Commit Graph

544 Commits

Author SHA1 Message Date
Simon Horman
0390185078 tc: flower: Allow *_mac options to accept a mask
* The argument to src_mac and dst_mac may now take an optional mask
  to limit the scope of matching.
* This address is is documented as a LLADDR in keeping with ip-link(8).
* The formats accepted match those already output when dumping flower
  filters from the kernel.

Example of use of LLADDR with and without a mask:

tc qdisc add dev eth0 ingress
tc filter add dev eth0 protocol ip parent ffff: flower indev eth0 \
	src_mac 52:54:01:00:00:00/ff:ff:00:00:00:01 action drop
tc filter add dev eth0 protocol ip parent ffff: flower indev eth0 \
	src_mac 52:54:00:00:00:00/23 action drop
tc filter add dev eth0 protocol ip parent ffff: flower indev eth0 \
	src_mac 52:54:00:00:00:00 action drop

Signed-off-by: Simon Horman <simon.horman@netronome.com>
2016-12-21 15:56:39 -08:00
Simon Horman
a8a1dccd2a tc: flower: document that *_ip parameters take a PREFIX as an argument.
* The argument to src_ip, dst_ip, enc_src_ip and enc_dst_ip take an
  optional prefix length which is used to provide a mask to limit the scope
  of matching.
* This is documented as a PREFIX in keeping with ip-route(8).

Example of uses of IPv4 and IPv6 prefixes

tc qdisc add dev eth0 ingress
tc filter add dev eth0 protocol ip parent ffff: flower \
    indev eth0 dst_ip 192.168.1.1 action drop
tc filter add dev eth0 protocol ip parent ffff: flower \
    indev eth0 src_ip 10.0.0.0/8 action drop
tc filter add dev eth0 protocol ipv6 parent ffff: flower \
    indev eth0 src_ip 2001:DB8:1::/48 action drop
tc filter add dev eth0 protocol ipv6 parent ffff: flower \
    indev eth0 dst_ip 2001:DB8::1 action drop

Signed-off-by: Simon Horman <simon.horman@netronome.com>
2016-12-21 15:56:39 -08:00
David Ahern
1949f82cdf Introduce ip vrf command
'ip vrf' follows the user semnatics established by 'ip netns'.

The 'ip vrf' subcommand supports 3 usages:

1. Run a command against a given vrf:
       ip vrf exec NAME CMD

   Uses the recently committed cgroup/sock BPF option. vrf directory
   is added to cgroup2 mount. Individual vrfs are created under it. BPF
   filter attached to vrf/NAME cgroup2 to set sk_bound_dev_if to the VRF
   device index. From there the current process (ip's pid) is addded to
   the cgroups.proc file and the given command is exected. In doing so
   all AF_INET/AF_INET6 (ipv4/ipv6) sockets are automatically bound to
   the VRF domain.

   The association is inherited parent to child allowing the command to
   be a shell from which other commands are run relative to the VRF.

2. Show the VRF a process is bound to:
       ip vrf id
   This command essentially looks at /proc/pid/cgroup for a "::/vrf/"
   entry with the VRF name following.

3. Show process ids bound to a VRF
       ip vrf pids NAME
   This command dumps the file MNT/vrf/NAME/cgroup.procs since that file
   shows the process ids in the particular vrf cgroup.

Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
2016-12-13 10:20:16 -08:00
Roi Dayan
7d59d6354f tc: tunnel_key: Add tc-tunnel_key man page to Makefile
To be installed with the other man pages.

Fixes: d57639a475 ("tc/act_tunnel: Introduce ip tunnel action")
Signed-off-by: Roi Dayan <roid@mellanox.com>
Reviewed-by: Amir Vadai <amir@vadai.me>
2016-12-13 10:15:11 -08:00
Roi Dayan
5c46a8fd61 tc: flower: Fix typo and style in flower man page
Replace vlan_eth_type with vlan_ethtype.

Fixes: 745d917260 ("tc: flower: Introduce vlan support")
Signed-off-by: Roi Dayan <roid@mellanox.com>
Reviewed-by: Hadar Hen Zion <hadarh@mellanox.com>
2016-12-13 10:15:11 -08:00
Hadar Hen Zion
449c709c38 tc/m_tunnel_key: Add dest UDP port to tunnel key action
Enhance tunnel key action parameters by adding destination UDP port.

Signed-off-by: Hadar Hen Zion <hadarh@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
2016-12-13 10:15:11 -08:00
Hadar Hen Zion
41aa17ff46 tc/cls_flower: Add dest UDP port to tunnel params
Enhance IP tunnel parameters by adding destination UDP port.

Signed-off-by: Hadar Hen Zion <hadarh@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
2016-12-13 10:15:11 -08:00
Thomas Graf
b15f440e78 lwt: BPF support for LWT
Adds support to configure BPF programs as nexthop actions via the LWT
framework.

