* [PATCH nf 1/4] netfilter: nf_flow_table_offload: fix dst_neigh lookup
2019-12-12 9:43 [PATCH nf 0/4] netfilter: nf_flow_table_offload: something fixes wenxu
@ 2019-12-12 9:43 ` wenxu
2019-12-12 9:43 ` [PATCH nf 2/4] netfilter: nf_flow_table_offload: check the status of dst_neigh wenxu
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-12-12 9:43 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel
From: wenxu <wenxu@ucloud.cn>
Get the dst_neigh through dst_ip, The dst_ip should get
through peer tuple.src_v4 fix for dnat case.
Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
net/netfilter/nf_flow_table_offload.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index de7a0d1..0289c3e 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -166,14 +166,16 @@ static int flow_offload_eth_dst(struct net *net,
enum flow_offload_tuple_dir dir,
struct nf_flow_rule *flow_rule)
{
- const struct flow_offload_tuple *tuple = &flow->tuplehash[dir].tuple;
+ const struct in_addr *dst_addr_v4 = &flow->tuplehash[!dir].tuple.src_v4;
struct flow_action_entry *entry0 = flow_action_entry_next(flow_rule);
struct flow_action_entry *entry1 = flow_action_entry_next(flow_rule);
+ const struct dst_entry *dst_cache;
struct neighbour *n;
u32 mask, val;
u16 val16;
- n = dst_neigh_lookup(tuple->dst_cache, &tuple->dst_v4);
+ dst_cache = flow->tuplehash[dir].tuple.dst_cache;
+ n = dst_neigh_lookup(dst_cache, dst_addr_v4);
if (!n)
return -ENOENT;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH nf 2/4] netfilter: nf_flow_table_offload: check the status of dst_neigh
2019-12-12 9:43 [PATCH nf 0/4] netfilter: nf_flow_table_offload: something fixes wenxu
2019-12-12 9:43 ` [PATCH nf 1/4] netfilter: nf_flow_table_offload: fix dst_neigh lookup wenxu
@ 2019-12-12 9:43 ` wenxu
2019-12-12 9:43 ` [PATCH nf 3/4] netfilter: nf_flow_table_offload: fix miss dst_neigh_lookup for ipv6 wenxu
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-12-12 9:43 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel
From: wenxu <wenxu@ucloud.cn>
It is better to get the dst_neigh with neigh->lock and check the
nud_state is VALID
Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
net/netfilter/nf_flow_table_offload.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index 0289c3e..aa40d58 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -170,8 +170,10 @@ static int flow_offload_eth_dst(struct net *net,
struct flow_action_entry *entry0 = flow_action_entry_next(flow_rule);
struct flow_action_entry *entry1 = flow_action_entry_next(flow_rule);
const struct dst_entry *dst_cache;
+ unsigned char ha[ETH_ALEN];
struct neighbour *n;
u32 mask, val;
+ u8 nud_state;
u16 val16;
dst_cache = flow->tuplehash[dir].tuple.dst_cache;
@@ -179,13 +181,21 @@ static int flow_offload_eth_dst(struct net *net,
if (!n)
return -ENOENT;
+ read_lock_bh(&n->lock);
+ nud_state = n->nud_state;
+ ether_addr_copy(ha, n->ha);
+ read_unlock_bh(&n->lock);
+
+ if (!(nud_state & NUD_VALID))
+ return -ENOENT;
+
mask = ~0xffffffff;
- memcpy(&val, n->ha, 4);
+ memcpy(&val, ha, 4);
flow_offload_mangle(entry0, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 0,
&val, &mask);
mask = ~0x0000ffff;
- memcpy(&val16, n->ha + 4, 2);
+ memcpy(&val16, ha + 4, 2);
val = val16;
flow_offload_mangle(entry1, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 4,
&val, &mask);
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH nf 3/4] netfilter: nf_flow_table_offload: fix miss dst_neigh_lookup for ipv6
2019-12-12 9:43 [PATCH nf 0/4] netfilter: nf_flow_table_offload: something fixes wenxu
2019-12-12 9:43 ` [PATCH nf 1/4] netfilter: nf_flow_table_offload: fix dst_neigh lookup wenxu
2019-12-12 9:43 ` [PATCH nf 2/4] netfilter: nf_flow_table_offload: check the status of dst_neigh wenxu
@ 2019-12-12 9:43 ` wenxu
2019-12-12 9:43 ` [PATCH nf 4/4] netfilter: nf_flow_table_offload: fix the nat port mangle wenxu
2019-12-12 10:06 ` [PATCH nf 0/4] netfilter: nf_flow_table_offload: something fixes wenxu
4 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-12-12 9:43 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel
From: wenxu <wenxu@ucloud.cn>
Add dst_neigh_lookup support for ipv6
Fixes: 5c27d8d76ce8 ("netfilter: nf_flow_table_offload: add IPv6 support")
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
net/netfilter/nf_flow_table_offload.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index aa40d58..2ce6001 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -164,20 +164,26 @@ static int flow_offload_eth_src(struct net *net,
static int flow_offload_eth_dst(struct net *net,
const struct flow_offload *flow,
enum flow_offload_tuple_dir dir,
- struct nf_flow_rule *flow_rule)
+ struct nf_flow_rule *flow_rule,
+ bool ipv6)
{
- const struct in_addr *dst_addr_v4 = &flow->tuplehash[!dir].tuple.src_v4;
struct flow_action_entry *entry0 = flow_action_entry_next(flow_rule);
struct flow_action_entry *entry1 = flow_action_entry_next(flow_rule);
const struct dst_entry *dst_cache;
unsigned char ha[ETH_ALEN];
struct neighbour *n;
+ const void *daddr;
u32 mask, val;
u8 nud_state;
u16 val16;
dst_cache = flow->tuplehash[dir].tuple.dst_cache;
- n = dst_neigh_lookup(dst_cache, dst_addr_v4);
+ if (ipv6)
+ daddr = &flow->tuplehash[!dir].tuple.src_v6;
+ else
+ daddr = &flow->tuplehash[!dir].tuple.src_v4;
+
+ n = dst_neigh_lookup(dst_cache, daddr);
if (!n)
return -ENOENT;
@@ -431,7 +437,7 @@ int nf_flow_rule_route_ipv4(struct net *net, const struct flow_offload *flow,
struct nf_flow_rule *flow_rule)
{
if (flow_offload_eth_src(net, flow, dir, flow_rule) < 0 ||
- flow_offload_eth_dst(net, flow, dir, flow_rule) < 0)
+ flow_offload_eth_dst(net, flow, dir, flow_rule, true) < 0)
return -1;
if (flow->flags & FLOW_OFFLOAD_SNAT) {
@@ -457,7 +463,7 @@ int nf_flow_rule_route_ipv6(struct net *net, const struct flow_offload *flow,
struct nf_flow_rule *flow_rule)
{
if (flow_offload_eth_src(net, flow, dir, flow_rule) < 0 ||
- flow_offload_eth_dst(net, flow, dir, flow_rule) < 0)
+ flow_offload_eth_dst(net, flow, dir, flow_rule, false) < 0)
return -1;
if (flow->flags & FLOW_OFFLOAD_SNAT) {
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH nf 4/4] netfilter: nf_flow_table_offload: fix the nat port mangle.
2019-12-12 9:43 [PATCH nf 0/4] netfilter: nf_flow_table_offload: something fixes wenxu
` (2 preceding siblings ...)
