Commit 323e395f authored by David S. Miller's avatar David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains Netfilter updates for nf-next:

1) Add IPS_HW_OFFLOAD status bit, from Bodong Wang.

2) Remove 128-bit limit on the set element data area, rise it
   to 64 bytes.

3) Report EOPNOTSUPP for unsupported NAT types and flags.

4) Set up nft_nat flags from the control plane path.

5) Add helper functions to set up the nf_nat_range2 structure.

6) Add netmap support for nft_nat.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 7263d72b 3ff7ddb1
...@@ -243,6 +243,10 @@ struct nft_set_elem { ...@@ -243,6 +243,10 @@ struct nft_set_elem {
u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)]; u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
struct nft_data val; struct nft_data val;
} key_end; } key_end;
union {
u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
struct nft_data val;
} data;
void *priv; void *priv;
}; };
......
...@@ -114,15 +114,19 @@ enum ip_conntrack_status { ...@@ -114,15 +114,19 @@ enum ip_conntrack_status {
IPS_OFFLOAD_BIT = 14, IPS_OFFLOAD_BIT = 14,
IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT), IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT),
/* Conntrack has been offloaded to hardware. */
IPS_HW_OFFLOAD_BIT = 15,
IPS_HW_OFFLOAD = (1 << IPS_HW_OFFLOAD_BIT),
/* Be careful here, modifying these bits can make things messy, /* Be careful here, modifying these bits can make things messy,
* so don't let users modify them directly. * so don't let users modify them directly.
*/ */
IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK | IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |
IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING | IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING |
IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_UNTRACKED | IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_UNTRACKED |
IPS_OFFLOAD), IPS_OFFLOAD | IPS_HW_OFFLOAD),
__IPS_MAX_BIT = 15, __IPS_MAX_BIT = 16,
}; };
/* Connection tracking event types */ /* Connection tracking event types */
......
...@@ -11,6 +11,7 @@ ...@@ -11,6 +11,7 @@
#define NF_NAT_RANGE_PERSISTENT (1 << 3) #define NF_NAT_RANGE_PERSISTENT (1 << 3)
#define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4) #define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4)
#define NF_NAT_RANGE_PROTO_OFFSET (1 << 5) #define NF_NAT_RANGE_PROTO_OFFSET (1 << 5)
#define NF_NAT_RANGE_NETMAP (1 << 6)
#define NF_NAT_RANGE_PROTO_RANDOM_ALL \ #define NF_NAT_RANGE_PROTO_RANDOM_ALL \
(NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY) (NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)
...@@ -18,7 +19,8 @@ ...@@ -18,7 +19,8 @@
#define NF_NAT_RANGE_MASK \ #define NF_NAT_RANGE_MASK \
(NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED | \ (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED | \
NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT | \ NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT | \
NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET) NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET | \
NF_NAT_RANGE_NETMAP)
struct nf_nat_ipv4_range { struct nf_nat_ipv4_range {
unsigned int flags; unsigned int flags;
......
...@@ -348,7 +348,9 @@ static int ct_seq_show(struct seq_file *s, void *v) ...@@ -348,7 +348,9 @@ static int ct_seq_show(struct seq_file *s, void *v)
if (seq_print_acct(s, ct, IP_CT_DIR_REPLY)) if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
goto release; goto release;
if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) if (test_bit(IPS_HW_OFFLOAD_BIT, &ct->status))
seq_puts(s, "[HW_OFFLOAD] ");
else if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
seq_puts(s, "[OFFLOAD] "); seq_puts(s, "[OFFLOAD] ");
else if (test_bit(IPS_ASSURED_BIT, &ct->status)) else if (test_bit(IPS_ASSURED_BIT, &ct->status))
seq_puts(s, "[ASSURED] "); seq_puts(s, "[ASSURED] ");
......
...@@ -754,12 +754,15 @@ static void flow_offload_work_add(struct flow_offload_work *offload) ...@@ -754,12 +754,15 @@ static void flow_offload_work_add(struct flow_offload_work *offload)
err = flow_offload_rule_add(offload, flow_rule); err = flow_offload_rule_add(offload, flow_rule);
if (err < 0) if (err < 0)
set_bit(NF_FLOW_HW_REFRESH, &offload->flow->flags); set_bit(NF_FLOW_HW_REFRESH, &offload->flow->flags);
else
set_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);
nf_flow_offload_destroy(flow_rule); nf_flow_offload_destroy(flow_rule);
} }
static void flow_offload_work_del(struct flow_offload_work *offload) static void flow_offload_work_del(struct flow_offload_work *offload)
