mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 22:54:01 +00:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for nf-next: 1) Add IPS_HW_OFFLOAD status bit, from Bodong Wang. 2) Remove 128-bit limit on the set element data area, rise it to 64 bytes. 3) Report EOPNOTSUPP for unsupported NAT types and flags. 4) Set up nft_nat flags from the control plane path. 5) Add helper functions to set up the nf_nat_range2 structure. 6) Add netmap support for nft_nat. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
commit
323e395f19
7 changed files with 129 additions and 42 deletions
|
@ -243,6 +243,10 @@ struct nft_set_elem {
|
||||||
u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
|
u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
|
||||||
struct nft_data val;
|
struct nft_data val;
|
||||||
} key_end;
|
} key_end;
|
||||||
|
union {
|
||||||
|
u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
|
||||||
|
struct nft_data val;
|
||||||
|
} data;
|
||||||
void *priv;
|
void *priv;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
@ -114,15 +114,19 @@ enum ip_conntrack_status {
|
||||||
IPS_OFFLOAD_BIT = 14,
|
IPS_OFFLOAD_BIT = 14,
|
||||||
IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT),
|
IPS_OFFLOAD = (1 << IPS_OFFLOAD_BIT),
|
||||||
|
|
||||||
|
/* Conntrack has been offloaded to hardware. */
|
||||||
|
IPS_HW_OFFLOAD_BIT = 15,
|
||||||
|
IPS_HW_OFFLOAD = (1 << IPS_HW_OFFLOAD_BIT),
|
||||||
|
|
||||||
/* Be careful here, modifying these bits can make things messy,
|
/* Be careful here, modifying these bits can make things messy,
|
||||||
* so don't let users modify them directly.
|
* so don't let users modify them directly.
|
||||||
*/
|
*/
|
||||||
IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |
|
IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |
|
||||||
IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING |
|
IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING |
|
||||||
IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_UNTRACKED |
|
IPS_SEQ_ADJUST | IPS_TEMPLATE | IPS_UNTRACKED |
|
||||||
IPS_OFFLOAD),
|
IPS_OFFLOAD | IPS_HW_OFFLOAD),
|
||||||
|
|
||||||
__IPS_MAX_BIT = 15,
|
__IPS_MAX_BIT = 16,
|
||||||
};
|
};
|
||||||
|
|
||||||
/* Connection tracking event types */
|
/* Connection tracking event types */
|
||||||
|
|
|
@ -11,6 +11,7 @@
|
||||||
#define NF_NAT_RANGE_PERSISTENT (1 << 3)
|
#define NF_NAT_RANGE_PERSISTENT (1 << 3)
|
||||||
#define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4)
|
#define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4)
|
||||||
#define NF_NAT_RANGE_PROTO_OFFSET (1 << 5)
|
#define NF_NAT_RANGE_PROTO_OFFSET (1 << 5)
|
||||||
|
#define NF_NAT_RANGE_NETMAP (1 << 6)
|
||||||
|
|
||||||
#define NF_NAT_RANGE_PROTO_RANDOM_ALL \
|
#define NF_NAT_RANGE_PROTO_RANDOM_ALL \
|
||||||
(NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)
|
(NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)
|
||||||
|
@ -18,7 +19,8 @@
|
||||||
#define NF_NAT_RANGE_MASK \
|
#define NF_NAT_RANGE_MASK \
|
||||||
(NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED | \
|
(NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED | \
|
||||||
NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT | \
|
NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT | \
|
||||||
NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET)
|
NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET | \
|
||||||
|
NF_NAT_RANGE_NETMAP)
|
||||||
|
|
||||||
struct nf_nat_ipv4_range {
|
struct nf_nat_ipv4_range {
|
||||||
unsigned int flags;
|
unsigned int flags;
|
||||||
|
|
|
@ -348,7 +348,9 @@ static int ct_seq_show(struct seq_file *s, void *v)
|
||||||
if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
|
if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
|
||||||
goto release;
|
goto release;
|
||||||
|
|
||||||
if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
|
if (test_bit(IPS_HW_OFFLOAD_BIT, &ct->status))
|
||||||
|
seq_puts(s, "[HW_OFFLOAD] ");
|
||||||
|
else if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
|
||||||
seq_puts(s, "[OFFLOAD] ");
|
seq_puts(s, "[OFFLOAD] ");
|
||||||
else if (test_bit(IPS_ASSURED_BIT, &ct->status))
|
else if (test_bit(IPS_ASSURED_BIT, &ct->status))
|
||||||
seq_puts(s, "[ASSURED] ");
|
seq_puts(s, "[ASSURED] ");
|
||||||
|
|
|
@ -754,12 +754,15 @@ static void flow_offload_work_add(struct flow_offload_work *offload)
|
||||||
err = flow_offload_rule_add(offload, flow_rule);
|
err = flow_offload_rule_add(offload, flow_rule);
|
||||||
if (err < 0)
|
if (err < 0)
|
||||||
set_bit(NF_FLOW_HW_REFRESH, &offload->flow->flags);
|
set_bit(NF_FLOW_HW_REFRESH, &offload->flow->flags);
|
||||||
|
else
|
||||||
|
set_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);
|
||||||
|
|
||||||
nf_flow_offload_destroy(flow_rule);
|
nf_flow_offload_destroy(flow_rule);
|
||||||
}
|
}
|
||||||
|
|
||||||
static void flow_offload_work_del(struct flow_offload_work *offload)
|
static void flow_offload_work_del(struct flow_offload_work *offload)
|
||||||
{
|
{
|
||||||
|
clear_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);
|
||||||
flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_ORIGINAL);
|
flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_ORIGINAL);
|
||||||
flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_REPLY);
|
flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_REPLY);
|
||||||
set_bit(NF_FLOW_HW_DEAD, &offload->flow->flags);
|
set_bit(NF_FLOW_HW_DEAD, &offload->flow->flags);
|
||||||
|
|
|
@ -4669,6 +4669,25 @@ static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set,
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set,
|
||||||
|
struct nft_data_desc *desc,
|
||||||
|
struct nft_data *data,
|
||||||
|
struct nlattr *attr)
|
||||||
|
{
|
||||||
|
int err;
|
||||||
|
|
||||||
|
err = nft_data_init(ctx, data, NFT_DATA_VALUE_MAXLEN, desc, attr);
|
||||||
|
if (err < 0)
|
||||||
|
return err;
|
||||||
|
|
||||||
|
if (desc->type != NFT_DATA_VERDICT && desc->len != set->dlen) {
|
||||||
|
nft_data_release(data, desc->type);
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
|
static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
|
||||||
const struct nlattr *attr)
|
const struct nlattr *attr)
|
||||||
{
|
{
|
||||||
|
@ -4946,7 +4965,6 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
|
||||||
struct nft_expr *expr = NULL;
|
struct nft_expr *expr = NULL;
|
||||||
struct nft_userdata *udata;
|
struct nft_userdata *udata;
|
||||||
struct nft_data_desc desc;
|
struct nft_data_desc desc;
|
||||||
struct nft_data data;
|
|
||||||
enum nft_registers dreg;
|
enum nft_registers dreg;
|
||||||
struct nft_trans *trans;
|
struct nft_trans *trans;
|
||||||
u32 flags = 0;
|
u32 flags = 0;
|
||||||
|
@ -5072,15 +5090,11 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
|
||||||
}
|
}
|
||||||
|
|
||||||
if (nla[NFTA_SET_ELEM_DATA] != NULL) {
|
if (nla[NFTA_SET_ELEM_DATA] != NULL) {
|
||||||
err = nft_data_init(ctx, &data, sizeof(data), &desc,
|
err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val,
|
||||||
nla[NFTA_SET_ELEM_DATA]);
|
nla[NFTA_SET_ELEM_DATA]);
|
||||||
if (err < 0)
|
if (err < 0)
|
||||||
goto err_parse_key_end;
|
goto err_parse_key_end;
|
||||||
|
|
||||||
err = -EINVAL;
|
|
||||||
if (set->dtype != NFT_DATA_VERDICT && desc.len != set->dlen)
|
|
||||||
goto err_parse_data;
|
|
||||||
|
|
||||||
dreg = nft_type_to_reg(set->dtype);
|
dreg = nft_type_to_reg(set->dtype);
|
||||||
list_for_each_entry(binding, &set->bindings, list) {
|
list_for_each_entry(binding, &set->bindings, list) {
|
||||||
struct nft_ctx bind_ctx = {
|
struct nft_ctx bind_ctx = {
|
||||||
|
@ -5094,14 +5108,14 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
err = nft_validate_register_store(&bind_ctx, dreg,
|
err = nft_validate_register_store(&bind_ctx, dreg,
|
||||||
&data,
|
&elem.data.val,
|
||||||
desc.type, desc.len);
|
desc.type, desc.len);
|
||||||
if (err < 0)
|
if (err < 0)
|
||||||
goto err_parse_data;
|
goto err_parse_data;
|
||||||
|
|
||||||
if (desc.type == NFT_DATA_VERDICT &&
|
if (desc.type == NFT_DATA_VERDICT &&
|
||||||
(data.verdict.code == NFT_GOTO ||
|
(elem.data.val.verdict.code == NFT_GOTO ||
|
||||||
data.verdict.code == NFT_JUMP))
|
elem.data.val.verdict.code == NFT_JUMP))
|
||||||
nft_validate_state_update(ctx->net,
|
nft_validate_state_update(ctx->net,
|
||||||
NFT_VALIDATE_NEED);
|
NFT_VALIDATE_NEED);
|
||||||
}
|
}
|
||||||
|
@ -5123,7 +5137,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
|
||||||
|
|
||||||
err = -ENOMEM;
|
err = -ENOMEM;
|
||||||
elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
|
elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
|
||||||
elem.key_end.val.data, data.data,
|
elem.key_end.val.data, elem.data.val.data,
|
||||||
timeout, expiration, GFP_KERNEL);
|
timeout, expiration, GFP_KERNEL);
|
||||||
if (elem.priv == NULL)
|
if (elem.priv == NULL)
|
||||||
goto err_parse_data;
|
goto err_parse_data;
|
||||||
|
@ -5201,7 +5215,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
|
||||||
nf_tables_set_elem_destroy(ctx, set, elem.priv);
|
nf_tables_set_elem_destroy(ctx, set, elem.priv);
|
||||||
err_parse_data:
|
err_parse_data:
|
||||||
if (nla[NFTA_SET_ELEM_DATA] != NULL)
|
if (nla[NFTA_SET_ELEM_DATA] != NULL)
|
||||||
nft_data_release(&data, desc.type);
|
nft_data_release(&elem.data.val, desc.type);
|
||||||
err_parse_key_end:
|
err_parse_key_end:
|
||||||
nft_data_release(&elem.key_end.val, NFT_DATA_VALUE);
|
nft_data_release(&elem.key_end.val, NFT_DATA_VALUE);
|
||||||
err_parse_key:
|
err_parse_key:
|
||||||
|
|
|
@ -30,6 +30,76 @@ struct nft_nat {
|
||||||
u16 flags;
|
u16 flags;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
static void nft_nat_setup_addr(struct nf_nat_range2 *range,
|
||||||
|
const struct nft_regs *regs,
|
||||||
|
const struct nft_nat *priv)
|
||||||
|
{
|
||||||
|
switch (priv->family) {
|
||||||
|
case AF_INET:
|
||||||
|
range->min_addr.ip = (__force __be32)
|
||||||
|
regs->data[priv->sreg_addr_min];
|
||||||
|
range->max_addr.ip = (__force __be32)
|
||||||
|
regs->data[priv->sreg_addr_max];
|
||||||
|
break;
|
||||||
|
case AF_INET6:
|
||||||
|
memcpy(range->min_addr.ip6, ®s->data[priv->sreg_addr_min],
|
||||||
|
sizeof(range->min_addr.ip6));
|
||||||
|
memcpy(range->max_addr.ip6, ®s->data[priv->sreg_addr_max],
|
||||||
|
sizeof(range->max_addr.ip6));
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
static void nft_nat_setup_proto(struct nf_nat_range2 *range,
|
||||||
|
const struct nft_regs *regs,
|
||||||
|
const struct nft_nat *priv)
|
||||||
|
{
|
||||||
|
range->min_proto.all = (__force __be16)
|
||||||
|
nft_reg_load16(®s->data[priv->sreg_proto_min]);
|
||||||
|
range->max_proto.all = (__force __be16)
|
||||||
|
nft_reg_load16(®s->data[priv->sreg_proto_max]);
|
||||||
|
}
|
||||||
|
|
||||||
|
static void nft_nat_setup_netmap(struct nf_nat_range2 *range,
|
||||||
|
const struct nft_pktinfo *pkt,
|
||||||
|
const struct nft_nat *priv)
|
||||||
|
{
|
||||||
|
struct sk_buff *skb = pkt->skb;
|
||||||
|
union nf_inet_addr new_addr;
|
||||||
|
__be32 netmask;
|
||||||
|
int i, len = 0;
|
||||||
|
|
||||||
|
switch (priv->type) {
|
||||||
|
case NFT_NAT_SNAT:
|
||||||
|
if (nft_pf(pkt) == NFPROTO_IPV4) {
|
||||||
|
new_addr.ip = ip_hdr(skb)->saddr;
|
||||||
|
len = sizeof(struct in_addr);
|
||||||
|
} else {
|
||||||
|
new_addr.in6 = ipv6_hdr(skb)->saddr;
|
||||||
|
len = sizeof(struct in6_addr);
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
case NFT_NAT_DNAT:
|
||||||
|
if (nft_pf(pkt) == NFPROTO_IPV4) {
|
||||||
|
new_addr.ip = ip_hdr(skb)->daddr;
|
||||||
|
len = sizeof(struct in_addr);
|
||||||
|
} else {
|
||||||
|
new_addr.in6 = ipv6_hdr(skb)->daddr;
|
||||||
|
len = sizeof(struct in6_addr);
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
for (i = 0; i < len / sizeof(__be32); i++) {
|
||||||
|
netmask = ~(range->min_addr.ip6[i] ^ range->max_addr.ip6[i]);
|
||||||
|
new_addr.ip6[i] &= ~netmask;
|
||||||
|
new_addr.ip6[i] |= range->min_addr.ip6[i] & netmask;
|
||||||
|
}
|
||||||
|
|
||||||
|
range->min_addr = new_addr;
|
||||||
|
range->max_addr = new_addr;
|
||||||
|
}
|
||||||
|
|
||||||
static void nft_nat_eval(const struct nft_expr *expr,
|
static void nft_nat_eval(const struct nft_expr *expr,
|
||||||
struct nft_regs *regs,
|
struct nft_regs *regs,
|
||||||
const struct nft_pktinfo *pkt)
|
const struct nft_pktinfo *pkt)
|
||||||
|
@ -40,33 +110,17 @@ static void nft_nat_eval(const struct nft_expr *expr,
|
||||||
struct nf_nat_range2 range;
|
struct nf_nat_range2 range;
|
||||||
|
|
||||||
