* [PATCH net-next 1/4] netfilter: flow_table_offload: Fix check ndo_setup_tc when setup_block
2019-11-13 4:46 [PATCH net-next 0/4] netfilter: flow_table_offload something fixes wenxu
@ 2019-11-13 4:46 ` wenxu
2019-11-13 4:46 ` [PATCH net-next 2/4] netfilter: flow_table_core: remove unnecessary parameter in flow_offload_fill_dir wenxu
` (4 subsequent siblings)
5 siblings, 0 replies; 8+ messages in thread
From: wenxu @ 2019-11-13 4:46 UTC (permalink / raw)
To: pablo, davem; +Cc: netfilter-devel, netdev
From: wenxu <wenxu@ucloud.cn>
It should check the ndo_setup_tc in the nf_flow_table_offload_setup
Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
net/netfilter/nf_flow_table_offload.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index 9be61f47..1cc6671 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -722,6 +722,9 @@ int nf_flow_table_offload_setup(struct nf_flowtable *flowtable,
if (!(flowtable->flags & NF_FLOWTABLE_HW_OFFLOAD))
return 0;
+ if (!dev->netdev_ops->ndo_setup_tc)
+ return -EOPNOTSUPP;
+
bo.net = dev_net(dev);
bo.block = &flowtable->flow_block;
bo.command = cmd;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH net-next 2/4] netfilter: flow_table_core: remove unnecessary parameter in flow_offload_fill_dir
2019-11-13 4:46 [PATCH net-next 0/4] netfilter: flow_table_offload something fixes wenxu
2019-11-13 4:46 ` [PATCH net-next 1/4] netfilter: flow_table_offload: Fix check ndo_setup_tc when setup_block wenxu
@ 2019-11-13 4:46 ` wenxu
2019-11-13 4:46 ` [PATCH net-next 3/4] netfilter: nf_tables: Fix check the err for FLOW_BLOCK_BIND setup call wenxu
` (3 subsequent siblings)
5 siblings, 0 replies; 8+ messages in thread
From: wenxu @ 2019-11-13 4:46 UTC (permalink / raw)
To: pablo, davem; +Cc: netfilter-devel, netdev
From: wenxu <wenxu@ucloud.cn>
The ct is already in the struct flow_offload. We should remove it
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
net/netfilter/nf_flow_table_core.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 8468d2d..9889d52 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -18,11 +18,11 @@
static LIST_HEAD(flowtables);
static void
-flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
+flow_offload_fill_dir(struct flow_offload *flow,
enum flow_offload_tuple_dir dir)
{
struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple;
- struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple;
+ struct nf_conntrack_tuple *ctt = &flow->ct->tuplehash[dir].tuple;
ft->dir = dir;
@@ -57,8 +57,8 @@ struct flow_offload *flow_offload_alloc(struct nf_conn *ct)
flow->ct = ct;
- flow_offload_fill_dir(flow, ct, FLOW_OFFLOAD_DIR_ORIGINAL);
- flow_offload_fill_dir(flow, ct, FLOW_OFFLOAD_DIR_REPLY);
+ flow_offload_fill_dir(flow, FLOW_OFFLOAD_DIR_ORIGINAL);
+ flow_offload_fill_dir(flow, FLOW_OFFLOAD_DIR_REPLY);
if (ct->status & IPS_SRC_NAT)
flow->flags |= FLOW_OFFLOAD_SNAT;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH net-next 3/4] netfilter: nf_tables: Fix check the err for FLOW_BLOCK_BIND setup call
2019-11-13 4:46 [PATCH net-next 0/4] netfilter: flow_table_offload something fixes wenxu
2019-11-13 4:46 ` [PATCH net-next 1/4] netfilter: flow_table_offload: Fix check ndo_setup_tc when setup_block wenxu
2019-11-13 4:46 ` [PATCH net-next 2/4] netfilter: flow_table_core: remove unnecessary parameter in flow_offload_fill_dir wenxu
@ 2019-11-13 4:46 ` wenxu
2019-11-14 23:27 ` Pablo Neira Ayuso
2019-11-13 4:46 ` [PATCH net-next 4/4] netfilter: nf_tables_api: Fix UNBIND setup in the nft_flowtable_event wenxu
` (2 subsequent siblings)
5 siblings, 1 reply; 8+ messages in thread
From: wenxu @ 2019-11-13 4:46 UTC (permalink / raw)
To: pablo, davem; +Cc: netfilter-devel, netdev
From: wenxu <wenxu@ucloud.cn>
Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
net/netfilter/nf_tables_api.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 2dc636f..0a00812 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5995,8 +5995,12 @@ static int nft_register_flowtable_net_hooks(struct net *net,
}
}
- flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
- FLOW_BLOCK_BIND);
+ err = flowtable->data.type->setup(&flowtable->data,
+ hook->ops.dev,
+ FLOW_BLOCK_BIND);
+ if (err < 0)
+ goto err_unregister_net_hooks;
+
err = nf_register_net_hook(net, &hook->ops);
if (err < 0)
goto err_unregister_net_hooks;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH net-next 3/4] netfilter: nf_tables: Fix check the err for FLOW_BLOCK_BIND setup call
2019-11-13 4:46 ` [PATCH net-next 3/4] netfilter: nf_tables: Fix check the err for FLOW_BLOCK_BIND setup call wenxu
@ 2019-11-14 23:27 ` Pablo Neira Ayuso
0 siblings, 0 replies; 8+ messages in thread
From: Pablo Neira Ayuso @ 2019-11-14 23:27 UTC (permalink / raw)
To: wenxu; +Cc: davem, netfilter-devel, netdev
[-- Attachment #1: Type: text/plain, Size: 1073 bytes --]
This one is incomplete, right? I'm attaching an alternative patch.
