projects / openwrt / staging / adrian.git / blob
? search:


e25a66f934f71198d65c048babd598fd450678ab
[openwrt/staging/adrian.git] /
1 From: Felix Fietkau <nbd@nbd.name>
2 Date: Sat, 17 Feb 2018 11:49:44 +0100
3 Subject: [PATCH] netfilter: nf_flow_table: move ipv4 offload hook code to
4 nf_flow_table
5
6 Allows some minor code sharing with the ipv6 hook code and is also
7 useful as preparation for adding iptables support for offload
8
9 Signed-off-by: Felix Fietkau <nbd@nbd.name>
10 ---
11 create mode 100644 net/netfilter/nf_flow_table_ip.c
12
13 --- a/net/ipv4/netfilter/nf_flow_table_ipv4.c
14 +++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c
15 @@ -2,248 +2,8 @@
16 #include <linux/init.h>
17 #include <linux/module.h>
18 #include <linux/netfilter.h>
19 -#include <linux/rhashtable.h>
20 -#include <linux/ip.h>
21 -#include <linux/netdevice.h>
22 -#include <net/ip.h>
23 -#include <net/neighbour.h>
24 #include <net/netfilter/nf_flow_table.h>
25 #include <net/netfilter/nf_tables.h>
26 -/* For layer 4 checksum field offset. */
27 -#include <linux/tcp.h>
28 -#include <linux/udp.h>
29 -
30 -static int nf_flow_nat_ip_tcp(struct sk_buff *skb, unsigned int thoff,
31 - __be32 addr, __be32 new_addr)
32 -{
33 - struct tcphdr *tcph;
34 -
35 - if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
36 - skb_try_make_writable(skb, thoff + sizeof(*tcph)))
37 - return -1;
38 -
39 - tcph = (void *)(skb_network_header(skb) + thoff);
40 - inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr, true);
41 -
42 - return 0;
43 -}
44 -
45 -static int nf_flow_nat_ip_udp(struct sk_buff *skb, unsigned int thoff,
46 - __be32 addr, __be32 new_addr)
47 -{
48 - struct udphdr *udph;
49 -
50 - if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
51 - skb_try_make_writable(skb, thoff + sizeof(*udph)))
52 - return -1;
53 -
54 - udph = (void *)(skb_network_header(skb) + thoff);
55 - if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
56 - inet_proto_csum_replace4(&udph->check, skb, addr,
57 - new_addr, true);
58 - if (!udph->check)
59 - udph->check = CSUM_MANGLED_0;
60 - }
61 -
62 - return 0;
63 -}
64 -
65 -static int nf_flow_nat_ip_l4proto(struct sk_buff *skb, struct iphdr *iph,
66 - unsigned int thoff, __be32 addr,
67 - __be32 new_addr)
68 -{
69 - switch (iph->protocol) {
70 - case IPPROTO_TCP:
71 - if (nf_flow_nat_ip_tcp(skb, thoff, addr, new_addr) < 0)
72 - return NF_DROP;
73 - break;
74 - case IPPROTO_UDP:
75 - if (nf_flow_nat_ip_udp(skb, thoff, addr, new_addr) < 0)
76 - return NF_DROP;
77 - break;
78 - }
79 -
80 - return 0;
81 -}
82 -
83 -static int nf_flow_snat_ip(const struct flow_offload *flow, struct sk_buff *skb,
84 - struct iphdr *iph, unsigned int thoff,
85 - enum flow_offload_tuple_dir dir)
86 -{
87 - __be32 addr, new_addr;
88 -
89 - switch (dir) {
90 - case FLOW_OFFLOAD_DIR_ORIGINAL:
91 - addr = iph->saddr;
92 - new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4.s_addr;
93 - iph->saddr = new_addr;
94 - break;
95 - case FLOW_OFFLOAD_DIR_REPLY:
96 - addr = iph->daddr;
97 - new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4.s_addr;
98 - iph->daddr = new_addr;
99 - break;
100 - default:
101 - return -1;
102 - }
103 - csum_replace4(&iph->check, addr, new_addr);
104 -
105 - return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
106 -}
107 -
108 -static int nf_flow_dnat_ip(const struct flow_offload *flow, struct sk_buff *skb,
109 - struct iphdr *iph, unsigned int thoff,
110 - enum flow_offload_tuple_dir dir)
111 -{
112 - __be32 addr, new_addr;
113 -
114 - switch (dir) {
115 - case FLOW_OFFLOAD_DIR_ORIGINAL:
116 - addr = iph->daddr;
117 - new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4.s_addr;
118 - iph->daddr = new_addr;
119 - break;
120 - case FLOW_OFFLOAD_DIR_REPLY:
121 - addr = iph->saddr;
122 - new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4.s_addr;
123 - iph->saddr = new_addr;
124 - break;
125 - default:
126 - return -1;
