Commit 33c6ce4a authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'net-move-more-duplicate-code-of-ovs-and-tc-conntrack-into-nf_conntrack_ovs' 

Xin Long says:

====================
net: move more duplicate code of ovs and tc conntrack into nf_conntrack_ovs

We've moved some duplicate code into nf_nat_ovs in:

  "net: eliminate the duplicate code in the ct nat functions of ovs and tc"

This patchset addresses more code duplication in the conntrack of ovs
and tc then creates nf_conntrack_ovs for them, and four functions will
be extracted and moved into it:

  nf_ct_handle_fragments()
  nf_ct_skb_network_trim()
  nf_ct_helper()
  nf_ct_add_helper()
====================

Link: https://lore.kernel.org/r/cover.1675810210.git.lucien.xin@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 025a785f 0785407e

include/net/netfilter/nf_conntrack.h

+4 −0
Original line number Diff line number Diff line
@@ -362,6 +362,10 @@ static inline struct nf_conntrack_net *nf_ct_pernet(const struct net *net) 
	return net_generic(net, nf_conntrack_net_id);

}



int nf_ct_skb_network_trim(struct sk_buff *skb, int family);

int nf_ct_handle_fragments(struct net *net, struct sk_buff *skb,

			   u16 zone, u8 family, u8 *proto, u16 *mru);



#define NF_CT_STAT_INC(net, count)	  __this_cpu_inc((net)->ct.stat->count)

#define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count)

#define NF_CT_STAT_ADD_ATOMIC(net, count, v) this_cpu_add((net)->ct.stat->count, (v))

net/netfilter/Kconfig

+3 −0
Original line number Diff line number Diff line
@@ -189,6 +189,9 @@ config NF_CONNTRACK_LABELS 
	  to connection tracking entries.  It can be used with xtables connlabel

	  match and the nftables ct expression.



config NF_CONNTRACK_OVS

	bool



config NF_CT_PROTO_DCCP

	bool 'DCCP protocol connection tracking support'

	depends on NETFILTER_ADVANCED

net/netfilter/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMEOUT) += nf_conntrack_timeout.o 
nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMESTAMP) += nf_conntrack_timestamp.o

nf_conntrack-$(CONFIG_NF_CONNTRACK_EVENTS) += nf_conntrack_ecache.o

nf_conntrack-$(CONFIG_NF_CONNTRACK_LABELS) += nf_conntrack_labels.o

nf_conntrack-$(CONFIG_NF_CONNTRACK_OVS) += nf_conntrack_ovs.o

nf_conntrack-$(CONFIG_NF_CT_PROTO_DCCP) += nf_conntrack_proto_dccp.o

nf_conntrack-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o

nf_conntrack-$(CONFIG_NF_CT_PROTO_GRE) += nf_conntrack_proto_gre.o

net/netfilter/nf_conntrack_helper.c

+0 −98
Original line number Diff line number Diff line
@@ -242,104 +242,6 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl, 
}

EXPORT_SYMBOL_GPL(__nf_ct_try_assign_helper);



/* 'skb' should already be pulled to nh_ofs. */

int nf_ct_helper(struct sk_buff *skb, struct nf_conn *ct,

		 enum ip_conntrack_info ctinfo, u16 proto)

{

	const struct nf_conntrack_helper *helper;

	const struct nf_conn_help *help;

	unsigned int protoff;

	int err;



	if (ctinfo == IP_CT_RELATED_REPLY)

		return NF_ACCEPT;



	help = nfct_help(ct);

	if (!help)

		return NF_ACCEPT;



	helper = rcu_dereference(help->helper);

	if (!helper)

		return NF_ACCEPT;



	if (helper->tuple.src.l3num != NFPROTO_UNSPEC &&

	    helper->tuple.src.l3num != proto)

		return NF_ACCEPT;



	switch (proto) {

	case NFPROTO_IPV4:

		protoff = ip_hdrlen(skb);

		proto = ip_hdr(skb)->protocol;

		break;

	case NFPROTO_IPV6: {

		u8 nexthdr = ipv6_hdr(skb)->nexthdr;

