Configuring udf flow
- Tracy Yang (Unlicensed)
Abstract
The goal is to be able to add flows which utilizes the udf (User defined filter) function of the hardware.
As hardware cannot parse the L3 protocol of an mpls packet, we can not match both mpls labels and transport layer ports. But we can do this by utilizing the udf function of hardware. The udf allow us to match 4 bytes of content at the given offset of the L2 header of the L3 header. The L2 header refers to the mac header of frame, and the L3 header refers to the first mpls lable of mpls frame or IP header of the non-mpls frame (in other words the header next to the inner VLAN tag).
Due to the limitation of the hardware, we only support 4 fields of udf. The max number of udf flows share the same limitation of normal tcam flows.
Note:
Only untag packets can be matched when configure udf base L2 and L3 at the same time.
Example 1
Send IP packets with dl_dst 22:22:22:22:22:22, dl_src 22:11:11:11:11:11, tag 1000.
And we want to match this tag.
Step1: Create a new bridge named br0
admin@PicOS-OVS$ovs-vsctl add-br br0 -- set bridge br0 datapath_type=pica8
Step 2: Add ports to br0
admin@PicOS-OVS$ovs-vsctl add-port br0 te-1/1/1 vlan_mode=trunk tag=1 -- set Interface te-1/1/1 type=pica8 admin@PicOS-OVS$ovs-vsctl add-port br0 te-1/1/2 vlan_mode=trunk tag=1 -- set Interface te-1/1/2 type=pica8
Step 3: Configure udf and add flow
ovs-vsctl set-udf-mode "udf0(l2,offset=12,length=4)" ovs-ofctl add-flow br0 table=250,in_port=1,udf0=0x810003E8/0x0000ffff,actions=2
Step 4: Check table
admin@PicOS-OVS$ovs-vsctl show-udf-mode udf mode is udf0(l2,offset=12,length=4) admin@PicOS-OVS$ admin@PicOS-OVS$ovs-ofctl dump-flows br-vi OFPST_FLOW reply (OF1.4) (xid=0x2): cookie=0x0, duration=25.315s, table=250, n_packets=n/a, n_bytes=0, in_port=4,udf0=0x3e8/0xffff actions=output:5 admin@PicOS-OVS$ admin@PicOS-OVS$ovs-appctl pica/dump-flows #1 udf permanent recirc_id=0,in_port=4,udf0=0x3e8/0xffff, actions:5 #0 normal permanent priority=0,recirc_id=0, actions:drop Total 2 flows in HW. admin@PicOS-OVS$
Example 2
Send IP packets with dl_dst 22:22:22:22:22:22, dl_src 22:11:11:11:11:11,ip_src=192.168.200.100,ip_dst=192.168.100.100,tp_src=2002,tp_dst=3003,mpls_label=666;
And we want to match mpls_label and tp_src:
Step1: Create a new bridge named br0
admin@PicOS-OVS$ovs-vsctl add-br br0 -- set bridge br0 datapath_type=pica8
Step 2: Add ports to br0
admin@PicOS-OVS$ovs-vsctl add-port br0 te-1/1/1 vlan_mode=trunk tag=1 -- set Interface te-1/1/1 type=pica8 admin@PicOS-OVS$ovs-vsctl add-port br0 te-1/1/2 vlan_mode=trunk tag=1 -- set Interface te-1/1/2 type=pica8
Step 3: Configure udf and add flow
ovs-vsctl set-udf-mode "udf0(l3,offset=0,length=4), udf1(l3,offset=24,length=2)" ovs-ofctl add-flow br0 table=250, in_port=1,udf0=0x0029a140/0xfffff000,udf1=0x07d2,actions=2
Note:
1. Offset needs to be aligned on 4 bytes and less than or equal to 124, length is less than or equal to 4.
2. (base, offset, length) defines one field of udf. Base refers to L2 or L3. Due to hardware limitations, we only support 4 fields of udf. But the max number of udf flows share the same limitation of normal tcam flows. L2 fields must be placed before L3 fields, and fields are in ascending order of offset with no overlapping of each other.
3. In the udf table, we can only use udf match format. We can not use both OXM (OpenFlow Extensible Match) and udf format in the same flow.
