* [PATCH net-next 1/2] net/sched: act_ct: Fix ipv6 lookup of offloaded connections
2020-03-04 11:49 [PATCH net-next 0/2] Fixes for tc act_ct software offload of established flows (diff v4->v6) Paul Blakey
@ 2020-03-04 11:49 ` Paul Blakey
2020-03-04 13:17 ` Marcelo Ricardo Leitner
2020-03-04 14:06 ` Jiri Pirko
2020-03-04 11:49 ` [PATCH net-next 2/2] net/sched: act_ct: Use pskb_network_may_pull() Paul Blakey
2020-03-04 19:05 ` [PATCH net-next 0/2] Fixes for tc act_ct software offload of established flows (diff v4->v6) David Miller
2 siblings, 2 replies; 8+ messages in thread
From: Paul Blakey @ 2020-03-04 11:49 UTC (permalink / raw)
To: Paul Blakey, Saeed Mahameed, Oz Shlomo, Jakub Kicinski,
Vlad Buslov, David Miller, netdev@vger.kernel.org, Jiri Pirko,
Roi Dayan, Cong Wang, Jamal Hadi Salim
When checking the protocol number tcf_ct_flow_table_lookup() handles
the flow as if it's always ipv4, while it can be ipv6.
Instead, refactor the code to fetch the tcp header, if available,
in the relevant family (ipv4/ipv6) filler function, and do the
check on the returned tcp header.
Fixes: 46475bb20f4b ("net/sched: act_ct: Software offload of established flows")
Signed-off-by: Paul Blakey <paulb@mellanox.com>
---
net/sched/act_ct.c | 60 +++++++++++++++++++++++-------------------------------
1 file changed, 26 insertions(+), 34 deletions(-)
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index a2d5582..f434db7 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -188,7 +188,8 @@ static void tcf_ct_flow_table_process_conn(struct tcf_ct_flow_table *ct_ft,
static bool
tcf_ct_flow_table_fill_tuple_ipv4(struct sk_buff *skb,
- struct flow_offload_tuple *tuple)
+ struct flow_offload_tuple *tuple,
+ struct tcphdr **tcph)
{
struct flow_ports *ports;
unsigned int thoff;
@@ -211,11 +212,16 @@ static void tcf_ct_flow_table_process_conn(struct tcf_ct_flow_table *ct_ft,
if (iph->ttl <= 1)
return false;
- if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
+ if (!pskb_may_pull(skb, iph->protocol == IPPROTO_TCP ?
+ thoff + sizeof(struct tcphdr) :
+ thoff + sizeof(*ports)))
return false;
- ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
+ iph = ip_hdr(skb);
+ if (iph->protocol == IPPROTO_TCP)
+ *tcph = (void *)(skb_network_header(skb) + thoff);
+ ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
tuple->src_v4.s_addr = iph->saddr;
tuple->dst_v4.s_addr = iph->daddr;
tuple->src_port = ports->source;
@@ -228,7 +234,8 @@ static void tcf_ct_flow_table_process_conn(struct tcf_ct_flow_table *ct_ft,
static bool
tcf_ct_flow_table_fill_tuple_ipv6(struct sk_buff *skb,
- struct flow_offload_tuple *tuple)
+ struct flow_offload_tuple *tuple,
+ struct tcphdr **tcph)
{
struct flow_ports *ports;
struct ipv6hdr *ip6h;
@@ -247,11 +254,16 @@ static void tcf_ct_flow_table_process_conn(struct tcf_ct_flow_table *ct_ft,
return false;
thoff = sizeof(*ip6h);
- if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
+ if (!pskb_may_pull(skb, ip6h->nexthdr == IPPROTO_TCP ?
