Commit 820dc052 authored by Lorenzo Bianconi's avatar Lorenzo Bianconi Committed by Alexei Starovoitov
Browse files

net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c 



Remove circular dependency between nf_nat module and nf_conntrack one
moving bpf_ct_set_nat_info kfunc in nf_nat_bpf.c

Fixes: 0fabd2aa ("net: netfilter: add bpf_ct_set_nat_info kfunc helper")
Suggested-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
Tested-by: default avatarNathan Chancellor <nathan@kernel.org>
Tested-by: default avatarYauheni Kaliuta <ykaliuta@redhat.com>
Signed-off-by: default avatarLorenzo Bianconi <lorenzo@kernel.org>
Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/r/51a65513d2cda3eeb0754842e8025ab3966068d8.1664490511.git.lorenzo@kernel.org


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 736baae6

include/net/netfilter/nf_conntrack_bpf.h

+19 −0
Original line number Diff line number Diff line
@@ -4,6 +4,11 @@ 
#define _NF_CONNTRACK_BPF_H



#include <linux/kconfig.h>

#include <net/netfilter/nf_conntrack.h>



struct nf_conn___init {

	struct nf_conn ct;

};



#if (IS_BUILTIN(CONFIG_NF_CONNTRACK) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) || \

    (IS_MODULE(CONFIG_NF_CONNTRACK) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES))
@@ -24,4 +29,18 @@ static inline void cleanup_nf_conntrack_bpf(void) 


#endif



#if (IS_BUILTIN(CONFIG_NF_NAT) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) || \

    (IS_MODULE(CONFIG_NF_NAT) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES))



extern int register_nf_nat_bpf(void);



#else



static inline int register_nf_nat_bpf(void)

{

	return 0;

}



#endif



#endif /* _NF_CONNTRACK_BPF_H */

net/netfilter/Makefile

+6 −0
Original line number Diff line number Diff line
@@ -60,6 +60,12 @@ obj-$(CONFIG_NF_NAT) += nf_nat.o 
nf_nat-$(CONFIG_NF_NAT_REDIRECT) += nf_nat_redirect.o

nf_nat-$(CONFIG_NF_NAT_MASQUERADE) += nf_nat_masquerade.o



ifeq ($(CONFIG_NF_NAT),m)

nf_nat-$(CONFIG_DEBUG_INFO_BTF_MODULES) += nf_nat_bpf.o

else ifeq ($(CONFIG_NF_NAT),y)

nf_nat-$(CONFIG_DEBUG_INFO_BTF) += nf_nat_bpf.o

endif



# NAT helpers

obj-$(CONFIG_NF_NAT_AMANDA) += nf_nat_amanda.o

obj-$(CONFIG_NF_NAT_FTP) += nf_nat_ftp.o

net/netfilter/nf_conntrack_bpf.c

+0 −50
Original line number Diff line number Diff line
@@ -14,10 +14,8 @@ 
#include <linux/types.h>

#include <linux/btf_ids.h>

#include <linux/net_namespace.h>

#include <net/netfilter/nf_conntrack.h>

#include <net/netfilter/nf_conntrack_bpf.h>

#include <net/netfilter/nf_conntrack_core.h>

#include <net/netfilter/nf_nat.h>



/* bpf_ct_opts - Options for CT lookup helpers

 *
@@ -239,10 +237,6 @@ __diag_push(); 
__diag_ignore_all("-Wmissing-prototypes",

		  "Global functions as their definitions will be in nf_conntrack BTF");



struct nf_conn___init {

	struct nf_conn ct;

};



/* bpf_xdp_ct_alloc - Allocate a new CT entry

 *

 * Parameters:
@@ -476,49 +470,6 @@ int bpf_ct_change_status(struct nf_conn *nfct, u32 status) 
	return nf_ct_change_status_common(nfct, status);

}



/* bpf_ct_set_nat_info - Set source or destination nat address

 *

 * Set source or destination nat address of the newly allocated

 * nf_conn before insertion. This must be invoked for referenced

 * PTR_TO_BTF_ID to nf_conn___init.

 *

 * Parameters:

 * @nfct	- Pointer to referenced nf_conn object, obtained using

 *		  bpf_xdp_ct_alloc or bpf_skb_ct_alloc.

 * @addr	- Nat source/destination address

 * @port	- Nat source/destination port. Non-positive values are

 *		  interpreted as select a random port.

 * @manip	- NF_NAT_MANIP_SRC or NF_NAT_MANIP_DST

 */

int bpf_ct_set_nat_info(struct nf_conn___init *nfct,

			union nf_inet_addr *addr, int port,

			enum nf_nat_manip_type manip)

{

#if ((IS_MODULE(CONFIG_NF_NAT) && IS_MODULE(CONFIG_NF_CONNTRACK)) || \

     IS_BUILTIN(CONFIG_NF_NAT))

	struct nf_conn *ct = (struct nf_conn *)nfct;

	u16 proto = nf_ct_l3num(ct);

	struct nf_nat_range2 range;



	if (proto != NFPROTO_IPV4 && proto != NFPROTO_IPV6)

		return -EINVAL;



	memset(&range, 0, sizeof(struct nf_nat_range2));

	range.flags = NF_NAT_RANGE_MAP_IPS;

	range.min_addr = *addr;

	range.max_addr = range.min_addr;

	if (port > 0) {

		range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;

		range.min_proto.all = cpu_to_be16(port);

		range.max_proto.all = range.min_proto.all;

