OpenWrt – Blame information for rev 3
?pathlinks?
Rev | Author | Line No. | Line |
---|---|---|---|
1 | office | 1 | From: Pablo Neira Ayuso <pablo@netfilter.org> |
2 | Date: Sun, 7 Jan 2018 01:04:19 +0100 |
||
3 | Subject: [PATCH] netfilter: flow table support for IPv6 |
||
4 | |||
5 | This patch adds the IPv6 flow table type, that implements the datapath |
||
6 | flow table to forward IPv6 traffic. |
||
7 | |||
8 | This patch exports ip6_dst_mtu_forward() that is required to check for |
||
9 | mtu to pass up packets that need PMTUD handling to the classic |
||
10 | forwarding path. |
||
11 | |||
12 | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
||
13 | --- |
||
14 | create mode 100644 net/ipv6/netfilter/nf_flow_table_ipv6.c |
||
15 | |||
16 | --- a/include/net/ipv6.h |
||
17 | +++ b/include/net/ipv6.h |
||
3 | office | 18 | @@ -918,6 +918,8 @@ static inline struct sk_buff *ip6_finish |
1 | office | 19 | &inet6_sk(sk)->cork); |
20 | } |
||
21 | |||
22 | +unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst); |
||
23 | + |
||
24 | int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst, |
||
25 | struct flowi6 *fl6); |
||
26 | struct dst_entry *ip6_dst_lookup_flow(const struct sock *sk, struct flowi6 *fl6, |
||
27 | --- a/net/ipv6/ip6_output.c |
||
28 | +++ b/net/ipv6/ip6_output.c |
||
3 | office | 29 | @@ -383,7 +383,7 @@ static inline int ip6_forward_finish(str |
1 | office | 30 | return dst_output(net, sk, skb); |
31 | } |
||
32 | |||
33 | -static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst) |
||
34 | +unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst) |
||
35 | { |
||
36 | unsigned int mtu; |
||
37 | struct inet6_dev *idev; |
||
3 | office | 38 | @@ -403,6 +403,7 @@ static unsigned int ip6_dst_mtu_forward( |
1 | office | 39 | |
40 | return mtu; |
||
41 | } |
||
42 | +EXPORT_SYMBOL_GPL(ip6_dst_mtu_forward); |
||
43 | |||
44 | static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu) |
||
45 | { |
||
46 | --- a/net/ipv6/netfilter/Kconfig |
||
47 | +++ b/net/ipv6/netfilter/Kconfig |
||
48 | @@ -99,6 +99,14 @@ config NFT_FIB_IPV6 |
||
49 | endif # NF_TABLES_IPV6 |
||
50 | endif # NF_TABLES |
||
51 | |||
52 | +config NF_FLOW_TABLE_IPV6 |
||
53 | + select NF_FLOW_TABLE |
||
54 | + tristate "Netfilter flow table IPv6 module" |
||
55 | + help |
||
56 | + This option adds the flow table IPv6 support. |
||
57 | + |
||
58 | + To compile it as a module, choose M here. |
||
59 | + |
||
60 | config NF_DUP_IPV6 |
||
61 | tristate "Netfilter IPv6 packet duplication to alternate destination" |
||
62 | depends on !NF_CONNTRACK || NF_CONNTRACK |
||
63 | --- a/net/ipv6/netfilter/Makefile |
||
64 | +++ b/net/ipv6/netfilter/Makefile |
||
65 | @@ -45,6 +45,9 @@ obj-$(CONFIG_NFT_REDIR_IPV6) += nft_redi |
||
66 | obj-$(CONFIG_NFT_DUP_IPV6) += nft_dup_ipv6.o |
||
67 | obj-$(CONFIG_NFT_FIB_IPV6) += nft_fib_ipv6.o |
||
68 | |||
69 | +# flow table support |
||
70 | +obj-$(CONFIG_NF_FLOW_TABLE_IPV6) += nf_flow_table_ipv6.o |
||
71 | + |
||
72 | # matches |
||
73 | obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o |
||
74 | obj-$(CONFIG_IP6_NF_MATCH_EUI64) += ip6t_eui64.o |
||
75 | --- /dev/null |
||
76 | +++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c |
||
77 | @@ -0,0 +1,277 @@ |
||
78 | +#include <linux/kernel.h> |
||
79 | +#include <linux/init.h> |
