target/linux/generic/backport-4.14/324-v4.16-netfilter-flow-table-support-for-IPv6.patch

   1 From: Pablo Neira Ayuso <pablo@netfilter.org>
   2 Date: Sun, 7 Jan 2018 01:04:19 +0100
   3 Subject: [PATCH] netfilter: flow table support for IPv6
   4
   5 This patch adds the IPv6 flow table type, that implements the datapath
   6 flow table to forward IPv6 traffic.
   7
   8 This patch exports ip6_dst_mtu_forward() that is required to check for
   9 mtu to pass up packets that need PMTUD handling to the classic
  10 forwarding path.
  11
  12 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  13 ---
  14  create mode 100644 net/ipv6/netfilter/nf_flow_table_ipv6.c
  15
  16 --- a/include/net/ipv6.h
  17 +++ b/include/net/ipv6.h
  18 @@ -918,6 +918,8 @@ static inline struct sk_buff *ip6_finish
  19                               &inet6_sk(sk)->cork);
  20  }
  21
  22 +unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst);
  23 +
  24  int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst,
  25                    struct flowi6 *fl6);
  26  struct dst_entry *ip6_dst_lookup_flow(const struct sock *sk, struct flowi6 *fl6,
  27 --- a/net/ipv6/ip6_output.c
  28 +++ b/net/ipv6/ip6_output.c
  29 @@ -383,7 +383,7 @@ static inline int ip6_forward_finish(str
  30         return dst_output(net, sk, skb);
  31  }
  32
  33 -static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
  34 +unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
  35  {
  36         unsigned int mtu;
  37         struct inet6_dev *idev;
  38 @@ -403,6 +403,7 @@ static unsigned int ip6_dst_mtu_forward(
  39
  40         return mtu;
  41  }
  42 +EXPORT_SYMBOL_GPL(ip6_dst_mtu_forward);
  43
  44  static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
  45  {
  46 --- a/net/ipv6/netfilter/Kconfig
  47 +++ b/net/ipv6/netfilter/Kconfig
  48 @@ -99,6 +99,14 @@ config NFT_FIB_IPV6
  49  endif # NF_TABLES_IPV6
  50  endif # NF_TABLES
  51
  52 +config NF_FLOW_TABLE_IPV6
  53 +       select NF_FLOW_TABLE
  54 +       tristate "Netfilter flow table IPv6 module"
  55 +       help
  56 +         This option adds the flow table IPv6 support.
  57 +
  58 +         To compile it as a module, choose M here.
  59 +
  60  config NF_DUP_IPV6
  61         tristate "Netfilter IPv6 packet duplication to alternate destination"
  62         depends on !NF_CONNTRACK || NF_CONNTRACK
  63 --- a/net/ipv6/netfilter/Makefile
  64 +++ b/net/ipv6/netfilter/Makefile
  65 @@ -45,6 +45,9 @@ obj-$(CONFIG_NFT_REDIR_IPV6) += nft_redi
  66  obj-$(CONFIG_NFT_DUP_IPV6) += nft_dup_ipv6.o
  67  obj-$(CONFIG_NFT_FIB_IPV6) += nft_fib_ipv6.o
  68
  69 +# flow table support
  70 +obj-$(CONFIG_NF_FLOW_TABLE_IPV6) += nf_flow_table_ipv6.o
  71 +
  72  # matches
  73  obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o
  74  obj-$(CONFIG_IP6_NF_MATCH_EUI64) += ip6t_eui64.o
  75 --- /dev/null
  76 +++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c
  77 @@ -0,0 +1,277 @@
  78 +#include <linux/kernel.h>
  79 +#include <linux/init.h>
  80 +#include <linux/module.h>
  81 +#include <linux/netfilter.h>
  82 +#include <linux/rhashtable.h>
  83 +#include <linux/ipv6.h>
  84 +#include <linux/netdevice.h>
  85 +#include <linux/ipv6.h>
  86 +#include <net/ipv6.h>
  87 +#include <net/ip6_route.h>
  88 +#include <net/neighbour.h>
  89 +#include <net/netfilter/nf_flow_table.h>
  90 +#include <net/netfilter/nf_tables.h>
  91 +/* For layer 4 checksum field offset. */
  92 +#include <linux/tcp.h>
  93 +#include <linux/udp.h>
  94 +
  95 +static int nf_flow_nat_ipv6_tcp(struct sk_buff *skb, unsigned int thoff,
  96 +                               struct in6_addr *addr,
  97 +                               struct in6_addr *new_addr)
  98 +{
  99 +       struct tcphdr *tcph;
 100 +
 101 +       if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
 102 +           skb_try_make_writable(skb, thoff + sizeof(*tcph)))
 103 +               return -1;
 104 +
 105 +       tcph = (void *)(skb_network_header(skb) + thoff);
 106 +       inet_proto_csum_replace16(&tcph->check, skb, addr->s6_addr32,
 107 +                                 new_addr->s6_addr32, true);
 108 +
 109 +       return 0;
 110 +}
 111 +
 112 +static int nf_flow_nat_ipv6_udp(struct sk_buff *skb, unsigned int thoff,
 113 +                               struct in6_addr *addr,
 114 +                               struct in6_addr *new_addr)
 115 +{
 116 +       struct udphdr *udph;
