ramips: add support for mqmaker witi 512mb version
[openwrt/openwrt.git] / target / linux / generic / backport-4.14 / 322-netfilter-add-generic-flow-table-infrastructure.patch
1 From: Pablo Neira Ayuso <pablo@netfilter.org>
2 Date: Sun, 7 Jan 2018 01:04:11 +0100
3 Subject: [PATCH] netfilter: add generic flow table infrastructure
4
5 This patch defines the API to interact with flow tables, this allows to
6 add, delete and lookup for entries in the flow table. This also adds the
7 generic garbage code that removes entries that have expired, ie. no
8 traffic has been seen for a while.
9
10 Users of the flow table infrastructure can delete entries via
11 flow_offload_dead(), which sets the dying bit, this signals the garbage
12 collector to release an entry from user context.
13
14 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
15 ---
16 create mode 100644 net/netfilter/nf_flow_table.c
17
18 --- a/include/net/netfilter/nf_flow_table.h
19 +++ b/include/net/netfilter/nf_flow_table.h
20 @@ -1,7 +1,12 @@
21 #ifndef _NF_FLOW_TABLE_H
22 #define _NF_FLOW_TABLE_H
23
24 +#include <linux/in.h>
25 +#include <linux/in6.h>
26 +#include <linux/netdevice.h>
27 #include <linux/rhashtable.h>
28 +#include <linux/rcupdate.h>
29 +#include <net/dst.h>
30
31 struct nf_flowtable;
32
33 @@ -20,4 +25,93 @@ struct nf_flowtable {
34 struct delayed_work gc_work;
35 };
36
37 +enum flow_offload_tuple_dir {
38 + FLOW_OFFLOAD_DIR_ORIGINAL,
39 + FLOW_OFFLOAD_DIR_REPLY,
40 + __FLOW_OFFLOAD_DIR_MAX = FLOW_OFFLOAD_DIR_REPLY,
41 +};
42 +#define FLOW_OFFLOAD_DIR_MAX (__FLOW_OFFLOAD_DIR_MAX + 1)
43 +
44 +struct flow_offload_tuple {
45 + union {
46 + struct in_addr src_v4;
47 + struct in6_addr src_v6;
48 + };
49 + union {
50 + struct in_addr dst_v4;
51 + struct in6_addr dst_v6;
52 + };
53 + struct {
54 + __be16 src_port;
55 + __be16 dst_port;
56 + };
57 +
58 + int iifidx;
59 +
60 + u8 l3proto;
61 + u8 l4proto;
62 + u8 dir;
63 +
64 + int oifidx;
65 +
66 + struct dst_entry *dst_cache;
67 +};
68 +
69 +struct flow_offload_tuple_rhash {
70 + struct rhash_head node;
71 + struct flow_offload_tuple tuple;
72 +};
73 +
74 +#define FLOW_OFFLOAD_SNAT 0x1
75 +#define FLOW_OFFLOAD_DNAT 0x2
76 +#define FLOW_OFFLOAD_DYING 0x4
77 +
78 +struct flow_offload {
79 + struct flow_offload_tuple_rhash tuplehash[FLOW_OFFLOAD_DIR_MAX];
80 + u32 flags;
81 + union {
82 + /* Your private driver data here. */
83 + u32 timeout;
84 + };
85 +};
86 +
87 +#define NF_FLOW_TIMEOUT (30 * HZ)
88 +
89 +struct nf_flow_route {
90 + struct {
91 + struct dst_entry *dst;
92 + int ifindex;
93 + } tuple[FLOW_OFFLOAD_DIR_MAX];
94 +};
95 +
96 +struct flow_offload *flow_offload_alloc(struct nf_conn *ct,
97 + struct nf_flow_route *route);
98 +void flow_offload_free(struct flow_offload *flow);
99 +
100 +int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow);
101 +void flow_offload_del(struct nf_flowtable *flow_table, struct flow_offload *flow);
102 +struct flow_offload_tuple_rhash *flow_offload_lookup(struct nf_flowtable *flow_table,
103 + struct flow_offload_tuple *tuple);
104 +int nf_flow_table_iterate(struct nf_flowtable *flow_table,
105 + void (*iter)(struct flow_offload *flow, void *data),
106 + void *data);
107 +void nf_flow_offload_work_gc(struct work_struct *work);
108 +extern const struct rhashtable_params nf_flow_offload_rhash_params;
109 +
110 +void flow_offload_dead(struct flow_offload *flow);
111 +
112 +int nf_flow_snat_port(const struct flow_offload *flow,
113 + struct sk_buff *skb, unsigned int thoff,
114 + u8 protocol, enum flow_offload_tuple_dir dir);
115 +int nf_flow_dnat_port(const struct flow_offload *flow,
116 + struct sk_buff *skb, unsigned int thoff,
117 + u8 protocol, enum flow_offload_tuple_dir dir);
118 +
119 +struct flow_ports {
120 + __be16 source, dest;
121 +};
122 +
123 +#define MODULE_ALIAS_NF_FLOWTABLE(family) \
124 + MODULE_ALIAS("nf-flowtable-" __stringify(family))
125 +
126 #endif /* _FLOW_OFFLOAD_H */
127 --- a/net/netfilter/Kconfig
128 +++ b/net/netfilter/Kconfig
129 @@ -661,6 +661,13 @@ endif # NF_TABLES_NETDEV
130
131 endif # NF_TABLES
132
133 +config NF_FLOW_TABLE
134 + tristate "Netfilter flow table module"
135 + help
136 + This option adds the flow table core infrastructure.