||
80 | +#include <linux/module.h> |
||
81 | +#include <linux/netfilter.h> |
||
82 | +#include <linux/rhashtable.h> |
||
83 | +#include <linux/ipv6.h> |
||
84 | +#include <linux/netdevice.h> |
||
85 | +#include <linux/ipv6.h> |
||
86 | +#include <net/ipv6.h> |
||
87 | +#include <net/ip6_route.h> |
||
88 | +#include <net/neighbour.h> |
||
89 | +#include <net/netfilter/nf_flow_table.h> |
||
90 | +#include <net/netfilter/nf_tables.h> |
||
91 | +/* For layer 4 checksum field offset. */ |
||
92 | +#include <linux/tcp.h> |
||
93 | +#include <linux/udp.h> |
||
94 | + |
||
95 | +static int nf_flow_nat_ipv6_tcp(struct sk_buff *skb, unsigned int thoff, |
||
96 | + struct in6_addr *addr, |
||
97 | + struct in6_addr *new_addr) |
||
98 | +{ |
||
99 | + struct tcphdr *tcph; |
||
100 | + |
||
101 | + if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) || |
||
102 | + skb_try_make_writable(skb, thoff + sizeof(*tcph))) |
||
103 | + return -1; |
||
104 | + |
||
105 | + tcph = (void *)(skb_network_header(skb) + thoff); |
||
106 | + inet_proto_csum_replace16(&tcph->check, skb, addr->s6_addr32, |
||
107 | + new_addr->s6_addr32, true); |
||
108 | + |
||
109 | + return 0; |
||
110 | +} |
||
111 | + |
||
112 | +static int nf_flow_nat_ipv6_udp(struct sk_buff *skb, unsigned int thoff, |
||
113 | + struct in6_addr *addr, |
||
114 | + struct in6_addr *new_addr) |
||
115 | +{ |
||
116 | + struct udphdr *udph; |
||
117 | + |
||
118 | + if (!pskb_may_pull(skb, thoff + sizeof(*udph)) || |
||
119 | + skb_try_make_writable(skb, thoff + sizeof(*udph))) |
||
120 | + return -1; |
||
121 | + |
||
122 | + udph = (void *)(skb_network_header(skb) + thoff); |
||
123 | + if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) { |
||
124 | + inet_proto_csum_replace16(&udph->check, skb, addr->s6_addr32, |
||
125 | + new_addr->s6_addr32, true); |
||
126 | + if (!udph->check) |
||
127 | + udph->check = CSUM_MANGLED_0; |
||
128 | + } |
||
129 | + |
||
130 | + return 0; |
||
131 | +} |
||
132 | + |
||
133 | +static int nf_flow_nat_ipv6_l4proto(struct sk_buff *skb, struct ipv6hdr *ip6h, |
||
134 | + unsigned int thoff, struct in6_addr *addr, |
||
135 | + struct in6_addr *new_addr) |
||
136 | +{ |
||
137 | + switch (ip6h->nexthdr) { |
||
138 | + case IPPROTO_TCP: |
||
139 | + if (nf_flow_nat_ipv6_tcp(skb, thoff, addr, new_addr) < 0) |
||
140 | + return NF_DROP; |
||
141 | + break; |
||
142 | + case IPPROTO_UDP: |
||
143 | + if (nf_flow_nat_ipv6_udp(skb, thoff, addr, new_addr) < 0) |
||
144 | + return NF_DROP; |
||
145 | + break; |
||
146 | + } |
||
147 | + |
||
148 | + return 0; |
||
149 | +} |
||
150 | + |
||
151 | +static int nf_flow_snat_ipv6(const struct flow_offload *flow, |
||
152 | + struct sk_buff *skb, struct ipv6hdr *ip6h, |
||
153 | + unsigned int thoff, |
||
154 | + enum flow_offload_tuple_dir dir) |
||
155 | +{ |
||
156 | + struct in6_addr addr, new_addr; |
||
157 | + |
||
158 | + switch (dir) { |
||
159 | + case FLOW_OFFLOAD_DIR_ORIGINAL: |
||
160 | + addr = ip6h->saddr; |
||
161 | + new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6; |
||
162 | + ip6h->saddr = new_addr; |
||
163 | + break; |
||
164 | + case FLOW_OFFLOAD_DIR_REPLY: |
||
165 | + addr = ip6h->daddr; |
||
166 | + new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6; |
||
167 | + ip6h->daddr = new_addr; |
||
