Commit 0fabd2aa authored by Lorenzo Bianconi's avatar Lorenzo Bianconi Committed by Alexei Starovoitov
Browse files

net: netfilter: add bpf_ct_set_nat_info kfunc helper 



Introduce bpf_ct_set_nat_info kfunc helper in order to set source and
destination nat addresses/ports in a new allocated ct entry not inserted
in the connection tracking table yet.

Signed-off-by: default avatarLorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/r/9567db2fdfa5bebe7b7cc5870f7a34549418b4fc.1663778601.git.lorenzo@kernel.org


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent eed807f6

net/netfilter/nf_conntrack_bpf.c

+46 −1
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ 
#include <net/netfilter/nf_conntrack.h>

#include <net/netfilter/nf_conntrack_bpf.h>

#include <net/netfilter/nf_conntrack_core.h>

#include <net/netfilter/nf_nat.h>



/* bpf_ct_opts - Options for CT lookup helpers

 *
@@ -137,7 +138,6 @@ __bpf_nf_ct_alloc_entry(struct net *net, struct bpf_sock_tuple *bpf_tuple, 


	memset(&ct->proto, 0, sizeof(ct->proto));

	__nf_ct_set_timeout(ct, timeout * HZ);

	ct->status |= IPS_CONFIRMED;



out:

	if (opts->netns_id >= 0)
@@ -390,6 +390,7 @@ struct nf_conn *bpf_ct_insert_entry(struct nf_conn___init *nfct_i) 
	struct nf_conn *nfct = (struct nf_conn *)nfct_i;

	int err;



	nfct->status |= IPS_CONFIRMED;

	err = nf_conntrack_hash_check_insert(nfct);

	if (err < 0) {

		nf_conntrack_free(nfct);
@@ -475,6 +476,49 @@ int bpf_ct_change_status(struct nf_conn *nfct, u32 status) 
	return nf_ct_change_status_common(nfct, status);

}



/* bpf_ct_set_nat_info - Set source or destination nat address

 *

 * Set source or destination nat address of the newly allocated

 * nf_conn before insertion. This must be invoked for referenced

 * PTR_TO_BTF_ID to nf_conn___init.

 *

 * Parameters:

 * @nfct	- Pointer to referenced nf_conn object, obtained using

 *		  bpf_xdp_ct_alloc or bpf_skb_ct_alloc.

 * @addr	- Nat source/destination address

 * @port	- Nat source/destination port. Non-positive values are

 *		  interpreted as select a random port.

 * @manip	- NF_NAT_MANIP_SRC or NF_NAT_MANIP_DST

 */

int bpf_ct_set_nat_info(struct nf_conn___init *nfct,

			union nf_inet_addr *addr, int port,

			enum nf_nat_manip_type manip)

{

#if ((IS_MODULE(CONFIG_NF_NAT) && IS_MODULE(CONFIG_NF_CONNTRACK)) || \

     IS_BUILTIN(CONFIG_NF_NAT))

	struct nf_conn *ct = (struct nf_conn *)nfct;

	u16 proto = nf_ct_l3num(ct);

	struct nf_nat_range2 range;



	if (proto != NFPROTO_IPV4 && proto != NFPROTO_IPV6)

		return -EINVAL;



	memset(&range, 0, sizeof(struct nf_nat_range2));

	range.flags = NF_NAT_RANGE_MAP_IPS;

	range.min_addr = *addr;

	range.max_addr = range.min_addr;

	if (port > 0) {

		range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;

		range.min_proto.all = cpu_to_be16(port);

		range.max_proto.all = range.min_proto.all;

	}



	return nf_nat_setup_info(ct, &range, manip) == NF_DROP ? -ENOMEM : 0;

#else

	return -EOPNOTSUPP;

#endif

}



__diag_pop()



BTF_SET8_START(nf_ct_kfunc_set)
@@ -488,6 +532,7 @@ BTF_ID_FLAGS(func, bpf_ct_set_timeout, KF_TRUSTED_ARGS) 
BTF_ID_FLAGS(func, bpf_ct_change_timeout, KF_TRUSTED_ARGS)

BTF_ID_FLAGS(func, bpf_ct_set_status, KF_TRUSTED_ARGS)

BTF_ID_FLAGS(func, bpf_ct_change_status, KF_TRUSTED_ARGS)

BTF_ID_FLAGS(func, bpf_ct_set_nat_info, KF_TRUSTED_ARGS)

BTF_SET8_END(nf_ct_kfunc_set)



static const struct btf_kfunc_id_set nf_conntrack_kfunc_set = {