137 +
138 + To compile it as a module, choose M here.
139 +
140 config NETFILTER_XTABLES
141 tristate "Netfilter Xtables support (required for ip_tables)"
142 default m if NETFILTER_ADVANCED=n
143 --- a/net/netfilter/Makefile
144 +++ b/net/netfilter/Makefile
145 @@ -110,6 +110,9 @@ obj-$(CONFIG_NFT_FIB_NETDEV) += nft_fib_
146 obj-$(CONFIG_NFT_DUP_NETDEV) += nft_dup_netdev.o
147 obj-$(CONFIG_NFT_FWD_NETDEV) += nft_fwd_netdev.o
148
149 +# flow table infrastructure
150 +obj-$(CONFIG_NF_FLOW_TABLE) += nf_flow_table.o
151 +
152 # generic X tables
153 obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
154
155 --- /dev/null
156 +++ b/net/netfilter/nf_flow_table.c
157 @@ -0,0 +1,429 @@
158 +#include <linux/kernel.h>
159 +#include <linux/init.h>
160 +#include <linux/module.h>
161 +#include <linux/netfilter.h>
162 +#include <linux/rhashtable.h>
163 +#include <linux/netdevice.h>
164 +#include <net/netfilter/nf_flow_table.h>
165 +#include <net/netfilter/nf_conntrack.h>
166 +#include <net/netfilter/nf_conntrack_core.h>
167 +#include <net/netfilter/nf_conntrack_tuple.h>
168 +
169 +struct flow_offload_entry {
170 + struct flow_offload flow;
171 + struct nf_conn *ct;
172 + struct rcu_head rcu_head;
173 +};
174 +
175 +struct flow_offload *
176 +flow_offload_alloc(struct nf_conn *ct, struct nf_flow_route *route)
177 +{
178 + struct flow_offload_entry *entry;
179 + struct flow_offload *flow;
180 +
181 + if (unlikely(nf_ct_is_dying(ct) ||
182 + !atomic_inc_not_zero(&ct->ct_general.use)))
183 + return NULL;
184 +
185 + entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
186 + if (!entry)
187 + goto err_ct_refcnt;
188 +
189 + flow = &entry->flow;
190 +
191 + if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst))
192 + goto err_dst_cache_original;
193 +
194 + if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_REPLY].dst))
195 + goto err_dst_cache_reply;
196 +
197 + entry->ct = ct;
198 +
199 + switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num) {
200 + case NFPROTO_IPV4:
201 + flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4 =
202 + ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.in;
203 + flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4 =
204 + ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in;
205 + flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4 =
206 + ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.in;
207 + flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4 =
208 + ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.in;
209 + break;
210 + case NFPROTO_IPV6:
211 + flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6 =
212 + ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.in6;
213 + flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6 =
214 + ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6;
215 + flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6 =
216 + ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.in6;
217 + flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6 =
218 + ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.in6;
219 + break;
220 + }
221 +
222 + flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.l3proto =
223 + ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
224 + flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.l4proto =
225 + ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
226 + flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.l3proto =
227 + ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
228 + flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.l4proto =
229 + ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
230 +
231 + flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache =
232 + route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst;
233 + flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache =
234 + route->tuple[FLOW_OFFLOAD_DIR_REPLY].dst;
235 +
236 + flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port =
237 + ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.tcp.port;
238 + flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port =
239 + ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port;
240 + flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port =
241 + ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u.tcp.port;
242 + flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port =
243 + ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.tcp.port;
244 +
245 + flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dir =
246 + FLOW_OFFLOAD_DIR_ORIGINAL;
247 + flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dir =
248 + FLOW_OFFLOAD_DIR_REPLY;
249 +
250 + flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.iifidx =
251 + route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].ifindex;
252 + flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.oifidx =
253 + route->tuple[FLOW_OFFLOAD_DIR_REPLY].ifindex;
254 + flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.iifidx =
255 + route->tuple[FLOW_OFFLOAD_DIR_REPLY].ifindex;
256 + flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.oifidx =
257 + route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].ifindex;
258 +
259 + if (ct->status & IPS_SRC_NAT)
260 + flow->flags |= FLOW_OFFLOAD_SNAT;
261 + else if (ct->status & IPS_DST_NAT)
262 + flow->flags |= FLOW_OFFLOAD_DNAT;
263 +
264 + return flow;
265 +
266 +err_dst_cache_reply:
267 + dst_release(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst);
268 +err_dst_cache_original:
269 + kfree(entry);
270 +err_ct_refcnt:
271 + nf_ct_put(ct);
272 +
273 + return NULL;
274 +}
275 +EXPORT_SYMBOL_GPL(flow_offload_alloc);
276 +
277 +void flow_offload_free(struct flow_offload *flow)
278 +{
279 + struct flow_offload_entry *e;
280 +
281 + dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache);
282 + dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache);
283 + e = container_of(flow, struct flow_offload_entry, flow);
284 + kfree(e);
285 +}
286 +EXPORT_SYMBOL_GPL(flow_offload_free);
287 +
288 +void flow_offload_dead(struct flow_offload *flow)
289 +{
290 + flow->flags |= FLOW_OFFLOAD_DYING;
291 +}
292 +EXPORT_SYMBOL_GPL(flow_offload_dead);
293 +
294 +int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
295 +{
296 + flow->timeout = (u32)jiffies;
297 +
298 + rhashtable_insert_fast(&flow_table->rhashtable,
299 + &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node,
300 + *flow_table->type->params);
301 + rhashtable_insert_fast(&flow_table->rhashtable,
302 + &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node,
303 + *flow_table->type->params);
304 + return 0;
305 +}
306 +EXPORT_SYMBOL_GPL(flow_offload_add);
307 +
308 +void flow_offload_del(struct nf_flowtable *flow_table,
309 + struct flow_offload *flow)
310 +{
311 + struct flow_offload_entry *e;
312 +
313 + rhashtable_remove_fast(&flow_table->rhashtable,
314 + &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node,
315 + *flow_table->type->params);
316 + rhashtable_remove_fast(&flow_table->rhashtable,
317 + &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node,
318 + *flow_table->type->params);
319 +
320 + e = container_of(flow, struct flow_offload_entry, flow);
321 + kfree_rcu(e, rcu_head);
322 +}
323 +EXPORT_SYMBOL_GPL(flow_offload_del);
324 +
325 +struct flow_offload_tuple_rhash *
326 +flow_offload_lookup(struct nf_flowtable *flow_table,
327 + struct flow_offload_tuple *tuple)
328 +{
329 + return rhashtable_lookup_fast(&flow_table->rhashtable, tuple,