168 | + break; |
||
169 | + default: |
||
170 | + return -1; |
||
171 | + } |
||
172 | + |
||
173 | + return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr); |
||
174 | +} |
||
175 | + |
||
176 | +static int nf_flow_dnat_ipv6(const struct flow_offload *flow, |
||
177 | + struct sk_buff *skb, struct ipv6hdr *ip6h, |
||
178 | + unsigned int thoff, |
||
179 | + enum flow_offload_tuple_dir dir) |
||
180 | +{ |
||
181 | + struct in6_addr addr, new_addr; |
||
182 | + |
||
183 | + switch (dir) { |
||
184 | + case FLOW_OFFLOAD_DIR_ORIGINAL: |
||
185 | + addr = ip6h->daddr; |
||
186 | + new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6; |
||
187 | + ip6h->daddr = new_addr; |
||
188 | + break; |
||
189 | + case FLOW_OFFLOAD_DIR_REPLY: |
||
190 | + addr = ip6h->saddr; |
||
191 | + new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6; |
||
192 | + ip6h->saddr = new_addr; |
||
193 | + break; |
||
194 | + default: |
||
195 | + return -1; |
||
196 | + } |
||
197 | + |
||
198 | + return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr); |
||
199 | +} |
||
200 | + |
||
201 | +static int nf_flow_nat_ipv6(const struct flow_offload *flow, |
||
202 | + struct sk_buff *skb, |
||
203 | + enum flow_offload_tuple_dir dir) |
||
204 | +{ |
||
205 | + struct ipv6hdr *ip6h = ipv6_hdr(skb); |
||
206 | + unsigned int thoff = sizeof(*ip6h); |
||
207 | + |
||
208 | + if (flow->flags & FLOW_OFFLOAD_SNAT && |
||
209 | + (nf_flow_snat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 || |
||
210 | + nf_flow_snat_ipv6(flow, skb, ip6h, thoff, dir) < 0)) |
||
211 | + return -1; |
||
212 | + if (flow->flags & FLOW_OFFLOAD_DNAT && |
||
213 | + (nf_flow_dnat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 || |
||
214 | + nf_flow_dnat_ipv6(flow, skb, ip6h, thoff, dir) < 0)) |
||
215 | + return -1; |
||
216 | + |
||
217 | + return 0; |
||
218 | +} |
||
219 | + |
||
220 | +static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev, |
||
221 | + struct flow_offload_tuple *tuple) |
||
222 | +{ |
||
223 | + struct flow_ports *ports; |
||
224 | + struct ipv6hdr *ip6h; |
||
225 | + unsigned int thoff; |
||
226 | + |
||
227 | + if (!pskb_may_pull(skb, sizeof(*ip6h))) |
||
228 | + return -1; |
||
229 | + |
||
230 | + ip6h = ipv6_hdr(skb); |
||
231 | + |
||
232 | + if (ip6h->nexthdr != IPPROTO_TCP && |
||
233 | + ip6h->nexthdr != IPPROTO_UDP) |
||
234 | + return -1; |
||
235 | + |
||
236 | + thoff = sizeof(*ip6h); |
||
237 | + if (!pskb_may_pull(skb, thoff + sizeof(*ports))) |
||
238 | + return -1; |
||
239 | + |
||
240 | + ports = (struct flow_ports *)(skb_network_header(skb) + thoff); |
||
241 | + |
||
242 | + tuple->src_v6 = ip6h->saddr; |
||
243 | + tuple->dst_v6 = ip6h->daddr; |
||
244 | + tuple->src_port = ports->source; |
||
245 | + tuple->dst_port = ports->dest; |
||
246 | + tuple->l3proto = AF_INET6; |
||
247 | + tuple->l4proto = ip6h->nexthdr; |
||
248 | + tuple->iifidx = dev->ifindex; |
||
249 | + |
||
250 | + return 0; |
||
251 | +} |
||
252 | + |
||
253 | +/* Based on ip_exceeds_mtu(). */ |
||
254 | +static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) |
||
255 | +{ |
||
256 | + if (skb->len <= mtu) |
||
257 | + return false; |
||
258 | + |
||
259 | + if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu)) |
||
260 | + return false; |
||
261 | + |
||
262 | + return true; |
