mbox series

[net-next,0/2] net: sched: cls-flower: add support for port-based fragment filtering

Message ID 1590611130-19146-1-git-send-email-jbaron@akamai.com
Headers show
Series net: sched: cls-flower: add support for port-based fragment filtering | expand

Message

Jason Baron May 27, 2020, 8:25 p.m. UTC 
Port based allow rules must currently allow all fragments since the
port number is not included in the 1rst fragment. We want to restrict
allowing all fragments by inclucding the port number in the 1rst
fragments.

For example, we can now allow fragments for only port 80 via:

# tc filter add dev $DEVICE parent ffff: priority 1 protocol ipv4 flower
  ip_proto tcp dst_port 80 action pass
# tc filter add dev $DEVICE parent ffff: priority 2 protocol ipv4 flower
  ip_flags frag/nofirstfrag action pass

The first patch includes ports for 1rst fragments.
The second patch adds test cases, demonstrating the new behavior.

Jason Baron (2):
  net: sched: cls-flower: include ports in 1rst fragment
  selftests: tc_flower: add destination port tests

 net/core/flow_dissector.c                          |  4 +-
 net/sched/cls_flower.c                             |  3 +-
 .../testing/selftests/net/forwarding/tc_flower.sh  | 73 +++++++++++++++++++++-
 3 files changed, 77 insertions(+), 3 deletions(-)