Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[vslib]Add MACsec forward and filters to HostInterfaceInfo #719

Merged
merged 5 commits into from
Dec 1, 2020
Merged

[vslib]Add MACsec forward and filters to HostInterfaceInfo #719

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8b4cb33
Add MACsec forward and filters to HostInterfaceInfo
Pterosaur Nov 23, 2020
fe58aaa
Polish code
Pterosaur Nov 26, 2020
8b7f3f8
Polish code
Pterosaur Nov 26, 2020
38be8ab
Move variables into namespace
Pterosaur Nov 27, 2020
f98468c
Change TrafficForwarder::sendTo function to be virtual
Pterosaur Nov 27, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 20 additions & 2 deletions vslib/inc/HostInterfaceInfo.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ extern "C" {
}

#include "EventQueue.h"
#include "TrafficFilterPipes.h"

#include "swss/selectableevent.h"

Expand Down Expand Up @@ -38,6 +39,20 @@ namespace saivs
_In_ const uint8_t *buffer,
_In_ size_t size) const;

bool installEth2TapFilter(
_In_ int priority,
_In_ std::shared_ptr<TrafficFilter> filter);

bool uninstallEth2TapFilter(
_In_ std::shared_ptr<TrafficFilter> filter);

bool installTap2EthFilter(
_In_ int priority,
_In_ std::shared_ptr<TrafficFilter> filter);

bool uninstallTap2EthFilter(
_In_ std::shared_ptr<TrafficFilter> filter);

private:

void veth2tap_fun();
Expand All @@ -58,13 +73,16 @@ namespace saivs

std::shared_ptr<EventQueue> m_eventQueue;

private:

int m_tapfd;

private:

std::shared_ptr<std::thread> m_e2t;
std::shared_ptr<std::thread> m_t2e;

TrafficFilterPipes m_e2tFilters;
TrafficFilterPipes m_t2eFilters;

swss::SelectableEvent m_e2tEvent;
swss::SelectableEvent m_t2eEvent;
};
Expand Down
4 changes: 2 additions & 2 deletions vslib/inc/MACsecFilter.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,10 +30,10 @@ namespace saivs
_In_ const void *buffer,
_In_ size_t length) = 0;

bool m_macsec_device_enable;
bool m_macsecDeviceEnable;

int m_macsecfd;

const std::string m_macsec_interface_name;
const std::string m_macsecInterfaceName;
};
}
7 changes: 6 additions & 1 deletion vslib/inc/MACsecForwarder.h
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
#pragma once

#include "HostInterfaceInfo.h"

#include "swss/sal.h"
#include "swss/selectableevent.h"

Expand All @@ -14,7 +16,8 @@ namespace saivs
public:
MACsecForwarder(
_In_ const std::string &macsecInterfaceName,
_In_ int tapfd);
_In_ int tapfd,
_In_ std::shared_ptr<HostInterfaceInfo> info);

virtual ~MACsecForwarder();

Expand All @@ -33,5 +36,7 @@ namespace saivs
swss::SelectableEvent m_exitEvent;

std::shared_ptr<std::thread> m_forwardThread;

std::shared_ptr<HostInterfaceInfo> m_info;
};
}
62 changes: 62 additions & 0 deletions vslib/src/HostInterfaceInfo.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,40 @@ void HostInterfaceInfo::async_process_packet_for_fdb_event(
m_eventQueue->enqueue(std::make_shared<Event>(EventType::EVENT_TYPE_PACKET, payload));
}

bool HostInterfaceInfo::installEth2TapFilter(
_In_ int priority,
_In_ std::shared_ptr<TrafficFilter> filter)
{
SWSS_LOG_ENTER();

return m_e2tFilters.installFilter(priority, filter);
}

bool HostInterfaceInfo::uninstallEth2TapFilter(
_In_ std::shared_ptr<TrafficFilter> filter)
{
SWSS_LOG_ENTER();

return m_e2tFilters.uninstallFilter(filter);
}

bool HostInterfaceInfo::installTap2EthFilter(
_In_ int priority,
_In_ std::shared_ptr<TrafficFilter> filter)
{
SWSS_LOG_ENTER();

return m_t2eFilters.installFilter(priority, filter);
}

bool HostInterfaceInfo::uninstallTap2EthFilter(
_In_ std::shared_ptr<TrafficFilter> filter)
{
SWSS_LOG_ENTER();

return m_t2eFilters.uninstallFilter(filter);
}

#define ETH_FRAME_BUFFER_SIZE (0x4000)
#define CONTROL_MESSAGE_BUFFER_SIZE (0x1000)
#define IEEE_8021Q_ETHER_TYPE (0x8100)
Expand Down Expand Up @@ -161,6 +195,20 @@ void HostInterfaceInfo::veth2tap_fun()
continue;
}