2019-12-12 9:43 ` [PATCH nf 3/4] netfilter: nf_flow_table_offload: fix miss dst_neigh_lookup for ipv6 wenxu
@ 2019-12-12 9:43 ` wenxu
2019-12-12 10:06 ` [PATCH nf 0/4] netfilter: nf_flow_table_offload: something fixes wenxu
4 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-12-12 9:43 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel
From: wenxu <wenxu@ucloud.cn>
For dnat:
The original dir maybe modify the dst port to src port of reply dir
The reply dir maybe modify the src port to dst port of origin dir
For snat:
The original dir maybe modify the src port to dst port of reply dir
The reply dir maybe modify the dst port to src port of reply dir
Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
net/netfilter/nf_flow_table_offload.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index 2ce6001..ed2746f 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -353,22 +353,26 @@ static void flow_offload_port_snat(struct net *net,
struct nf_flow_rule *flow_rule)
{
struct flow_action_entry *entry = flow_action_entry_next(flow_rule);
- u32 mask = ~htonl(0xffff0000), port;
+ u32 mask, port;
u32 offset;
switch (dir) {
case FLOW_OFFLOAD_DIR_ORIGINAL:
port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port);
offset = 0; /* offsetof(struct tcphdr, source); */
+ port = htonl(port << 16);
+ mask = ~htonl(0xffff0000);
break;
case FLOW_OFFLOAD_DIR_REPLY:
port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port);
offset = 0; /* offsetof(struct tcphdr, dest); */
+ port = htonl(port);
+ mask = ~htonl(0xffff);
break;
default:
return;
}
- port = htonl(port << 16);
+
flow_offload_mangle(entry, flow_offload_l4proto(flow), offset,
&port, &mask);
}
@@ -379,22 +383,26 @@ static void flow_offload_port_dnat(struct net *net,
struct nf_flow_rule *flow_rule)
{
struct flow_action_entry *entry = flow_action_entry_next(flow_rule);
- u32 mask = ~htonl(0xffff), port;
+ u32 mask, port;
u32 offset;
switch (dir) {
case FLOW_OFFLOAD_DIR_ORIGINAL:
- port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port);
- offset = 0; /* offsetof(struct tcphdr, source); */
+ port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port);
+ offset = 0; /* offsetof(struct tcphdr, dest); */
+ port = htonl(port);
+ mask = ~htonl(0xffff);
break;
case FLOW_OFFLOAD_DIR_REPLY:
- port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port);
- offset = 0; /* offsetof(struct tcphdr, dest); */
+ port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port);
+ offset = 0; /* offsetof(struct tcphdr, source); */
+ port = htonl(port << 16);
+ mask = ~htonl(0xffff0000);
break;
default:
return;
}
- port = htonl(port);
+
flow_offload_mangle(entry, flow_offload_l4proto(flow), offset,
&port, &mask);
}
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH nf 0/4] netfilter: nf_flow_table_offload: something fixes
2019-12-12 9:43 [PATCH nf 0/4] netfilter: nf_flow_table_offload: something fixes wenxu
` (3 preceding siblings ...)
2019-12-12 9:43 ` [PATCH nf 4/4] netfilter: nf_flow_table_offload: fix the nat port mangle wenxu
@ 2019-12-12 10:06 ` wenxu
4 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-12-12 10:06 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel
Hi pablo,
Please drop this series. I will resend one. Tanks
On 12/12/2019 5:43 PM, wenxu@ucloud.cn wrote:
> From: wenxu <wenxu@ucloud.cn>
>
>
> wenxu (4):
> netfilter: nf_flow_table_offload: fix dst_neigh lookup
> netfilter: nf_flow_table_offload: check the status of dst_neigh
> netfilter: nf_flow_table_offload: fix miss dst_neigh_lookup for ipv6
> netfilter: nf_flow_table_offload: fix the nat port mangle.
>
> net/netfilter/nf_flow_table_offload.c | 56 +++++++++++++++++++++++++----------
> 1 file changed, 41 insertions(+), 15 deletions(-)
>
^ permalink raw reply [flat|nested] 6+ messages in thread