		__be16 frag_off;

		int ofs;



		ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,

				       &frag_off);

		if (ofs < 0 || (frag_off & htons(~0x7)) != 0) {

			pr_debug("proto header not found\n");

			return NF_ACCEPT;

		}

		protoff = ofs;

		proto = nexthdr;

		break;

	}

	default:

		WARN_ONCE(1, "helper invoked on non-IP family!");

		return NF_DROP;

	}



	if (helper->tuple.dst.protonum != proto)

		return NF_ACCEPT;



	err = helper->help(skb, protoff, ct, ctinfo);

	if (err != NF_ACCEPT)

		return err;



	/* Adjust seqs after helper.  This is needed due to some helpers (e.g.,

	 * FTP with NAT) adusting the TCP payload size when mangling IP

	 * addresses and/or port numbers in the text-based control connection.

	 */

	if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&

	    !nf_ct_seq_adjust(skb, ct, ctinfo, protoff))

		return NF_DROP;

	return NF_ACCEPT;

}

EXPORT_SYMBOL_GPL(nf_ct_helper);



int nf_ct_add_helper(struct nf_conn *ct, const char *name, u8 family,

		     u8 proto, bool nat, struct nf_conntrack_helper **hp)

{

	struct nf_conntrack_helper *helper;

	struct nf_conn_help *help;

	int ret = 0;



	helper = nf_conntrack_helper_try_module_get(name, family, proto);

	if (!helper)

		return -EINVAL;



	help = nf_ct_helper_ext_add(ct, GFP_KERNEL);

	if (!help) {

		nf_conntrack_helper_put(helper);

		return -ENOMEM;

	}

#if IS_ENABLED(CONFIG_NF_NAT)

	if (nat) {

		ret = nf_nat_helper_try_module_get(name, family, proto);

		if (ret) {

			nf_conntrack_helper_put(helper);

			return ret;

		}

	}

#endif

	rcu_assign_pointer(help->helper, helper);

	*hp = helper;

	return ret;

}

EXPORT_SYMBOL_GPL(nf_ct_add_helper);



/* appropriate ct lock protecting must be taken by caller */

static int unhelp(struct nf_conn *ct, void *me)

{

net/netfilter/nf_conntrack_ovs.c

0 → 100644
+178 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/* Support ct functions for openvswitch and used by OVS and TC conntrack. */



#include <net/netfilter/nf_conntrack_helper.h>

#include <net/netfilter/nf_conntrack_seqadj.h>

#include <net/netfilter/ipv6/nf_defrag_ipv6.h>

#include <net/ipv6_frag.h>

#include <net/ip.h>



/* 'skb' should already be pulled to nh_ofs. */

int nf_ct_helper(struct sk_buff *skb, struct nf_conn *ct,

		 enum ip_conntrack_info ctinfo, u16 proto)

{

	const struct nf_conntrack_helper *helper;

	const struct nf_conn_help *help;

	unsigned int protoff;

	int err;



	if (ctinfo == IP_CT_RELATED_REPLY)

		return NF_ACCEPT;



	help = nfct_help(ct);

	if (!help)

		return NF_ACCEPT;



	helper = rcu_dereference(help->helper);

	if (!helper)

		return NF_ACCEPT;



	if (helper->tuple.src.l3num != NFPROTO_UNSPEC &&

	    helper->tuple.src.l3num != proto)

		return NF_ACCEPT;



	switch (proto) {

	case NFPROTO_IPV4:

		protoff = ip_hdrlen(skb);

		proto = ip_hdr(skb)->protocol;

		break;

	case NFPROTO_IPV6: {

		u8 nexthdr = ipv6_hdr(skb)->nexthdr;

		__be16 frag_off;

		int ofs;



		ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,

				       &frag_off);

		if (ofs < 0 || (frag_off & htons(~0x7)) != 0) {

			pr_debug("proto header not found\n");

			return NF_ACCEPT;