Example:
   ip route add 192.168.253.2/32 \
     encap bpf out obj lwt_len_hist_kern.o section len_hist \
     dev veth0

Signed-off-by: Thomas Graf <tgraf@suug.ch>
2016-12-12 15:32:54 -08:00
Simon Horman
eb3b5696f1 tc: flower: support matching on ICMP type and code
Support matching on ICMP type and code.

Example usage:

tc qdisc add dev eth0 ingress

tc filter add dev eth0 protocol ip parent ffff: flower \
	indev eth0 ip_proto icmp type 8 code 0 action drop

tc filter add dev eth0 protocol ipv6 parent ffff: flower \
	indev eth0 ip_proto icmpv6 type 128 code 0 action drop

Signed-off-by: Simon Horman <simon.horman@netronome.com>
2016-12-09 12:46:34 -08:00
Daniel Borkmann
c7272ca720 bpf: add initial support for attaching xdp progs
Now that we made the BPF loader generic as a library, reuse it
for loading XDP programs as well. This basically adds a minimal
start of a facility for iproute2 to load XDP programs. There
currently only exists the xdp1_user.c sample code in the kernel
tree that sets up netlink directly and an iovisor/bcc front-end.

Since we have all the necessary infrastructure in place already
from tc side, we can just reuse its loader back-end and thus
facilitate migration and usability among the two for people
familiar with tc/bpf already. Sharing maps, performing tail calls,
etc works the same way as with tc. Naturally, once kernel
configuration API evolves, we will extend new features for XDP
here as well, resp. extend dumping of related netlink attributes.

Minimal example:

  clang -target bpf -O2 -Wall -c prog.c -o prog.o
  ip [-force] link set dev em1 xdp obj prog.o       # attaching
  ip [-d] link                                      # dumping
  ip link set dev em1 xdp off                       # detaching

For the dump, intention is that in the first line for each ip
link entry, we'll see "xdp" to indicate that this device has an
XDP program attached. Once we dump some more useful information
via netlink (digest, etc), idea is that 'ip -d link' will then
display additional relevant program information below the "link/
ether [...]" output line for such devices, for example.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
2016-12-09 12:44:12 -08:00
Roi Dayan
6566ca8cdb devlink: Add option to set and show eswitch inline mode
This is needed for some HWs to do proper macthing and steering.
Possible values are none, link, network, transport.

Signed-off-by: Roi Dayan <roid@mellanox.com>
Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com>
2016-12-09 12:41:03 -08:00
Roi Dayan
a93b6bb3a2 devlink: Add usage help for eswitch subcommand
Add missing usage help for devlink dev eswitch subcommand.

Signed-off-by: Roi Dayan <roid@mellanox.com>
Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com>
2016-12-09 12:40:52 -08:00
Stephen Hemminger
e6fee79104 Merge branch 'master' into net-next 2016-12-09 12:38:51 -08:00
Stephen Hemminger
b95e5c55a9 Revert "devlink: Add usage help for eswitch subcommand"
This reverts commit 11f4cd31d2.
2016-12-09 12:37:39 -08:00
Stephen Hemminger
d646916993 Revert "devlink: Add option to set and show eswitch inline mode"
This reverts commit b9dcf9c282.

Intended for net-next
2016-12-09 12:37:19 -08:00
Simon Horman
6ad7e60c1f tc: flower: document SCTP ip_proto
Add SCTP ip_proto to help text and man page.

Signed-off-by: Simon Horman <simon.horman@netronome.com>
2016-12-05 10:13:26 -08:00
Simon Horman
730381fede tc: flower: remove references to eth_type in manpage
Remove references to eth_type and ether_type (spelling error) in
the tc flower manpage.

Also correct formatting of boldface text with whitespace.

Cc: Paul Blakey <paulb@mellanox.com>
Signed-off-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
2016-12-02 14:59:43 -08:00
Amir Vadai
d57639a475 tc/act_tunnel: Introduce ip tunnel action
This action could be used before redirecting packets to a shared tunnel
device, or when redirecting packets arriving from a such a device.

The 'unset' action is optional. It is used to explicitly unset the
metadata created by the tunnel device during decap. If not used, the
metadata will be released automatically by the kernel.
The 'set' operation, will set the metadata with the specified values for
the encap.

For example, the following flower filter will forward all ICMP packets
destined to 11.11.11.2 through the shared vxlan device 'vxlan0'. Before
redirecting, a metadata for the vxlan tunnel is created using the
tunnel_key action and it's arguments:

$ tc filter add dev net0 protocol ip parent ffff: \
    flower \
      ip_proto 1 \
      dst_ip 11.11.11.2 \
    action tunnel_key set \
      src_ip 11.11.0.1 \
      dst_ip 11.11.0.2 \
      id 11 \
    action mirred egress redirect dev vxlan0

Signed-off-by: Amir Vadai <amir@vadai.me>
2016-12-02 14:12:09 -08:00
Amir Vadai
bb9b63b18e tc/cls_flower: Classify packet in ip tunnels
Introduce classifying by metadata extracted by the tunnel device.
Outer header fields - source/dest ip and tunnel id, are extracted from
the metadata when classifying.

