Commit 1963c740 authored by Lorenzo Bianconi's avatar Lorenzo Bianconi Committed by Alexei Starovoitov
Browse files

net: netfilter: Reports ct direction in CT lookup helpers for XDP and TC-BPF 



Report connection tracking tuple direction in
bpf_skb_ct_lookup/bpf_xdp_ct_lookup helpers. Direction will be used to
implement snat/dnat through xdp ebpf program.

Signed-off-by: default avatarLorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/aa1aaac89191cfc64078ecef36c0a48c302321b9.1648908601.git.lorenzo@kernel.org
parent 2d0df019

net/netfilter/nf_conntrack_bpf.c

+15 −7
Original line number Diff line number Diff line
@@ -38,6 +38,7 @@ 
 * @l4proto    - Layer 4 protocol

 *		 Values:

 *		   IPPROTO_TCP, IPPROTO_UDP

 * @dir:       - connection tracking tuple direction.

 * @reserved   - Reserved member, will be reused for more options in future

 *		 Values:

 *		   0
@@ -46,7 +47,8 @@ struct bpf_ct_opts { 
	s32 netns_id;

	s32 error;

	u8 l4proto;

	u8 reserved[3];

	u8 dir;

	u8 reserved[2];

};



enum {
@@ -56,10 +58,11 @@ enum { 
static struct nf_conn *__bpf_nf_ct_lookup(struct net *net,

					  struct bpf_sock_tuple *bpf_tuple,

					  u32 tuple_len, u8 protonum,

					  s32 netns_id)

					  s32 netns_id, u8 *dir)

{

	struct nf_conntrack_tuple_hash *hash;

	struct nf_conntrack_tuple tuple;

	struct nf_conn *ct;



	if (unlikely(protonum != IPPROTO_TCP && protonum != IPPROTO_UDP))

		return ERR_PTR(-EPROTO);
@@ -99,7 +102,12 @@ static struct nf_conn *__bpf_nf_ct_lookup(struct net *net, 
		put_net(net);

	if (!hash)

		return ERR_PTR(-ENOENT);

	return nf_ct_tuplehash_to_ctrack(hash);



	ct = nf_ct_tuplehash_to_ctrack(hash);

	if (dir)

		*dir = NF_CT_DIRECTION(hash);



	return ct;

}



__diag_push();
@@ -135,13 +143,13 @@ bpf_xdp_ct_lookup(struct xdp_md *xdp_ctx, struct bpf_sock_tuple *bpf_tuple, 
	if (!opts)

		return NULL;

	if (!bpf_tuple || opts->reserved[0] || opts->reserved[1] ||

	    opts->reserved[2] || opts__sz != NF_BPF_CT_OPTS_SZ) {

	    opts__sz != NF_BPF_CT_OPTS_SZ) {

		opts->error = -EINVAL;

		return NULL;

	}

	caller_net = dev_net(ctx->rxq->dev);

	nfct = __bpf_nf_ct_lookup(caller_net, bpf_tuple, tuple__sz, opts->l4proto,

				  opts->netns_id);

				  opts->netns_id, &opts->dir);

	if (IS_ERR(nfct)) {

		opts->error = PTR_ERR(nfct);

		return NULL;
@@ -178,13 +186,13 @@ bpf_skb_ct_lookup(struct __sk_buff *skb_ctx, struct bpf_sock_tuple *bpf_tuple, 
	if (!opts)

		return NULL;

	if (!bpf_tuple || opts->reserved[0] || opts->reserved[1] ||

	    opts->reserved[2] || opts__sz != NF_BPF_CT_OPTS_SZ) {

	    opts__sz != NF_BPF_CT_OPTS_SZ) {

		opts->error = -EINVAL;

		return NULL;

	}

	caller_net = skb->dev ? dev_net(skb->dev) : sock_net(skb->sk);

	nfct = __bpf_nf_ct_lookup(caller_net, bpf_tuple, tuple__sz, opts->l4proto,

				  opts->netns_id);

				  opts->netns_id, &opts->dir);

	if (IS_ERR(nfct)) {

		opts->error = PTR_ERR(nfct);

		return NULL;