127 - }
128 -
129 - return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
130 -}
131 -
132 -static int nf_flow_nat_ip(const struct flow_offload *flow, struct sk_buff *skb,
133 - enum flow_offload_tuple_dir dir)
134 -{
135 - struct iphdr *iph = ip_hdr(skb);
136 - unsigned int thoff = iph->ihl * 4;
137 -
138 - if (flow->flags & FLOW_OFFLOAD_SNAT &&
139 - (nf_flow_snat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
140 - nf_flow_snat_ip(flow, skb, iph, thoff, dir) < 0))
141 - return -1;
142 - if (flow->flags & FLOW_OFFLOAD_DNAT &&
143 - (nf_flow_dnat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
144 - nf_flow_dnat_ip(flow, skb, iph, thoff, dir) < 0))
145 - return -1;
146 -
147 - return 0;
148 -}
149 -
150 -static bool ip_has_options(unsigned int thoff)
151 -{
152 - return thoff != sizeof(struct iphdr);
153 -}
154 -
155 -static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev,
156 - struct flow_offload_tuple *tuple)
157 -{
158 - struct flow_ports *ports;
159 - unsigned int thoff;
160 - struct iphdr *iph;
161 -
162 - if (!pskb_may_pull(skb, sizeof(*iph)))
163 - return -1;
164 -
165 - iph = ip_hdr(skb);
166 - thoff = iph->ihl * 4;
167 -
168 - if (ip_is_fragment(iph) ||
169 - unlikely(ip_has_options(thoff)))
170 - return -1;
171 -
172 - if (iph->protocol != IPPROTO_TCP &&
173 - iph->protocol != IPPROTO_UDP)
174 - return -1;
175 -
176 - thoff = iph->ihl * 4;
177 - if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
178 - return -1;
179 -
180 - ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
181 -
182 - tuple->src_v4.s_addr = iph->saddr;
183 - tuple->dst_v4.s_addr = iph->daddr;
184 - tuple->src_port = ports->source;
185 - tuple->dst_port = ports->dest;
186 - tuple->l3proto = AF_INET;
187 - tuple->l4proto = iph->protocol;
188 - tuple->iifidx = dev->ifindex;
189 -
190 - return 0;
191 -}
192 -
193 -/* Based on ip_exceeds_mtu(). */
194 -static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
195 -{
196 - if (skb->len <= mtu)
197 - return false;
198 -
199 - if ((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0)
200 - return false;
201 -
202 - if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
203 - return false;
204 -
205 - return true;
206 -}
207 -
208 -unsigned int
209 -nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
210 - const struct nf_hook_state *state)
211 -{
212 - struct flow_offload_tuple_rhash *tuplehash;
213 - struct nf_flowtable *flow_table = priv;
214 - struct flow_offload_tuple tuple = {};
215 - enum flow_offload_tuple_dir dir;
216 - struct flow_offload *flow;
217 - struct net_device *outdev;
218 - const struct rtable *rt;
219 - struct iphdr *iph;
220 - __be32 nexthop;
221 -
222 - if (skb->protocol != htons(ETH_P_IP))
223 - return NF_ACCEPT;
224 -
225 - if (nf_flow_tuple_ip(skb, state->in, &tuple) < 0)
226 - return NF_ACCEPT;
227 -
228 - tuplehash = flow_offload_lookup(flow_table, &tuple);
229 - if (tuplehash == NULL)
230 - return NF_ACCEPT;
231 -
232 - outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx);
233 - if (!outdev)
234 - return NF_ACCEPT;
235 -
236 - dir = tuplehash->tuple.dir;
237 - flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
238 - rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache;
239 -
240 - if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
241 - return NF_ACCEPT;
242 -
243 - if (skb_try_make_writable(skb, sizeof(*iph)))
244 - return NF_DROP;
245 -
246 - if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
247 - nf_flow_nat_ip(flow, skb, dir) < 0)
248 - return NF_DROP;
249 -
250 - flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
251 - iph = ip_hdr(skb);
252 - ip_decrease_ttl(iph);
253 -
254 - skb->dev = outdev;
255 - nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr);
256 - neigh_xmit(NEIGH_ARP_TABLE, outdev, &nexthop, skb);
257 -
258 - return NF_STOLEN;
259 -}
260 -EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook);