For example, the following will add a filter on the ingress Qdisc of shared
vxlan device named 'vxlan0'. To forward packets with outer src ip
11.11.0.2, dst ip 11.11.0.1 and tunnel id 11. The packets will be
forwarded to tap device 'vnet0':

$ tc filter add dev vxlan0 protocol ip parent ffff: \
    flower \
      enc_src_ip 11.11.0.2 \
      enc_dst_ip 11.11.0.1 \
      enc_key_id 11 \
      dst_ip 11.11.11.1 \
    action mirred egress redirect dev vnet0

Signed-off-by: Amir Vadai <amir@vadai.me>
2016-12-02 14:12:09 -08:00
Stephen Hemminger
d6ad31db57 Merge branch 'master' into net-next 2016-12-01 10:48:05 -08:00
Phil Sutter
f5f760b812 man: ip-route.8: Add notes about dropped IPv4 route cache
Signed-off-by: Phil Sutter <phil@nwl.cc>
2016-12-01 10:47:11 -08:00
Stephen Hemminger
328374dcfe Merge branch 'master' into net-next 2016-12-01 10:29:12 -08:00
Roi Dayan
b9dcf9c282 devlink: Add option to set and show eswitch inline mode
This is needed for some HWs to do proper macthing and steering.
Possible values are none, link, network, transport.

Signed-off-by: Roi Dayan <roid@mellanox.com>
Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com>
2016-11-29 19:17:20 -08:00
Roi Dayan
11f4cd31d2 devlink: Add usage help for eswitch subcommand
Add missing usage help for devlink dev eswitch subcommand.

Signed-off-by: Roi Dayan <roid@mellanox.com>
Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com>
2016-11-29 19:17:20 -08:00
Asbjørn Sloth Tønnesen
51a9d01aaa man: ip-l2tp.8: document UDP checksum options
Signed-off-by: Asbjørn Sloth Tønnesen <asbjorn@asbjorn.st>
2016-11-29 13:31:30 -08:00
Asbjørn Sloth Tønnesen
8a11421a5d l2tp: support sequence numbering
This patch implement and documents the user interface for
sequence numbering.

Signed-off-by: Asbjørn Sloth Tønnesen <asbjorn@asbjorn.st>
2016-11-29 13:31:30 -08:00
Asbjørn Sloth Tønnesen
d0baf5cac8 man: ip-l2tp.8: remove non-existent tunnel parameter name
The name parameter is only valid for sessions, not tunnels.

Signed-off-by: Asbjørn Sloth Tønnesen <asbjorn@asbjorn.st>
2016-11-29 13:31:30 -08:00
Asbjørn Sloth Tønnesen
222c4dab8e man: ip-l2tp.8: fix l2spec_type documentation
Signed-off-by: Asbjørn Sloth Tønnesen <asbjorn@asbjorn.st>
2016-11-29 13:31:30 -08:00
michael-dev@fami-braun.de
aa1b44ca77 iproute2: macvlan: add "source" mode
Adjusting iproute2 utility to support new macvlan link type mode called
"source".

Example of commands that can be applied:
  ip link add link eth0 name macvlan0 type macvlan mode source
  ip link set link dev macvlan0 type macvlan macaddr add 00:11:11:11:11:11
  ip link set link dev macvlan0 type macvlan macaddr del 00:11:11:11:11:11
  ip link set link dev macvlan0 type macvlan macaddr flush
  ip -details link show dev macvlan0

Based on previous work of Stefan Gula <steweg@gmail.com>

Signed-off-by: Michael Braun <michael-dev@fami-braun.de>

Cc: steweg@gmail.com

v5:
 - rebase and fix checkpatch

v4:
 - add MACADDR_SET support
 - skip FLAG_UNICAST / FLAG_UNICAST_ALL as this is not upstream
 - fix man page
2016-11-29 12:41:42 -08:00
Roman Mashak
7bdcc0d942 tc: updated man page to reflect GET command to retrieve a single filter.
Signed-off-by: Roman Mashak <mrv@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
2016-11-29 11:41:58 -08:00
Phil Sutter
f89d46ad63 ss: Add support for SCTP protocol
This makes use of the sctp_diag interface recently added to the kernel.

Joint work with Xin Long who provided the PoC implementation which I
merely polished up a bit.

Signed-off-by: Phil Sutter <phil@nwl.cc>
2016-11-29 11:41:57 -08:00
Paul Blakey
d9c3995ab7 tc: flower: Fix usage message
Remove left over usage from removal of eth_type argument.

Fixes: 488b41d020 ('tc: flower no need to specify the ethertype')
Signed-off-by: Paul Blakey <paulb@mellanox.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
2016-11-12 10:19:06 +03:00
Shmulik Ladkani
5eca0a3701 tc: m_mirred: Add support for ingress redirect/mirror
So far, only the 'egress' direction was implemented.

Allow specifying 'ingress' as the direction packet appears on the target
interface.

For example, this takes incoming 802.1q frames on veth0 and redirects
them for input on dummy0:

 # tc filter add dev veth0 parent ffff: pref 1 protocol 802.1q basic \
     action mirred ingress redirect dev dummy0

Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
2016-10-26 11:20:47 -07:00
Stephen Hemminger
c07a36c3db Revert "iproute2: macvlan: add "source" mode"
This reverts commit f33b727610.

The upstream changes are not in 4.9
2016-10-26 11:15:09 -07:00
Nikolay Aleksandrov
9208b4e7c9 bridge: add support for the multicast flood flag
Recently a new per-port flag was added which controls the flooding of
unknown multicast, this patch adds support for controlling it via iproute2.
It also updates the man pages with information about the new flag.

Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
2016-10-17 05:29:24 -07:00
Jakub Kicinski
87e46a5198 tc: cls_bpf: handle skip_sw and skip_hw flags
Add support for controling hardware offload using (now standard)
skip_sw and skip_hw flags in cls_bpf.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
2016-10-17 05:27:59 -07:00
michael-dev@fami-braun.de
f33b727610 iproute2: macvlan: add "source" mode
Adjusting iproute2 utility to support new macvlan link type mode called
"source".

Example of commands that can be applied:
  ip link add link eth0 name macvlan0 type macvlan mode source
  ip link set link dev macvlan0 type macvlan macaddr add 00:11:11:11:11:11
  ip link set link dev macvlan0 type macvlan macaddr del 00:11:11:11:11:11
  ip link set link dev macvlan0 type macvlan macaddr flush
  ip -details link show dev macvlan0

Based on previous work of Stefan Gula <steweg@gmail.com>

Signed-off-by: Michael Braun <michael-dev@fami-braun.de>

Cc: steweg@gmail.com
2016-10-12 15:22:14 -07:00
Lucas Bates
a40995d1c7 man pages: add man page for skbmod action
Signed-off-by: Lucas Bates <lucasb@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
2016-10-12 15:21:55 -07:00
Jamal Hadi Salim
46871dc9c6 man pages: Add tc-ife to Makefile
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
2016-10-12 15:09:52 -07:00
Lucas Bates
d491a3480f man pages: update ife action to include tcindex
Signed-off-by: Lucas Bates <lucasb@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
2016-10-12 15:09:52 -07:00
Hangbin Liu
ca89c52143 ip rule: add selector support
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
2016-10-09 19:25:59 -07:00
Moshe Shemesh
56e9f0ab19 ip link: Add support to configure SR-IOV VF to vlan protocol 802.1ad (VST QinQ)
Introduce a new API that exposes a list of vlans per VF (IFLA_VF_VLAN_LIST),
giving the ability for user-space application to specify it for the VF as
an option to support 802.1ad (VST QinQ).

We introduce struct vf_vlan_info, which extends struct vf_vlan and adds
an optional VF VLAN proto parameter.
Default VLAN-protocol is 802.1Q.

Add IFLA_VF_VLAN_LIST in addition to IFLA_VF_VLAN to keep backward
compatibility with older kernel versions.

Suitable ip link tool command examples:
 - Set vf vlan protocol 802.1ad (S-TAG)
	ip link set eth0 vf 1 vlan 100 proto 802.1ad
 - Set vf vlan S-TAG and vlan C-TAG (VST QinQ)
	ip link set eth0 vf 1 vlan 100 proto 802.1ad vlan 30 proto 802.1Q
 - Set vf to VST (802.1Q) mode
	ip link set eth0 vf 1 vlan 100 proto 802.1Q
 - Or by omitting the new parameter (backward compatible)
	ip link set eth0 vf 1 vlan 100

Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
2016-10-09 19:17:15 -07:00
Shmulik Ladkani
4654173e90 tc: m_vlan: Add vlan modify action
The 'vlan modify' action allows to replace an existing 802.1q tag
according to user provided settings.
It accepts same arguments as the 'vlan push' action.

For example, this replaces vid 6 with vid 5:

 # tc filter add dev veth0 parent ffff: pref 1 protocol 802.1q \
      basic match 'meta(vlan mask 0xfff eq 6)' \
      action vlan modify id 5 continue

Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
2016-10-09 19:11:34 -07:00
Parthasarathy Bhuvaragan
76fee71bf3 tipc: update man page for link monitor
Add description for the new link monitor commands.

Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
2016-09-20 09:13:09 -07:00
Stephen Hemminger
6831acc8ef Merge branch 'master' into net-next 2016-09-20 09:13:03 -07:00
Phil Sutter
31a29009c5 iproute: fix documentation for ip rule scan order
Hi,

On Thu, Sep 08, 2016 at 11:59:55AM +0200, Michal Kubecek wrote:
> On Thu, Sep 01, 2016 at 09:04:54AM -0700, Stephen Hemminger wrote:
> > On Tue, 30 Aug 2016 17:32:52 -0700
> > Iskren Chernev <iskren@imo.im> wrote:
> >
> > > From 416f45b62f33017d19a9b14e7b0179807c993cbe Mon Sep 17 00:00:00 2001
> > > From: Iskren Chernev <iskren@imo.im>
> > > Date: Tue, 30 Aug 2016 17:08:54 -0700
> > > Subject: [PATCH bug-fix] iproute: fix documentation for ip rule scan order
> > >
> > > ---
> > >  man/man8/ip-rule.8 | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/man/man8/ip-rule.8 b/man/man8/ip-rule.8
> > > index 1774ae3..3508d80 100644
> > > --- a/man/man8/ip-rule.8
> > > +++ b/man/man8/ip-rule.8
> > > @@ -93,7 +93,7 @@ Each policy routing rule consists of a
> > >  .B selector
> > >  and an
> > >  .B action predicate.
> > > -The RPDB is scanned in order of decreasing priority. The selector
> > > +The RPDB is scanned in order of increasing priority. The selector
> > >  of each rule is applied to {source address, destination address,
> > > incoming
> > >  interface, tos, fwmark} and, if the selector matches the packet,
> > >  the action is performed. The action predicate may return with success.
> > > --
> > > 2.4.5
> >
> > Applied
>
> I'm sorry I didn't notice before but this just reverts the change done
> by commit 4957250166 ("iproute2: clarification of various man8 pages").
> IMHO the problem is that both versions are equally confusing as the word
> "priority" can be understood in two different senses.
>
> How about more explicit formulation, e.g.
>
>   ... in order of decreasing logical priority (i.e. increasing numeric
>   values).
>
> Would that be better?

Looks like the real issue is missing definition of priority. What about
this:
2016-09-20 09:08:56 -07:00
Stephen Hemminger
88ba11bc08 Merge branch 'master' into net-next 2016-09-01 09:11:10 -07:00
Davide Caratti
0330f49ea0 macsec: fix byte ordering on input/display of 'sci'
use get_be64() in place of get_u64() when parsing input 'sci' parameter,
so that 'sci' can be entered using network byte order regardless the
endianness of target system; use ntohll() when printing out 'sci'. While
at it, improve documentation of 'sci' in ip-link.8.

Signed-off-by: Davide Caratti <dcaratti@redhat.com>
2016-09-01 09:08:50 -07:00
Davide Caratti
d0baa1389f man: ip.8: add missing 'macsec' item to OBJECT list
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
2016-09-01 09:08:50 -07:00
Davide Caratti
5898bd667a macsec: fix input of 'port', improve documentation of 'address'
remove hardcoded base 10 parsing of 'port' parameter, update man page
and fix usage() functions as well. Fix misleading line in man page that
theoretically allowed specifying 'port' keyword right after 'sci' keyword.
Provide documentation of 'address' parameter in man pages and in usage()
functions as well.

Signed-off-by: Davide Caratti <dcaratti@redhat.com>
2016-09-01 09:08:50 -07:00
Iskren Chernev
4a564d914d iproute: fix documentation for ip rule scan order 2016-09-01 08:41:37 -07:00
Stephen Hemminger
98a2af1d40 Merge branch 'master' into net-next 2016-09-01 08:39:15 -07:00
Hadar Hen Zion
0e43ed9dea tc: m_vlan: Add priority option to push vlan action
The current vlan push action supports only vid and protocol options.
Add priority option.

Example script that adds vlan push action with vid and priority:

tc filter add dev veth0 protocol ip parent ffff: \
	flower \
	indev veth0 \
	action vlan push id 100 priority 5

Signed-off-by: Hadar Hen Zion <hadarh@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
2016-09-01 08:38:41 -07:00
Hadar Hen Zion
745d917260 tc: flower: Introduce vlan support
Classification according to vlan id and vlan priority.

Example script that adds vlan filter:

 # add ingress qdisc
 tc qdisc add dev ens4f0 ingress

 # add a flower filter with vlan id and priority classification
 tc filter add dev ens4f0 protocol 802.1Q parent ffff: \
	flower \
		indev ens4f0 \
		vlan_ethtype ipv4 \
		vlan_id 100 \
		vlan_prio 3 \
	action vlan pop

Signed-off-by: Hadar Hen Zion <hadarh@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
2016-09-01 08:38:41 -07:00
Yotam Gigi
0501294bca tc: man: Add man entry for the matchall classifier.
In addition to providing information about the mathcall filter and its
configurations, the man entry contains examples for creating port
mirorring entries.

