target/linux/generic/backport-4.14/355-v4.18-netfilter-nf_flow_table-move-ipv6-offload-hook-code-.patch

   1 From: Felix Fietkau <nbd@nbd.name>
   2 Date: Sat, 17 Feb 2018 11:55:51 +0100
   3 Subject: [PATCH] netfilter: nf_flow_table: move ipv6 offload hook code to
   4  nf_flow_table
   5
   6 Useful as preparation for adding iptables support for offload
   7
   8 Signed-off-by: Felix Fietkau <nbd@nbd.name>
   9 ---
  10
  11 --- a/net/ipv6/netfilter/nf_flow_table_ipv6.c
  12 +++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c
  13 @@ -3,240 +3,8 @@
  14  #include <linux/module.h>
  15  #include <linux/netfilter.h>
  16  #include <linux/rhashtable.h>
  17 -#include <linux/ipv6.h>
  18 -#include <linux/netdevice.h>
  19 -#include <net/ipv6.h>
  20 -#include <net/ip6_route.h>
  21 -#include <net/neighbour.h>
  22  #include <net/netfilter/nf_flow_table.h>
  23  #include <net/netfilter/nf_tables.h>
  24 -/* For layer 4 checksum field offset. */
  25 -#include <linux/tcp.h>
  26 -#include <linux/udp.h>
  27 -
  28 -static int nf_flow_nat_ipv6_tcp(struct sk_buff *skb, unsigned int thoff,
  29 -                               struct in6_addr *addr,
  30 -                               struct in6_addr *new_addr)
  31 -{
  32 -       struct tcphdr *tcph;
  33 -
  34 -       if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
  35 -           skb_try_make_writable(skb, thoff + sizeof(*tcph)))
  36 -               return -1;
  37 -
  38 -       tcph = (void *)(skb_network_header(skb) + thoff);
  39 -       inet_proto_csum_replace16(&tcph->check, skb, addr->s6_addr32,
  40 -                                 new_addr->s6_addr32, true);
  41 -
  42 -       return 0;
  43 -}
  44 -
  45 -static int nf_flow_nat_ipv6_udp(struct sk_buff *skb, unsigned int thoff,
  46 -                               struct in6_addr *addr,
  47 -                               struct in6_addr *new_addr)
  48 -{
  49 -       struct udphdr *udph;
  50 -
  51 -       if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
  52 -           skb_try_make_writable(skb, thoff + sizeof(*udph)))
  53 -               return -1;
  54 -
  55 -       udph = (void *)(skb_network_header(skb) + thoff);
  56 -       if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
  57 -               inet_proto_csum_replace16(&udph->check, skb, addr->s6_addr32,
  58 -                                         new_addr->s6_addr32, true);
  59 -               if (!udph->check)
  60 -                       udph->check = CSUM_MANGLED_0;
  61 -       }
  62 -
  63 -       return 0;
  64 -}
  65 -
  66 -static int nf_flow_nat_ipv6_l4proto(struct sk_buff *skb, struct ipv6hdr *ip6h,
  67 -                                   unsigned int thoff, struct in6_addr *addr,
  68 -                                   struct in6_addr *new_addr)
  69 -{
  70 -       switch (ip6h->nexthdr) {
  71 -       case IPPROTO_TCP:
  72 -               if (nf_flow_nat_ipv6_tcp(skb, thoff, addr, new_addr) < 0)
  73 -                       return NF_DROP;
  74 -               break;
  75 -       case IPPROTO_UDP:
  76 -               if (nf_flow_nat_ipv6_udp(skb, thoff, addr, new_addr) < 0)
  77 -                       return NF_DROP;
  78 -               break;
  79 -       }
  80 -
  81 -       return 0;
  82 -}
  83 -
  84 -static int nf_flow_snat_ipv6(const struct flow_offload *flow,
  85 -                            struct sk_buff *skb, struct ipv6hdr *ip6h,
  86 -                            unsigned int thoff,
  87 -                            enum flow_offload_tuple_dir dir)
  88 -{
  89 -       struct in6_addr addr, new_addr;
  90 -
  91 -       switch (dir) {
  92 -       case FLOW_OFFLOAD_DIR_ORIGINAL:
  93 -               addr = ip6h->saddr;
  94 -               new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6;
  95 -               ip6h->saddr = new_addr;
  96 -               break;
  97 -       case FLOW_OFFLOAD_DIR_REPLY:
  98 -               addr = ip6h->daddr;
  99 -               new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6;
 100 -               ip6h->daddr = new_addr;
 101 -               break;
 102 -       default:
 103 -               return -1;
 104 -       }
 105 -
 106 -       return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
 107 -}
 108 -
 109 -static int nf_flow_dnat_ipv6(const struct flow_offload *flow,
 110 -                            struct sk_buff *skb, struct ipv6hdr *ip6h,
 111 -                            unsigned int thoff,
 112 -                            enum flow_offload_tuple_dir dir)
 113 -{
 114 -       struct in6_addr addr, new_addr;
 115 -
 116 -       switch (dir) {
 117 -       case FLOW_OFFLOAD_DIR_ORIGINAL:
