pkt-loop-filter/pkt-loop-filter.h

#ifndef __PKT_LOOP_FILTER_H__
#define __PKT_LOOP_FILTER_H__

#define MAX_IFINDEXES 10

#define NS_PER_SEC 1000000000ULL
#define STATE_LIFETIME (10 * NS_PER_SEC)
#define LOCK_LIFETIME (5 * NS_PER_SEC)

struct pkt_loop_key {
        __u8 src_mac[6];
        __u16 src_vlan;
};

struct pkt_loop_data {
        __u64 expiry_time;
        __u64 lock_time;
        __u32 ifindex;
        __u32 drops;

};

#endif
Add pkt-loop-filter example Add an example to filter looping packets on (for instance) a bond interface, by recording the egress MAC+VLAN and dropping any packets that come in on other (related) interfaces with the same MAC+VLAN. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> 2022-05-20 14:53:14 +02:00			`#ifndef __PKT_LOOP_FILTER_H__`
			`#define __PKT_LOOP_FILTER_H__`

pkt-loop-filter: Filter multicast traffic This adds filtering of multicast traffic to the set of interfaces. The filtering works by marking one of the interfaces as "primary" (which is just the first interface name that is supplied on the command line) and filtering everything with an all-ones destination MAC address if it's coming in on any interface that's not the primary one. To handle interfaces going down, we actually supply all the ifindexes to the BPF program, and also install a tracing hook that listens to ifdown events and switches the logic to the next ifindex in the sequence if the primary one goes down. This is a bit rudimentary but should at least provide basic filtering. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> 2022-06-14 17:36:54 +02:00			`#define MAX_IFINDEXES 10`

Add pkt-loop-filter example Add an example to filter looping packets on (for instance) a bond interface, by recording the egress MAC+VLAN and dropping any packets that come in on other (related) interfaces with the same MAC+VLAN. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> 2022-05-20 14:53:14 +02:00			`#define NS_PER_SEC 1000000000ULL`
			`#define STATE_LIFETIME (10 * NS_PER_SEC)`
pkt-loop-filter: Fix gratuitous ARP handling The exception for gratuitous ARPs are only supposed to be for entries that would otherwise be dropped due to the loop filtering logic. In addition, we should record egress gratuitous ARPs and make sure they don't trigger the exception when looping back (this is 'rule 4' of the openvswitch SLB bonding logic). Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> 2022-07-14 23:45:01 +02:00			`#define LOCK_LIFETIME (5 * NS_PER_SEC)`
Add pkt-loop-filter example Add an example to filter looping packets on (for instance) a bond interface, by recording the egress MAC+VLAN and dropping any packets that come in on other (related) interfaces with the same MAC+VLAN. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> 2022-05-20 14:53:14 +02:00
			`struct pkt_loop_key {`
			`__u8 src_mac[6];`
			`__u16 src_vlan;`
			`};`

			`struct pkt_loop_data {`
			`__u64 expiry_time;`
pkt-loop-filter: Fix gratuitous ARP handling The exception for gratuitous ARPs are only supposed to be for entries that would otherwise be dropped due to the loop filtering logic. In addition, we should record egress gratuitous ARPs and make sure they don't trigger the exception when looping back (this is 'rule 4' of the openvswitch SLB bonding logic). Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> 2022-07-14 23:45:01 +02:00			`__u64 lock_time;`
Add pkt-loop-filter example Add an example to filter looping packets on (for instance) a bond interface, by recording the egress MAC+VLAN and dropping any packets that come in on other (related) interfaces with the same MAC+VLAN. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> 2022-05-20 14:53:14 +02:00			`__u32 ifindex;`
			`__u32 drops;`

			`};`

			`#endif`