netfilter: flowtable: add vlan support

[mirror_ubuntu-jammy-kernel.git] / net / netfilter / nf_flow_table_core.c

diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 5fa657b8e03dff15a2fa828f22b09a364e7d5887..595f4434b84da251c8b78385b94ac1db7e7cd79b 100644 (file)
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -79,11 +79,8 @@ static int flow_offload_fill_route(struct flow_offload *flow,
                                   enum flow_offload_tuple_dir dir)
 {
        struct flow_offload_tuple *flow_tuple = &flow->tuplehash[dir].tuple;
-       struct dst_entry *other_dst = route->tuple[!dir].dst;
        struct dst_entry *dst = route->tuple[dir].dst;
-
-       if (!dst_hold_safe(route->tuple[dir].dst))
-               return -1;
+       int i, j = 0;
 
        switch (flow_tuple->l3proto) {
        case NFPROTO_IPV4:
@@ -94,12 +91,43 @@ static int flow_offload_fill_route(struct flow_offload *flow,
                break;
        }
 
-       flow_tuple->iifidx = other_dst->dev->ifindex;
-       flow_tuple->dst_cache = dst;
+       flow_tuple->iifidx = route->tuple[dir].in.ifindex;
+       for (i = route->tuple[dir].in.num_encaps - 1; i >= 0; i--) {
+               flow_tuple->encap[j].id = route->tuple[dir].in.encap[i].id;
+               flow_tuple->encap[j].proto = route->tuple[dir].in.encap[i].proto;
+               j++;
+       }
+       flow_tuple->encap_num = route->tuple[dir].in.num_encaps;
+
+       switch (route->tuple[dir].xmit_type) {
+       case FLOW_OFFLOAD_XMIT_DIRECT:
+               memcpy(flow_tuple->out.h_dest, route->tuple[dir].out.h_dest,
+                      ETH_ALEN);
+               memcpy(flow_tuple->out.h_source, route->tuple[dir].out.h_source,
+                      ETH_ALEN);
+               flow_tuple->out.ifidx = route->tuple[dir].out.ifindex;
+               break;
+       case FLOW_OFFLOAD_XMIT_XFRM:
+       case FLOW_OFFLOAD_XMIT_NEIGH:
+               if (!dst_hold_safe(route->tuple[dir].dst))
+                       return -1;
+
+               flow_tuple->dst_cache = dst;
+               break;
+       }
+       flow_tuple->xmit_type = route->tuple[dir].xmit_type;
 
        return 0;
 }
 
+static void nft_flow_dst_release(struct flow_offload *flow,
+                                enum flow_offload_tuple_dir dir)
+{
+       if (flow->tuplehash[dir].tuple.xmit_type == FLOW_OFFLOAD_XMIT_NEIGH ||
+           flow->tuplehash[dir].tuple.xmit_type == FLOW_OFFLOAD_XMIT_XFRM)
+               dst_release(flow->tuplehash[dir].tuple.dst_cache);
+}
+
 int flow_offload_route_init(struct flow_offload *flow,
                            const struct nf_flow_route *route)
 {
@@ -118,7 +146,7 @@ int flow_offload_route_init(struct flow_offload *flow,
        return 0;
 
 err_route_reply:
-       dst_release(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst);
+       nft_flow_dst_release(flow, FLOW_OFFLOAD_DIR_ORIGINAL);
 
        return err;
 }
@@ -169,8 +197,8 @@ static void flow_offload_fixup_ct(struct nf_conn *ct)
 
 static void flow_offload_route_release(struct flow_offload *flow)
 {
-       dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache);
-       dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache);
+       nft_flow_dst_release(flow, FLOW_OFFLOAD_DIR_ORIGINAL);
+       nft_flow_dst_release(flow, FLOW_OFFLOAD_DIR_REPLY);
 }
 
 void flow_offload_free(struct flow_offload *flow)
@@ -389,29 +417,20 @@ static void nf_flow_offload_work_gc(struct work_struct *work)
        queue_delayed_work(system_power_efficient_wq, &flow_table->gc_work, HZ);
 }
 
-
-static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff,
-                               __be16 port, __be16 new_port)
+static void nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff,
+                                __be16 port, __be16 new_port)
 {
        struct tcphdr *tcph;
 
-       if (skb_try_make_writable(skb, thoff + sizeof(*tcph)))
-               return -1;
-
        tcph = (void *)(skb_network_header(skb) + thoff);
        inet_proto_csum_replace2(&tcph->check, skb, port, new_port, false);
-
-       return 0;
 }
 
-static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff,
-                               __be16 port, __be16 new_port)
+static void nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff,
+                                __be16 port, __be16 new_port)
 {
        struct udphdr *udph;
 
-       if (skb_try_make_writable(skb, thoff + sizeof(*udph)))
-               return -1;
-
        udph = (void *)(skb_network_header(skb) + thoff);
        if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
                inet_proto_csum_replace2(&udph->check, skb, port,
@@ -419,37 +438,28 @@ static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff,
                if (!udph->check)
                        udph->check = CSUM_MANGLED_0;
        }
-
-       return 0;
 }
 
-static int nf_flow_nat_port(struct sk_buff *skb, unsigned int thoff,
-                           u8 protocol, __be16 port, __be16 new_port)
+static void nf_flow_nat_port(struct sk_buff *skb, unsigned int thoff,
+                            u8 protocol, __be16 port, __be16 new_port)
 {
        switch (protocol) {
        case IPPROTO_TCP:
-               if (nf_flow_nat_port_tcp(skb, thoff, port, new_port) < 0)
-                       return NF_DROP;
+               nf_flow_nat_port_tcp(skb, thoff, port, new_port);
                break;
        case IPPROTO_UDP:
-               if (nf_flow_nat_port_udp(skb, thoff, port, new_port) < 0)
-                       return NF_DROP;
+               nf_flow_nat_port_udp(skb, thoff, port, new_port);
                break;
        }
-
-       return 0;
 }
 
-int nf_flow_snat_port(const struct flow_offload *flow,
-                     struct sk_buff *skb, unsigned int thoff,
-                     u8 protocol, enum flow_offload_tuple_dir dir)
+void nf_flow_snat_port(const struct flow_offload *flow,
+                      struct sk_buff *skb, unsigned int thoff,
+                      u8 protocol, enum flow_offload_tuple_dir dir)
 {
        struct flow_ports *hdr;
        __be16 port, new_port;
 
-       if (skb_try_make_writable(skb, thoff + sizeof(*hdr)))
-               return -1;
-
        hdr = (void *)(skb_network_header(skb) + thoff);
 
        switch (dir) {
@@ -463,24 +473,19 @@ int nf_flow_snat_port(const struct flow_offload *flow,
                new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port;
                hdr->dest = new_port;
                break;
-       default:
-               return -1;
        }
 
-       return nf_flow_nat_port(skb, thoff, protocol, port, new_port);
+       nf_flow_nat_port(skb, thoff, protocol, port, new_port);
 }
 EXPORT_SYMBOL_GPL(nf_flow_snat_port);
 
-int nf_flow_dnat_port(const struct flow_offload *flow,
-                     struct sk_buff *skb, unsigned int thoff,
-                     u8 protocol, enum flow_offload_tuple_dir dir)
+void nf_flow_dnat_port(const struct flow_offload *flow, struct sk_buff *skb,
+                      unsigned int thoff, u8 protocol,
+                      enum flow_offload_tuple_dir dir)
 {
        struct flow_ports *hdr;
        __be16 port, new_port;
 
-       if (skb_try_make_writable(skb, thoff + sizeof(*hdr)))
-               return -1;
-
        hdr = (void *)(skb_network_header(skb) + thoff);
 
        switch (dir) {
@@ -494,11 +499,9 @@ int nf_flow_dnat_port(const struct flow_offload *flow,
                new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port;
                hdr->source = new_port;
                break;
-       default:
-               return -1;
        }
 
-       return nf_flow_nat_port(skb, thoff, protocol, port, new_port);
+       nf_flow_nat_port(skb, thoff, protocol, port, new_port);
 }
 EXPORT_SYMBOL_GPL(nf_flow_dnat_port);