target/linux/generic/backport-5.10/610-v5.13-22-netfilter-flowtable-add-pppoe-support.patch

   1 From: Pablo Neira Ayuso <pablo@netfilter.org>
   2 Date: Wed, 24 Mar 2021 02:30:43 +0100
   3 Subject: [PATCH] netfilter: flowtable: add pppoe support
   4
   5 Add the PPPoE protocol and session id to the flow tuple using the encap
   6 fields to uniquely identify flows from the receive path. For the
   7 transmit path, dev_hard_header() on the vlan device push the headers.
   8
   9 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  10 ---
  11
  12 --- a/net/netfilter/nf_flow_table_ip.c
  13 +++ b/net/netfilter/nf_flow_table_ip.c
  14 @@ -7,6 +7,9 @@
  15  #include <linux/ip.h>
  16  #include <linux/ipv6.h>
  17  #include <linux/netdevice.h>
  18 +#include <linux/if_ether.h>
  19 +#include <linux/if_pppox.h>
  20 +#include <linux/ppp_defs.h>
  21  #include <net/ip.h>
  22  #include <net/ipv6.h>
  23  #include <net/ip6_route.h>
  24 @@ -139,6 +142,8 @@ static bool ip_has_options(unsigned int
  25  static void nf_flow_tuple_encap(struct sk_buff *skb,
  26                                 struct flow_offload_tuple *tuple)
  27  {
  28 +       struct vlan_ethhdr *veth;
  29 +       struct pppoe_hdr *phdr;
  30         int i = 0;
  31
  32         if (skb_vlan_tag_present(skb)) {
  33 @@ -146,11 +151,17 @@ static void nf_flow_tuple_encap(struct s
  34                 tuple->encap[i].proto = skb->vlan_proto;
  35                 i++;
  36         }
  37 -       if (skb->protocol == htons(ETH_P_8021Q)) {
  38 -               struct vlan_ethhdr *veth = (struct vlan_ethhdr *)skb_mac_header(skb);
  39 -
  40 +       switch (skb->protocol) {
  41 +       case htons(ETH_P_8021Q):
  42 +               veth = (struct vlan_ethhdr *)skb_mac_header(skb);
  43                 tuple->encap[i].id = ntohs(veth->h_vlan_TCI);
  44                 tuple->encap[i].proto = skb->protocol;
  45 +               break;
  46 +       case htons(ETH_P_PPP_SES):
  47 +               phdr = (struct pppoe_hdr *)skb_mac_header(skb);
  48 +               tuple->encap[i].id = ntohs(phdr->sid);
  49 +               tuple->encap[i].proto = skb->protocol;
  50 +               break;
  51         }
  52  }
  53
  54 @@ -228,17 +239,41 @@ static unsigned int nf_flow_xmit_xfrm(st
  55         return NF_STOLEN;
  56  }
  57
  58 +static inline __be16 nf_flow_pppoe_proto(const struct sk_buff *skb)
  59 +{
  60 +       __be16 proto;
  61 +
  62 +       proto = *((__be16 *)(skb_mac_header(skb) + ETH_HLEN +
  63 +                            sizeof(struct pppoe_hdr)));
  64 +       switch (proto) {
  65 +       case htons(PPP_IP):
  66 +               return htons(ETH_P_IP);
  67 +       case htons(PPP_IPV6):
  68 +               return htons(ETH_P_IPV6);
  69 +       }
  70 +
  71 +       return 0;
  72 +}
  73 +
  74  static bool nf_flow_skb_encap_protocol(const struct sk_buff *skb, __be16 proto,
  75                                        u32 *offset)
  76  {
  77 -       if (skb->protocol == htons(ETH_P_8021Q)) {
  78 -               struct vlan_ethhdr *veth;
  79 +       struct vlan_ethhdr *veth;
  80
  81 +       switch (skb->protocol) {
  82 +       case htons(ETH_P_8021Q):
  83                 veth = (struct vlan_ethhdr *)skb_mac_header(skb);
  84                 if (veth->h_vlan_encapsulated_proto == proto) {
  85                         *offset += VLAN_HLEN;
  86                         return true;
  87                 }
  88 +               break;
  89 +       case htons(ETH_P_PPP_SES):
  90 +               if (nf_flow_pppoe_proto(skb) == proto) {
  91 +                       *offset += PPPOE_SES_HLEN;
  92 +                       return true;
  93 +               }
  94 +               break;
  95         }
  96
  97         return false;
  98 @@ -255,12 +290,18 @@ static void nf_flow_encap_pop(struct sk_
  99                         __vlan_hwaccel_clear_tag(skb);
 100                         continue;
 101                 }
 102 -               if (skb->protocol == htons(ETH_P_8021Q)) {
 103 +               switch (skb->protocol) {
 104 +               case htons(ETH_P_8021Q):
 105                         vlan_hdr = (struct vlan_hdr *)skb->data;
 106                         __skb_pull(skb, VLAN_HLEN);
 107                         vlan_set_encap_proto(skb, vlan_hdr);
 108                         skb_reset_network_header(skb);
 109                         break;
 110 +               case htons(ETH_P_PPP_SES):
 111 +                       skb->protocol = nf_flow_pppoe_proto(skb);
 112 +                       skb_pull(skb, PPPOE_SES_HLEN);
 113 +                       skb_reset_network_header(skb);
 114 +                       break;
 115                 }
 116         }
 117  }
 118 --- a/net/netfilter/nft_flow_offload.c
 119 +++ b/net/netfilter/nft_flow_offload.c
 120 @@ -90,6 +90,7 @@ static void nft_dev_path_info(const stru
 121                 switch (path->type) {
 122                 case DEV_PATH_ETHERNET:
 123                 case DEV_PATH_VLAN:
 124 +               case DEV_PATH_PPPOE:
 125                         info->indev = path->dev;
 126                         if (is_zero_ether_addr(info->h_source))
 127                                 memcpy(info->h_source, path->dev->dev_addr, ETH_ALEN);
 128 @@ -97,7 +98,7 @@ static void nft_dev_path_info(const stru
 129                         if (path->type == DEV_PATH_ETHERNET)
 130                                 break;
 131
 132 -                       /* DEV_PATH_VLAN */
 133 +                       /* DEV_PATH_VLAN and DEV_PATH_PPPOE */
 134                         if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) {
 135                                 info->indev = NULL;
 136                                 break;
 137 @@ -106,6 +107,8 @@ static void nft_dev_path_info(const stru
 138                         info->encap[info->num_encaps].id = path->encap.id;
 139                         info->encap[info->num_encaps].proto = path->encap.proto;
 140                         info->num_encaps++;
 141 +                       if (path->type == DEV_PATH_PPPOE)
 142 +                               memcpy(info->h_dest, path->encap.h_dest, ETH_ALEN);
 143                         break;
 144                 case DEV_PATH_BRIDGE:
 145                         if (is_zero_ether_addr(info->h_source))