4. Flows in other tables can not use goto action with a udf table, and udf tables do not support goto action either, supporting output and drop actions,and from version 2.6.4,udf actions also support set_queue,meter and normal.
5. All udf flows will have higher priority than all the other tcam flows.
6. Adding udf flows will return errors, when there are arp or mpls flows in hardware already; also arp or mpls flows will return an error when there are udf flows in the hardware table already.
7. When adding udf flows, table=250 in match field is needed.
8. User cannot enable udf mode and match mode at the same time.
UDF L4
From PicOS2.8.0, picos support UDF offset from L4. The L4 header refers to L4 protocol ports, such as tcp or udp.
For example:
Send packets with：
dl_dst=22:22:22:22:22;22,dl_src=22:11:11:11:11:11, dl_vlan=199,nw_dst=1.1.1.1,nw_src=2.2.2.2,udp,udp_src=1234,udp_dst=5678
And we will match udp source port and destination port with udf.
Configure udf:
admin@PicOS-OVS$ovs-vsctl set-udf-mode "udf0(l4,offset=0,length=4)"
Add flow.
admin@PicOS-OVS$ovs-ofctl add-flow br0 in_port=1,table=250,udf0=0x04d2162e,actions=2
Macro UDF
From PicOS2.8.0, support a new format to add udf flow entry. Different from previous use (base, offset, length) to configure udf, user can use udf fields to configure it now.
1)Show all udf field.
admin@PicOS-OVS$ovs-vsctl show-udf-field
Udf support fields:
Match field layer Offset Length
------------------------------------------------------------
dl_type l2 12 2
vlan_inner l2 16 4
mpls_outermost l3 0 4
ip_src l3 12 4
ip_dst l3 16 4
l2gre_key l3 24 4
l2gre_ip_src_high l3 52 4
l2gre_ip_src_low_dst_high l3 56 4
l2gre_ip_dst_low l3 60 2
l2gre_ip_src_high_tag l3 56 4
l2gre_ip_src_low_dst_high_tag l3 60 4
l2gre_ip_dst_low_tag l3 64 2
l4_port l4 0 4
vxlan_vni l4 12 3
vxlan_ip_src_high l4 40 4
vxlan_ip_src_low_dst_high l4 44 4
vxlan_ip_dst_low l4 48 2
vxlan_ip_src_high_tag l4 44 4
vxlan_ip_src_low_dst_high_tag l4 48 4
vxlan_ip_dst_low_tag l4 52 2
admin@PicOS-OVS$
2)configure macro udf.
admin@PicOS-OVS$ovs-vsctl set-macro-udf dl_type,ip_src,ip_dst
The match field can be any field in show-udf-field.
3)show udf mode.
admin@PicOS-OVS$ovs-vsctl show-udf-mode
or:
admin@PicOS-OVS$ovs-vsctl show-macro-udf
For example:
We will match vxlan vni for sending vxlan packets with vni=1122867.
1)Configure macro udf.
admin@PicOS-OVS$ovs-vsctl set-macro-udf vxlan_vni admin@PicOS-OVS$ admin@PicOS-OVS$ovs-vsctl show-udf-mode udf mode is udf0(l4,offset=12,length=3) admin@PicOS-OVS$ovs-vsctl show-macro-udf macro udf mode is vxlan_vni : udf0(l4,offset=12,length=3) admin@PicOS-OVS$
2)Add flow to macth vni.
admin@PicOS-OVS$ovs-ofctl add-flow br0 table=250,udf0=0x112233,actions=3
1.l4 can not work with l2/l3.
2.If you want to configure l2 and l3 udf at the same time, the matched packets must be untag packets.
3.It cannot match the tag value which packets have one tag using macro udf.
UDF on TD3
Three commands you can use to show and set udf.
|
On trident3 platforms, using "ovs-vsctl show-udf-base" will show udf_v2 base types.
root@PICOS-OVS:~# ovs-vsctl show-udf-base |
Users can set udf mode using command "ovs-vsctl set-udf-mode "udf0(base=2,offset=0,length=2)"",on td3 support 10 base ids. According to above descriptions of each base id to set the udf mode you need.
Copyright © 2024 Pica8 Inc. All Rights Reserved.