Linux 2.4 Packet Filtering HOWTO 简体中文版(1)

该博客是Linux 2.4 Packet Filtering HOWTO的简体中文版,介绍了在Linux 2.4内核中如何使用iptables过滤不正确的包,还提及了文档的修订信息、译者及感谢人员。

Linux 2.4 Packet Filtering HOWTO 简体中文版

Rusty Russell, mailing list netfilter@lists.samba.org
$Revision: 1.3 $ $Date: 2002/06/05 13:21:56 $
简体中文:洋鬼鬼·NetSnake
感谢 网中人netmanforever@yahoo.com 提供的繁体参照
此文档描述在Linux2.4 内核中,如何使用iptables过滤不正确的包
(译者:Packet在很多专业书籍中译为分组,此处根据大部分人的习惯,仍译为包)

1. 简介
2. 官方站点及邮件列表
3. 那么,什么是Packet Filter?
3.1 我为什么需要Packet Filter?
3.2 如何在Linux下进行包过滤?
3.2.1 iptables
3.2.2 创建永久性规则
4. 你算老几,凭什么玩弄我的内核?
5. Rusty的真正的包过滤快速指南
6. 包是如何穿过过滤器的
7. 使用iptables
7.1 当计算机启动后你会看到的
7.2 对单个规则的操作
7.3 过滤规格
7.3.1 指定源和目的IP地址
7.3.2 反向指定
7.3.3 协议指定
7.3.4 接口指定
7.3.5 分片指定
7.3.6 iptables扩展:新的匹配
7.3.6.1 TCP 扩展
7.3.6.1.1 TCP标志的解释
7.3.6.2 UDP 扩展
7.3.6.3 ICMP扩展
7.3.6.4 其他匹配的扩展
7.3.6.5 状态匹配
7.4 目标规格
7.4.1 用户定义链
7.4.2 iptables扩展:新目标
7.4.3 特殊的内建目标
7.5 对整个链进行操作
7.5.1 创建新链
7.5.2 删除链
7.5.3 清空一个链
7.5.4 对链进行列表
7.5.5 重置(清零)计数器
7.5.6 设置原则(默认规则)
8. 使用ipchains和ipfwadm
9. NAT和包过滤的混合使用
10. iptables和ipchains之间的差别
11. 对制定包过滤器的建议
1. 简介
欢迎,亲爱的读者。
这篇文章假设你知道有关IP地址、网络地址、网络掩码、选路和DNS。如果不知道,我建议你先阅读网络概念的HowTo(Network Concepts HOWTO)。
这篇HOWTO并非一个简要的介绍(会让你发热、发毛,没有安全感),也非一个完全的原始的披露(最吃苦耐劳的人也会被搅晕,不过必定会有所斩获)。
你的网络并不安全。问题在于,必须获取快速、简洁的通讯,但又必须限于良好的、无恶意的行为,就如同在嘈杂的大戏院里,你可以高谈阔论,但是绝不能大喊:着火了!。这篇HOWTO不能解决这种问题。
(译者:所有安全都只是相对的,否则根本不会产生这种东西了)
因此,你只能决定在哪方面妥协。我想帮助你使用一些可用的工具和一些通常需要注意的漏洞,希望你将它们用在好的一面,而不是出于恶意的目的 -- 另一个同样重要的问题。
(C) 2000 Paul `Rusty' Russell. Licenced under the GNU GPL.

2、 官方站点及邮件列表位置
这里有三个官方站点:
o Thanks to Filewatcher http://netfilter.filewatcher.org.
o Thanks to The Samba Team and SGI http://netfilter.samba.org.
o Thanks to Harald Welte http://netfilter.gnumonks.org.
你可以通过以下站点访问全部相关站点。
http://www.netfilter.org and http://www.iptables.org
以下是netfilter官方邮件列表
http://www.netfilter.org/contact.html#list.

3.那么,什么是包过滤器?
包过滤器是这样一种软件:它检查通过的每个包的头部,然后决定如何处置它们。可以这样对待它们:丢弃(也就是说,如果这个包从未被接受,那么丢弃它),通过(也就是说,让包通过),或者更复杂的(操作)。
Linux下,包过滤内建在内核中(内核模块,或者内建),而且我们还有处理包的一些技巧,不过检查头部和处理包的一般性原则仍在这里。

3.1 我为何要包过滤?
控制、安全、警戒。
 
控制:
当你用你的Linux服务器把你的内部网和另一个网络(就是Internet吧)连起来,你可以决定哪些通信是允许的,哪些不允许。例如,包头部包含了包的目标地址,你可以阻碍包发送到(你)确定的几个外部网络,另一个例子,我用NetScape连接到Dilbert archives。页面上有来自doubleclick.net的广告,然后NetScape浪费了我的时间愉快的下载他们。 告诉包过滤器禁止任何来自或者发往doubleclick.net地址的包,问题就解决了。(当然有更好的办法,见Junkbuster)。
 
安全:
当Linux服务器是混乱的Internet和你良好的、有序的网络之间唯一的东西时, 你最好能知道哪些东西可以进入你的大门。例如,你可以允许所有(包)从你的网络 发出,不过你可能会为来自外部的著名的“Ping of Death”而焦急。另一个例子,你不希望 外人telnet到你的Linux服务器,尽管所有账户都有密码。或许你只想(像绝大多数人)成为 Internet的旁观者,而非它的服务器(也可能愿意是吧)。简单的不允许任何人接入,设置 包过滤器拒绝所有进入的包(是不错的办法)。
 
警戒:
有时,本地网络上错误配置的机器可能会向外部喷射出大量的包。最好是当(网络中)出现任何不正常现象时,让包过滤器告诉你。这样你可能可以做点什么,或者你天生就很好奇。

