Skip to content

Commit d3bab20

Browse files
rjarrychristophefontaine
authored andcommitted
datapath: drop packets on interfaces with admin down flag
Check GR_IFACE_F_UP flag in eth_input, eth_output, ipip_input and ipip_output nodes before processing packets. If the interface or its parent (for VLANs) is administratively down, redirect packets to the iface_input_admin_down drop node. This prevents traffic from flowing through interfaces that have been disabled via configuration. Signed-off-by: Robin Jarry <[email protected]>
1 parent ca05839 commit d3bab20

File tree

4 files changed

+39
-1
lines changed

4 files changed

+39
-1
lines changed

modules/infra/datapath/eth_input.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ enum {
1616
UNKNOWN_ETHER_TYPE = 0,
1717
UNKNOWN_VLAN,
1818
INVALID_IFACE,
19+
IFACE_DOWN,
1920
NB_EDGES,
2021
};
2122

@@ -57,6 +58,11 @@ eth_input_process(struct rte_graph *graph, struct rte_node *node, void **objs, u
5758
eth_type = eth->ether_type;
5859
vlan_id = 0;
5960

61+
if (!(eth_in->iface->flags & GR_IFACE_F_UP)) {
62+
edge = IFACE_DOWN;
63+
goto next;
64+
}
65+
6066
if (m->ol_flags & RTE_MBUF_F_RX_VLAN_STRIPPED) {
6167
vlan_id = m->vlan_tci & 0xfff;
6268
} else if (eth_type == RTE_BE16(RTE_ETHER_TYPE_VLAN)) {
@@ -75,6 +81,10 @@ eth_input_process(struct rte_graph *graph, struct rte_node *node, void **objs, u
7581
edge = UNKNOWN_VLAN;
7682
goto next;
7783
}
84+
if (!(vlan_iface->flags & GR_IFACE_F_UP)) {
85+
edge = IFACE_DOWN;
86+
goto next;
87+
}
7888
eth_in->iface = vlan_iface;
7989
}
8090
edge = l2l3_edges[eth_type];
@@ -147,6 +157,7 @@ static struct rte_node_register node = {
147157
[UNKNOWN_ETHER_TYPE] = "eth_input_unknown_type",
148158
[UNKNOWN_VLAN] = "eth_input_unknown_vlan",
149159
[INVALID_IFACE] = "eth_input_invalid_iface",
160+
[IFACE_DOWN] = "iface_input_admin_down",
150161
// other edges are updated dynamically with gr_eth_input_add_type
151162
},
152163
};
@@ -166,3 +177,4 @@ GR_NODE_REGISTER(info);
166177
GR_DROP_REGISTER(eth_input_unknown_type);
167178
GR_DROP_REGISTER(eth_input_unknown_vlan);
168179
GR_DROP_REGISTER(eth_input_invalid_iface);
180+
GR_DROP_REGISTER(iface_input_admin_down);

modules/infra/datapath/eth_output.c

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ enum {
1818
INVAL = 0,
1919
NO_HEADROOM,
2020
NO_MAC,
21+
IFACE_DOWN,
2122
NB_EDGES,
2223
};
2324

@@ -48,8 +49,21 @@ eth_output_process(struct rte_graph *graph, struct rte_node *node, void **objs,
4849
iface = priv->iface;
4950
vlan = NULL;
5051

52+
if (!(priv->iface->flags & GR_IFACE_F_UP)) {
53+
edge = IFACE_DOWN;
54+
goto next;
55+
}
5156
if (priv->iface->type == GR_IFACE_TYPE_VLAN) {
5257
const struct iface_info_vlan *sub = iface_info_vlan(priv->iface);
58+
priv->iface = iface_from_id(sub->parent_id);
59+
if (priv->iface == NULL) {
60+
edge = INVAL;
61+
goto next;
62+
}
63+
if (!(priv->iface->flags & GR_IFACE_F_UP)) {
64+
edge = IFACE_DOWN;
65+
goto next;
66+
}
5367
vlan = (struct rte_vlan_hdr *)rte_pktmbuf_prepend(mbuf, sizeof(*vlan));
5468
if (unlikely(vlan == NULL)) {
5569
edge = NO_HEADROOM;
@@ -58,7 +72,6 @@ eth_output_process(struct rte_graph *graph, struct rte_node *node, void **objs,
5872
vlan->vlan_tci = rte_cpu_to_be_16(sub->vlan_id);
5973
vlan->eth_proto = priv->ether_type;
6074
priv->ether_type = RTE_BE16(RTE_ETHER_TYPE_VLAN);
61-
priv->iface = iface_from_id(sub->parent_id);
6275
src_mac = sub->mac;
6376
} else if (iface_get_eth_addr(priv->iface->id, &src_mac) < 0) {
6477
edge = NO_MAC;
@@ -107,6 +120,7 @@ static struct rte_node_register node = {
107120
[INVAL] = "eth_output_inval",
108121
[NO_HEADROOM] = "error_no_headroom",
109122
[NO_MAC] = "eth_output_no_mac",
123+
[IFACE_DOWN] = "iface_input_admin_down",
110124
},
111125
};
112126

modules/ipip/datapath_in.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
enum {
2222
IP_INPUT = 0,
2323
NO_TUNNEL,
24+
IFACE_DOWN,
2425
EDGE_COUNT,
2526
};
2627

@@ -61,6 +62,10 @@ ipip_input_process(struct rte_graph *graph, struct rte_node *node, void **objs,
6162
edge = NO_TUNNEL;
6263
goto next;
6364
}
65+
if (!(ipip->flags & GR_IFACE_F_UP)) {
66+
edge = IFACE_DOWN;
67+
goto next;
68+
}
6469
// The hw checksum offload only works on the outer IP.
6570
// Clear the offload flag so that ip_input will check it in software.
6671
mbuf->ol_flags |= RTE_MBUF_F_RX_IP_CKSUM_NONE;
@@ -95,6 +100,7 @@ static struct rte_node_register ipip_input_node = {
95100
.next_nodes = {
96101
[IP_INPUT] = "ip_input",
97102
[NO_TUNNEL] = "ipip_input_no_tunnel",
103+
[IFACE_DOWN] = "iface_input_admin_down",
98104
},
99105
};
100106

modules/ipip/datapath_out.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ enum {
2323
IP_OUTPUT = 0,
2424
NO_TUNNEL,
2525
NO_HEADROOM,
26+
IFACE_DOWN,
2627
EDGE_COUNT,
2728
};
2829

@@ -51,6 +52,10 @@ ipip_output_process(struct rte_graph *graph, struct rte_node *node, void **objs,
5152
struct trace_ipip_data *t = gr_mbuf_trace_add(mbuf, node, sizeof(*t));
5253
t->iface_id = iface->id;
5354
}
55+
if (!(iface->flags & GR_IFACE_F_UP)) {
56+
edge = IFACE_DOWN;
57+
goto next;
58+
}
5459
ip_data->iface = iface;
5560
ipip = iface_info_ipip(iface);
5661

@@ -98,6 +103,7 @@ static struct rte_node_register ipip_output_node = {
98103
[IP_OUTPUT] = "ip_output",
99104
[NO_TUNNEL] = "ipip_output_no_tunnel",
100105
[NO_HEADROOM] = "error_no_headroom",
106+
[IFACE_DOWN] = "iface_input_admin_down",
101107
},
102108
};
103109

0 commit comments

Comments
 (0)