		}

		protoff = ofs;

		proto = nexthdr;

		break;

	}

	default:

		WARN_ONCE(1, "helper invoked on non-IP family!");

		return NF_DROP;

	}



	if (helper->tuple.dst.protonum != proto)

		return NF_ACCEPT;



	err = helper->help(skb, protoff, ct, ctinfo);

	if (err != NF_ACCEPT)

		return err;



	/* Adjust seqs after helper.  This is needed due to some helpers (e.g.,

	 * FTP with NAT) adusting the TCP payload size when mangling IP

	 * addresses and/or port numbers in the text-based control connection.

	 */

	if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&

	    !nf_ct_seq_adjust(skb, ct, ctinfo, protoff))

		return NF_DROP;

	return NF_ACCEPT;

}

EXPORT_SYMBOL_GPL(nf_ct_helper);



int nf_ct_add_helper(struct nf_conn *ct, const char *name, u8 family,

		     u8 proto, bool nat, struct nf_conntrack_helper **hp)

{

	struct nf_conntrack_helper *helper;

	struct nf_conn_help *help;

	int ret = 0;



	helper = nf_conntrack_helper_try_module_get(name, family, proto);

	if (!helper)

		return -EINVAL;



	help = nf_ct_helper_ext_add(ct, GFP_KERNEL);

	if (!help) {

		nf_conntrack_helper_put(helper);

		return -ENOMEM;

	}

#if IS_ENABLED(CONFIG_NF_NAT)

	if (nat) {

		ret = nf_nat_helper_try_module_get(name, family, proto);

		if (ret) {

			nf_conntrack_helper_put(helper);

			return ret;

		}

	}

#endif

	rcu_assign_pointer(help->helper, helper);

	*hp = helper;

	return ret;

}

EXPORT_SYMBOL_GPL(nf_ct_add_helper);



/* Trim the skb to the length specified by the IP/IPv6 header,

 * removing any trailing lower-layer padding. This prepares the skb

 * for higher-layer processing that assumes skb->len excludes padding

 * (such as nf_ip_checksum). The caller needs to pull the skb to the

 * network header, and ensure ip_hdr/ipv6_hdr points to valid data.

 */

int nf_ct_skb_network_trim(struct sk_buff *skb, int family)

{

	unsigned int len;



	switch (family) {

	case NFPROTO_IPV4:

		len = skb_ip_totlen(skb);

		break;

	case NFPROTO_IPV6:

		len = sizeof(struct ipv6hdr)

			+ ntohs(ipv6_hdr(skb)->payload_len);

		break;

	default:

		len = skb->len;

	}



	return pskb_trim_rcsum(skb, len);

}

EXPORT_SYMBOL_GPL(nf_ct_skb_network_trim);



/* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero

 * value if 'skb' is freed.

 */

int nf_ct_handle_fragments(struct net *net, struct sk_buff *skb,

			   u16 zone, u8 family, u8 *proto, u16 *mru)

{

	int err;



	if (family == NFPROTO_IPV4) {

		enum ip_defrag_users user = IP_DEFRAG_CONNTRACK_IN + zone;



		memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));

		local_bh_disable();

		err = ip_defrag(net, skb, user);

		local_bh_enable();

		if (err)

			return err;



		*mru = IPCB(skb)->frag_max_size;

#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)

	} else if (family == NFPROTO_IPV6) {

		enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone;



		memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));

		err = nf_ct_frag6_gather(net, skb, user);

		if (err) {

			if (err != -EINPROGRESS)

				kfree_skb(skb);

			return err;

		}



		*proto = ipv6_hdr(skb)->nexthdr;

		*mru = IP6CB(skb)->frag_max_size;

#endif

	} else {

		kfree_skb(skb);

		return -EPFNOSUPPORT;

	}



	skb_clear_hash(skb);

	skb->ignore_df = 1;



	return 0;

}

EXPORT_SYMBOL_GPL(nf_ct_handle_fragments);