{ {
clear_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);
flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_ORIGINAL); flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_ORIGINAL);
flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_REPLY); flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_REPLY);
set_bit(NF_FLOW_HW_DEAD, &offload->flow->flags); set_bit(NF_FLOW_HW_DEAD, &offload->flow->flags);
......
...@@ -4669,6 +4669,25 @@ static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set, ...@@ -4669,6 +4669,25 @@ static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set,
return 0; return 0;
} }
static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set,
struct nft_data_desc *desc,
struct nft_data *data,
struct nlattr *attr)
{
int err;
err = nft_data_init(ctx, data, NFT_DATA_VALUE_MAXLEN, desc, attr);
if (err < 0)
return err;
if (desc->type != NFT_DATA_VERDICT && desc->len != set->dlen) {
nft_data_release(data, desc->type);
return -EINVAL;
}
return 0;
}
static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set, static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
const struct nlattr *attr) const struct nlattr *attr)
{ {
...@@ -4946,7 +4965,6 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, ...@@ -4946,7 +4965,6 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
struct nft_expr *expr = NULL; struct nft_expr *expr = NULL;
struct nft_userdata *udata; struct nft_userdata *udata;
struct nft_data_desc desc; struct nft_data_desc desc;
struct nft_data data;
enum nft_registers dreg; enum nft_registers dreg;
struct nft_trans *trans; struct nft_trans *trans;
u32 flags = 0; u32 flags = 0;
...@@ -5072,15 +5090,11 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, ...@@ -5072,15 +5090,11 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
} }
if (nla[NFTA_SET_ELEM_DATA] != NULL) { if (nla[NFTA_SET_ELEM_DATA] != NULL) {
err = nft_data_init(ctx, &data, sizeof(data), &desc, err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val,
nla[NFTA_SET_ELEM_DATA]); nla[NFTA_SET_ELEM_DATA]);
if (err < 0) if (err < 0)
goto err_parse_key_end; goto err_parse_key_end;
err = -EINVAL;
if (set->dtype != NFT_DATA_VERDICT && desc.len != set->dlen)
goto err_parse_data;
dreg = nft_type_to_reg(set->dtype); dreg = nft_type_to_reg(set->dtype);
list_for_each_entry(binding, &set->bindings, list) { list_for_each_entry(binding, &set->bindings, list) {
struct nft_ctx bind_ctx = { struct nft_ctx bind_ctx = {
...@@ -5094,14 +5108,14 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, ...@@ -5094,14 +5108,14 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
continue; continue;
err = nft_validate_register_store(&bind_ctx, dreg, err = nft_validate_register_store(&bind_ctx, dreg,
&data, &elem.data.val,
desc.type, desc.len); desc.type, desc.len);
if (err < 0) if (err < 0)
goto err_parse_data; goto err_parse_data;
if (desc.type == NFT_DATA_VERDICT && if (desc.type == NFT_DATA_VERDICT &&
(data.verdict.code == NFT_GOTO || (elem.data.val.verdict.code == NFT_GOTO ||
data.verdict.code == NFT_JUMP)) elem.data.val.verdict.code == NFT_JUMP))
nft_validate_state_update(ctx->net, nft_validate_state_update(ctx->net,
NFT_VALIDATE_NEED); NFT_VALIDATE_NEED);
} }
...@@ -5123,7 +5137,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, ...@@ -5123,7 +5137,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
err = -ENOMEM; err = -ENOMEM;
elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
elem.key_end.val.data, data.data, elem.key_end.val.data, elem.data.val.data,
timeout, expiration, GFP_KERNEL); timeout, expiration, GFP_KERNEL);
if (elem.priv == NULL) if (elem.priv == NULL)
goto err_parse_data; goto err_parse_data;
...@@ -5201,7 +5215,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, ...@@ -5201,7 +5215,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
nf_tables_set_elem_destroy(ctx, set, elem.priv); nf_tables_set_elem_destroy(ctx, set, elem.priv);
err_parse_data: err_parse_data:
if (nla[NFTA_SET_ELEM_DATA] != NULL) if (nla[NFTA_SET_ELEM_DATA] != NULL)
nft_data_release(&data, desc.type); nft_data_release(&elem.data.val, desc.type);
err_parse_key_end: err_parse_key_end:
nft_data_release(&elem.key_end.val, NFT_DATA_VALUE); nft_data_release(&elem.key_end.val, NFT_DATA_VALUE);
err_parse_key: err_parse_key:
......
...@@ -30,6 +30,76 @@ struct nft_nat { ...@@ -30,6 +30,76 @@ struct nft_nat {
u16 flags; u16 flags;
}; };
static void nft_nat_setup_addr(struct nf_nat_range2 *range,
const struct nft_regs *regs,
const struct nft_nat *priv)
{
switch (priv->family) {
case AF_INET:
range->min_addr.ip = (__force __be32)
regs->data[priv->sreg_addr_min];