3.2 如何在Linux下进行包过滤?
Linux内核在其1.1系列中就有了包过滤功能。第一代,由Alan Cox 1994年移植于BSD的ipfw。这在Linux 2.0中由Jos Vos和其他人进行了加强;用户空间工具'ipfwadm'可用来控制内核过滤规则。1998年中,我在Michael Neuling的帮助下,为Linux 2.2进行了重写,推出了用户空间工具'ipchains'。最后,1999年中,基于Linux 2.4的第四代工具,'iptables',和其他内核的改写正式推出。这就是这个iptables的HOWTO文档的所在。
译者:userspace根据台湾同胞的说法,是用来区别系统内存中的适用范围的,分为核心空间和使用者空间,不必深究)
你需要包含netfilter架构的内核。netfilter是Linux中的一个通用框架,也可以插入(plug in)其他内容(如iptables模块)。也就是说你需要2.3.15及以后版本,而且在配置内核时对CONFIG_NETFILTER回答'Y'。
iptables这个工具用来和内核交互并告诉它哪些包应该过滤。除非你是程序员或者 特别好奇,否则这就是你用来控制包过滤的了。

3.2.1. iptables
iptables工具向内核的包过滤表中插入和删除规则。这就意味着无论怎样设置,启动后信息都会丢失;请参看“制定永久性规则”(Making Rules Permanent)来确定如何保证下次启动这些规则能被恢复。
iptables是ipfwadm和ipchains的替代品。如果你是它们的使用者,请参看 “使用ipchains和ipfwadm”,如何轻松使用iptables。

3.2.2 创建永久性规则
你当前的防火墙设置保存在内核中,所以重启后就会丢失。你可以试着用iptables-save和iptables-restore脚本来保存他们,并由一个文件恢复。

4. 你算老几,凭什么玩弄我的内核?
我是Rusty Russell。Linux IP防火墙的维护者,也是一个适当的时候出现在适当的地方的coder。我写了ipchains(参见“如何在Linux下进行包过滤?”看看实际的工作其实由哪些人完成),并希望能学到足够的东西修正这次的包过滤。
WatchGuard,一个非常出色的防火墙公司,总之一堆广告,此处省略一千字……
在此,我想澄清一个误解:我不是内核专家,我了解它,是因为我的核心工作让我接触了他们:David S. Miller, Alexey Kuznetsov, Andi Kleen, Alan Cox。无论如何,他们做了最深层的工作,轮到我时,已经非常安全和容易了。

5. Rusty的真正的包过滤快速指南
绝大部分人只有一个PPP连接到Internet,而且不希望有人由此进入他们的网络或者防火墙:
# 插入connection-tracking模块(如国内建在内核中就不需要)
# insmod ip_conntrack
# insmod ip_conntrack_ftp
 
# 对创建大量新的连接创建一个链,除非这些连接来自内部。
# iptables -N block
# iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
# iptables -A block -m state --state NEW -i ! ppp0 -j ACCEPT
# iptables -A block -j DROP
 
# 由INPUT和FORWARD链跳往(刚刚创建的)那条链。
# iptables -A INPUT -j block
# iptables -A FORWARD -j block

6. 包是如何穿过过滤器的
内核由'filter'表中的以下三个规则开始。这些被称为防火墙链或就叫链。这三个链分别是 INPUT、OUTPUT和FORWARD。
对于ASCII艺术迷来说,链好象这样:(注意:这与2.0和2.2内核非常不同)
译者:ASCII艺术,这里指的是利用纯ASCII文本作图
                         _____
  Incoming                 /     /         Outgoing
         -->[Routing ]--->|FORWARD|------->
            [Decision]     /_____/        ^
                 |                        |
                 v                       ____
                ___                     /    /
               /   /                 |OUTPUT|
              |INPUT|                  /____/
               /___/                      ^
                 |                        |
                  ----> Local Process ----
三个圈代表上面说的三个链。当包到达图中的一个圈,那个链就检查并确定包的命运。 如果链决定DROP包,包在那里就被杀死。但是如果链决定让包ACCEPT,包就继续在图中前进。
一个链是规则的列表。每个规则都会说:'如果包头看上去像这个的话,那么就这样处理'。 如果规则和包不匹配,由链中的下一个规则处理。最后,如果再也没有要进行处理的规则了, 内核就根据链的原则(policy,有时称为默认规则)来决定应当如何做。在一个注重安全的 系统中,原则通常是让内核丢弃这个包。
1. 当一个包进入时(就是由以太网卡),内核首先检查包的目的地。这被称作“选路”。
2. 如果它就是进入本机的,包会向图中的下方移动,到达INPUT链。如果到了这里,任何等待这个包的进程都会收到它。
3. 否则,如果内核未被允许转发,或者不知道该如何转发这个包,它会被丢弃。如果允许转发,而且包的目的地是另一个网络接口(如果你有另一个的话),那么包向我们图中的右边行进,到达FORWARD链。如果允许通过(ACCEPT),它就被送了出去。
4. 最后,服务器上运行的程序可以发送网络包。这些包马上通过OUTPUT链。如果被允(ACCEPT),那么包继续向可以到达它的目的地的网络接口发送。

7. 使用iptables
iptables有着非常详尽的使用手册(man iptables),而且如果你需要某个选项更详细的介绍。看看“iptables和ipchains的差别”可能对你非常有用。
使用iptables你可以做很多不同的事。开始的内建的三个链INPUT、OUTPUT和FORWARD是不能被删除的。让我们看看整个链的管理。
1. 创建一个新的链 (-N)。
2. 删除一个空链(-X)。
3.修改内建链的原则(-P)。
4. 显示链中的规则(表)(-L)。
5. 清空一个链(-F)。
6. 将链中所有规则的包和字节计数器清零(-Z)。
有几种办法操作链中的规则:
1. 向链中添加一条新规则(-A)。
2. 在链中某个位置插入一条新规则(-I)。
3. 替换某个位置的规则(-R)。
4. 删除链中某个位置的规则,或者是第一个被匹配的。(-D)。

7.1. 当计算机启动后你会看到的
ptables可以作为模块,称为'iptables_filter.o,可以在第一次运行iptables时自动被装载。也可以永久性的编到内核中。
在所有iptables命令执行之前(当心:某些发布版会在初始化脚本中运行iptables),所有内建链中都没有任何规则('INPUT'、'FORWARD'和'OUTPUT'),所有链的原则都是ACCEPT。你可以在装载iptable_filter模块时,提供'forward=0'选项来修改FORWARD的默认原则。

