof(d)-1);
+                                       argc--;
+                                       argv++;
+                               }
 
                                break;
 
@@ -220,6 +247,8 @@ parse_direction(struct action_util *a, int *argc_p, char ***argv_p,
 
        tail = addattr_nest(n, MAX_MSG, tca_id);
        addattr_l(n, MAX_MSG, TCA_MIRRED_PARMS, &p, sizeof(p));
+       if (blockid)
+               addattr32(n, MAX_MSG, TCA_MIRRED_BLOCKID, blockid);
        addattr_nest_end(n, tail);
 
        *argc_p = argc;
@@ -299,7 +328,15 @@ print_mirred(struct action_util *au, FILE *f, struct rtattr *arg)
                     mirred_action(p->eaction));
        print_string(PRINT_JSON, "direction", NULL,
                     mirred_direction(p->eaction));
-       print_string(PRINT_ANY, "to_dev", " to device %s)", dev);
+       if (tb[TCA_MIRRED_BLOCKID]) {
+               const __u32 *blockid = RTA_DATA(tb[TCA_MIRRED_BLOCKID]);
+
+               print_uint(PRINT_ANY, "to_blockid", " to blockid %u)",
+                          *blockid);
+       } else {
+               print_string(PRINT_ANY, "to_dev", " to device %s)", dev);
+       }
+
        print_action_control(f, " ", p->action, "");
 
        print_nl();