size_t length = static_cast<size_t>(size);
Pterosaur marked this conversation as resolved.
Show resolved Hide resolved
auto ret = m_e2tFilters.execute(buffer, length);
size = static_cast<ssize_t>(length);

if (ret == TrafficFilter::TERMINATE)
{
continue;
}
else if (ret == TrafficFilter::ERROR)
{
// Error log should be recorded in filter
return;
}

struct cmsghdr *cmsg;

for (cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL; cmsg = CMSG_NXTHDR(&msg, cmsg))
Expand Down Expand Up @@ -268,6 +316,20 @@ void HostInterfaceInfo::tap2veth_fun()
continue;
}

size_t length = static_cast<size_t>(size);
auto ret = m_t2eFilters.execute(buffer, length);
Pterosaur marked this conversation as resolved.
Show resolved Hide resolved
size = static_cast<ssize_t>(length);

if (ret == TrafficFilter::TERMINATE)
{
continue;
}
else if (ret == TrafficFilter::ERROR)
{
// Error log should be recorded in filter
return;
}

if (write(m_packet_socket, buffer, (int)size) < 0)
{
if (errno != ENETDOWN)
Expand Down
80 changes: 77 additions & 3 deletions vslib/src/MACsecForwarder.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,13 +15,19 @@
using namespace saivs;

#define ETH_FRAME_BUFFER_SIZE (0x4000)
#define CONTROL_MESSAGE_BUFFER_SIZE (0x1000)
#define IEEE_8021Q_ETHER_TYPE (0x8100)
#define MAC_ADDRESS_SIZE (6)
#define VLAN_TAG_SIZE (4)

MACsecForwarder::MACsecForwarder(
_In_ const std::string &macsecInterfaceName,
_In_ int tapfd):
_In_ int tapfd,
_In_ std::shared_ptr<HostInterfaceInfo> info):
m_tapfd(tapfd),
m_macsecInterfaceName(macsecInterfaceName),
m_runThread(true)
m_runThread(true),
m_info(info)
{
SWSS_LOG_ENTER();

Expand Down Expand Up @@ -112,6 +118,25 @@ void MACsecForwarder::forward()

while (m_runThread)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why you need separate thread in macsec ? there is already thread thats deals with packet processing, why not tap into that ?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we already have 2 threads per port that transfer the data, and you are having some another thread for the path that is already processing data, this seems a waist of resources

Copy link
Contributor Author

@Pterosaur Pterosaur Nov 24, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I remember you asked this question before, sorry that I did not explain it clear.
I think we need three threads in current design. The previous two are for forwarding data between tap and veth, and the new one is for forwarding the plaintext data from macsec to tap.

Meanwhile, all encrypted data on the thread 2 will be dropped by the macsec ingress filter. Because linux kernel will help us to forward the encrypted data.
All plaintext data, except EAPOL traffic, from tap interface will be captured by the MACsec egress filter that forwards to the macsec device for encryption.
Who will help us to forward the plaintext data from macsec device? I believe it should be thread 3.

image

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so mu understanding here is now like this: we have regular traffic, and encrypted traffic coming to the same interface then based on something (dont know what it is) you can distinguish which one is which, and for encrypted traffic you are sending this traffic to separate created socket that will decrypt this traffic inside kernel and then you can read that socket (or other one?) to get planetext traffic, process it, block or forward, maybe generate fdb notification, and then forward back encrypted traffic (re-encrypted if some filters are applied that modify pakcket) to the existing tap device?

if this is the case, both encrypted and plain text traffic come to the single tap interface, and right now this traffic is processing 1 by 1 packet in order that they arrived, with your async solution there is possibility that arrived packets will be reordered, and this is probably whats not happening in real hardware, but thats my guess. Anyway in this case i think you should block for processing in the pipeline.

if my understanding here is wrong, please setup a call meeting with me, we can talk and share on teams. I'm in CET timezone and available from 11am to 10pm everyday

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

basically this MACsecForwarder::forward() is exactly the same as HostInterfaceInfo::veth2tap_fun, but not having this filter option, and just uses different FD, but other processes are the same, i think this could be somehow unified, but maybe not this PR

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agree. I add a new super class TrafficForwarder. Maybe we can leverage it to refactor this part in the another PR.