Signed-off-by: Yotam Gigi <yotamg@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
2016-09-01 08:37:01 -07:00
Richard Alpe
ed81deabf2 tipc: add the ability to get UDP bearer options
In this patch we introduce the ability to get UDP specific bearer
options such as remoteip, remoteport, localip and localport.

After some discussions on tipc-discussion on how to handle media
specific options we agreed to pass them after the media.

For media generic bearer options we already do:
$ tipc bearer get OPTION media MEDIA name|device NAME|DEVICE

For the UDP media specific bearer options we introduce in this path:
$ tipc bearer get media udp name NAME OPTION
such as
$ tipc bearer get media udp name NAME remoteip

This allows bash-completion to tab complete only appropriate options,
it makes more logical sense and it scales better. Even though it might
look a little different to the user.

In order to use the existing option parsing framework to do this we
add a flag (OPT_KEY) to the option parsing function.

If the UDP bearer has multiple remoteip addresses associated with it
(replicast) we handle the TIPC_NLA_UDP_MULTI_REMOTEIP flag and send
a TIPC_NL_UDP_GET_REMOTEIP query transparently to the user.

Signed-off-by: Richard Alpe <richard.alpe@ericsson.com>
Reviewed-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
2016-09-01 08:34:35 -07:00
Richard Alpe
f1f40cf77d tipc: introduce bearer add for remoteip
Introduce the ability to add remote IP addresses to an existing UDP
bearer. On the kernel side, adding a "remoteip" to an existing bearer
puts the bearer in "replicast" mode where TIPC multicast messages are
send out to each configured remoteip using unicast. This is required
for TIPC UDP bearers to work in environments where IP multicast is
disabled.

Signed-off-by: Richard Alpe <richard.alpe@ericsson.com>
Reviewed-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
2016-09-01 08:34:35 -07:00
Stephen Hemminger
3cc0b954b0 Merge branch 'master' into net-next 2016-08-29 11:19:03 -07:00
Or Gerlitz
f57856fab2 devlink: Add e-switch support
Implement kernel devlink e-switch interface. Currently we allow
to get and set the device e-switch mode.

Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Roi Dayan <roid@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
2016-08-29 11:15:54 -07:00
Nikolay Aleksandrov
7abf5de677 bridge: vlan: add support to display per-vlan statistics
This patch adds support for the stats argument to the bridge
vlan command which will display the per-vlan statistics and the device
each vlan belongs to with its flags. The supported command filtering
options are dev and vid. Also the man page is updated to explain the new
option.
The patch uses the new RTM_GETSTATS interface with a filter_mask to dump
all bridges and ports vlans. Later we can add support for using the
per-device dump and filter it in the kernel instead.

Example:
$ bridge -s vlan show
port             vlan id
br0               1 Egress Untagged
                    RX: 2536 bytes 20 packets
                    TX: 2536 bytes 20 packets
                  101
                    RX: 43158 bytes 50 packets
                    TX: 43158 bytes 50 packets
eth1              1 Egress Untagged
                    RX: 2536 bytes 20 packets
                    TX: 2536 bytes 20 packets
                  100
                    RX: 0 bytes 0 packets
                    TX: 0 bytes 0 packets
                  101
                    RX: 43158 bytes 50 packets
                    TX: 43158 bytes 50 packets
                  102
                    RX: 16897 bytes 93 packets
                    TX: 0 bytes 0 packets

The format is the same as bridge vlan show but with stats, even though
under the hood the calls done to the kernel are different.

Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
2016-08-29 10:58:40 -07:00
Stephen Hemminger
f7708201f8 Merge branch 'master' into net-next 2016-08-29 10:57:02 -07:00
Roman Mashak
27d2b08e23 police: bug fix man page
Signed-off-by: Roman Mashak <mrv@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
2016-08-29 10:54:40 -07:00
Richard Alpe
535194a172 tipc: add peer remove functionality
This enables a user to remove an offline peer from the kernel data
structures. This could for example be useful when deliberately scaling
in peer nodes in a cloud environment.

This functionality was first merged in:
f9dec657e4 (Richard Alpe tipc: add peer remove functionality)

And later backed out (as the kernel counterpart was held up) in:
385caeb13b (Stephen Hemminger Revert "tipc: add peer remove functionality")

Signed-off-by: Richard Alpe <richard.alpe@ericsson.com>
Reviewed-by: Jon Maloy <jon.maloy@ericsson.com>
Reviewed-by: Ying Xue <ying.xue@windriver.com>
2016-08-29 10:33:24 -07:00
Richard Alpe
ff77557957 tipc: fix UDP bearer synopsis
Local ip is not required to identify a UDP bearer and shouldn't be
passed to bearer disable, set or get. In this patch we remove the
localip entry from the synopsis of these functions.

Signed-off-by: Richard Alpe <richard.alpe@ericsson.com>
2016-08-17 13:52:07 -07:00
Phil Sutter
7e33b09331 man: ip-link.8: Document missing geneve options
This adds missing documentation of geneve type options:

- dstport
- external
- udpcsum
- udp6zerocsumtx
- udp6zerocsumrx

The bits for the last three was just copy and pasted from vxlan section.

