-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
net: create nf_conntrack_ovs for ovs and tc use
Similar to nf_nat_ovs created by Commit ebddb14 ("net: move the nat function to nf_nat_ovs for ovs and tc"), this patch is to create nf_conntrack_ovs to get these functions shared by OVS and TC only. There are nf_ct_helper() and nf_ct_add_helper() from nf_conntrak_helper in this patch, and will be more in the following patches. Signed-off-by: Xin Long <lucien.xin@gmail.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
- Loading branch information
Xin Long
authored and
Jakub Kicinski
committed
Feb 11, 2023
1 parent
025a785
commit c0c3ab6
Showing
6 changed files
with
110 additions
and
98 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,104 @@ | ||
| // SPDX-License-Identifier: GPL-2.0-only | ||
| /* Support ct functions for openvswitch and used by OVS and TC conntrack. */ | ||
|
|
||
| #include <net/netfilter/nf_conntrack_helper.h> | ||
| #include <net/netfilter/nf_conntrack_seqadj.h> | ||
| #include <net/ip.h> | ||
|
|
||
| /* 'skb' should already be pulled to nh_ofs. */ | ||
| int nf_ct_helper(struct sk_buff *skb, struct nf_conn *ct, | ||
| enum ip_conntrack_info ctinfo, u16 proto) | ||
| { | ||
| const struct nf_conntrack_helper *helper; | ||
| const struct nf_conn_help *help; | ||
| unsigned int protoff; | ||
| int err; | ||
|
|
||
| if (ctinfo == IP_CT_RELATED_REPLY) | ||
| return NF_ACCEPT; | ||
|
|
||
| help = nfct_help(ct); | ||
| if (!help) | ||
| return NF_ACCEPT; | ||
|
|
||
| helper = rcu_dereference(help->helper); | ||
| if (!helper) | ||
| return NF_ACCEPT; | ||
|
|
||
| if (helper->tuple.src.l3num != NFPROTO_UNSPEC && | ||
| helper->tuple.src.l3num != proto) | ||
| return NF_ACCEPT; | ||
|
|
||
| switch (proto) { | ||
| case NFPROTO_IPV4: | ||
| protoff = ip_hdrlen(skb); | ||
| proto = ip_hdr(skb)->protocol; | ||
| break; | ||
| case NFPROTO_IPV6: { | ||
| u8 nexthdr = ipv6_hdr(skb)->nexthdr; | ||
| __be16 frag_off; | ||
| int ofs; | ||
|
|
||
| ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr, | ||
| &frag_off); | ||
| if (ofs < 0 || (frag_off & htons(~0x7)) != 0) { | ||
| pr_debug("proto header not found\n"); | ||
| return NF_ACCEPT; | ||
| } | ||
| protoff = ofs; | ||
| proto = nexthdr; | ||
| break; | ||
| } | ||
| default: | ||
| WARN_ONCE(1, "helper invoked on non-IP family!"); | ||
| return NF_DROP; | ||
| } | ||
|
|
||
| if (helper->tuple.dst.protonum != proto) | ||
| return NF_ACCEPT; | ||
|
|
||
| err = helper->help(skb, protoff, ct, ctinfo); | ||
| if (err != NF_ACCEPT) | ||
| return err; | ||
|
|
||
| /* Adjust seqs after helper. This is needed due to some helpers (e.g., | ||
| * FTP with NAT) adusting the TCP payload size when mangling IP | ||
| * addresses and/or port numbers in the text-based control connection. | ||
| */ | ||
| if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) && | ||
| !nf_ct_seq_adjust(skb, ct, ctinfo, protoff)) | ||
| return NF_DROP; | ||
| return NF_ACCEPT; | ||
| } | ||
| EXPORT_SYMBOL_GPL(nf_ct_helper); | ||
|
|
||
| int nf_ct_add_helper(struct nf_conn *ct, const char *name, u8 family, | ||
| u8 proto, bool nat, struct nf_conntrack_helper **hp) | ||
| { | ||
| struct nf_conntrack_helper *helper; | ||
| struct nf_conn_help *help; | ||
| int ret = 0; | ||
|
|
||
| helper = nf_conntrack_helper_try_module_get(name, family, proto); | ||
| if (!helper) | ||
| return -EINVAL; | ||
|
|
||
| help = nf_ct_helper_ext_add(ct, GFP_KERNEL); | ||
| if (!help) { | ||
| nf_conntrack_helper_put(helper); | ||
| return -ENOMEM; | ||
| } | ||
| #if IS_ENABLED(CONFIG_NF_NAT) | ||
| if (nat) { | ||
| ret = nf_nat_helper_try_module_get(name, family, proto); | ||
| if (ret) { | ||
| nf_conntrack_helper_put(helper); | ||
| return ret; | ||
| } | ||
| } | ||
| #endif | ||
| rcu_assign_pointer(help->helper, helper); | ||
| *hp = helper; | ||
| return ret; | ||
| } | ||
| EXPORT_SYMBOL_GPL(nf_ct_add_helper); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters