* [PATCH net-next 1/3] net/ipv4: Move device validation to helper
2018-09-20 20:50 [PATCH net-next 0/3] net: wean netfilter from fib_nh dsahern
@ 2018-09-20 20:50 ` dsahern
2018-09-20 20:50 ` [PATCH net-next 2/3] netfilter: rpfilter: Convert rpfilter_lookup_reverse to new dev helper dsahern
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: dsahern @ 2018-09-20 20:50 UTC (permalink / raw)
To: netdev, netfilter-devel; +Cc: pablo, fw, David Ahern
From: David Ahern <dsahern@gmail.com>
Move the device matching check in __fib_validate_source to a helper and
export it for use by netfilter modules. Code move only; no functional
change intended.
Signed-off-by: David Ahern <dsahern@gmail.com>
---
include/net/ip_fib.h | 1 +
net/ipv4/fib_frontend.c | 44 +++++++++++++++++++++++++++-----------------
2 files changed, 28 insertions(+), 17 deletions(-)
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 69c91d1934c1..f7c109e37298 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -373,6 +373,7 @@ static inline bool fib4_rules_early_flow_dissect(struct net *net,
extern const struct nla_policy rtm_ipv4_policy[];
void ip_fib_init(void);
__be32 fib_compute_spec_dst(struct sk_buff *skb);
+bool fib_info_nh_uses_dev(struct fib_info *fi, const struct net_device *dev);
int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
u8 tos, int oif, struct net_device *dev,
struct in_device *idev, u32 *itag);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 2998b0e47d4b..222b968de94c 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -315,6 +315,32 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
return inet_select_addr(dev, ip_hdr(skb)->saddr, scope);
}
+bool fib_info_nh_uses_dev(struct fib_info *fi, const struct net_device *dev)
+{
+ bool dev_match = false;
+ int ret;
+
+#ifdef CONFIG_IP_ROUTE_MULTIPATH
+ for (ret = 0; ret < fi->fib_nhs; ret++) {
+ struct fib_nh *nh = &fi->fib_nh[ret];
+
+ if (nh->nh_dev == dev) {
+ dev_match = true;
+ break;
+ } else if (l3mdev_master_ifindex_rcu(nh->nh_dev) == dev->ifindex) {
+ dev_match = true;
+ break;
+ }
+ }
+#else
+ if (fi->fib_nh[0].nh_dev == dev)
+ dev_match = true;
+#endif
+
+ return dev_match;
+}
+EXPORT_SYMBOL_GPL(fib_info_nh_uses_dev);
+
/* Given (packet source, input interface) and optional (dst, oif, tos):
* - (main) check, that source is valid i.e. not broadcast or our local
* address.
@@ -361,24 +387,8 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
(res.type != RTN_LOCAL || !IN_DEV_ACCEPT_LOCAL(idev)))
goto e_inval;
fib_combine_itag(itag, &res);
- dev_match = false;
-
-#ifdef CONFIG_IP_ROUTE_MULTIPATH
- for (ret = 0; ret < res.fi->fib_nhs; ret++) {
- struct fib_nh *nh = &res.fi->fib_nh[ret];
- if (nh->nh_dev == dev) {
- dev_match = true;
- break;
- } else if (l3mdev_master_ifindex_rcu(nh->nh_dev) == dev->ifindex) {
- dev_match = true;
- break;
- }
- }
-#else
- if (FIB_RES_DEV(res) == dev)
- dev_match = true;
-#endif
+ dev_match = fib_info_nh_uses_dev(res.fi, dev);
if (dev_match) {
ret = FIB_RES_NH(res).nh_scope >= RT_SCOPE_HOST;
return ret;
--
2.11.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH net-next 2/3] netfilter: rpfilter: Convert rpfilter_lookup_reverse to new dev helper
2018-09-20 20:50 [PATCH net-next 0/3] net: wean netfilter from fib_nh dsahern
2018-09-20 20:50 ` [PATCH net-next 1/3] net/ipv4: Move device validation to helper dsahern
@ 2018-09-20 20:50 ` dsahern
2018-09-20 20:50 ` [PATCH net-next 3/3] netfilter: nft_fib: Convert nft_fib4_eval " dsahern
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: dsahern @ 2018-09-20 20:50 UTC (permalink / raw)
To: netdev, netfilter-devel; +Cc: pablo, fw, David Ahern
From: David Ahern <dsahern@gmail.com>
Convert rpfilter_lookup_reverse to the new device checking helper
and remove the duplicate code.