Signed-off-by: Phil Sutter <phil@nwl.cc>
2016-08-12 12:58:53 -07:00
Stephen Hemminger
6d54c41580 Merge branch 'master' into net-next 2016-08-08 08:44:07 -07:00
Davide Caratti
89bb6e673a macsec: cipher and icvlen can be set separately
since kernel driver has valid default values for 'cipher' and 'icvlen',
there is no need for requiring users to specify both of them when a new
link is added. Also, prompt an error message and exit with appropriate
exit status in case of unsupported cipher suite.

Signed-off-by: Davide Caratti <dcaratti@redhat.com>
2016-07-28 11:12:39 -07:00
Davide Caratti
fd4df5b211 ip {link,address}: add 'macsec' item to TYPE list
fix output of "ip address help" and "ip link help". Update TYPE list in man
pages ip-address.8 and ip-link.8 as well.

Signed-off-by: Davide Caratti <dcaratti@redhat.com>
2016-07-28 11:12:39 -07:00
Davide Caratti
c0ab80a490 man: macsec: fix macsec related typos
- ip-macsec.8: fix wrong 'device' keyword in 'ip link add device eth0';
add missing description of 'validate' keyword; remove spurious bracket
near 'encrypt' keyword; add missing reference to configuration of 'port'
and 'sci'
- ip-link.8 fix wrong 'es' and 'encoding' keywords in MACsec section

Signed-off-by: Davide Caratti <dcaratti@redhat.com>
2016-07-28 11:12:39 -07:00
Stephen Hemminger
79f5bf17a5 Merge branch 'master' into net-next 2016-07-25 08:21:00 -07:00
Michal Soltys
bdd6104f52 man/man8/tc-flow.8: minor corrections
- baseclass: major handle must match that of class's, Y defaults to 1
- flow map example: maps to 1-256, not 1-257

Signed-off-by: Michal Soltys <soltys@ziu.info>
2016-07-25 08:19:25 -07:00
Stephen Hemminger
ac75d5cd36 Merge branch 'master' into net-next 2016-07-20 12:21:42 -07:00
Phil Sutter
6acf086c2b ip-address.8: Document autojoin flag
Description copied from related kernel support commit message with a
little tailoring to fit.

While at it, fix font of non-terminal CONFFLAG-LIST in synopsis.

Signed-off-by: Phil Sutter <phil@nwl.cc>
2016-07-20 12:21:18 -07:00
Phil Sutter
52a5986980 ip-link.8: Fix font choices
Signed-off-by: Phil Sutter <phil@nwl.cc>
2016-07-20 12:04:34 -07:00
Phil Sutter
3dd4b8936b ip-link.8: Add slave type option descriptions
Signed-off-by: Phil Sutter <phil@nwl.cc>
2016-07-20 12:04:34 -07:00
Phil Sutter
f9e9f92881 ip-link.8: Place 'ip link set' warning more prominently
This moves the warning to the beginning of the section about 'ip link
set' which makes it still stand out after adding more text to it's end.

Signed-off-by: Phil Sutter <phil@nwl.cc>
2016-07-20 12:04:34 -07:00
Phil Sutter
657426c506 ip-link.8: Extend type list in synopsis
'ip link set' supports passing a type to set type-specific parameters.
Add this missing piece of information to the synopsis section.

Signed-off-by: Phil Sutter <phil@nwl.cc>
2016-07-20 12:04:34 -07:00
Roopa Prabhu
db7263798a bridge: update man page
Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>
2016-07-20 12:02:02 -07:00
David Ahern
7a4559f67c ss: Add option to suppress header line
Add option to suppress header line. When used the following line
is not shown:
"State  Recv-Q Send-Q     Local Address:Port  Peer Address:Port"

Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
2016-07-20 11:55:43 -07:00
Stephen Hemminger
ba5783cbf3 Merge branch 'master' into net-next 2016-07-15 11:49:41 -07:00
Ido Schimmel
78c610e6ea man: Point to 'devlink-sb' from 'devlink' man page
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
2016-07-15 11:46:39 -07:00
Ido Schimmel
e3da7a45ba man: Add devlink man pages to Makefile
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
2016-07-15 11:46:39 -07:00
Eli Cohen
d91fb3f4c7 Add support for configuring Infiniband GUIDs
Add two NLA's that allow configuration of Infiniband node or port GUIDs
by referencing the IPoIB net device set over the physical function. The
format to be used is as follows:

ip link set dev ib0 vf 0 node_guid 00:02:c9:03:00:21:6e:70
ip link set dev ib0 vf 0 port_guid 00:02:c9:03:00:21:6e:78