 117 +
 118 +       if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
 119 +           skb_try_make_writable(skb, thoff + sizeof(*udph)))
 120 +               return -1;
 121 +
 122 +       udph = (void *)(skb_network_header(skb) + thoff);
 123 +       if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
 124 +               inet_proto_csum_replace16(&udph->check, skb, addr->s6_addr32,
 125 +                                         new_addr->s6_addr32, true);
 126 +               if (!udph->check)
 127 +                       udph->check = CSUM_MANGLED_0;
 128 +       }
 129 +
 130 +       return 0;
 131 +}
 132 +
 133 +static int nf_flow_nat_ipv6_l4proto(struct sk_buff *skb, struct ipv6hdr *ip6h,
 134 +                                   unsigned int thoff, struct in6_addr *addr,
 135 +                                   struct in6_addr *new_addr)
 136 +{
 137 +       switch (ip6h->nexthdr) {
 138 +       case IPPROTO_TCP:
 139 +               if (nf_flow_nat_ipv6_tcp(skb, thoff, addr, new_addr) < 0)
 140 +                       return NF_DROP;
 141 +               break;
 142 +       case IPPROTO_UDP:
 143 +               if (nf_flow_nat_ipv6_udp(skb, thoff, addr, new_addr) < 0)
 144 +                       return NF_DROP;
 145 +               break;
 146 +       }
 147 +
 148 +       return 0;
 149 +}
 150 +
 151 +static int nf_flow_snat_ipv6(const struct flow_offload *flow,
 152 +                            struct sk_buff *skb, struct ipv6hdr *ip6h,
 153 +                            unsigned int thoff,
 154 +                            enum flow_offload_tuple_dir dir)
 155 +{
 156 +       struct in6_addr addr, new_addr;
 157 +
 158 +       switch (dir) {
 159 +       case FLOW_OFFLOAD_DIR_ORIGINAL:
 160 +               addr = ip6h->saddr;
 161 +               new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6;
 162 +               ip6h->saddr = new_addr;
 163 +               break;
 164 +       case FLOW_OFFLOAD_DIR_REPLY:
 165 +               addr = ip6h->daddr;
 166 +               new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6;
 167 +               ip6h->daddr = new_addr;
 168 +               break;
 169 +       default:
 170 +               return -1;
 171 +       }
 172 +
 173 +       return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
 174 +}
 175 +
 176 +static int nf_flow_dnat_ipv6(const struct flow_offload *flow,
 177 +                            struct sk_buff *skb, struct ipv6hdr *ip6h,
 178 +                            unsigned int thoff,
 179 +                            enum flow_offload_tuple_dir dir)
 180 +{
 181 +       struct in6_addr addr, new_addr;
 182 +
 183 +       switch (dir) {
 184 +       case FLOW_OFFLOAD_DIR_ORIGINAL:
 185 +               addr = ip6h->daddr;
 186 +               new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6;
 187 +               ip6h->daddr = new_addr;
 188 +               break;
 189 +       case FLOW_OFFLOAD_DIR_REPLY:
 190 +               addr = ip6h->saddr;
 191 +               new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6;
 192 +               ip6h->saddr = new_addr;
 193 +               break;
 194 +       default:
 195 +               return -1;
 196 +       }
 197 +
 198 +       return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
 199 +}
 200 +
 201 +static int nf_flow_nat_ipv6(const struct flow_offload *flow,
 202 +                           struct sk_buff *skb,
 203 +                           enum flow_offload_tuple_dir dir)
 204 +{
 205 +       struct ipv6hdr *ip6h = ipv6_hdr(skb);
 206 +       unsigned int thoff = sizeof(*ip6h);
 207 +
 208 +       if (flow->flags & FLOW_OFFLOAD_SNAT &&
 209 +           (nf_flow_snat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
 210 +            nf_flow_snat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
 211 +               return -1;
 212 +       if (flow->flags & FLOW_OFFLOAD_DNAT &&
 213 +           (nf_flow_dnat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
 214 +            nf_flow_dnat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
 215 +               return -1;
 216 +
 217 +       return 0;
 218 +}
 219 +
 220 +static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
 221 +                             struct flow_offload_tuple *tuple)
 222 +{
 223 +       struct flow_ports *ports;
 224 +       struct ipv6hdr *ip6h;
 225 +       unsigned int thoff;