 118 -               addr = ip6h->daddr;
 119 -               new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6;
 120 -               ip6h->daddr = new_addr;
 121 -               break;
 122 -       case FLOW_OFFLOAD_DIR_REPLY:
 123 -               addr = ip6h->saddr;
 124 -               new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6;
 125 -               ip6h->saddr = new_addr;
 126 -               break;
 127 -       default:
 128 -               return -1;
 129 -       }
 130 -
 131 -       return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
 132 -}
 133 -
 134 -static int nf_flow_nat_ipv6(const struct flow_offload *flow,
 135 -                           struct sk_buff *skb,
 136 -                           enum flow_offload_tuple_dir dir)
 137 -{
 138 -       struct ipv6hdr *ip6h = ipv6_hdr(skb);
 139 -       unsigned int thoff = sizeof(*ip6h);
 140 -
 141 -       if (flow->flags & FLOW_OFFLOAD_SNAT &&
 142 -           (nf_flow_snat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
 143 -            nf_flow_snat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
 144 -               return -1;
 145 -       if (flow->flags & FLOW_OFFLOAD_DNAT &&
 146 -           (nf_flow_dnat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
 147 -            nf_flow_dnat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
 148 -               return -1;
 149 -
 150 -       return 0;
 151 -}
 152 -
 153 -static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
 154 -                             struct flow_offload_tuple *tuple)
 155 -{
 156 -       struct flow_ports *ports;
 157 -       struct ipv6hdr *ip6h;
 158 -       unsigned int thoff;
 159 -
 160 -       if (!pskb_may_pull(skb, sizeof(*ip6h)))
 161 -               return -1;
 162 -
 163 -       ip6h = ipv6_hdr(skb);
 164 -
 165 -       if (ip6h->nexthdr != IPPROTO_TCP &&
 166 -           ip6h->nexthdr != IPPROTO_UDP)
 167 -               return -1;
 168 -
 169 -       thoff = sizeof(*ip6h);
 170 -       if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
 171 -               return -1;
 172 -
 173 -       ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
 174 -
 175 -       tuple->src_v6           = ip6h->saddr;
 176 -       tuple->dst_v6           = ip6h->daddr;
 177 -       tuple->src_port         = ports->source;
 178 -       tuple->dst_port         = ports->dest;
 179 -       tuple->l3proto          = AF_INET6;
 180 -       tuple->l4proto          = ip6h->nexthdr;
 181 -       tuple->iifidx           = dev->ifindex;
 182 -
 183 -       return 0;
 184 -}
 185 -
 186 -/* Based on ip_exceeds_mtu(). */
 187 -static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
 188 -{
 189 -       if (skb->len <= mtu)
 190 -               return false;
 191 -
 192 -       if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
 193 -               return false;
 194 -
 195 -       return true;
 196 -}
 197 -
 198 -unsigned int
 199 -nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
 200 -                         const struct nf_hook_state *state)
 201 -{
 202 -       struct flow_offload_tuple_rhash *tuplehash;
 203 -       struct nf_flowtable *flow_table = priv;
 204 -       struct flow_offload_tuple tuple = {};
 205 -       enum flow_offload_tuple_dir dir;
 206 -       struct flow_offload *flow;
 207 -       struct net_device *outdev;
 208 -       struct in6_addr *nexthop;
 209 -       struct ipv6hdr *ip6h;
 210 -       struct rt6_info *rt;
 211 -
 212 -       if (skb->protocol != htons(ETH_P_IPV6))
 213 -               return NF_ACCEPT;
 214 -
 215 -       if (nf_flow_tuple_ipv6(skb, state->in, &tuple) < 0)
 216 -               return NF_ACCEPT;
 217 -
 218 -       tuplehash = flow_offload_lookup(flow_table, &tuple);
 219 -       if (tuplehash == NULL)
 220 -               return NF_ACCEPT;
 221 -
 222 -       outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx);
 223 -       if (!outdev)
 224 -               return NF_ACCEPT;
 225 -
 226 -       dir = tuplehash->tuple.dir;
 227 -       flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
 228 -       rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache;
 229 -
 230 -       if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
 231 -               return NF_ACCEPT;
 232 -
 233 -       if (skb_try_make_writable(skb, sizeof(*ip6h)))
 234 -               return NF_DROP;
 235 -
 236 -       if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
 237 -           nf_flow_nat_ipv6(flow, skb, dir) < 0)
 238 -               return NF_DROP;
 239 -
 240 -       flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
 241 -       ip6h = ipv6_hdr(skb);