Signed-off-by: Eli Cohen <eli@mellanox.com>
2016-07-15 11:25:36 -07:00
Stephen Hemminger
d5b62e6439 Merge branch 'master' into net-next 2016-07-06 21:29:32 -07:00
David Ahern
0130f0120b ip route: Add support for vrf keyword
Add vrf keyword to 'ip route' commands. Allows:
1. Users can list routes by VRF name:
       $ ip route show vrf NAME

   VRF tables have all routes including local and broadcast routes.
   The VRF keyword filters LOCAL and BROADCAST routes; to see all
   routes the table option can be used. Or to see local routes only
   for a VRF:
       $ ip route show vrf NAME type local

2. Add or delete a route for a VRF:
       $ ip route {add|delete} vrf NAME <route spec>

3. Do a route lookup for a VRF:
       $ ip route get vrf NAME ADDRESS

Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
2016-07-06 21:28:31 -07:00
David Ahern
5db1adae2a ip neigh: Add support for keyword
Add vrf keyword to 'ip neigh' commands. Allows listing neighbor
entries for all links associated with a given VRF.

Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
2016-07-06 21:28:31 -07:00
David Ahern
104444c201 ip link/addr: Add support for vrf keyword
Add vrf keyword to 'ip link' and 'ip addr' commands (common list code).

Allows:
1. Adding a link to a VRF
       $ ip link set NAME vrf NAME

   Removing a link from a VRF still uses 'ip link set NAME nomaster'

2. Showing links associated with a VRF:
       $ ip link show vrf NAME

3. List addresses associated with links in a VRF
       $ ip -br addr show vrf red

Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
2016-07-06 21:28:31 -07:00
Amir Vadai
cfcabf18d8 tc: flower: Add skip_{hw|sw} support
On devices that support TC flower offloads, these flags enable a filter to be
added only to HW or only to SW. skip_sw and skip_hw are mutually exclusive
flags. By default without any flags, the filter is added to both HW and SW,
but no error checks are done in case of failure to add to HW.
With skip-sw, failure to add to HW is treated as an error.

Here is a sample script that adds 2 filters, one with skip_sw and the other
with skip_hw flag.

   # add ingress qdisc
   tc qdisc add dev enp0s9 ingress

   # enable hw tc offload.
   ethtool -K enp0s9 hw-tc-offload on

   # add a flower filter with skip-sw flag.
   tc filter add dev enp0s9 protocol ip parent ffff: flower \
	   ip_proto 1 indev enp0s9 skip_sw \
	   action drop

   # add a flower filter with skip-hw flag.
   tc filter add dev enp0s9 protocol ip parent ffff: flower \
	   ip_proto 3 indev enp0s9 skip_hw \
	   action drop

Signed-off-by: Amir Vadai <amirva@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
2016-07-06 21:24:48 -07:00
Stephen Hemminger
2a5855706a Merge branch 'master' into net-next 2016-07-06 21:23:26 -07:00
Jamal Hadi Salim
1d1e0fd29b actions: skbedit add support for mod-ing skb pkt_type
I'll make a formal submission sans the header when the kernel patches
makes it in. This version is for someone who wants to play around with
the net-next kernel patches i sent

Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
2016-07-06 21:15:44 -07:00
Michal Soltys
509dcd43c9 iproute2: unmangle netdev/my emails in man pages (hfsc, stab)
No other man pages do so, hiding netdev is kind of silly and I don't
mind having my own address normally visible.
2016-07-06 21:07:23 -07:00
Masatake YAMATO
fab3e001fd man: rtacct: add missing TP marker
Signed-off-by: Masatake YAMATO <yamato@redhat.com>
2016-07-06 21:06:33 -07:00
Stephen Hemminger
f62f952fad Merge branch 'master' into net-next 2016-06-30 17:31:37 -07:00
Vivien Didelot
3aa8f8cb7a bridge: man: fix STP LISTENING description
Correct the unclear and poorly conjugated STP LISTENING documentation.

Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
2016-06-30 17:30:02 -07:00
Vivien Didelot
400b5404af bridge: man: fix BPUD typo
s/BPUD/BPDU/ in guard description.

Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
2016-06-30 17:30:02 -07:00
Phil Sutter
577cfe0b67 ip-address: Align type list in help and man page
This adds missing entries on both sides until they are identical.

Signed-off-by: Phil Sutter <phil@nwl.cc>
2016-06-29 09:20:02 -07:00
Stephen Hemminger
131351086e Merge branch 'master' into net-next 2016-06-27 11:30:06 -07:00
David Ahern
2a6f9cfa8b man: ip-link: Add vrf type
Add description for vrf type to ip-link man page.

Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
2016-06-27 10:53:28 -07:00
Vivien Didelot
7fab22abd1 bridge: man: fix "brige" typo
Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
2016-06-27 10:50:37 -07:00
Vivien Didelot
296cee6fdf bridge: vlan: fix a few "fdb" typos in vlan doc
Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
2016-06-27 10:49:50 -07:00