7.2. 对单个规则的操作
这是基本的包过滤:管理规则,添加(-A)和删除(-D)命令可能是最常用的。其他的(-I插入和-R替换)只是简单的扩展而已。
每个规则都有一组条件来匹配包,和如果匹配了该如何做(target)。例如,你可能希望丢弃所有来自127.0.0.1的ICMP包。这样我们的条件就是协议必须是ICMP,而且源地址必须是127.0.0.1,我们的目标是丢弃(DROP)。127.0.0.1是一个回送接口,即使你没有真正的网络连接它也会存在。你可以用ping程序生成这样的包(它简单的发送ICMP 类型8(echo request),所有愿意响应的主机都会用ICMP 类型0(echo reply)来响应)。这对于测试非常有用。
# ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.2 ms
--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.2/0.2/0.2 ms
# iptables -A INPUT -s 127.0.0.1 -p icmp -j DROP
# ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
--- 127.0.0.1 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
这里,第一个ping是成功的('-c 1'告诉ping只发送一个包)
然后我们可以向'INPUT'链中添加(-A)一个规则,制定来自127.0.0.1('-s 127.0.0.1')的ICMP协议('-p icmp')包都将被丢弃('-j DROP')。
然后我们测试我们的规则,用第二个ping。在程序放弃等待永远不可能的响应之前,会暂停一下。
我们可以用两种办法中的任一种删除规则。首先,因为知道这是INPUT链中唯一的规则,我们用编号删除:
# iptables -D INPUT 1
删除INPUT链中的编号为1的规则
第二种办法是 -A 命令的映射,不过用-D替换-A。当你的链中规则很复杂,而你不想计算它们的编号的时候这就十分有用了。这样的话,我们可以使用:
# iptables -D INPUT -s 127.0.0.1 -p icmp -j DROP
-D的语法必须和-A(或者-I或者-R)一样精确。如果链中有多个相同的规则,只会删除第一个。

7.3 过滤规格
我们已经看了,用'-p'指定协议,用'-s'指定源地址,不过还有其他选项我们可以用来指定包的特征。下面是一个详细的手册。

7.3.1 指定源和目的IP地址
源('-s','--source'或'--src')和目的('-d','--destination'或'--dst')IP地址可以用四种办法指定。最常用的方法是使用全名,就像'localhost'或者'www.linuxhq.com'。第二种办法是指定IP地址,如'127.0.0.1'。
第三和第四种办法允许指定一组IP地址,就像'199.95.207.0/24'或者'199.95.207.0/255.255.255.0'。这指定了从199.95.207.0到199.95.207.255范围内的所有IP地址。'/'后面的数字说明哪部分IP地址是有效的。'32'或者'255.255.255.255‘为默认的(匹配整个IP地址)。用'/0'来指定任何IP地址,像这样:
# '-s 0/0'在这里是多余的
# iptables -A INPUT -s 0/0 -j DROP
这很少用到,这和上面出现过的不指定'-s'结果完全一样。

7.3.2 反向指定
很多标记,包括'-s'(或'--source')和'-d'('--destination')标记可以在前面加上'!'标志(读作'not'),来匹配所有和给出的 NOT 的地址。例如, '-s ! localhost'匹配所有不是来自本机的包。

7.3.3 协议指定
可以用'-p'(或'--protocol')指定协议。协议可以是数字(如果你知道IP的协议数值)或者像'TCP'、'UDP'或者'ICMP'这类的名称。大小写无所谓,所以'tcp'和'TCP'一样。
协议名称前可加上'!',以反向解释它,例如'-p ! TCP'将匹配所有不是TCP的包。

7.3.4 接口指定
'-i'(或'--in-interface')和'-o'(或'--out-interface')选项指定匹配的接口名。接口可以是包进入的('-i')或者送出('-o')的物理设备。你可以用ifconfig命令列出当前'up'的接口。(也就是说正在工作的)。
通过INPUT链的包不会有送出接口,所以在这个链中'-o'永远不会匹配。同样,通过OUTPUT链的包也没有进入接口,这个链中的'-i'也不会被匹配。
只有通过FORWARD链的包才有进入和送出两个接口。
可以指定一个当前不存在的接口。在这个接口可用之前,规则不能匹配任何东西。这对于拨号PPP连接及类似的非常有用(通常是ppp0接口)。
一个特殊情况,接口名后面是一个'+',那就会匹配以这个字符串开头的所有接口(无论当前是否存在)。例如,指定一个匹配所有ppp接口的规则,要用到-i ppp+选项。
接口名也可以在前面插入 '!',来匹配所有与指定接口不同的包,如-i ! ppp+。