Signed-off-by: David Ahern <dsahern@gmail.com>
---
net/ipv4/netfilter/ipt_rpfilter.c | 17 +----------------
1 file changed, 1 insertion(+), 16 deletions(-)
diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
index 12843c9ef142..0b10d8812828 100644
--- a/net/ipv4/netfilter/ipt_rpfilter.c
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -36,7 +36,6 @@ static bool rpfilter_lookup_reverse(struct net *net, struct flowi4 *fl4,
const struct net_device *dev, u8 flags)
{
struct fib_result res;
- bool dev_match;
int ret __maybe_unused;
if (fib_lookup(net, fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE))
@@ -46,21 +45,7 @@ static bool rpfilter_lookup_reverse(struct net *net, struct flowi4 *fl4,
if (res.type != RTN_LOCAL || !(flags & XT_RPFILTER_ACCEPT_LOCAL))
return false;
}
- dev_match = false;
-#ifdef CONFIG_IP_ROUTE_MULTIPATH
- for (ret = 0; ret < res.fi->fib_nhs; ret++) {
- struct fib_nh *nh = &res.fi->fib_nh[ret];
-
- if (nh->nh_dev == dev) {
- dev_match = true;
- break;
- }
- }
-#else
- if (FIB_RES_DEV(res) == dev)
- dev_match = true;
-#endif
- return dev_match || flags & XT_RPFILTER_LOOSE;
+ return fib_info_nh_uses_dev(res.fi, dev) || flags & XT_RPFILTER_LOOSE;
}
static bool
--
2.11.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH net-next 3/3] netfilter: nft_fib: Convert nft_fib4_eval to new dev helper
2018-09-20 20:50 [PATCH net-next 0/3] net: wean netfilter from fib_nh dsahern
2018-09-20 20:50 ` [PATCH net-next 1/3] net/ipv4: Move device validation to helper dsahern
2018-09-20 20:50 ` [PATCH net-next 2/3] netfilter: rpfilter: Convert rpfilter_lookup_reverse to new dev helper dsahern
@ 2018-09-20 20:50 ` dsahern
2018-09-20 20:53 ` [PATCH net-next 0/3] net: wean netfilter from fib_nh Florian Westphal
2018-09-21 3:02 ` David Miller
4 siblings, 0 replies; 6+ messages in thread
From: dsahern @ 2018-09-20 20:50 UTC (permalink / raw)
To: netdev, netfilter-devel; +Cc: pablo, fw, David Ahern
From: David Ahern <dsahern@gmail.com>
Convert nft_fib4_eval to the new device checking helper and
remove the duplicate code.
Signed-off-by: David Ahern <dsahern@gmail.com>
---
net/ipv4/netfilter/nft_fib_ipv4.c | 27 ++++++---------------------
1 file changed, 6 insertions(+), 21 deletions(-)
diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c
index e50976e3c213..94eb25bc8d7e 100644
--- a/net/ipv4/netfilter/nft_fib_ipv4.c
+++ b/net/ipv4/netfilter/nft_fib_ipv4.c
@@ -76,10 +76,7 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
.flowi4_iif = LOOPBACK_IFINDEX,
};
const struct net_device *oif;
- struct net_device *found;
-#ifdef CONFIG_IP_ROUTE_MULTIPATH
- int i;
-#endif
+ const struct net_device *found;
/*
* Do not set flowi4_oif, it restricts results (for example, asking
@@ -146,25 +143,13 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
if (!oif) {
found = FIB_RES_DEV(res);
- goto ok;
- }
-
-#ifdef CONFIG_IP_ROUTE_MULTIPATH
- for (i = 0; i < res.fi->fib_nhs; i++) {
- struct fib_nh *nh = &res.fi->fib_nh[i];
+ } else {
+ if (!fib_info_nh_uses_dev(res.fi, oif))
+ return;
- if (nh->nh_dev == oif) {
- found = nh->nh_dev;
- goto ok;
- }
+ found = oif;
}
- return;
-#else
- found = FIB_RES_DEV(res);
- if (found != oif)
- return;
-#endif
-ok:
+
switch (priv->result) {
case NFT_FIB_RESULT_OIF:
*dest = found->ifindex;
--
2.11.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH net-next 0/3] net: wean netfilter from fib_nh
2018-09-20 20:50 [PATCH net-next 0/3] net: wean netfilter from fib_nh dsahern
` (2 preceding siblings ...)
2018-09-20 20:50 ` [PATCH net-next 3/3] netfilter: nft_fib: Convert nft_fib4_eval " dsahern
@ 2018-09-20 20:53 ` Florian Westphal
2018-09-21 3:02 ` David Miller
4 siblings, 0 replies; 6+ messages in thread
From: Florian Westphal @ 2018-09-20 20:53 UTC (permalink / raw)
To: dsahern; +Cc: netdev, netfilter-devel, pablo, fw, David Ahern
dsahern@kernel.org <dsahern@kernel.org> wrote:
> From: David Ahern <dsahern@gmail.com>
>
> Two netfilter modules reference fib_nh. In both cases the code is
> only checking if a nexthop in a fib_info uses a specific device.
> Both instances essentially duplicate code from __fib_validate_source,
> so move that code into a helper and flip the netfilter modules to
> use it.
Lokks good to me, thanks David.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH net-next 0/3] net: wean netfilter from fib_nh
2018-09-20 20:50 [PATCH net-next 0/3] net: wean netfilter from fib_nh dsahern
` (3 preceding siblings ...)
2018-09-20 20:53 ` [PATCH net-next 0/3] net: wean netfilter from fib_nh Florian Westphal
@ 2018-09-21 3:02 ` David Miller
4 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2018-09-21 3:02 UTC (permalink / raw)
To: dsahern; +Cc: netdev, netfilter-devel, pablo, fw, dsahern
From: dsahern@kernel.org
Date: Thu, 20 Sep 2018 13:50:46 -0700
> From: David Ahern <dsahern@gmail.com>
>
> Two netfilter modules reference fib_nh. In both cases the code is
> only checking if a nexthop in a fib_info uses a specific device.
> Both instances essentially duplicate code from __fib_validate_source,
> so move that code into a helper and flip the netfilter modules to
> use it.
Series applied, thanks David.
^ permalink raw reply [flat|nested] 6+ messages in thread