range->max_addr.ip = (__force __be32)
regs->data[priv->sreg_addr_max];
break;
case AF_INET6:
memcpy(range->min_addr.ip6, &regs->data[priv->sreg_addr_min],
sizeof(range->min_addr.ip6));
memcpy(range->max_addr.ip6, &regs->data[priv->sreg_addr_max],
sizeof(range->max_addr.ip6));
break;
}
}
static void nft_nat_setup_proto(struct nf_nat_range2 *range,
const struct nft_regs *regs,
const struct nft_nat *priv)
{
range->min_proto.all = (__force __be16)
nft_reg_load16(&regs->data[priv->sreg_proto_min]);
range->max_proto.all = (__force __be16)
nft_reg_load16(&regs->data[priv->sreg_proto_max]);
}
static void nft_nat_setup_netmap(struct nf_nat_range2 *range,
const struct nft_pktinfo *pkt,
const struct nft_nat *priv)
{
struct sk_buff *skb = pkt->skb;
union nf_inet_addr new_addr;
__be32 netmask;
int i, len = 0;
switch (priv->type) {
case NFT_NAT_SNAT:
if (nft_pf(pkt) == NFPROTO_IPV4) {
new_addr.ip = ip_hdr(skb)->saddr;
len = sizeof(struct in_addr);
} else {
new_addr.in6 = ipv6_hdr(skb)->saddr;
len = sizeof(struct in6_addr);
}
break;
case NFT_NAT_DNAT:
if (nft_pf(pkt) == NFPROTO_IPV4) {
new_addr.ip = ip_hdr(skb)->daddr;
len = sizeof(struct in_addr);
} else {
new_addr.in6 = ipv6_hdr(skb)->daddr;
len = sizeof(struct in6_addr);
}
break;
}
for (i = 0; i < len / sizeof(__be32); i++) {
netmask = ~(range->min_addr.ip6[i] ^ range->max_addr.ip6[i]);
new_addr.ip6[i] &= ~netmask;
new_addr.ip6[i] |= range->min_addr.ip6[i] & netmask;
}
range->min_addr = new_addr;
range->max_addr = new_addr;
}
static void nft_nat_eval(const struct nft_expr *expr, static void nft_nat_eval(const struct nft_expr *expr,
struct nft_regs *regs, struct nft_regs *regs,
const struct nft_pktinfo *pkt) const struct nft_pktinfo *pkt)
...@@ -40,33 +110,17 @@ static void nft_nat_eval(const struct nft_expr *expr, ...@@ -40,33 +110,17 @@ static void nft_nat_eval(const struct nft_expr *expr,
struct nf_nat_range2 range; struct nf_nat_range2 range;
memset(&range, 0, sizeof(range)); memset(&range, 0, sizeof(range));
if (priv->sreg_addr_min) {
if (priv->family == AF_INET) {
range.min_addr.ip = (__force __be32)
regs->data[priv->sreg_addr_min];
range.max_addr.ip = (__force __be32)
regs->data[priv->sreg_addr_max];
} else { if (priv->sreg_addr_min) {
memcpy(range.min_addr.ip6, nft_nat_setup_addr(&range, regs, priv);
&regs->data[priv->sreg_addr_min], if (priv->flags & NF_NAT_RANGE_NETMAP)
sizeof(range.min_addr.ip6)); nft_nat_setup_netmap(&range, pkt, priv);
memcpy(range.max_addr.ip6,
&regs->data[priv->sreg_addr_max],
sizeof(range.max_addr.ip6));
}
range.flags |= NF_NAT_RANGE_MAP_IPS;
} }
if (priv->sreg_proto_min) { if (priv->sreg_proto_min)
range.min_proto.all = (__force __be16)nft_reg_load16( nft_nat_setup_proto(&range, regs, priv);
&regs->data[priv->sreg_proto_min]);
range.max_proto.all = (__force __be16)nft_reg_load16(
&regs->data[priv->sreg_proto_max]);
range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
}
range.flags |= priv->flags; range.flags = priv->flags;
regs->verdict.code = nf_nat_setup_info(ct, &range, priv->type); regs->verdict.code = nf_nat_setup_info(ct, &range, priv->type);
} }
...@@ -129,7 +183,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, ...@@ -129,7 +183,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
priv->type = NF_NAT_MANIP_DST; priv->type = NF_NAT_MANIP_DST;
break; break;
default: default:
return -EINVAL; return -EOPNOTSUPP;
} }
if (tb[NFTA_NAT_FAMILY] == NULL) if (tb[NFTA_NAT_FAMILY] == NULL)
...@@ -169,6 +223,8 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, ...@@ -169,6 +223,8 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
} else { } else {
priv->sreg_addr_max = priv->sreg_addr_min; priv->sreg_addr_max = priv->sreg_addr_min;
} }
priv->flags |= NF_NAT_RANGE_MAP_IPS;
} }
plen = sizeof_field(struct nf_nat_range, min_addr.all); plen = sizeof_field(struct nf_nat_range, min_addr.all);
...@@ -191,12 +247,14 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, ...@@ -191,12 +247,14 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
} else { } else {
priv->sreg_proto_max = priv->sreg_proto_min; priv->sreg_proto_max = priv->sreg_proto_min;
} }
priv->flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
} }
if (tb[NFTA_NAT_FLAGS]) { if (tb[NFTA_NAT_FLAGS]) {
priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS])); priv->flags |= ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS]));
if (priv->flags & ~NF_NAT_RANGE_MASK) if (priv->flags & ~NF_NAT_RANGE_MASK)
return -EINVAL; return -EOPNOTSUPP;
} }
return nf_ct_netns_get(ctx->net, family); return nf_ct_netns_get(ctx->net, family);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment