mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 

Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains Netfilter updates for nf-next:

1) Add IPS_HW_OFFLOAD status bit, from Bodong Wang.

2) Remove 128-bit limit on the set element data area, rise it
   to 64 bytes.

3) Report EOPNOTSUPP for unsupported NAT types and flags.

4) Set up nft_nat flags from the control plane path.

5) Add helper functions to set up the nf_nat_range2 structure.

6) Add netmap support for nft_nat.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2020-04-29 14:14:44 -07:00
parent 7263d72bec 3ff7ddb135
commit 323e395f19
7 changed files with 129 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
include/net/netfilter/nf_tables.h
View File

@ -243,6 +243,10 @@ struct nft_set_elem {
u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
struct nft_data val;
} key_end;
union {
u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
struct nft_data val;
} data;
void *priv;
};

8
include/uapi/linux/netfilter/nf_conntrack_common.h
View File

@ -114,15 +114,19 @@ enum ip_conntrack_status {
IPS_OFFLOAD_BIT = 14,
IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT),
/* Conntrack has been offloaded to hardware. */
IPS_HW_OFFLOAD_BIT = 15,
IPS_HW_OFFLOAD = (1 << IPS_HW_OFFLOAD_BIT),
/* Be careful here, modifying these bits can make things messy,
* so don't let users modify them directly.
*/
IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |
IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING |
IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_UNTRACKED |
IPS_OFFLOAD),
IPS_OFFLOAD | IPS_HW_OFFLOAD),
__IPS_MAX_BIT = 15,
__IPS_MAX_BIT = 16,
};
/* Connection tracking event types */

4
include/uapi/linux/netfilter/nf_nat.h
View File

@ -11,6 +11,7 @@
#define NF_NAT_RANGE_PERSISTENT (1 << 3)
#define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4)
#define NF_NAT_RANGE_PROTO_OFFSET (1 << 5)
#define NF_NAT_RANGE_NETMAP (1 << 6)
#define NF_NAT_RANGE_PROTO_RANDOM_ALL \
(NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)
@ -18,7 +19,8 @@
#define NF_NAT_RANGE_MASK \
(NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED | \
NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT | \
NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET)
NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET | \
NF_NAT_RANGE_NETMAP)
struct nf_nat_ipv4_range {
unsigned int flags;

4
net/netfilter/nf_conntrack_standalone.c
View File

@ -348,7 +348,9 @@ static int ct_seq_show(struct seq_file *s, void *v)
if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
goto release;
if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
if (test_bit(IPS_HW_OFFLOAD_BIT, &ct->status))
seq_puts(s, "[HW_OFFLOAD] ");
else if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
seq_puts(s, "[OFFLOAD] ");
else if (test_bit(IPS_ASSURED_BIT, &ct->status))
seq_puts(s, "[ASSURED] ");

3
net/netfilter/nf_flow_table_offload.c
View File

@ -754,12 +754,15 @@ static void flow_offload_work_add(struct flow_offload_work *offload)
err = flow_offload_rule_add(offload, flow_rule);
if (err < 0)
set_bit(NF_FLOW_HW_REFRESH, &offload->flow->flags);
else
set_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);
nf_flow_offload_destroy(flow_rule);
}
static void flow_offload_work_del(struct flow_offload_work *offload)
{
clear_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);
flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_ORIGINAL);
flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_REPLY);
set_bit(NF_FLOW_HW_DEAD, &offload->flow->flags);

38
net/netfilter/nf_tables_api.c
View File

@ -4669,6 +4669,25 @@ static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set,
return 0;
}
static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set,
struct nft_data_desc *desc,
struct nft_data *data,
struct nlattr *attr)
{
int err;
err = nft_data_init(ctx, data, NFT_DATA_VALUE_MAXLEN, desc, attr);
if (err < 0)
return err;
if (desc->type != NFT_DATA_VERDICT && desc->len != set->dlen) {
nft_data_release(data, desc->type);
return -EINVAL;
}
return 0;
}
static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
const struct nlattr *attr)
{
@ -4946,7 +4965,6 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
struct nft_expr *expr = NULL;
struct nft_userdata *udata;
struct nft_data_desc desc;
struct nft_data data;
enum nft_registers dreg;
struct nft_trans *trans;
u32 flags = 0;
@ -5072,15 +5090,11 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
}
if (nla[NFTA_SET_ELEM_DATA] != NULL) {
err = nft_data_init(ctx, &data, sizeof(data), &desc,
nla[NFTA_SET_ELEM_DATA]);
err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val,
nla[NFTA_SET_ELEM_DATA]);
if (err < 0)
goto err_parse_key_end;
err = -EINVAL;
if (set->dtype != NFT_DATA_VERDICT && desc.len != set->dlen)
goto err_parse_data;
dreg = nft_type_to_reg(set->dtype);
list_for_each_entry(binding, &set->bindings, list) {
struct nft_ctx bind_ctx = {
@ -5094,14 +5108,14 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
continue;
err = nft_validate_register_store(&bind_ctx, dreg,
&data,
&elem.data.val,
desc.type, desc.len);
if (err < 0)
goto err_parse_data;
if (desc.type == NFT_DATA_VERDICT &&
(data.verdict.code == NFT_GOTO ||
data.verdict.code == NFT_JUMP))
(elem.data.val.verdict.code == NFT_GOTO ||
elem.data.val.verdict.code == NFT_JUMP))
nft_validate_state_update(ctx->net,
NFT_VALIDATE_NEED);
}
@ -5123,7 +5137,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
err = -ENOMEM;
elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
elem.key_end.val.data, data.data,
elem.key_end.val.data, elem.data.val.data,
timeout, expiration, GFP_KERNEL);
if (elem.priv == NULL)
goto err_parse_data;
@ -5201,7 +5215,7 @@ err_trans:
nf_tables_set_elem_destroy(ctx, set, elem.priv);
err_parse_data:
if (nla[NFTA_SET_ELEM_DATA] != NULL)
nft_data_release(&data, desc.type);
nft_data_release(&elem.data.val, desc.type);
err_parse_key_end:
nft_data_release(&elem.key_end.val, NFT_DATA_VALUE);
err_parse_key:

110
net/netfilter/nft_nat.c
View File

@ -30,6 +30,76 @@ struct nft_nat {
u16 flags;
};
static void nft_nat_setup_addr(struct nf_nat_range2 *range,
const struct nft_regs *regs,
const struct nft_nat *priv)
{
switch (priv->family) {
case AF_INET:
range->min_addr.ip = (__force __be32)
regs->data[priv->sreg_addr_min];
range->max_addr.ip = (__force __be32)
regs->data[priv->sreg_addr_max];
break;
case AF_INET6:
memcpy(range->min_addr.ip6, &regs->data[priv->sreg_addr_min],
sizeof(range->min_addr.ip6));
memcpy(range->max_addr.ip6, &regs->data[priv->sreg_addr_max],
sizeof(range->max_addr.ip6));
break;
}
}
static void nft_nat_setup_proto(struct nf_nat_range2 *range,
const struct nft_regs *regs,
const struct nft_nat *priv)
{
range->min_proto.all = (__force __be16)
nft_reg_load16(&regs->data[priv->sreg_proto_min]);
range->max_proto.all = (__force __be16)
nft_reg_load16(&regs->data[priv->sreg_proto_max]);
}
static void nft_nat_setup_netmap(struct nf_nat_range2 *range,
const struct nft_pktinfo *pkt,
const struct nft_nat *priv)
{
struct sk_buff *skb = pkt->skb;
union nf_inet_addr new_addr;
__be32 netmask;
int i, len = 0;
switch (priv->type) {
case NFT_NAT_SNAT:
if (nft_pf(pkt) == NFPROTO_IPV4) {
new_addr.ip = ip_hdr(skb)->saddr;
len = sizeof(struct in_addr);
} else {
new_addr.in6 = ipv6_hdr(skb)->saddr;
len = sizeof(struct in6_addr);
}
break;
case NFT_NAT_DNAT:
if (nft_pf(pkt) == NFPROTO_IPV4) {
new_addr.ip = ip_hdr(skb)->daddr;
len = sizeof(struct in_addr);
} else {
new_addr.in6 = ipv6_hdr(skb)->daddr;
len = sizeof(struct in6_addr);
}
break;
}
for (i = 0; i < len / sizeof(__be32); i++) {
netmask = ~(range->min_addr.ip6[i] ^ range->max_addr.ip6[i]);
new_addr.ip6[i] &= ~netmask;
new_addr.ip6[i] |= range->min_addr.ip6[i] & netmask;
}
range->min_addr = new_addr;
range->max_addr = new_addr;
}
static void nft_nat_eval(const struct nft_expr *expr,
struct nft_regs *regs,
const struct nft_pktinfo *pkt)
@ -40,33 +110,17 @@ static void nft_nat_eval(const struct nft_expr *expr,
struct nf_nat_range2 range;
memset(&range, 0, sizeof(range));
if (priv->sreg_addr_min) {
if (priv->family == AF_INET) {
range.min_addr.ip = (__force __be32)
regs->data[priv->sreg_addr_min];
range.max_addr.ip = (__force __be32)
regs->data[priv->sreg_addr_max];
} else {
memcpy(range.min_addr.ip6,
&regs->data[priv->sreg_addr_min],
sizeof(range.min_addr.ip6));
memcpy(range.max_addr.ip6,
&regs->data[priv->sreg_addr_max],
sizeof(range.max_addr.ip6));
}
range.flags |= NF_NAT_RANGE_MAP_IPS;
nft_nat_setup_addr(&range, regs, priv);
if (priv->flags & NF_NAT_RANGE_NETMAP)
nft_nat_setup_netmap(&range, pkt, priv);
}
if (priv->sreg_proto_min) {
range.min_proto.all = (__force __be16)nft_reg_load16(
&regs->data[priv->sreg_proto_min]);
range.max_proto.all = (__force __be16)nft_reg_load16(
&regs->data[priv->sreg_proto_max]);
range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
}
if (priv->sreg_proto_min)
nft_nat_setup_proto(&range, regs, priv);
range.flags |= priv->flags;
range.flags = priv->flags;
regs->verdict.code = nf_nat_setup_info(ct, &range, priv->type);
}
@ -129,7 +183,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
priv->type = NF_NAT_MANIP_DST;
break;
default:
return -EINVAL;
return -EOPNOTSUPP;
}
if (tb[NFTA_NAT_FAMILY] == NULL)
@ -169,6 +223,8 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
} else {
priv->sreg_addr_max = priv->sreg_addr_min;
}
priv->flags |= NF_NAT_RANGE_MAP_IPS;
}
plen = sizeof_field(struct nf_nat_range, min_addr.all);
@ -191,12 +247,14 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
} else {
priv->sreg_proto_max = priv->sreg_proto_min;
}
priv->flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
}
if (tb[NFTA_NAT_FLAGS]) {
priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS]));
priv->flags |= ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS]));
if (priv->flags & ~NF_NAT_RANGE_MASK)
return -EINVAL;
return -EOPNOTSUPP;
}
return nf_ct_netns_get(ctx->net, family);