 226 +
 227 +       if (!pskb_may_pull(skb, sizeof(*ip6h)))
 228 +               return -1;
 229 +
 230 +       ip6h = ipv6_hdr(skb);
 231 +
 232 +       if (ip6h->nexthdr != IPPROTO_TCP &&
 233 +           ip6h->nexthdr != IPPROTO_UDP)
 234 +               return -1;
 235 +
 236 +       thoff = sizeof(*ip6h);
 237 +       if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
 238 +               return -1;
 239 +
 240 +       ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
 241 +
 242 +       tuple->src_v6           = ip6h->saddr;
 243 +       tuple->dst_v6           = ip6h->daddr;
 244 +       tuple->src_port         = ports->source;
 245 +       tuple->dst_port         = ports->dest;
 246 +       tuple->l3proto          = AF_INET6;
 247 +       tuple->l4proto          = ip6h->nexthdr;
 248 +       tuple->iifidx           = dev->ifindex;
 249 +
 250 +       return 0;
 251 +}
 252 +
 253 +/* Based on ip_exceeds_mtu(). */
 254 +static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
 255 +{
 256 +       if (skb->len <= mtu)
 257 +               return false;
 258 +
 259 +       if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
 260 +               return false;
 261 +
 262 +       return true;
 263 +}
 264 +
 265 +static bool nf_flow_exceeds_mtu(struct sk_buff *skb, const struct rt6_info *rt)
 266 +{
 267 +       u32 mtu;
 268 +
 269 +       mtu = ip6_dst_mtu_forward(&rt->dst);
 270 +       if (__nf_flow_exceeds_mtu(skb, mtu))
 271 +               return true;
 272 +
 273 +       return false;
 274 +}
 275 +
 276 +static unsigned int
 277 +nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
 278 +                         const struct nf_hook_state *state)
 279 +{
 280 +       struct flow_offload_tuple_rhash *tuplehash;
 281 +       struct nf_flowtable *flow_table = priv;
 282 +       struct flow_offload_tuple tuple = {};
 283 +       enum flow_offload_tuple_dir dir;
 284 +       struct flow_offload *flow;
 285 +       struct net_device *outdev;
 286 +       struct in6_addr *nexthop;
 287 +       struct ipv6hdr *ip6h;
 288 +       struct rt6_info *rt;
 289 +
 290 +       if (skb->protocol != htons(ETH_P_IPV6))
 291 +               return NF_ACCEPT;
 292 +
 293 +       if (nf_flow_tuple_ipv6(skb, state->in, &tuple) < 0)
 294 +               return NF_ACCEPT;
 295 +
 296 +       tuplehash = flow_offload_lookup(flow_table, &tuple);
 297 +       if (tuplehash == NULL)
 298 +               return NF_ACCEPT;
 299 +
 300 +       outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx);
 301 +       if (!outdev)
 302 +               return NF_ACCEPT;
 303 +
 304 +       dir = tuplehash->tuple.dir;
 305 +       flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
 306 +
 307 +       rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache;
 308 +       if (unlikely(nf_flow_exceeds_mtu(skb, rt)))
 309 +               return NF_ACCEPT;
 310 +
 311 +       if (skb_try_make_writable(skb, sizeof(*ip6h)))
 312 +               return NF_DROP;
 313 +
 314 +       if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
 315 +           nf_flow_nat_ipv6(flow, skb, dir) < 0)
 316 +               return NF_DROP;
 317 +
 318 +       flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
 319 +       ip6h = ipv6_hdr(skb);
 320 +       ip6h->hop_limit--;
 321 +
 322 +       skb->dev = outdev;
 323 +       nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6);
 324 +       neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb);
 325 +
 326 +       return NF_STOLEN;
 327 +}
 328 +
 329 +static struct nf_flowtable_type flowtable_ipv6 = {
 330 +       .family         = NFPROTO_IPV6,
 331 +       .params         = &nf_flow_offload_rhash_params,
 332 +       .gc             = nf_flow_offload_work_gc,
 333 +       .hook           = nf_flow_offload_ipv6_hook,
 334 +       .owner          = THIS_MODULE,
 335 +};
 336 +
 337 +static int __init nf_flow_ipv6_module_init(void)
 338 +{
 339 +       nft_register_flowtable_type(&flowtable_ipv6);
 340 +
 341 +       return 0;
 342 +}
 343 +
 344 +static void __exit nf_flow_ipv6_module_exit(void)
 345 +{
 346 +       nft_unregister_flowtable_type(&flowtable_ipv6);
 347 +}
 348 +
 349 +module_init(nf_flow_ipv6_module_init);
 350 +module_exit(nf_flow_ipv6_module_exit);
 351 +
 352 +MODULE_LICENSE("GPL");
 353 +MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
 354 +MODULE_ALIAS_NF_FLOWTABLE(AF_INET6);