Packets to the CPU The device offers tight control of specific types of traffic to be sent to the CPU. In the device architecture, there is no implicit flooding of Unknown Unicast, Multicast, and Broadcast traffic to the CPU port. In addition, Egress Filtering mechanisms (VLAN egress filtering and Spanning Tree state egress filtering) can be applied to packets sent to the CPU port, as well as to any other network egress port. A packet is sent to the CPU as a result of one of the following actions:  Packet is assigned a TRAP command by an ingress processing engine (Section 22.1.5, TRAP Command).Packet is assigned a MIRROR command by an ingress processing engine (Section 22.1.4, MIRROR Command).Packet is assigned a FORWARD command to the virtual CPU ePort 63 by an ingress processing engine (Section 22.1.3, FORWARD Command).Packet is selected for sampling to the CPU by the ingress or egress ePort sampling mechanism (Section 32.3, Traffic Sampling to the CPU).Packet is mirrored to ingress/egress analyzer ePort and the designated analyzer ePort is the virtual CPU ePort. In cascaded topologies, it may not be desirable for packets received on a physical cascade port to be mirrored to the CPU, as this may result in the packet being mirrored to the CPU on each device that it traverses in the cascaded system (refer to Section 11.15.2, Multicast Routing in a Cascaded System). To support such configurations, each physical port can be configured to disable mirroring a packet to the CPU. Configuration  To control the mirroring of packets to the CPU based on physical source port, configure <Port<r*32+27>Duplicate ToCPUEn>– <Port<r*32+0>Duplicate ToCPUEn> field in the Duplication of Packets to CPU Configuration r Register (r=0–3) (Table 801 p. 2732) accordingly.  To control the mirroring of packets to the CPU based on source ePort, configure the <Duplicate To CPU En 1> and the <Duplicate To CPU En 2> field in the EQ Ingress ePort Table (Table 822 p. 2743) accordingly. 23.2.1 CPU Code Assignment Packets sent to the CPU are assigned an 8-bit CPU Code, which indicates the reason the packet is being sent to the CPU. In addition, the CPU Code determines the attributes controlling how the packet is sent to the CPU, according to the CPU Code table (Section 23.2.5, CPU Code Table). Many mechanisms throughout the ingress pipeline can trigger a packet to be sent to the CPU. Most of these mechanisms assign a fixed CPU Code, indicating the mechanism or the event that triggered sending the packet to the CPU. The list of CPU Codes is found in Appendix B, CPU and Drop Codes. In addition to the fixed assigned values, there is also a range of user-defined CPU Codes. For further details, refer to Appendix B, CPU and Drop Codes. When multiple engines assign a packet command MIRROR or TRAP, the packet command and CPU Code is resolved according to the resolution table in Section 22.3, Command Resolution Matrix. Various mechanisms allow the application to assign the CPU Code for the trapped or mirrored packet. Examples of these mechanisms are listed below:  If the Ingress Policy engine Action entry command is TRAP or MIRROR, the Action entry contains the specific user-defined CPU Code to be assigned to the packet (refer to Section 9.9.1, IPCL Action Table).If the Tunnel-Termination-Interface (TTI) engine action entry command is TRAP or MIRROR, the Action entry contains the specific user-defined CPU Code to be assigned to the packet (refer to Section 6.9, TTI Action Entry).  Pre-Egress Application Specific CPU Code assignment (Section 23.2.4, Application-Specific CPU Codes) 翻译并解释
09-20
Home > Operations, Administration, and Maintenance (OAM) Engine > OAM Engine Configuration OAM Engine Configuration The OAM engine configuration requires common infrastructure settings that affect all OAM flows. For each OAM flow, the application must configure the OAM Table attributes that define the flow behavior. This is achieved by setting the fields of the OAM Engine table. This table has 2K rules and it must be partitioned between Ingress and Egress OAM engines. The OAM engine table record is described in the CPSS_DXCH_OAM_ENTRY_STC structure. The flow configuration is described in details in OAM Engine Single Flow Configuration. The OAM engine detects various exceptions. The device also maintains special counters and indications of the exceptions. Exception handling configuration is described in OAM Exception – Configuration, Indications, Counters, and Recovery. Exception recovery is described in Exception Recovery. Using stage Parameter in OAM APIs Most of the CPSS APIs described in this section have a parameter called stage that defines if the API is applicable to either Ingress or Egress OAM processing. The Ingress and Egress processing is defined by the CPSS_DXCH_OAM_STAGE_TYPE_ENT type. To set the OAM processing to Ingress stage, use constant CPSS_DXCH_OAM_STAGE_TYPE_INGRESS_E. To set the OAM processing to Egress stage, use constant CPSS_DXCH_OAM_STAGE_TYPE_EGRESS_E. If the stage parameter is omitted, the API is applicable to both Ingress and Egress stages. OAM Engine Initialization To enable the Ingress or Egress OAM processing, call cpssDxChOamEnableSet. The OAM Engine table has 2K flow entries. The application may need to allocate continuous areas for OAM Ingress and Egress flows in the OAM table. To set the basic flow offset for each stage, call cpssDxChOamTableBaseFlowIdSet. All other OAM APIs rely on this setting for accessing the OAM table. Keepalive Functionality Configuration The OAM engine uses the keepalive daemon for monitoring the connectivity with a peer device. Each flow in the OAM table defines keepalive attributes. The built-in aging daemon applies them. To detect LOC, the daemon uses up to 8 configurable timers. Each timer is used to measure the time between successful keepalive message arrivals. The LOC timeout for a single flow is defined as the number of times the timer elapsed. A keepalive exception is raised if there was no packet for the configured time. Each timer can be set to a different period. Each flow can use any of the 8 timers. To enable keepalive detection on the device, call cpssDxChOamAgingDaemonEnableSet. Set the enable parameter to GT_TRUE to enable the aging daemon. If the daemon is enabled, the periodic keepalive check will be performed on entries according to the aging settings in the OAM Engine table. Otherwise, the Ingress or Egress keepalive check will be globally disabled. The device supports 8 different aging timers per stage to provide a greater granularity. To configure each one of the 8 aging timers, call cpssDxChOamAgingPeriodEntrySet. The timers are configured in units of 40 ns. The applicable range of time units is 0 to 0x3FFFFFFFF. Therefore, the maximal time that can be set equals to ~10 minutes. The timers are referenced in the OAM Table entry field agingPeriodIndex described in LOC Detection