	}



	return nf_nat_setup_info(ct, &range, manip) == NF_DROP ? -ENOMEM : 0;

#else

	return -EOPNOTSUPP;

#endif

}



__diag_pop()



BTF_SET8_START(nf_ct_kfunc_set)
@@ -532,7 +483,6 @@ BTF_ID_FLAGS(func, bpf_ct_set_timeout, KF_TRUSTED_ARGS) 
BTF_ID_FLAGS(func, bpf_ct_change_timeout, KF_TRUSTED_ARGS)

BTF_ID_FLAGS(func, bpf_ct_set_status, KF_TRUSTED_ARGS)

BTF_ID_FLAGS(func, bpf_ct_change_status, KF_TRUSTED_ARGS)

BTF_ID_FLAGS(func, bpf_ct_set_nat_info, KF_TRUSTED_ARGS)

BTF_SET8_END(nf_ct_kfunc_set)



static const struct btf_kfunc_id_set nf_conntrack_kfunc_set = {

net/netfilter/nf_nat_bpf.c

0 → 100644
+79 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/* Unstable NAT Helpers for XDP and TC-BPF hook

 *

 * These are called from the XDP and SCHED_CLS BPF programs. Note that it is

 * allowed to break compatibility for these functions since the interface they

 * are exposed through to BPF programs is explicitly unstable.

 */



#include <linux/bpf.h>

#include <linux/btf_ids.h>

#include <net/netfilter/nf_conntrack_bpf.h>

#include <net/netfilter/nf_conntrack_core.h>

#include <net/netfilter/nf_nat.h>



__diag_push();

__diag_ignore_all("-Wmissing-prototypes",

		  "Global functions as their definitions will be in nf_nat BTF");



/* bpf_ct_set_nat_info - Set source or destination nat address

 *

 * Set source or destination nat address of the newly allocated

 * nf_conn before insertion. This must be invoked for referenced

 * PTR_TO_BTF_ID to nf_conn___init.

 *

 * Parameters:

 * @nfct	- Pointer to referenced nf_conn object, obtained using

 *		  bpf_xdp_ct_alloc or bpf_skb_ct_alloc.

 * @addr	- Nat source/destination address

 * @port	- Nat source/destination port. Non-positive values are

 *		  interpreted as select a random port.

 * @manip	- NF_NAT_MANIP_SRC or NF_NAT_MANIP_DST

 */

int bpf_ct_set_nat_info(struct nf_conn___init *nfct,

			union nf_inet_addr *addr, int port,

			enum nf_nat_manip_type manip)

{

	struct nf_conn *ct = (struct nf_conn *)nfct;

	u16 proto = nf_ct_l3num(ct);

	struct nf_nat_range2 range;



	if (proto != NFPROTO_IPV4 && proto != NFPROTO_IPV6)

		return -EINVAL;



	memset(&range, 0, sizeof(struct nf_nat_range2));

	range.flags = NF_NAT_RANGE_MAP_IPS;

	range.min_addr = *addr;

	range.max_addr = range.min_addr;

	if (port > 0) {

		range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;

		range.min_proto.all = cpu_to_be16(port);

		range.max_proto.all = range.min_proto.all;

	}



	return nf_nat_setup_info(ct, &range, manip) == NF_DROP ? -ENOMEM : 0;

}



__diag_pop()



BTF_SET8_START(nf_nat_kfunc_set)

BTF_ID_FLAGS(func, bpf_ct_set_nat_info, KF_TRUSTED_ARGS)

BTF_SET8_END(nf_nat_kfunc_set)



static const struct btf_kfunc_id_set nf_bpf_nat_kfunc_set = {

	.owner = THIS_MODULE,

	.set   = &nf_nat_kfunc_set,

};



int register_nf_nat_bpf(void)

{

	int ret;



	ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP,

					&nf_bpf_nat_kfunc_set);

	if (ret)

		return ret;



	return register_btf_kfunc_id_set(BPF_PROG_TYPE_SCHED_CLS,

					 &nf_bpf_nat_kfunc_set);

}

net/netfilter/nf_nat_core.c

+2 −2
Original line number Diff line number Diff line
@@ -16,7 +16,7 @@ 
#include <linux/siphash.h>

#include <linux/rtnetlink.h>



#include <net/netfilter/nf_conntrack.h>

#include <net/netfilter/nf_conntrack_bpf.h>

#include <net/netfilter/nf_conntrack_core.h>

#include <net/netfilter/nf_conntrack_helper.h>

#include <net/netfilter/nf_conntrack_seqadj.h>
@@ -1152,7 +1152,7 @@ static int __init nf_nat_init(void) 
	WARN_ON(nf_nat_hook != NULL);

	RCU_INIT_POINTER(nf_nat_hook, &nat_hook);



	return 0;

	return register_nf_nat_bpf();

}



static void __exit nf_nat_cleanup(void)