7d1d65cb84
This work contains a lightweight BPF-based traffic classifier that can
serve as a flexible alternative to ematch-based tree classification, i.e.
now that BPF filter engine can also be JITed in the kernel. Naturally, tc
actions and policies are supported as well with cls_bpf. Multiple BPF
programs/filter can be attached for a class, or they can just as well be
written within a single BPF program, that's really up to the user how he
wishes to run/optimize the code, e.g. also for inversion of verdicts etc.
The notion of a BPF program's return/exit codes is being kept as follows:
0: No match
-1: Select classid given in "tc filter ..." command
else: flowid, overwrite the default one
As a minimal usage example with iproute2, we use a 3 band prio root qdisc
on a router with sfq each as leave, and assign ssh and icmp bpf-based
filters to band 1, http traffic to band 2 and the rest to band 3. For the
first two bands we load the bytecode from a file, in the 2nd we load it
inline as an example:
echo 1 > /proc/sys/net/core/bpf_jit_enable
tc qdisc del dev em1 root
tc qdisc add dev em1 root handle 1: prio bands 3 priomap 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
tc qdisc add dev em1 parent 1:1 sfq perturb 16
tc qdisc add dev em1 parent 1:2 sfq perturb 16
tc qdisc add dev em1 parent 1:3 sfq perturb 16
tc filter add dev em1 parent 1: bpf run bytecode-file /etc/tc/ssh.bpf flowid 1:1
tc filter add dev em1 parent 1: bpf run bytecode-file /etc/tc/icmp.bpf flowid 1:1
tc filter add dev em1 parent 1: bpf run bytecode-file /etc/tc/http.bpf flowid 1:2
tc filter add dev em1 parent 1: bpf run bytecode "`bpfc -f tc -i misc.ops`" flowid 1:3
BPF programs can be easily created and passed to tc, either as inline
'bytecode' or 'bytecode-file'. There are a couple of front-ends that can
compile opcodes, for example:
1) People familiar with tcpdump-like filters:
tcpdump -iem1 -ddd port 22 | tr '\n' ',' > /etc/tc/ssh.bpf
2) People that want to low-level program their filters or use BPF
extensions that lack support by libpcap's compiler:
bpfc -f tc -i ssh.ops > /etc/tc/ssh.bpf
ssh.ops example code:
ldh [12]
jne #0x800, drop
ldb [23]
jneq #6, drop
ldh [20]
jset #0x1fff, drop
ldxb 4 * ([14] & 0xf)
ldh [%x + 14]
jeq #0x16, pass
ldh [%x + 16]
jne #0x16, drop
pass: ret #-1
drop: ret #0
It was chosen to load bytecode into tc, since the reverse operation,
tc filter list dev em1, is then able to show the exact commands again.
Possible follow-up work could also include a small expression compiler
for iproute2. Tested with the help of bmon. This idea came up during
the Netfilter Workshop 2013 in Copenhagen. Also thanks to feedback from
Eric Dumazet!