memset(&range, 0, sizeof(range));
|
memset(&range, 0, sizeof(range));
|
||||||
|
|
||||||
if (priv->sreg_addr_min) {
|
if (priv->sreg_addr_min) {
|
||||||
if (priv->family == AF_INET) {
|
nft_nat_setup_addr(&range, regs, priv);
|
||||||
range.min_addr.ip = (__force __be32)
|
if (priv->flags & NF_NAT_RANGE_NETMAP)
|
||||||
regs->data[priv->sreg_addr_min];
|
nft_nat_setup_netmap(&range, pkt, priv);
|
||||||
range.max_addr.ip = (__force __be32)
|
|
||||||
regs->data[priv->sreg_addr_max];
|
|
||||||
|
|
||||||
} else {
|
|
||||||
memcpy(range.min_addr.ip6,
|
|
||||||
®s->data[priv->sreg_addr_min],
|
|
||||||
sizeof(range.min_addr.ip6));
|
|
||||||
memcpy(range.max_addr.ip6,
|
|
||||||
®s->data[priv->sreg_addr_max],
|
|
||||||
sizeof(range.max_addr.ip6));
|
|
||||||
}
|
|
||||||
range.flags |= NF_NAT_RANGE_MAP_IPS;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if (priv->sreg_proto_min) {
|
if (priv->sreg_proto_min)
|
||||||
range.min_proto.all = (__force __be16)nft_reg_load16(
|
nft_nat_setup_proto(&range, regs, priv);
|
||||||
®s->data[priv->sreg_proto_min]);
|
|
||||||
range.max_proto.all = (__force __be16)nft_reg_load16(
|
|
||||||
®s->data[priv->sreg_proto_max]);
|
|
||||||
range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
|
|
||||||
}
|
|
||||||
|
|
||||||
range.flags |= priv->flags;
|
range.flags = priv->flags;
|
||||||
|
|
||||||
regs->verdict.code = nf_nat_setup_info(ct, &range, priv->type);
|
regs->verdict.code = nf_nat_setup_info(ct, &range, priv->type);
|
||||||
}
|
}
|
||||||
|
@ -129,7 +183,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
|
||||||
priv->type = NF_NAT_MANIP_DST;
|
priv->type = NF_NAT_MANIP_DST;
|
||||||
break;
|
break;
|
||||||
default:
|
default:
|
||||||
return -EINVAL;
|
return -EOPNOTSUPP;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (tb[NFTA_NAT_FAMILY] == NULL)
|
if (tb[NFTA_NAT_FAMILY] == NULL)
|
||||||
|
@ -169,6 +223,8 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
|
||||||
} else {
|
} else {
|
||||||
priv->sreg_addr_max = priv->sreg_addr_min;
|
priv->sreg_addr_max = priv->sreg_addr_min;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
priv->flags |= NF_NAT_RANGE_MAP_IPS;
|
||||||
}
|
}
|
||||||
|
|
||||||
plen = sizeof_field(struct nf_nat_range, min_addr.all);
|
plen = sizeof_field(struct nf_nat_range, min_addr.all);
|
||||||
|
@ -191,12 +247,14 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
|
||||||
} else {
|
} else {
|
||||||
priv->sreg_proto_max = priv->sreg_proto_min;
|
priv->sreg_proto_max = priv->sreg_proto_min;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
priv->flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (tb[NFTA_NAT_FLAGS]) {
|
if (tb[NFTA_NAT_FLAGS]) {
|
||||||
priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS]));
|
priv->flags |= ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS]));
|
||||||
if (priv->flags & ~NF_NAT_RANGE_MASK)
|
if (priv->flags & ~NF_NAT_RANGE_MASK)
|
||||||
return -EINVAL;
|
return -EOPNOTSUPP;
|
||||||
}
|
}
|
||||||
|
|
||||||
return nf_ct_netns_get(ctx->net, family);
|
return nf_ct_netns_get(ctx->net, family);
|
||||||
|
|
Loading…
Reference in a new issue