On Wed, Nov 13, 2019 at 12:46:41PM +0800, wenxu@ucloud.cn wrote:
> From: wenxu <wenxu@ucloud.cn>
>
> Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
> Signed-off-by: wenxu <wenxu@ucloud.cn>
> ---
> net/netfilter/nf_tables_api.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index 2dc636f..0a00812 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -5995,8 +5995,12 @@ static int nft_register_flowtable_net_hooks(struct net *net,
> }
> }
>
> - flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
> - FLOW_BLOCK_BIND);
> + err = flowtable->data.type->setup(&flowtable->data,
> + hook->ops.dev,
> + FLOW_BLOCK_BIND);
> + if (err < 0)
> + goto err_unregister_net_hooks;
> +
> err = nf_register_net_hook(net, &hook->ops);
> if (err < 0)
> goto err_unregister_net_hooks;
> --
> 1.8.3.1
>
[-- Attachment #2: 0001-netfilter-nf_tables-unbind-callbacks-if-flowtable-ho.patch --]
[-- Type: text/x-diff, Size: 1198 bytes --]
From a6e05e56907673e21948c6ae53f45494b25fc0aa Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 15 Nov 2019 00:22:55 +0100
Subject: [PATCH] netfilter: nf_tables: unbind callbacks if flowtable hook
registration fails
Undo the callback binding before unregistering the existing hooks.
Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
Reported-by: wenxu <wenxu@ucloud.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 2dc636faa322..ad3882e14e82 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5998,8 +5998,12 @@ static int nft_register_flowtable_net_hooks(struct net *net,
flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
FLOW_BLOCK_BIND);
err = nf_register_net_hook(net, &hook->ops);
- if (err < 0)
+ if (err < 0) {
+ flowtable->data.type->setup(&flowtable->data,
+ hook->ops.dev,
+ FLOW_BLOCK_UNBIND);
goto err_unregister_net_hooks;
+ }
i++;
}
--
2.11.0
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH net-next 4/4] netfilter: nf_tables_api: Fix UNBIND setup in the nft_flowtable_event
2019-11-13 4:46 [PATCH net-next 0/4] netfilter: flow_table_offload something fixes wenxu
` (2 preceding siblings ...)
2019-11-13 4:46 ` [PATCH net-next 3/4] netfilter: nf_tables: Fix check the err for FLOW_BLOCK_BIND setup call wenxu
@ 2019-11-13 4:46 ` wenxu
2019-11-14 23:13 ` [PATCH net-next 0/4] netfilter: flow_table_offload something fixes Pablo Neira Ayuso
2019-11-14 23:14 ` David Miller
5 siblings, 0 replies; 8+ messages in thread
From: wenxu @ 2019-11-13 4:46 UTC (permalink / raw)
To: pablo, davem; +Cc: netfilter-devel, netdev
From: wenxu <wenxu@ucloud.cn>
It should do UNBIND setup in the nft_flowtable_event.
Fixes: 8bb69f3b2918 ("netfilter: nf_tables: add flowtable offload control plane")
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
net/netfilter/nf_tables_api.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 0a00812..87e7b97 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6470,6 +6470,8 @@ static void nft_flowtable_event(unsigned long event, struct net_device *dev,
continue;
nf_unregister_net_hook(dev_net(dev), &hook->ops);
+ flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
+ FLOW_BLOCK_UNBIND);
list_del_rcu(&hook->list);
kfree_rcu(hook, rcu);
break;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH net-next 0/4] netfilter: flow_table_offload something fixes
2019-11-13 4:46 [PATCH net-next 0/4] netfilter: flow_table_offload something fixes wenxu
` (3 preceding siblings ...)
2019-11-13 4:46 ` [PATCH net-next 4/4] netfilter: nf_tables_api: Fix UNBIND setup in the nft_flowtable_event wenxu
@ 2019-11-14 23:13 ` Pablo Neira Ayuso
2019-11-14 23:14 ` David Miller
5 siblings, 0 replies; 8+ messages in thread
From: Pablo Neira Ayuso @ 2019-11-14 23:13 UTC (permalink / raw)
To: wenxu; +Cc: davem, netfilter-devel, netdev
Series applied to nf-next, thanks.
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH net-next 0/4] netfilter: flow_table_offload something fixes
2019-11-13 4:46 [PATCH net-next 0/4] netfilter: flow_table_offload something fixes wenxu
` (4 preceding siblings ...)
2019-11-14 23:13 ` [PATCH net-next 0/4] netfilter: flow_table_offload something fixes Pablo Neira Ayuso
@ 2019-11-14 23:14 ` David Miller
5 siblings, 0 replies; 8+ messages in thread
From: David Miller @ 2019-11-14 23:14 UTC (permalink / raw)
To: wenxu; +Cc: pablo, netfilter-devel, netdev
From: wenxu@ucloud.cn
Date: Wed, 13 Nov 2019 12:46:38 +0800
> From: wenxu <wenxu@ucloud.cn>
>
>
> wenxu (4):
> netfilter: flow_table_offload: Fix check ndo_setup_tc when setup_block
> netfilter: flow_table_core: remove unnecessary parameter in
> flow_offload_fill_dir
> netfilter: nf_tables: Fix check the err for FLOW_BLOCK_BIND setup call
> netfilter: nf_tables_api: Fix UNBIND setup in the nft_flowtable_event
Pablo, I assume you will take these.
Thanks.
^ permalink raw reply [flat|nested] 8+ messages in thread