261
262 static struct nf_flowtable_type flowtable_ipv4 = {
263 .family = NFPROTO_IPV4,
264 --- a/net/netfilter/Makefile
265 +++ b/net/netfilter/Makefile
266 @@ -113,7 +113,7 @@ obj-$(CONFIG_NFT_FWD_NETDEV) += nft_fwd_
267
268 # flow table infrastructure
269 obj-$(CONFIG_NF_FLOW_TABLE) += nf_flow_table.o
270 -nf_flow_table-objs := nf_flow_table_core.o
271 +nf_flow_table-objs := nf_flow_table_core.o nf_flow_table_ip.o
272
273 obj-$(CONFIG_NF_FLOW_TABLE_INET) += nf_flow_table_inet.o
274
275 --- /dev/null
276 +++ b/net/netfilter/nf_flow_table_ip.c
277 @@ -0,0 +1,245 @@
278 +#include <linux/kernel.h>
279 +#include <linux/init.h>
280 +#include <linux/module.h>
281 +#include <linux/netfilter.h>
282 +#include <linux/rhashtable.h>
283 +#include <linux/ip.h>
284 +#include <linux/netdevice.h>
285 +#include <net/ip.h>
286 +#include <net/neighbour.h>
287 +#include <net/netfilter/nf_flow_table.h>
288 +/* For layer 4 checksum field offset. */
289 +#include <linux/tcp.h>
290 +#include <linux/udp.h>
291 +
292 +static int nf_flow_nat_ip_tcp(struct sk_buff *skb, unsigned int thoff,
293 + __be32 addr, __be32 new_addr)
294 +{
295 + struct tcphdr *tcph;
296 +
297 + if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
298 + skb_try_make_writable(skb, thoff + sizeof(*tcph)))
299 + return -1;
300 +
301 + tcph = (void *)(skb_network_header(skb) + thoff);
302 + inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr, true);
303 +
304 + return 0;
305 +}
306 +
307 +static int nf_flow_nat_ip_udp(struct sk_buff *skb, unsigned int thoff,
308 + __be32 addr, __be32 new_addr)
309 +{
310 + struct udphdr *udph;
311 +
312 + if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
313 + skb_try_make_writable(skb, thoff + sizeof(*udph)))
314 + return -1;
315 +
316 + udph = (void *)(skb_network_header(skb) + thoff);
317 + if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
318 + inet_proto_csum_replace4(&udph->check, skb, addr,
319 + new_addr, true);
320 + if (!udph->check)
321 + udph->check = CSUM_MANGLED_0;
322 + }
323 +
324 + return 0;
325 +}
326 +
327 +static int nf_flow_nat_ip_l4proto(struct sk_buff *skb, struct iphdr *iph,
328 + unsigned int thoff, __be32 addr,
329 + __be32 new_addr)
330 +{
331 + switch (iph->protocol) {
332 + case IPPROTO_TCP:
333 + if (nf_flow_nat_ip_tcp(skb, thoff, addr, new_addr) < 0)
334 + return NF_DROP;
335 + break;
336 + case IPPROTO_UDP:
337 + if (nf_flow_nat_ip_udp(skb, thoff, addr, new_addr) < 0)
338 + return NF_DROP;
339 + break;
340 + }
341 +
342 + return 0;
343 +}
344 +
345 +static int nf_flow_snat_ip(const struct flow_offload *flow, struct sk_buff *skb,
346 + struct iphdr *iph, unsigned int thoff,
347 + enum flow_offload_tuple_dir dir)
348 +{
349 + __be32 addr, new_addr;
350 +
351 + switch (dir) {
352 + case FLOW_OFFLOAD_DIR_ORIGINAL:
353 + addr = iph->saddr;
354 + new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4.s_addr;
355 + iph->saddr = new_addr;
356 + break;
357 + case FLOW_OFFLOAD_DIR_REPLY:
358 + addr = iph->daddr;
359 + new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4.s_addr;
360 + iph->daddr = new_addr;
361 + break;
362 + default:
363 + return -1;
364 + }
365 + csum_replace4(&iph->check, addr, new_addr);
366 +
367 + return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
368 +}
369 +
370 +static int nf_flow_dnat_ip(const struct flow_offload *flow, struct sk_buff *skb,
371 + struct iphdr *iph, unsigned int thoff,
372 + enum flow_offload_tuple_dir dir)
373 +{
374 + __be32 addr, new_addr;
375 +
376 + switch (dir) {
377 + case FLOW_OFFLOAD_DIR_ORIGINAL:
378 + addr = iph->daddr;
379 + new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4.s_addr;
380 + iph->daddr = new_addr;
381 + break;
382 + case FLOW_OFFLOAD_DIR_REPLY:
383 + addr = iph->saddr;
384 + new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4.s_addr;
385 + iph->saddr = new_addr;
386 + break;
387 + default:
388 + return -1;
389 + }
390 +