{
struct msghdr msg;
memset(&msg, 0, sizeof(struct msghdr));

struct sockaddr_storage srcAddr;

struct iovec iov[1];

iov[0].iov_base = buffer; // buffer for message
iov[0].iov_len = sizeof(buffer);

char control[CONTROL_MESSAGE_BUFFER_SIZE]; // buffer for control messages

msg.msg_name = &srcAddr;
msg.msg_namelen = sizeof(srcAddr);
msg.msg_iov = iov;
msg.msg_iovlen = 1;
msg.msg_control = control;
msg.msg_controllen = sizeof(control);

swss::Selectable *sel = NULL;
int result = s.select(&sel);

Expand All @@ -128,7 +153,7 @@ void MACsecForwarder::forward()
if (sel == &m_exitEvent) // thread end event
break;

ssize_t size = read(m_macsecfd, buffer, sizeof(buffer));
ssize_t size = recvmsg(m_macsecfd, &msg, 0);
Pterosaur marked this conversation as resolved.
Show resolved Hide resolved

if (size < 0)
{
Expand All @@ -151,6 +176,55 @@ void MACsecForwarder::forward()

continue;
}
else if (size < (ssize_t)sizeof(ethhdr))
{
SWSS_LOG_ERROR("invalid ethernet frame length: %zu", msg.msg_controllen);

continue;
}

struct cmsghdr *cmsg;

for (cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL; cmsg = CMSG_NXTHDR(&msg, cmsg))
Pterosaur marked this conversation as resolved.
Show resolved Hide resolved
{
if (cmsg->cmsg_level != SOL_PACKET || cmsg->cmsg_type != PACKET_AUXDATA)
continue;

struct tpacket_auxdata* aux = (struct tpacket_auxdata*)CMSG_DATA(cmsg);

if ((aux->tp_status & TP_STATUS_VLAN_VALID) &&
(aux->tp_status & TP_STATUS_VLAN_TPID_VALID))
{
SWSS_LOG_DEBUG("got vlan tci: 0x%x, vlanid: %d", aux->tp_vlan_tci, aux->tp_vlan_tci & 0xFFF);

// inject vlan tag into frame

// for overlapping buffers
memmove(buffer + 2 * MAC_ADDRESS_SIZE + VLAN_TAG_SIZE,
buffer + 2 * MAC_ADDRESS_SIZE,
size - (2 * MAC_ADDRESS_SIZE));

uint16_t tci = htons(aux->tp_vlan_tci);
uint16_t tpid = htons(IEEE_8021Q_ETHER_TYPE);

uint8_t* pvlan = (uint8_t *)(buffer + 2 * MAC_ADDRESS_SIZE);
memcpy(pvlan, &tpid, sizeof(uint16_t));
memcpy(pvlan + sizeof(uint16_t), &tci, sizeof(uint16_t));

size += VLAN_TAG_SIZE;

break;
}
}

if (m_info == nullptr)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i think this should be checked on the constructor and throw if empty

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

{
SWSS_LOG_ERROR("The HostInterfaceInfo on the MACsec port %s is empty", m_macsecInterfaceName.c_str());

break;
}

m_info->async_process_packet_for_fdb_event(buffer, size);
Pterosaur marked this conversation as resolved.
Show resolved Hide resolved

if (write(m_tapfd, buffer, static_cast<int>(size)) < 0)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this also seems like a HostInterfaceInfo::veth2tap_fun end of the function, so this is also could be moved to a common function?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

{
Expand Down
2 changes: 1 addition & 1 deletion vslib/src/MACsecManager.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -579,7 +579,7 @@ bool MACsecManager::add_macsec_forwarder(

auto &manager = itr->second;

manager.m_forwarder = std::make_shared<MACsecForwarder>(macsecInterface, manager.m_info->m_tapfd);
manager.m_forwarder = std::make_shared<MACsecForwarder>(macsecInterface, manager.m_info->m_tapfd, manager.m_info);
Copy link
Collaborator

@kcudnik kcudnik Nov 25, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

manager.m_info->m_tapfd in not necessary parameter, remove; you are already passing manager.m_info inside, so you can internally use that m_tapfd, and also m_tapfd should be private, did you change visibility of that item ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

return true;
}

Expand Down
6 changes: 5 additions & 1 deletion vslib/src/Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,11 @@ libSaiVS_a_SOURCES = \
SwitchMLNX2700.cpp \
CorePortIndexMap.cpp \
CorePortIndexMapContainer.cpp \
CorePortIndexMapFileParser.cpp
CorePortIndexMapFileParser.cpp \
MACsecFilter.cpp \
MACsecEgressFilter.cpp \
MACsecIngressFilter.cpp \
TrafficFilterPipes.cpp

libsaivs_la_SOURCES = \
sai_vs_fdb.cpp \
Expand Down