Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit be2861dc authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_{fwd,dup}_netdev: add offload support 



This patch adds support for packet mirroring and redirection. The
nft_fwd_dup_netdev_offload() function configures the flow_action object
for the fwd and the dup actions.

Extend nft_flow_rule_destroy() to release the net_device object when the
flow_rule object is released, since nft_fwd_dup_netdev_offload() bumps
the net_device reference counter.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Acked-by: default avatarwenxu <wenxu@ucloud.cn>
parent ee394f96

include/net/netfilter/nf_dup_netdev.h

+6 −0
Original line number Diff line number Diff line
@@ -7,4 +7,10 @@ 
void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif);

void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif);



struct nft_offload_ctx;

struct nft_flow_rule;



int nft_fwd_dup_netdev_offload(struct nft_offload_ctx *ctx,

			       struct nft_flow_rule *flow,

			       enum flow_action_id id, int oif);

#endif

include/net/netfilter/nf_tables_offload.h

+2 −1
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ struct nft_offload_ctx { 
		u8				protonum;

	} dep;

	unsigned int				num_actions;

	struct net				*net;

	struct nft_offload_reg			regs[NFT_REG32_15 + 1];

};
@@ -61,7 +62,7 @@ struct nft_flow_rule { 
#define NFT_OFFLOAD_F_ACTION	(1 << 0)



struct nft_rule;

struct nft_flow_rule *nft_flow_rule_create(const struct nft_rule *rule);

struct nft_flow_rule *nft_flow_rule_create(struct net *net, const struct nft_rule *rule);

void nft_flow_rule_destroy(struct nft_flow_rule *flow);

int nft_flow_rule_offload_commit(struct net *net);

net/netfilter/nf_dup_netdev.c

+21 −0
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ 
#include <linux/netfilter.h>

#include <linux/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables_offload.h>

#include <net/netfilter/nf_dup_netdev.h>



static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev)
@@ -50,5 +51,25 @@ void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif) 
}

EXPORT_SYMBOL_GPL(nf_dup_netdev_egress);



int nft_fwd_dup_netdev_offload(struct nft_offload_ctx *ctx,

			       struct nft_flow_rule *flow,

			       enum flow_action_id id, int oif)

{

	struct flow_action_entry *entry;

	struct net_device *dev;



	/* nft_flow_rule_destroy() releases the reference on this device. */

	dev = dev_get_by_index(ctx->net, oif);

	if (!dev)

		return -EOPNOTSUPP;



	entry = &flow->rule->action.entries[ctx->num_actions++];

	entry->id = id;

	entry->dev = dev;



	return 0;

}

EXPORT_SYMBOL_GPL(nft_fwd_dup_netdev_offload);



MODULE_LICENSE("GPL");

MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");

net/netfilter/nf_tables_api.c

+1 −1
Original line number Diff line number Diff line
@@ -2853,7 +2853,7 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, 
		return nft_table_validate(net, table);



	if (chain->flags & NFT_CHAIN_HW_OFFLOAD) {

		flow = nft_flow_rule_create(rule);

		flow = nft_flow_rule_create(net, rule);

		if (IS_ERR(flow))

			return PTR_ERR(flow);

net/netfilter/nf_tables_offload.c

+16 −1
Original line number Diff line number Diff line
@@ -28,7 +28,8 @@ static struct nft_flow_rule *nft_flow_rule_alloc(int num_actions) 
	return flow;

}



struct nft_flow_rule *nft_flow_rule_create(const struct nft_rule *rule)

struct nft_flow_rule *nft_flow_rule_create(struct net *net,

					   const struct nft_rule *rule)

{

	struct nft_offload_ctx *ctx;

	struct nft_flow_rule *flow;
@@ -54,6 +55,7 @@ struct nft_flow_rule *nft_flow_rule_create(const struct nft_rule *rule) 
		err = -ENOMEM;

		goto err_out;

	}

	ctx->net = net;

	ctx->dep.type = NFT_OFFLOAD_DEP_UNSPEC;



	while (expr->ops && expr != nft_expr_last(rule)) {
@@ -80,6 +82,19 @@ struct nft_flow_rule *nft_flow_rule_create(const struct nft_rule *rule) 


void nft_flow_rule_destroy(struct nft_flow_rule *flow)

{

	struct flow_action_entry *entry;

	int i;



	flow_action_for_each(i, entry, &flow->rule->action) {

		switch (entry->id) {

		case FLOW_ACTION_REDIRECT:

		case FLOW_ACTION_MIRRED:

			dev_put(entry->dev);

			break;

		default:

			break;

		}

	}

	kfree(flow->rule);

	kfree(flow);

}