Commit Graph

10 Commits

Author SHA1 Message Date
c1e1aaf019 pkt-loop-filter: Operate directly on bond devices
Instead of having to pass the component interfaces to the userspace
program, we can just pass the bond ifname, and have the loader detect which
bond component interfaces are in the bond, and automatically load the BPF
program on each one. Reusing the active bond detection code from the
previous commit also allows us to automatically detect the right initial
active interface, and keep this up-to-date by hooking into the bonding code
that changes it when an iface goes down, instead of naively rotating
between active interfaces.

Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
2022-06-29 16:58:34 +02:00
032d9cde85 pkt-loop-filter: Add get-bond-active utility
Add a small utility that uses a kprobe to extract the currently active
slave ifindex from a bond interface. This value is normally only exported
to userspace for bond types where it can be explicitly set, but the bond
driver has an internal notion of an active interface regardless of the bond
type. We can extract this value with a kprobe by attaching to a function in
the bond driver and triggering an operation that causes this function to be
called.

Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
2022-06-29 16:58:34 +02:00
f746871b1a pkt-loop-filter: Filter IGMP packets along with multicast
Filter not only the multicast packets themselves, but also any IGMP (and
ICMPv6 MLD) packets coming in on multiple interfaces.

Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
2022-06-29 16:58:34 +02:00
6f47602582 pkt-loop-filter: Add optional debugging of dropped packets
Add a debug mode to pkt-loop-filter that outputs debug messages for every
dropped packet (with the reason it was dropped). Also add a small script to
read the kernel trace pipe, after making sure tracing is active (otherwise
there will be no output in the pipe).

The source MAC address+VLAN is squeezed into a single u64 when printing as
a quick workaround to the lack of MAC address printing in BPF printk.

Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
2022-06-29 16:58:34 +02:00
e4530b04ce pkt-loop-filter: Fix off-by-one in bounds check
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
2022-06-29 16:58:34 +02:00
e9aeda404e pkt-loop-filter: fix ethernet multicast frame identification
Multicast, which also includes broadcast, frames can be identified by
looking at the LSB of the first octet of the destination MAC address.

Original-patch-by: Jonathan Toppins <jtoppins@redhat.com>
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
2022-06-29 16:58:34 +02:00
96a5c2ebbf pkt-loop-filter: Set map size from userspace instead of in BPF definition
With this we can add a command line parameter to dynamically size the map
later.

Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
2022-06-14 17:43:39 +02:00
60ed7a8e8b pkt-loop-filter: Filter multicast traffic
This adds filtering of multicast traffic to the set of interfaces. The
filtering works by marking one of the interfaces as "primary" (which is
just the first interface name that is supplied on the command line) and
filtering everything with an all-ones destination MAC address if it's
coming in on any interface that's not the primary one.

To handle interfaces going down, we actually supply all the ifindexes to
the BPF program, and also install a tracing hook that listens to ifdown
events and switches the logic to the next ifindex in the sequence if the
primary one goes down. This is a bit rudimentary but should at least
provide basic filtering.

Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
2022-06-14 17:43:35 +02:00
c57a5bc169 pkt-loop-filter: Attach a tracing program to catch ifdown events
This is needed to be able to react to interfaces going down so we can
allow multicast on a secondary interface if the primary goes down. We don't
actually react to the event yet, just print it; handling this will be added
in a subsequent commit.

Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
2022-06-14 17:43:31 +02:00
070715cf1c Add pkt-loop-filter example
Add an example to filter looping packets on (for instance) a bond
interface, by recording the egress MAC+VLAN and dropping any packets that
come in on other (related) interfaces with the same MAC+VLAN.

Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
2022-05-20 14:53:14 +02:00