Configuration. An application may configure a keep-alive engine to process dropped keep-alive packets. There is a separate configuration for soft-dropped and hard-dropped packets. To enable processing of dropped packets, call cpssDxChOamKeepaliveForPacketCommandEnableSet. Reporting LOC Event Set OAM engine to report LOC events by calling cpssDxChOamAgingBitmapUpdateModeSet with mode set to CPSS_DXCH_OAM_AGING_BITMAP_UPDATE_MODE_ONLY_FAILURES_E. This ensures aging bitmap is updated only upon flow failure. Setting mode to CPSS_DXCH_OAM_AGING_BITMAP_UPDATE_MODE_ALL_E, allows updating aging bitmap to OK as well as to failure. Enabling Protection LOC The OAM Engine can trigger protection switching upon a LOC event. To enable a protection switching update, set the of CPSS_DXCH_OAM_ENTRY_STC, when calling cpssDxChOamEntrySet or cpssDxChOamPortGroupEntrySet. The protection switching configuration is described in Protection Switching. Note that the protection LOC update must be configured in the OAM Engine table at the same row as the row of the LOC table that implements the protection switch. Monitoring Payload In some cases, it is desired to validate the packet payload beyond verifying that the message had arrived with the correct header. The OAM engine provides the ability to monitor the packet payload for correctness. This is implemented by comparing the hashed value calculated for the monitored packet fields with the configured one. The OAM engine can optionally report the changes in the monitored packet data fields. To configure a continuous area of up to 12 bits that will be monitored by the hash mechanism, call cpssDxChOamHashBitSelectionSet. This setting will be used by the OAM engine as described in Packet Header Correctness Detection. OAM Table Related Configuration For a TCAM action to assign a flow ID to an OAM packet, the respective entry in the OAM table requires configuring using the cpssDxChOamEntrySet API. In addition, additional configurations are required for proper processing of OAM packets, as described below. Packet Command Profile Configuration The OAM engine uses the Packet Opcode table to apply commands and set CPU codes for packets trapped to the CPU. To access entries in the Opcode to Packet Command table is a lookup table, use the following two indexes: The 8-bit opcode from the CFM packet header The profile ID – The packetCommandProfile field of CPSS_DXCH_OAM_ENTRY_STC, set by the cpssDxChOamEntrySet API Call cpssDxChOamEntrySet to set the opcodeParsingEnable field of CPSS_DXCH_OAM_ENTRY_STC set to GT_TRUE, in order to enable access to the Opcode to Packet Command table. The contents of the table is a packet command of the CPSS_PACKET_CMD_ENT type, including CPSS_PACKET_CMD_LOOPBACK_E as a possible command. It is recommended to configure the table prior to enabling the OAM functionality. To configure the profile table, call cpssDxChOamOpcodeProfilePacketCommandEntrySet. If the packet command is drop or forward to CPU, cpssDxChOamOpcodeProfilePacketCommandEntrySet is also used to configure the CPU/DROP code to be sent to the CPU. Multicast packets can be automatically assigned (profile ID +1) for accessing the Packet Opcode table. In this way, an application can enable different handling for Multicast and Unicast flows. In order to enable a dedicated profile for Multicast traffic, use cpssDxChOamOpcodeProfileDedicatedMcProfileEnableSet. Dual-Ended Loss Measurement Command To define a packet command for Dual-Ended Loss Measurement packets, call cpssDxChOamDualEndedLmPacketCommandSet. The structure CPSS_PACKET_CMD_END describes the command types. CPU Code Configuration for Trapped Packets All trapped packets contain the CPU code that can be used by the application for further processing. The opcode is constructed dynamically for each packet from 3 configured values as follows: CPU_result_code=<OAM_CPU_Code_Base>+ (OAM_Table_Flow_Cpu_Code_Offset> << 2) + (Opcode_Packet_Command_Table_CPU_Code_Offset) where: OAM_CPU_Code_Base is the value configured by cpssDxChOamCpuCodeBaseSet. OAM Table_Cpu OAM_Table_Flow_Cpu_Code_Offset is the value configured for a specific flow in the OAM Engine table. For more details, see OAM Engine Single Flow Configuration. Opcode_Packet_Command_Table_CPU_Code_Offset is the value from the Opcode to Packet command table to be set by calling cpssDxChOamOpcodeProfilePacketCommandEntrySet. The available CPU code offset constants are defined by the CPSS_NET_RX_CPU_CODE_ENT enumeration type. Timestamp Configuration CPSS provides APIs that enable time stamping in OAM frames and configure the offset where the time stamp must be inserted. To enable time stamping parsing for the incoming frames, call cpssDxChOamTimeStampParsingEnableSet. To configure Ethertype to be inserted into outgoing DM frames, call cpssDxChOamTimeStampEtherTypeSet. Timestamping can be done anywhere within OAM packets using the PTP Timestamp table. To insert a timestamp: Call cpssDxChOamEntrySet to set the timestampEnable and oamPtpOffsetIndex fields of CPSS_DXCH_OAM_ENTRY_STC. If the packet is not DM, turn off (set to GT_FALSE) opcodeParsingEnable. Call cpssDxChPtpTsCfgTableSet to configure the entry of index oamPtpOffsetIndex from Step 1. Set the entry of type CPSS_DXCH_PTP_TS_CFG_ENTRY_STC to be used as a parameter of cpssDxChPtpTsCfgTableSet to: tsMode = CPSS_DXCH_PTP_TS_TIMESTAMPING_MODE_DO_ACTION_E Set tsAction of type CPSS_DXCH_PTP_TS_ACTION_ENT to the required timestamp type, for example CPSS_DXCH_PTP_TS_ACTION_ADD_INGRESS_TIME_E packetFormat = CPSS_DXCH_PTP_TS_PACKET_TYPE_Y1731_E ptpTransport = CPSS_DXCH_PTP_TRANSPORT_TYPE_ETHERNET_E Set L3 offset of timestamp insertion Packet to Opcode Table Usage Some OAM packets are processed as known types of OAM messages (LM, DM, CCM Keep Alive). OAM types with dedicated processing are listed in CPSS_DXCH_OAM_OPCODE_TYPE_ENT. Packet are classified by opcode-matching with predefined OAM opcode types listed in the Opcode table. Upon finding an opcode match, an internal OAM process (not an OAM Action) is triggered. Call cpssDxChOamOpcodeSet to set the table per stage and per OAM opcode type (keepalive message, LM, DM).it triggers The following figure illustrates the common format for all OAM PDUs. Figure 299: Common OAM PDU Format Set opcodeType to CPSS_DXCH_OAM_OPCODE_TYPE_LM_SINGLE_ENDED_E to configure opcode for the single-ended LM opcode. Set opcodeType to CPSS_DXCH_OAM_OPCODE_TYPE_LM_DUAL_ENDED_E to define an opcode for dual-ended loss measurement. Set opcodeType to CPSS_DXCH_OAM_OPCODE_TYPE_KEEPALIVE_E to define an opcode for keepalive monitoring. Note, that if the opcode does not match CPSS_DXCH_OAM_OPCODE_TYPE_DM_E, even though opcode parsing is enabled and timestampEnable is set, no timestamp is added to the packet. Each flow in the OAM table is configured to either attempt opcode matching or skip it. To enable OAM Engine matching of packet opcode to a configured