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
61 lines
2.3 KiB
Makefile
61 lines
2.3 KiB
Makefile
#
|
|
# Makefile for the Linux Traffic Control Unit.
|
|
#
|
|
|
|
obj-y := sch_generic.o sch_mq.o
|
|
|
|
obj-$(CONFIG_NET_SCHED) += sch_api.o sch_blackhole.o
|
|
obj-$(CONFIG_NET_CLS) += cls_api.o
|
|
obj-$(CONFIG_NET_CLS_ACT) += act_api.o
|
|
obj-$(CONFIG_NET_ACT_POLICE) += act_police.o
|
|
obj-$(CONFIG_NET_ACT_GACT) += act_gact.o
|
|
obj-$(CONFIG_NET_ACT_MIRRED) += act_mirred.o
|
|
obj-$(CONFIG_NET_ACT_IPT) += act_ipt.o
|
|
obj-$(CONFIG_NET_ACT_NAT) += act_nat.o
|
|
obj-$(CONFIG_NET_ACT_PEDIT) += act_pedit.o
|
|
obj-$(CONFIG_NET_ACT_SIMP) += act_simple.o
|
|
obj-$(CONFIG_NET_ACT_SKBEDIT) += act_skbedit.o
|
|
obj-$(CONFIG_NET_ACT_CSUM) += act_csum.o
|
|
obj-$(CONFIG_NET_SCH_FIFO) += sch_fifo.o
|
|
obj-$(CONFIG_NET_SCH_CBQ) += sch_cbq.o
|
|
obj-$(CONFIG_NET_SCH_HTB) += sch_htb.o
|
|
obj-$(CONFIG_NET_SCH_HFSC) += sch_hfsc.o
|
|
obj-$(CONFIG_NET_SCH_RED) += sch_red.o
|
|
obj-$(CONFIG_NET_SCH_GRED) += sch_gred.o
|
|
obj-$(CONFIG_NET_SCH_INGRESS) += sch_ingress.o
|
|
obj-$(CONFIG_NET_SCH_DSMARK) += sch_dsmark.o
|
|
obj-$(CONFIG_NET_SCH_SFB) += sch_sfb.o
|
|
obj-$(CONFIG_NET_SCH_SFQ) += sch_sfq.o
|
|
obj-$(CONFIG_NET_SCH_TBF) += sch_tbf.o
|
|
obj-$(CONFIG_NET_SCH_TEQL) += sch_teql.o
|
|
obj-$(CONFIG_NET_SCH_PRIO) += sch_prio.o
|
|
obj-$(CONFIG_NET_SCH_MULTIQ) += sch_multiq.o
|
|
obj-$(CONFIG_NET_SCH_ATM) += sch_atm.o
|
|
obj-$(CONFIG_NET_SCH_NETEM) += sch_netem.o
|
|
obj-$(CONFIG_NET_SCH_DRR) += sch_drr.o
|
|
obj-$(CONFIG_NET_SCH_PLUG) += sch_plug.o
|
|
obj-$(CONFIG_NET_SCH_MQPRIO) += sch_mqprio.o
|
|
obj-$(CONFIG_NET_SCH_CHOKE) += sch_choke.o
|
|
obj-$(CONFIG_NET_SCH_QFQ) += sch_qfq.o
|
|
obj-$(CONFIG_NET_SCH_CODEL) += sch_codel.o
|
|
obj-$(CONFIG_NET_SCH_FQ_CODEL) += sch_fq_codel.o
|
|
obj-$(CONFIG_NET_SCH_FQ) += sch_fq.o
|
|
|
|
obj-$(CONFIG_NET_CLS_U32) += cls_u32.o
|
|
obj-$(CONFIG_NET_CLS_ROUTE4) += cls_route.o
|
|
obj-$(CONFIG_NET_CLS_FW) += cls_fw.o
|
|
obj-$(CONFIG_NET_CLS_RSVP) += cls_rsvp.o
|
|
obj-$(CONFIG_NET_CLS_TCINDEX) += cls_tcindex.o
|
|
obj-$(CONFIG_NET_CLS_RSVP6) += cls_rsvp6.o
|
|
obj-$(CONFIG_NET_CLS_BASIC) += cls_basic.o
|
|
obj-$(CONFIG_NET_CLS_FLOW) += cls_flow.o
|
|
obj-$(CONFIG_NET_CLS_CGROUP) += cls_cgroup.o
|
|
obj-$(CONFIG_NET_CLS_BPF) += cls_bpf.o
|
|
obj-$(CONFIG_NET_EMATCH) += ematch.o
|
|
obj-$(CONFIG_NET_EMATCH_CMP) += em_cmp.o
|
|
obj-$(CONFIG_NET_EMATCH_NBYTE) += em_nbyte.o
|
|
obj-$(CONFIG_NET_EMATCH_U32) += em_u32.o
|
|
obj-$(CONFIG_NET_EMATCH_META) += em_meta.o
|
|
obj-$(CONFIG_NET_EMATCH_TEXT) += em_text.o
|
|
obj-$(CONFIG_NET_EMATCH_CANID) += em_canid.o
|
|
obj-$(CONFIG_NET_EMATCH_IPSET) += em_ipset.o
|