330 + *flow_table->type->params);
331 +}
332 +EXPORT_SYMBOL_GPL(flow_offload_lookup);
333 +
334 +static void nf_flow_release_ct(const struct flow_offload *flow)
335 +{
336 + struct flow_offload_entry *e;
337 +
338 + e = container_of(flow, struct flow_offload_entry, flow);
339 + nf_ct_delete(e->ct, 0, 0);
340 + nf_ct_put(e->ct);
341 +}
342 +
343 +int nf_flow_table_iterate(struct nf_flowtable *flow_table,
344 + void (*iter)(struct flow_offload *flow, void *data),
345 + void *data)
346 +{
347 + struct flow_offload_tuple_rhash *tuplehash;
348 + struct rhashtable_iter hti;
349 + struct flow_offload *flow;
350 + int err;
351 +
352 + err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL);
353 + if (err)
354 + return err;
355 +
356 + rhashtable_walk_start(&hti);
357 +
358 + while ((tuplehash = rhashtable_walk_next(&hti))) {
359 + if (IS_ERR(tuplehash)) {
360 + err = PTR_ERR(tuplehash);
361 + if (err != -EAGAIN)
362 + goto out;
363 +
364 + continue;
365 + }
366 + if (tuplehash->tuple.dir)
367 + continue;
368 +
369 + flow = container_of(tuplehash, struct flow_offload, tuplehash[0]);
370 +
371 + iter(flow, data);
372 + }
373 +out:
374 + rhashtable_walk_stop(&hti);
375 + rhashtable_walk_exit(&hti);
376 +
377 + return err;
378 +}
379 +EXPORT_SYMBOL_GPL(nf_flow_table_iterate);
380 +
381 +static inline bool nf_flow_has_expired(const struct flow_offload *flow)
382 +{
383 + return (__s32)(flow->timeout - (u32)jiffies) <= 0;
384 +}
385 +
386 +static inline bool nf_flow_is_dying(const struct flow_offload *flow)
387 +{
388 + return flow->flags & FLOW_OFFLOAD_DYING;
389 +}
390 +
391 +void nf_flow_offload_work_gc(struct work_struct *work)
392 +{
393 + struct flow_offload_tuple_rhash *tuplehash;
394 + struct nf_flowtable *flow_table;
395 + struct rhashtable_iter hti;
396 + struct flow_offload *flow;
397 + int err;
398 +
399 + flow_table = container_of(work, struct nf_flowtable, gc_work.work);
400 +
401 + err = rhashtable_walk_init(&flow_table->rhashtable, &hti, GFP_KERNEL);
402 + if (err)
403 + goto schedule;
404 +
405 + rhashtable_walk_start(&hti);
406 +
407 + while ((tuplehash = rhashtable_walk_next(&hti))) {
408 + if (IS_ERR(tuplehash)) {
409 + err = PTR_ERR(tuplehash);
410 + if (err != -EAGAIN)
411 + goto out;
412 +
413 + continue;
414 + }
415 + if (tuplehash->tuple.dir)
416 + continue;
417 +
418 + flow = container_of(tuplehash, struct flow_offload, tuplehash[0]);
419 +
420 + if (nf_flow_has_expired(flow) ||
421 + nf_flow_is_dying(flow)) {
422 + flow_offload_del(flow_table, flow);
423 + nf_flow_release_ct(flow);
424 + }
425 + }
426 +out:
427 + rhashtable_walk_stop(&hti);
428 + rhashtable_walk_exit(&hti);
429 +schedule:
430 + queue_delayed_work(system_power_efficient_wq, &flow_table->gc_work, HZ);
431 +}
432 +EXPORT_SYMBOL_GPL(nf_flow_offload_work_gc);
433 +
434 +static u32 flow_offload_hash(const void *data, u32 len, u32 seed)
435 +{
436 + const struct flow_offload_tuple *tuple = data;
437 +
438 + return jhash(tuple, offsetof(struct flow_offload_tuple, dir), seed);
439 +}
440 +
441 +static u32 flow_offload_hash_obj(const void *data, u32 len, u32 seed)
442 +{
443 + const struct flow_offload_tuple_rhash *tuplehash = data;
444 +
445 + return jhash(&tuplehash->tuple, offsetof(struct flow_offload_tuple, dir), seed);
446 +}
447 +
448 +static int flow_offload_hash_cmp(struct rhashtable_compare_arg *arg,
449 + const void *ptr)
450 +{
451 + const struct flow_offload_tuple *tuple = arg->key;
452 + const struct flow_offload_tuple_rhash *x = ptr;
453 +
454 + if (memcmp(&x->tuple, tuple, offsetof(struct flow_offload_tuple, dir)))
455 + return 1;
456 +
457 + return 0;
458 +}
459 +
460 +const struct rhashtable_params nf_flow_offload_rhash_params = {
461 + .head_offset = offsetof(struct flow_offload_tuple_rhash, node),
462 + .hashfn = flow_offload_hash,
463 + .obj_hashfn = flow_offload_hash_obj,
464 + .obj_cmpfn = flow_offload_hash_cmp,
465 + .automatic_shrinking = true,
466 +};
467 +EXPORT_SYMBOL_GPL(nf_flow_offload_rhash_params);
468 +
469 +static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff,
470 + __be16 port, __be16 new_port)
471 +{
472 + struct tcphdr *tcph;
473 +
474 + if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
475 + skb_try_make_writable(skb, thoff + sizeof(*tcph)))
476 + return -1;
477 +
478 + tcph = (void *)(skb_network_header(skb) + thoff);
479 + inet_proto_csum_replace2(&tcph->check, skb, port, new_port, true);
480 +
481 + return 0;
482 +}
483 +
484 +static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff,
485 + __be16 port, __be16 new_port)
486 +{
487 + struct udphdr *udph;
488 +
489 + if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
490 + skb_try_make_writable(skb, thoff + sizeof(*udph)))
491 + return -1;
492 +
493 + udph = (void *)(skb_network_header(skb) + thoff);
494 + if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
495 + inet_proto_csum_replace2(&udph->check, skb, port,
496 + new_port, true);
497 + if (!udph->check)
498 + udph->check = CSUM_MANGLED_0;
499 + }
500 +
501 + return 0;
502 +}
503 +
504 +static int nf_flow_nat_port(struct sk_buff *skb, unsigned int thoff,
505 + u8 protocol, __be16 port, __be16 new_port)
506 +{
507 + switch (protocol) {
508 + case IPPROTO_TCP:
509 + if (nf_flow_nat_port_tcp(skb, thoff, port, new_port) < 0)
510 + return NF_DROP;
511 + break;
512 + case IPPROTO_UDP:
513 + if (nf_flow_nat_port_udp(skb, thoff, port, new_port) < 0)
514 + return NF_DROP;
515 + break;
516 + }
517 +
518 + return 0;
519 +}
520 +
521 +int nf_flow_snat_port(const struct flow_offload *flow,
522 + struct sk_buff *skb, unsigned int thoff,
523 + u8 protocol, enum flow_offload_tuple_dir dir)
524 +{
525 + struct flow_ports *hdr;
526 + __be16 port, new_port;
527 +
528 + if (!pskb_may_pull(skb, thoff + sizeof(*hdr)) ||
529 + skb_try_make_writable(skb, thoff + sizeof(*hdr)))
530 + return -1;
531 +
532 + hdr = (void *)(skb_network_header(skb) + thoff);
533 +
534 + switch (dir) {
535 + case FLOW_OFFLOAD_DIR_ORIGINAL:
536 + port = hdr->source;
537 + new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port;
538 + hdr->source = new_port;
539 + break;
540 + case FLOW_OFFLOAD_DIR_REPLY:
541 + port = hdr->dest;
542 + new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port;
543 + hdr->dest = new_port;
544 + break;
545 + default:
546 + return -1;
547 + }
548 +
549 + return nf_flow_nat_port(skb, thoff, protocol, port, new_port);
550 +}
551 +EXPORT_SYMBOL_GPL(nf_flow_snat_port);
552 +
553 +int nf_flow_dnat_port(const struct flow_offload *flow,
554 + struct sk_buff *skb, unsigned int thoff,
555 + u8 protocol, enum flow_offload_tuple_dir dir)
556 +{
557 + struct flow_ports *hdr;
558 + __be16 port, new_port;
559 +
560 + if (!pskb_may_pull(skb, thoff + sizeof(*hdr)) ||
561 + skb_try_make_writable(skb, thoff + sizeof(*hdr)))
562 + return -1;
563 +
564 + hdr = (void *)(skb_network_header(skb) + thoff);
565 +
566 + switch (dir) {
567 + case FLOW_OFFLOAD_DIR_ORIGINAL:
568 + port = hdr->dest;
569 + new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port;
570 + hdr->dest = new_port;
571 + break;
572 + case FLOW_OFFLOAD_DIR_REPLY:
573 + port = hdr->source;
574 + new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port;
575 + hdr->source = new_port;
576 + break;
577 + default:
578 + return -1;
579 + }
580 +
581 + return nf_flow_nat_port(skb, thoff, protocol, port, new_port);
582 +}
583 +EXPORT_SYMBOL_GPL(nf_flow_dnat_port);
584 +
585 +MODULE_LICENSE("GPL");
586 +MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");