one, call cpssDxChOamEntrySet, and set the field opcodeParsingEnable in CPSS_DXCH_OAM_ENTRY_STC. Loss Measurements Configuration – Destination Offset There is a special LM Offset table that contains a packet destination offset. The OAM engine accesses the LM Offset table to determine the offset in the packet and insert the LM counters data. This table is accessed according to the index configured in the OAM Engine table, as described in Loss Measurements (LM) Configuration. To configure the LM Offset table, call cpssDxChOamLmOffsetTableSet. The parameter entryIndex defines the table row. The parameter offset contains the offset value. IETF MPLS-TP OAM Support The OAM engine determines the packet command according to 8-bit opcode values retrieved from OAM packets. However, in the MPLS TP, the OAM is represented by a 16-bit MPLS Control Word value. The device provides a flexible way of mapping MPLS -TP Control Word to 8-bit opcode values used by the OAM engine. This is done by using 16 profiles. To map an MPLS Channel Type to a profile, call cpssDxChOamMplsCwChannelTypeProfileSet. To configure mapping profiles, call cpssDxChPclOamChannelTypeProfileToOpcodeMappingSet. OAM Exception – Configuration, Indications, Counters, and Recovery Exception Overview There are 7 OAM exceptions that may occur during OAM processing. Keepalive Aging Exception – Occurs when OAM flows age out and Loss of Continuity occurs. Excess Keepalive Exception – Occurs when an excess number of keepalive messages is received in one of the flows. RDI Status Exception – Occurs when an OAM message is received with an RDI value that is different than the current RDI status of the corresponding OAM Table entry. Tx Period Exception – Occurs when the transmission period of an OAM message differs from the configured transmission period in the corresponding OAM Table entry. Invalid Keepalive Exception – Occurs when the hash verification of a received OAM packet fails. MEG Level Exception – Occurs when the MEG Level of the received OAM message is lower than expected. Source Interface Exception – Occurs when the source interface of the OAM message is different from the one expected. The device also maintains a summary exception indication. It is set if any of the above exceptions occurs. The CPSS_DXCH_OAM_EXCEPTION_TYPE_ENT type must be used to define the exception type in any of the exception related APIs described in this section. Exception Action Configuration CPSS provides an API that defines the command to apply on a packet upon exception and the data to forward to the CPU if CPU TRAP was asserted upon exception. To bind a command and the CPU code to an exception, call cpssDxChOamExceptionConfigSet. The structure CPSS_DXCH_OAM_EXCEPTION_CONFIG_STC defines the command and CPU data for each exception. The commands to apply on the packet upon exception are listed by CPSS_PACKET_CMD_ENT. The codes to pass to the CPU are listed by CPSS_NET_RX_CPU_CODE_ENT. Exception Counters Access The device maintains counters for each exception type at the device level (cumulative counter for exceptions that occurred in all 2K flows). Call cpssDxChOamExceptionCounterGet to obtain the current value of the device level exception counter for the specified exception type. Note, the exception counters are not cleared on read, and wrap around upon reaching the maximal value (232-1). Counter types are listed by CPSS_DXCH_OAM_EXCEPTION_TYPE_ENT. Exception Recovery At times, exception state toggles from Fail to Pass. In such cases, it is possible to assign a pre-configured Recovery Packet Command and CPU/drop code to the packet that triggered the state change. This allows notifying the application of flow recovery by assigning a MIRROR command to the packet. To achieve that, call cpssDxChOamExceptionRecoveryConfigSet with exceptionCommandPtr (CPSS_DXCH_OAM_EXCEPTION_COMMAND_CONFIG_STC) set to the desired exception recovery configuration per the specified exception type and OAM direction/stage (ingress/egress). Exception Storm Suppression This section is applicable for Falcon family of devices CPSS allows suppressing exception storms for OAM exceptions, though it is possible to still assign command and CPU code (the latter, for packets marked as TO CPU) to the respective packets. To suppress exception storm for exceptions: Enable exception suppression for the desired exception type in the relevant OAM table entry (CPSS_DXCH_OAM_ENTRY_STC). The following fields are available: Keepalive aging – keepaliveAgingStormSuppressEnable Invalid keepalive hash – invalidHashKeepaliveStormSuppressEnable MEG level – megLevelStormSuppressEnable Source interface – sourceInterfaceStormSuppressEnable Tx period – txPeriodStormSuppressEnable NOTE: For explanation on each of these exception types, see OAM Exception – Configuration, Indications, Counters, and Recovery. Call cpssDxChOamExceptionSuppressConfigSet with exceptionCommandPtr (CPSS_DXCH_OAM_EXCEPTION_COMMAND_CONFIG_STC) set to the desired packet OAM handling configuration per the specified exception type and OAM direction/stage (ingress/egress). Exception Status Indication The device maintains 2 structures per each exception type—the device exception status vector, and flows exception status table. Device Exception Status Access The device exception status vector has 64 bits where each bit represents the cumulative exception status of 32 consecutive flows. For example, if bit 3 is set to 1, there is an exception in one of the flows, from flow 96 up to flow 127. To read the device exception status vector of all 2K flows, call cpssDxChOamExceptionGroupStatusGet. Set the exceptionType parameter to indicate the required exception type. Single-Flow Exception Status Access For each of the above exceptions, the device maintains an exception status indications table. The exception status indication table has 64 rows. Each row has 32 bits—one bit per OAM flow. When an exception occurs for flow i, the OAM engine sets bit i in the corresponding exception table row. Figure 300: Calculation of Flow ID with Exception To get the status of 32 flow exceptions, call cpssDxChOamExceptionStatusGet and provide the exception type and row index that contains the required flow exception. The cpssDxChOamExceptionGroupStatusGet API provides the row IDs to be used as inputs to cpssDxChOamExceptionStatusGet. In Falcon devices, obtain the exception status by calling cpssDxChOamPortGroupEntryGet. To detect which flow caused the exception, call cpssDxChOamExceptionGroupStatusGet. The indexes to set bits in the returned vector groupStatusArr must be used as input parameters to cpssDxChOamExceptionStatusGet. An example shown in the previous figure explains how to calculate the flow ID that caused the exception. OAM Engine Single Flow Configuration The OAM engine provides building blocks to implement any of the CFM protocols defined by the Ethernet OAM standards 