 242 -       ip6h->hop_limit--;
 243 -
 244 -       skb->dev = outdev;
 245 -       nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6);
 246 -       neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb);
 247 -
 248 -       return NF_STOLEN;
 249 -}
 250 -EXPORT_SYMBOL_GPL(nf_flow_offload_ipv6_hook);
 251
 252  static struct nf_flowtable_type flowtable_ipv6 = {
 253         .family         = NFPROTO_IPV6,
 254 --- a/net/netfilter/nf_flow_table_ip.c
 255 +++ b/net/netfilter/nf_flow_table_ip.c
 256 @@ -4,8 +4,11 @@
 257  #include <linux/netfilter.h>
 258  #include <linux/rhashtable.h>
 259  #include <linux/ip.h>
 260 +#include <linux/ipv6.h>
 261  #include <linux/netdevice.h>
 262  #include <net/ip.h>
 263 +#include <net/ipv6.h>
 264 +#include <net/ip6_route.h>
 265  #include <net/neighbour.h>
 266  #include <net/netfilter/nf_flow_table.h>
 267  /* For layer 4 checksum field offset. */
 268 @@ -241,3 +244,215 @@ nf_flow_offload_ip_hook(void *priv, stru
 269         return NF_STOLEN;
 270  }
 271  EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook);
 272 +
 273 +static int nf_flow_nat_ipv6_tcp(struct sk_buff *skb, unsigned int thoff,
 274 +                               struct in6_addr *addr,
 275 +                               struct in6_addr *new_addr)
 276 +{
 277 +       struct tcphdr *tcph;
 278 +
 279 +       if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
 280 +           skb_try_make_writable(skb, thoff + sizeof(*tcph)))
 281 +               return -1;
 282 +
 283 +       tcph = (void *)(skb_network_header(skb) + thoff);
 284 +       inet_proto_csum_replace16(&tcph->check, skb, addr->s6_addr32,
 285 +                                 new_addr->s6_addr32, true);
 286 +
 287 +       return 0;
 288 +}
 289 +
 290 +static int nf_flow_nat_ipv6_udp(struct sk_buff *skb, unsigned int thoff,
 291 +                               struct in6_addr *addr,
 292 +                               struct in6_addr *new_addr)
 293 +{
 294 +       struct udphdr *udph;
 295 +
 296 +       if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
 297 +           skb_try_make_writable(skb, thoff + sizeof(*udph)))
 298 +               return -1;
 299 +
 300 +       udph = (void *)(skb_network_header(skb) + thoff);
 301 +       if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
 302 +               inet_proto_csum_replace16(&udph->check, skb, addr->s6_addr32,
 303 +                                         new_addr->s6_addr32, true);
 304 +               if (!udph->check)
 305 +                       udph->check = CSUM_MANGLED_0;
 306 +       }
 307 +
 308 +       return 0;
 309 +}
 310 +
 311 +static int nf_flow_nat_ipv6_l4proto(struct sk_buff *skb, struct ipv6hdr *ip6h,
 312 +                                   unsigned int thoff, struct in6_addr *addr,
 313 +                                   struct in6_addr *new_addr)
 314 +{
 315 +       switch (ip6h->nexthdr) {
 316 +       case IPPROTO_TCP:
 317 +               if (nf_flow_nat_ipv6_tcp(skb, thoff, addr, new_addr) < 0)
 318 +                       return NF_DROP;
 319 +               break;
 320 +       case IPPROTO_UDP:
 321 +               if (nf_flow_nat_ipv6_udp(skb, thoff, addr, new_addr) < 0)
 322 +                       return NF_DROP;
 323 +               break;
 324 +       }
 325 +
 326 +       return 0;
 327 +}
 328 +
 329 +static int nf_flow_snat_ipv6(const struct flow_offload *flow,
 330 +                            struct sk_buff *skb, struct ipv6hdr *ip6h,
 331 +                            unsigned int thoff,
 332 +                            enum flow_offload_tuple_dir dir)
 333 +{
 334 +       struct in6_addr addr, new_addr;
 335 +
 336 +       switch (dir) {
 337 +       case FLOW_OFFLOAD_DIR_ORIGINAL:
 338 +               addr = ip6h->saddr;
 339 +               new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6;
 340 +               ip6h->saddr = new_addr;
 341 +               break;
 342 +       case FLOW_OFFLOAD_DIR_REPLY:
 343 +               addr = ip6h->daddr;
 344 +               new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6;
 345 +               ip6h->daddr = new_addr;
 346 +               break;
 347 +       default:
 348 +               return -1;
 349 +       }
 350 +
 351 +       return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
 352 +}
 353 +
 354 +static int nf_flow_dnat_ipv6(const struct flow_offload *flow,
 355 +                            struct sk_buff *skb, struct ipv6hdr *ip6h,
 356 +                            unsigned int thoff,
 357 +                            enum flow_offload_tuple_dir dir)
 358 +{
 359 +       struct in6_addr addr, new_addr;
 360 +
 361 +       switch (dir) {