+ thoff + sizeof(struct tcphdr) :
+ thoff + sizeof(*ports)))
return false;
- ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
+ ip6h = ipv6_hdr(skb);
+ if (ip6h->nexthdr == IPPROTO_TCP)
+ *tcph = (void *)(skb_network_header(skb) + thoff);
+ ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
tuple->src_v6 = ip6h->saddr;
tuple->dst_v6 = ip6h->daddr;
tuple->src_port = ports->source;
@@ -262,24 +274,6 @@ static void tcf_ct_flow_table_process_conn(struct tcf_ct_flow_table *ct_ft,
return true;
}
-static bool tcf_ct_flow_table_check_tcp(struct flow_offload *flow,
- struct sk_buff *skb,
- unsigned int thoff)
-{
- struct tcphdr *tcph;
-
- if (!pskb_may_pull(skb, thoff + sizeof(*tcph)))
- return false;
-
- tcph = (void *)(skb_network_header(skb) + thoff);
- if (unlikely(tcph->fin || tcph->rst)) {
- flow_offload_teardown(flow);
- return false;
- }
-
- return true;
-}
-
static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p,
struct sk_buff *skb,
u8 family)
@@ -288,10 +282,9 @@ static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p,
struct flow_offload_tuple_rhash *tuplehash;
struct flow_offload_tuple tuple = {};
enum ip_conntrack_info ctinfo;
+ struct tcphdr *tcph = NULL;
struct flow_offload *flow;
struct nf_conn *ct;
- unsigned int thoff;
- int ip_proto;
u8 dir;
/* Previously seen or loopback */
@@ -301,11 +294,11 @@ static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p,
switch (family) {
case NFPROTO_IPV4:
- if (!tcf_ct_flow_table_fill_tuple_ipv4(skb, &tuple))
+ if (!tcf_ct_flow_table_fill_tuple_ipv4(skb, &tuple, &tcph))
return false;
break;
case NFPROTO_IPV6:
- if (!tcf_ct_flow_table_fill_tuple_ipv6(skb, &tuple))
+ if (!tcf_ct_flow_table_fill_tuple_ipv6(skb, &tuple, &tcph))
return false;
break;
default:
@@ -320,15 +313,14 @@ static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p,
flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
ct = flow->ct;
+ if (tcph && (unlikely(tcph->fin || tcph->rst))) {
+ flow_offload_teardown(flow);
+ return false;
+ }
+
ctinfo = dir == FLOW_OFFLOAD_DIR_ORIGINAL ? IP_CT_ESTABLISHED :
IP_CT_ESTABLISHED_REPLY;
- thoff = ip_hdr(skb)->ihl * 4;
- ip_proto = ip_hdr(skb)->protocol;
- if (ip_proto == IPPROTO_TCP &&
- !tcf_ct_flow_table_check_tcp(flow, skb, thoff))
- return false;
-
nf_conntrack_get(&ct->ct_general);
nf_ct_set(skb, ct, ctinfo);
--
1.8.3.1
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH net-next 2/2] net/sched: act_ct: Use pskb_network_may_pull()
2020-03-04 11:49 [PATCH net-next 0/2] Fixes for tc act_ct software offload of established flows (diff v4->v6) Paul Blakey
2020-03-04 11:49 ` [PATCH net-next 1/2] net/sched: act_ct: Fix ipv6 lookup of offloaded connections Paul Blakey
@ 2020-03-04 11:49 ` Paul Blakey
2020-03-04 13:17 ` Marcelo Ricardo Leitner
2020-03-04 14:12 ` Jiri Pirko
2020-03-04 19:05 ` [PATCH net-next 0/2] Fixes for tc act_ct software offload of established flows (diff v4->v6) David Miller
2 siblings, 2 replies; 8+ messages in thread
From: Paul Blakey @ 2020-03-04 11:49 UTC (permalink / raw)
To: Paul Blakey, Saeed Mahameed, Oz Shlomo, Jakub Kicinski,
Vlad Buslov, David Miller, netdev@vger.kernel.org, Jiri Pirko,
Roi Dayan, Cong Wang, Jamal Hadi Salim
To make the filler functions more generic, use network
relative skb pulling.
Signed-off-by: Paul Blakey <paulb@mellanox.com>
---
net/sched/act_ct.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index f434db7..23eba61 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -195,7 +195,7 @@ static void tcf_ct_flow_table_process_conn(struct tcf_ct_flow_table *ct_ft,
unsigned int thoff;
struct iphdr *iph;
- if (!pskb_may_pull(skb, sizeof(*iph)))
+ if (!pskb_network_may_pull(skb, sizeof(*iph)))
return false;
iph = ip_hdr(skb);
@@ -212,9 +212,9 @@ static void tcf_ct_flow_table_process_conn(struct tcf_ct_flow_table *ct_ft,
if (iph->ttl <= 1)
return false;
- if (!pskb_may_pull(skb, iph->protocol == IPPROTO_TCP ?
- thoff + sizeof(struct tcphdr) :
- thoff + sizeof(*ports)))
+ if (!pskb_network_may_pull(skb, iph->protocol == IPPROTO_TCP ?
+ thoff + sizeof(struct tcphdr) :
+ thoff + sizeof(*ports)))
return false;
iph = ip_hdr(skb);
@@ -241,7 +241,7 @@ static void tcf_ct_flow_table_process_conn(struct tcf_ct_flow_table *ct_ft,
struct ipv6hdr *ip6h;
unsigned int thoff;
- if (!pskb_may_pull(skb, sizeof(*ip6h)))
+ if (!pskb_network_may_pull(skb, sizeof(*ip6h)))
return false;
ip6h = ipv6_hdr(skb);
@@ -254,9 +254,9 @@ static void tcf_ct_flow_table_process_conn(struct tcf_ct_flow_table *ct_ft,
return false;
thoff = sizeof(*ip6h);
- if (!pskb_may_pull(skb, ip6h->nexthdr == IPPROTO_TCP ?
- thoff + sizeof(struct tcphdr) :
- thoff + sizeof(*ports)))
+ if (!pskb_network_may_pull(skb, ip6h->nexthdr == IPPROTO_TCP ?
+ thoff + sizeof(struct tcphdr) :
+ thoff + sizeof(*ports)))
return false;
ip6h = ipv6_hdr(skb);
--
1.8.3.1
^ permalink raw reply related [flat|nested] 8+ messages in thread