||
263 | +} |
||
264 | + |
||
265 | +static bool nf_flow_exceeds_mtu(struct sk_buff *skb, const struct rt6_info *rt) |
||
266 | +{ |
||
267 | + u32 mtu; |
||
268 | + |
||
269 | + mtu = ip6_dst_mtu_forward(&rt->dst); |
||
270 | + if (__nf_flow_exceeds_mtu(skb, mtu)) |
||
271 | + return true; |
||
272 | + |
||
273 | + return false; |
||
274 | +} |
||
275 | + |
||
276 | +static unsigned int |
||
277 | +nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, |
||
278 | + const struct nf_hook_state *state) |
||
279 | +{ |
||
280 | + struct flow_offload_tuple_rhash *tuplehash; |
||
281 | + struct nf_flowtable *flow_table = priv; |
||
282 | + struct flow_offload_tuple tuple = {}; |
||
283 | + enum flow_offload_tuple_dir dir; |
||
284 | + struct flow_offload *flow; |
||
285 | + struct net_device *outdev; |
||
286 | + struct in6_addr *nexthop; |
||
287 | + struct ipv6hdr *ip6h; |
||
288 | + struct rt6_info *rt; |
||
289 | + |
||
290 | + if (skb->protocol != htons(ETH_P_IPV6)) |
||
291 | + return NF_ACCEPT; |
||
292 | + |
||
293 | + if (nf_flow_tuple_ipv6(skb, state->in, &tuple) < 0) |
||
294 | + return NF_ACCEPT; |
||
295 | + |
||
296 | + tuplehash = flow_offload_lookup(flow_table, &tuple); |
||
297 | + if (tuplehash == NULL) |
||
298 | + return NF_ACCEPT; |
||
299 | + |
||
300 | + outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx); |
||
301 | + if (!outdev) |
||
302 | + return NF_ACCEPT; |
||
303 | + |
||
304 | + dir = tuplehash->tuple.dir; |
||
305 | + flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); |
||
306 | + |
||
307 | + rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache; |
||
308 | + if (unlikely(nf_flow_exceeds_mtu(skb, rt))) |
||
309 | + return NF_ACCEPT; |
||
310 | + |
||
311 | + if (skb_try_make_writable(skb, sizeof(*ip6h))) |
||
312 | + return NF_DROP; |
||
313 | + |
||
314 | + if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) && |
||
315 | + nf_flow_nat_ipv6(flow, skb, dir) < 0) |
||
316 | + return NF_DROP; |
||
317 | + |
||
318 | + flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT; |
||
319 | + ip6h = ipv6_hdr(skb); |
||
320 | + ip6h->hop_limit--; |
||
321 | + |
||
322 | + skb->dev = outdev; |
||
323 | + nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6); |
||
324 | + neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb); |
||
325 | + |
||
326 | + return NF_STOLEN; |
||
327 | +} |
||
328 | + |
||
329 | +static struct nf_flowtable_type flowtable_ipv6 = { |
||
330 | + .family = NFPROTO_IPV6, |
||
331 | + .params = &nf_flow_offload_rhash_params, |
||
332 | + .gc = nf_flow_offload_work_gc, |
||
333 | + .hook = nf_flow_offload_ipv6_hook, |
||
334 | + .owner = THIS_MODULE, |
||
335 | +}; |
||
336 | + |
||
337 | +static int __init nf_flow_ipv6_module_init(void) |
||
338 | +{ |
||
339 | + nft_register_flowtable_type(&flowtable_ipv6); |
||
340 | + |
||
341 | + return 0; |
||
342 | +} |
||
343 | + |
||
344 | +static void __exit nf_flow_ipv6_module_exit(void) |
||
345 | +{ |
||
346 | + nft_unregister_flowtable_type(&flowtable_ipv6); |
||
347 | +} |
||
348 | + |
||
349 | +module_init(nf_flow_ipv6_module_init); |
||
350 | +module_exit(nf_flow_ipv6_module_exit); |
||
351 | + |
||
352 | +MODULE_LICENSE("GPL"); |
||
353 | +MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); |
||
354 | +MODULE_ALIAS_NF_FLOWTABLE(AF_INET6); |