 362 +       case FLOW_OFFLOAD_DIR_ORIGINAL:
 363 +               addr = ip6h->daddr;
 364 +               new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6;
 365 +               ip6h->daddr = new_addr;
 366 +               break;
 367 +       case FLOW_OFFLOAD_DIR_REPLY:
 368 +               addr = ip6h->saddr;
 369 +               new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6;
 370 +               ip6h->saddr = new_addr;
 371 +               break;
 372 +       default:
 373 +               return -1;
 374 +       }
 375 +
 376 +       return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
 377 +}
 378 +
 379 +static int nf_flow_nat_ipv6(const struct flow_offload *flow,
 380 +                           struct sk_buff *skb,
 381 +                           enum flow_offload_tuple_dir dir)
 382 +{
 383 +       struct ipv6hdr *ip6h = ipv6_hdr(skb);
 384 +       unsigned int thoff = sizeof(*ip6h);
 385 +
 386 +       if (flow->flags & FLOW_OFFLOAD_SNAT &&
 387 +           (nf_flow_snat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
 388 +            nf_flow_snat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
 389 +               return -1;
 390 +       if (flow->flags & FLOW_OFFLOAD_DNAT &&
 391 +           (nf_flow_dnat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
 392 +            nf_flow_dnat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
 393 +               return -1;
 394 +
 395 +       return 0;
 396 +}
 397 +
 398 +static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
 399 +                             struct flow_offload_tuple *tuple)
 400 +{
 401 +       struct flow_ports *ports;
 402 +       struct ipv6hdr *ip6h;
 403 +       unsigned int thoff;
 404 +
 405 +       if (!pskb_may_pull(skb, sizeof(*ip6h)))
 406 +               return -1;
 407 +
 408 +       ip6h = ipv6_hdr(skb);
 409 +
 410 +       if (ip6h->nexthdr != IPPROTO_TCP &&
 411 +           ip6h->nexthdr != IPPROTO_UDP)
 412 +               return -1;
 413 +
 414 +       thoff = sizeof(*ip6h);
 415 +       if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
 416 +               return -1;
 417 +
 418 +       ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
 419 +
 420 +       tuple->src_v6           = ip6h->saddr;
 421 +       tuple->dst_v6           = ip6h->daddr;
 422 +       tuple->src_port         = ports->source;
 423 +       tuple->dst_port         = ports->dest;
 424 +       tuple->l3proto          = AF_INET6;
 425 +       tuple->l4proto          = ip6h->nexthdr;
 426 +       tuple->iifidx           = dev->ifindex;
 427 +
 428 +       return 0;
 429 +}
 430 +
 431 +unsigned int
 432 +nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
 433 +                         const struct nf_hook_state *state)
 434 +{
 435 +       struct flow_offload_tuple_rhash *tuplehash;
 436 +       struct nf_flowtable *flow_table = priv;
 437 +       struct flow_offload_tuple tuple = {};
 438 +       enum flow_offload_tuple_dir dir;
 439 +       struct flow_offload *flow;
 440 +       struct net_device *outdev;
 441 +       struct in6_addr *nexthop;
 442 +       struct ipv6hdr *ip6h;
 443 +       struct rt6_info *rt;
 444 +
 445 +       if (skb->protocol != htons(ETH_P_IPV6))
 446 +               return NF_ACCEPT;
 447 +
 448 +       if (nf_flow_tuple_ipv6(skb, state->in, &tuple) < 0)
 449 +               return NF_ACCEPT;
 450 +
 451 +       tuplehash = flow_offload_lookup(flow_table, &tuple);
 452 +       if (tuplehash == NULL)
 453 +               return NF_ACCEPT;
 454 +
 455 +       outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx);
 456 +       if (!outdev)
 457 +               return NF_ACCEPT;
 458 +
 459 +       dir = tuplehash->tuple.dir;
 460 +       flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
 461 +       rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache;
 462 +
 463 +       if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
 464 +               return NF_ACCEPT;
 465 +
 466 +       if (skb_try_make_writable(skb, sizeof(*ip6h)))
 467 +               return NF_DROP;
 468 +
 469 +       if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
 470 +           nf_flow_nat_ipv6(flow, skb, dir) < 0)
 471 +               return NF_DROP;
 472 +
 473 +       flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
 474 +       ip6h = ipv6_hdr(skb);
 475 +       ip6h->hop_limit--;
 476 +
 477 +       skb->dev = outdev;
 478 +       nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6);
 479 +       neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb);
 480 +
 481 +       return NF_STOLEN;
 482 +}
 483 +EXPORT_SYMBOL_GPL(nf_flow_offload_ipv6_hook);