802.1ag/Y.1731, MPLS OAM ITU-T Y.1711 standard, and others. The CFM supports 3 protocols with 3 message types: Linktrace Protocol with Linktrace Message (LTM) Continuity Check Protocol with Continuity Check Message (CCM) Loopback Protocol with Loopback Message LBM The standards also introduce the requirements for filtering CFM messages, Delay Measurements (DM) and Loss Measurements (LM) as well as for sending and detecting indications of local alarms. (RDI). The above requirements can be supported by configuring the entry in OAM Engine table. To configure an OAM Engine table entry, call cpssDxChOamEntrySet or cpssDxChOamPortGroupEntrySet. All the settings are configured through the CPSS_DXCH_OAM_ENTRY_STC structure field. The fields described in this section are assumed to be members of this structure. The OAM Engine table is configured for each OAM flow and consists of the following: OAM Packet Parsing MEG Level Filtering Configuration Source Interface Filtering Configuration Keepalive Monitoring Configuration Delay Measurement (DM) Configuration Loss Measurements (LM) Configuration OAM Packet Parsing Set opcodeParsingEnable to GT_TRUE to use the packet Opcode to determine the packet command. This field is typically enabled for OAM flows of the 802.1ag / Y.1731 / MPLS-TP OAM, and is typically disabled for flows of other OAM protocols, such as BFD or Y.1711. If set, the packet command is determined using the Opcode-to-packet-command table. For the LM and DM processing, set this field to apply the LM and DM actions only to packets with opcode that matches the configured opcodes. If opcodeParsingEnable is not set, the DM or LM action is applied to any packet that passes the TTI or PCL classification and is referred to OAM processing. For details on the DM processing, see Delay Measurement (DM) Configuration. For details on the LM processing, see Loss Measurements (LM) Configuration. MEG Level Filtering Configuration The IEEE 802.1ag l standard specifies that OAM messages of the level below the level configured must be dropped. In the following example, the device is configured to process OAM packets for portId =5, MEG level =3 and VID =10. Packets with MEG levels 0,1, and 2 must be dropped while packets with levels above 3 must be forwarded. Set the megLevelCheckEnable parameter to GT_TRUE to enable MEG filtering. Set megLevel = 3. CFM packets from any MEG level for port 0 and VID =10 will be classified for the OAM engine. The OAM engine will drop all packets below level 3 while the CFM frames above level 3 will be forwarded. The CFM packets of MEG level 3 will undergo OAM processing according to the Opcode to Packet command mapping table configuration. The MEG Level exception occurs when the MEG level of the received OAM message is lower than expected. Multiple MEG Level Filtering The same IEEE 802.1ag standard specifies that multiple MEG levels may be defined for a single interface. The following example explains how to configure 2 separate Maintenance Points (MP). There are 2 MP for the same service—one at level (3) and another one at Level (5). Port=0, VID=7, MEG Level=3 Port=0, VID=7, MEG Level=5 In this case, 2 separate OAM Table entries are created, one for each of these MPs: The first entry must not perform MEG filtering. megLevelCheckEnable = GT_FALSE The second entry – filtering enabled for MEG Level=5. megLevelCheckEnable = GT_TRUE megLevel = 5 Two corresponding TCAM rules are created for these flows: (either in the TTI or in the PCL) First rule – EtherType=CFM, Port=0, VID=7, MEG Level=3. Second rule (must appear after the first one) – EtherType=CFM, Port=0, VID=7, MEG Level=* The first rule binds the OAM flow with MEG Level=3 to the corresponding OAM entry. The second rule binds the OAM flow to the second OAM entry, resulting in a MEG Level filtering. The OAM packets with MEG level 3 will be matched by the first TCAM entry and will be processed by the OAM engine’s first rule. The other OAM packets with MEG levels other than 3 will be matched by the second TCAM rule, and will be processed by the second OAM entry. Thus, the following MEG Levels are dropped: 0, 1, 2, 4, while all packets in MEG Levels above 5 are forwarded. Source Interface Filtering Configuration Source interface filtering is defined in IEEE 802.1ag. The device can be configured to detect source interface violations. The Source Interface exception occurs when the source interface of the OAM message is different than the one configured, as explained further. If classification rules do not use the source interface as the classification parameter, the OAM frames may arrive from different interfaces. Set sourceInterfaceCheckEnable to enable source interface filtering. Set sourceInterface to define the filtering interface. To enable packet filtering from any port except for the configured one, set sourceInterfaceCheckMode to CPSS_DXCH_OAM_SOURCE_INTERFACE_CHECK_MODE_MATCH_E. Set sourceInterfaceCheckMode to CPSS_DXCH_OAM_SOURCE_INTERFACE_CHECK_MODE_NO_MATCH_E to raise an exception if an OAM packet arrives from the interface other than the one set in the sourceInterface field. Multiple Interface Filtering It is possible to configure filtering of multiple interfaces on the same device. Multiple MEPs can be defined within a single switch, with the same VID and MEG level, but with different interfaces. The following example shows how to configure processing of OAM packets from 2 different interfaces, while dropping OAM packets from any other interface. For example, 2 separate Down Maintenance Points (MP) may be defined as follows: ePort=0, VID=7, MEG Level=3 ePort=1, VID=7, MEG Level=3 In this case, 2 separate OAM Table entries are created, one for each of these MPs. First entry – the set source interface filtering is disabled. sourceInterfaceCheckEnable = GT_FALSE; Second entry – source interface filtering is enabled in the following way: sourceInterfaceCheckEnable = GT_TRUE; sourceInterface.portNum = 1; sourceInterfaceCheckMode = CPSS_DXCH_OAM_SOURCE_INTERFACE_CHECK_MODE_MATCH_E; Two corresponding TCAM rules are created for these flows (either in TTI or PCL). First rule – EtherType=CFM, ePort=0, VID=7. Second rule (must appear after the first one) – EtherType=CFM, ePort=*, VID=7. The first rule binds the OAM flow with ePort=0 to the corresponding OAM entry. The second rule binds the OAM flow to the second OAM entry, resulting in a source interface filtering. Thus, OAM packets with VID=7 from ePorts 0 or 1 are not dropped, while packets from other ports are dropped. Keepalive Monitoring Configuration Keepalive monitoring provides the following configurable functionalities: LOC Detection Configuration Packet Header Correctness Detection Excess Keep Alive Message Detection LOC Detection Configuration To define the keepalive timeout for the flow, set the agingPeriodIndex field to point to one of the 8 aging timers described in Keepalive Functionality Configuration. Set the agingThreshold field to configure the number of periods of the selected aging timer. LOC is detected if there is no CCM packet during the time period defined by agingThreshold. The Keepalive Aging exception occurs when an OAM flow ages out and LOC occurs. To configure the LOC timeout period for 100 ms using the aging timer of 1 ms, set agingThreshold =100. The Keepalive exception occurs if a message does not arrive within 100 ms. Packet Header Correctness Detection The device can be configured to detect the correctness of a packet header. Set the hashVerifyEnable field to enable detection. If enabled, the packet header is verified against the hash value that is set in the flowHash field. This field can be either configured by an API or can be dynamically set, according to the first OAM packet, by the device. To use the configured value, set the lockHashValueEnable field to GT_TRUE. Otherwise, the OAM engine will control this field. The packet header correctness check is based on monitoring a 12-bit hash value out of the 32-bit hash value computed by the hash generator. To select packet fields and a hash method, see Hash Modes and Mechanism. The configuration of a continuous area of up to 12 bits that will be monitored by the hash mechanism is described in Monitoring Payload. Excess Keep Alive Message Detection The OAM engine can be configured to detect excess keep alive messages. The excess keep alive detection algorithm causes the exception if for the configured detection time the expected number of keep alive messages is above the threshold. Set excessKeepaliveDetectionEnable to detect excess keepalive messages. To configure the detection time, set excessKeepalivePeriodThreshold to the number of aging timer periods and excessKeepaliveMessageThreshold to the minimal number of messages expected during the configured period. The Excess Keepalive exception occurs when an excess number of keepalive messages is received. Set the following fields to detect excess keepalive frames in 100 ms, using a minimal amount of messages (4), if the aging timer is configured to period of 1 ms. excessKeepalivePeriodThreshold =100; excessKeepaliveMessageThreshold =4; The OAM engine may be set to compare the period of received keepalive packets with the configured one. To enable this check, set the periodCheckEnable field and set the expected period in the keepaliveTxPeriod field. The Tx Period exception occurs when the transmission period of an OAM message differs from the configured transmission period in the corresponding OAM Table entry. RDI Check Configuration The OAM engine can be configured to compare the RDI field in the packet to the configured one in the OAM engine table. To enable this check, set the rdiCheckEnable field. The RDI check is performed only if the keepaliveAgingEnable field is set. The OAM Engine monitors the RDI bit that was extracted into UDB according to the profile. The expected location RDI must be set by calling cpssDxChPclOamRdiMatchingSet. The RDI Status exception occurs when an OAM message is received with an RDI value that is different than the current RDI status of the corresponding OAM Table entry. Delay Measurement (DM) Configuration The OAM Engine provides a convenient way to configure time stamping for implementing an accurate delay measurement functionality. The device maintains an internal Time of Day (ToD) counter that is used for time stamping. This ToD counter can be synchronized to a network Grandmaster clock using the Precision Time Protocol (PTP) or to a time server using the Network Time Protocol (NTP). For details on synchronizing the ToD, see Time Synchronization and Timestamping. The OAM engine uses the offset table defined in Time Synchronization and Timestamping to read the offset of the packet in which the time stamp must be inserted. The OAM Engine entry is configured with the index to the offset table. To enable time stamping in the OAM packets serviced by a flowId entry of the OAM engine, call cpssDxChOamEntrySet and set following fields: Set the opcodeParsingEnable field to GT_TRUE Set the timestampEnable field to GT_TRUE. Configure the offset of the packet where the time stamp is copied by setting the offsetIndex field to point to the offset table with the configured offset. The time stamping will be performed only for packets with an opcode matched to one of the 16 opcodes available in the DM Opcodes table. To configure 16 DM opcodes, call cpssDxChOamOpcodeSet. Set the opcodeType parameter to CPSS_DXCH_OAM_OPCODE_TYPE_DM_E and set 16 DM opcodes in opcodeValue. The opcodeIndex parameter defines the required index in the DM opcodes table. If opcodeParsingEnable is set to GT_FALSE, the timestamps are set to any packet classified to the OAM flow. Loss Measurements (LM) Configuration Loss Measurement (LM) is performed by reading billing and policy counters and inserting them into OAM frames. All the service counters are assigned using the TTI or PCL classification rules, as defined in a. The TTI, IPCL, or EPCL engine rules must be set to bound the traffic to counters. Only a green conforming counter out of 3 billing counters is used for LM. For more details on configuring counters in the TTI engine, see TTI Rules and Actions. For more details on configuring counters in a PCL lookup, see Policy Action. An OAM Engine Table rule defines where to insert LM counters into a frame. The OAM engine maintains a table that allows setting LM values into a different offset depending on the packet opcode. The LM configuration is explained in detail further in this section. The OAM packets are identified and classified into flows in the TTI (see TTI Rules and Actions). The relevant rule action must have the following fields set: oamProcessEnable + flowId – Bind the packet to a specific entry in the OAM table. bindToPolicer – This field must be enabled in the action entry if LM counting is enabled for this flow. policerIndex – Specifies the index of the LM counting entry when Bind To Policer Counter is set. To bind the Policer counter to the OAM, call cpssDxChPclRuleSetas defined in Policy Action. To define LM counting, call cpssDxChOamEntrySet and set following fields in structure CPSS_DXCH_OAM_ENTRY_ST: To enable counting of OAM packets in LM, set lmCountingMode = CPSS_DXCH_OAM_LM_COUNTING_MODE_ENABLE_E. To insert an Egress counter into the packet as defined in the LM table, set the lmCounterCaptureEnable to GT_TRUE. To define an offset for inserting the LM data, set offsetIndex to point to the LM Offset table (see Loss Measurements Configuration – Destination Offset). CPU Code Offset Configuration To configure the value to be added to the CPU code value for packets trapped or mirrored to the CPU, configure the cpuCodeOffset field. Copyright© 2025 Marvell Confidential Doc. No. MV-S800962-00 Last Modified:
10-21
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值