391 + return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
392 +}
393 +
394 +static int nf_flow_nat_ip(const struct flow_offload *flow, struct sk_buff *skb,
395 + enum flow_offload_tuple_dir dir)
396 +{
397 + struct iphdr *iph = ip_hdr(skb);
398 + unsigned int thoff = iph->ihl * 4;
399 +
400 + if (flow->flags & FLOW_OFFLOAD_SNAT &&
401 + (nf_flow_snat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
402 + nf_flow_snat_ip(flow, skb, iph, thoff, dir) < 0))
403 + return -1;
404 + if (flow->flags & FLOW_OFFLOAD_DNAT &&
405 + (nf_flow_dnat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
406 + nf_flow_dnat_ip(flow, skb, iph, thoff, dir) < 0))
407 + return -1;
408 +
409 + return 0;
410 +}
411 +
412 +static bool ip_has_options(unsigned int thoff)
413 +{
414 + return thoff != sizeof(struct iphdr);
415 +}
416 +
417 +static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev,
418 + struct flow_offload_tuple *tuple)
419 +{
420 + struct flow_ports *ports;
421 + unsigned int thoff;
422 + struct iphdr *iph;
423 +
424 + if (!pskb_may_pull(skb, sizeof(*iph)))
425 + return -1;
426 +
427 + iph = ip_hdr(skb);
428 + thoff = iph->ihl * 4;
429 +
430 + if (ip_is_fragment(iph) ||
431 + unlikely(ip_has_options(thoff)))
432 + return -1;
433 +
434 + if (iph->protocol != IPPROTO_TCP &&
435 + iph->protocol != IPPROTO_UDP)
436 + return -1;
437 +
438 + thoff = iph->ihl * 4;
439 + if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
440 + return -1;
441 +
442 + ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
443 +
444 + tuple->src_v4.s_addr = iph->saddr;
445 + tuple->dst_v4.s_addr = iph->daddr;
446 + tuple->src_port = ports->source;
447 + tuple->dst_port = ports->dest;
448 + tuple->l3proto = AF_INET;
449 + tuple->l4proto = iph->protocol;
450 + tuple->iifidx = dev->ifindex;
451 +
452 + return 0;
453 +}
454 +
455 +/* Based on ip_exceeds_mtu(). */
456 +static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
457 +{
458 + if (skb->len <= mtu)
459 + return false;
460 +
461 + if ((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0)
462 + return false;
463 +
464 + if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
465 + return false;
466 +
467 + return true;
468 +}
469 +
470 +unsigned int
471 +nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
472 + const struct nf_hook_state *state)
473 +{
474 + struct flow_offload_tuple_rhash *tuplehash;
475 + struct nf_flowtable *flow_table = priv;
476 + struct flow_offload_tuple tuple = {};
477 + enum flow_offload_tuple_dir dir;
478 + struct flow_offload *flow;
479 + struct net_device *outdev;
480 + const struct rtable *rt;
481 + struct iphdr *iph;
482 + __be32 nexthop;
483 +
484 + if (skb->protocol != htons(ETH_P_IP))
485 + return NF_ACCEPT;
486 +
487 + if (nf_flow_tuple_ip(skb, state->in, &tuple) < 0)
488 + return NF_ACCEPT;
489 +
490 + tuplehash = flow_offload_lookup(flow_table, &tuple);
491 + if (tuplehash == NULL)
492 + return NF_ACCEPT;
493 +
494 + outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx);
495 + if (!outdev)
496 + return NF_ACCEPT;
497 +
498 + dir = tuplehash->tuple.dir;
499 + flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
500 + rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache;
501 +
502 + if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
503 + return NF_ACCEPT;
504 +
505 + if (skb_try_make_writable(skb, sizeof(*iph)))
506 + return NF_DROP;
507 +
508 + if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
509 + nf_flow_nat_ip(flow, skb, dir) < 0)
510 + return NF_DROP;
511 +
512 + flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
513 + iph = ip_hdr(skb);
514 + ip_decrease_ttl(iph);
515 +
516 + skb->dev = outdev;
517 + nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr);
518 + neigh_xmit(NEIGH_ARP_TABLE, outdev, &nexthop, skb);
519 +
520 + return NF_STOLEN;
521 +}
522 +EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook);
Staging tree of Adrian Schmutzler