netfilter: flowtable: add vlan support

[mirror_ubuntu-jammy-kernel.git] / net / netfilter / nf_flow_table_ip.c

diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index 9e84767a7e9b721be1a31809489299a5411b4913..d90636295b0d251c7fb25bd817c9bc0296e3df72 100644 (file)
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -136,23 +136,44 @@ static bool ip_has_options(unsigned int thoff)
        return thoff != sizeof(struct iphdr);
 }
 
+static void nf_flow_tuple_encap(struct sk_buff *skb,
+                               struct flow_offload_tuple *tuple)
+{
+       int i = 0;
+
+       if (skb_vlan_tag_present(skb)) {
+               tuple->encap[i].id = skb_vlan_tag_get(skb);
+               tuple->encap[i].proto = skb->vlan_proto;
+               i++;
+       }
+       if (skb->protocol == htons(ETH_P_8021Q)) {
+               struct vlan_ethhdr *veth = (struct vlan_ethhdr *)skb_mac_header(skb);
+
+               tuple->encap[i].id = ntohs(veth->h_vlan_TCI);
+               tuple->encap[i].proto = skb->protocol;
+       }
+}
+
 static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev,
-                           struct flow_offload_tuple *tuple, u32 *hdrsize)
+                           struct flow_offload_tuple *tuple, u32 *hdrsize,
+                           u32 offset)
 {
        struct flow_ports *ports;
        unsigned int thoff;
        struct iphdr *iph;
 
-       if (!pskb_may_pull(skb, sizeof(*iph)))
+       if (!pskb_may_pull(skb, sizeof(*iph) + offset))
                return -1;
 
-       iph = ip_hdr(skb);
-       thoff = iph->ihl * 4;
+       iph = (struct iphdr *)(skb_network_header(skb) + offset);
+       thoff = (iph->ihl * 4);
 
        if (ip_is_fragment(iph) ||
            unlikely(ip_has_options(thoff)))
                return -1;
 
+       thoff += offset;
+
        switch (iph->protocol) {
        case IPPROTO_TCP:
                *hdrsize = sizeof(struct tcphdr);
@@ -167,11 +188,10 @@ static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev,
        if (iph->ttl <= 1)
                return -1;
 
-       thoff = iph->ihl * 4;
        if (!pskb_may_pull(skb, thoff + *hdrsize))
                return -1;
 
-       iph = ip_hdr(skb);
+       iph = (struct iphdr *)(skb_network_header(skb) + offset);
        ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
 
        tuple->src_v4.s_addr    = iph->saddr;
@@ -181,6 +201,7 @@ static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev,
        tuple->l3proto          = AF_INET;
        tuple->l4proto          = iph->protocol;
        tuple->iifidx           = dev->ifindex;
+       nf_flow_tuple_encap(skb, tuple);
 
        return 0;
 }
@@ -207,6 +228,43 @@ static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb,
        return NF_STOLEN;
 }
 
+static bool nf_flow_skb_encap_protocol(const struct sk_buff *skb, __be16 proto,
+                                      u32 *offset)
+{
+       if (skb->protocol == htons(ETH_P_8021Q)) {
+               struct vlan_ethhdr *veth;
+
+               veth = (struct vlan_ethhdr *)skb_mac_header(skb);
+               if (veth->h_vlan_encapsulated_proto == proto) {
+                       *offset += VLAN_HLEN;
+                       return true;
+               }
+       }
+
+       return false;
+}
+
+static void nf_flow_encap_pop(struct sk_buff *skb,
+                             struct flow_offload_tuple_rhash *tuplehash)
+{
+       struct vlan_hdr *vlan_hdr;
+       int i;
+
+       for (i = 0; i < tuplehash->tuple.encap_num; i++) {
+               if (skb_vlan_tag_present(skb)) {
+                       __vlan_hwaccel_clear_tag(skb);
+                       continue;
+               }
+               if (skb->protocol == htons(ETH_P_8021Q)) {
+                       vlan_hdr = (struct vlan_hdr *)skb->data;
+                       __skb_pull(skb, VLAN_HLEN);
+                       vlan_set_encap_proto(skb, vlan_hdr);
+                       skb_reset_network_header(skb);
+                       break;
+               }
+       }
+}
+
 static unsigned int nf_flow_queue_xmit(struct net *net, struct sk_buff *skb,
                                       const struct flow_offload_tuple_rhash *tuplehash,
                                       unsigned short type)
@@ -235,17 +293,18 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
        enum flow_offload_tuple_dir dir;
        struct flow_offload *flow;
        struct net_device *outdev;
+       u32 hdrsize, offset = 0;
+       unsigned int thoff, mtu;
        struct rtable *rt;
-       unsigned int thoff;
        struct iphdr *iph;
        __be32 nexthop;
-       u32 hdrsize;
        int ret;
 
-       if (skb->protocol != htons(ETH_P_IP))
+       if (skb->protocol != htons(ETH_P_IP) &&
+           !nf_flow_skb_encap_protocol(skb, htons(ETH_P_IP), &offset))
                return NF_ACCEPT;
 
-       if (nf_flow_tuple_ip(skb, state->in, &tuple, &hdrsize) < 0)
+       if (nf_flow_tuple_ip(skb, state->in, &tuple, &hdrsize, offset) < 0)
                return NF_ACCEPT;
 
        tuplehash = flow_offload_lookup(flow_table, &tuple);
@@ -255,11 +314,12 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
        dir = tuplehash->tuple.dir;
        flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
 
-       if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
+       mtu = flow->tuplehash[dir].tuple.mtu + offset;
+       if (unlikely(nf_flow_exceeds_mtu(skb, mtu)))
                return NF_ACCEPT;
 
-       iph = ip_hdr(skb);
-       thoff = iph->ihl * 4;
+       iph = (struct iphdr *)(skb_network_header(skb) + offset);
+       thoff = (iph->ihl * 4) + offset;
        if (nf_flow_state_check(flow, iph->protocol, skb, thoff))
                return NF_ACCEPT;
 
@@ -277,6 +337,9 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
 
        flow_offload_refresh(flow_table, flow);
 
+       nf_flow_encap_pop(skb, tuplehash);
+       thoff -= offset;
+
        iph = ip_hdr(skb);
        nf_flow_nat_ip(flow, skb, thoff, dir, iph);
 
@@ -418,16 +481,18 @@ static void nf_flow_nat_ipv6(const struct flow_offload *flow,
 }
 
 static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
-                             struct flow_offload_tuple *tuple, u32 *hdrsize)
+                             struct flow_offload_tuple *tuple, u32 *hdrsize,
+                             u32 offset)
 {
        struct flow_ports *ports;
        struct ipv6hdr *ip6h;
        unsigned int thoff;
 
-       if (!pskb_may_pull(skb, sizeof(*ip6h)))
+       thoff = sizeof(*ip6h) + offset;
+       if (!pskb_may_pull(skb, thoff))
                return -1;
 
-       ip6h = ipv6_hdr(skb);
+       ip6h = (struct ipv6hdr *)(skb_network_header(skb) + offset);
 
        switch (ip6h->nexthdr) {
        case IPPROTO_TCP:
@@ -443,11 +508,10 @@ static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
        if (ip6h->hop_limit <= 1)
                return -1;
 
-       thoff = sizeof(*ip6h);
        if (!pskb_may_pull(skb, thoff + *hdrsize))
                return -1;
 
-       ip6h = ipv6_hdr(skb);
+       ip6h = (struct ipv6hdr *)(skb_network_header(skb) + offset);
        ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
 
        tuple->src_v6           = ip6h->saddr;
@@ -457,6 +521,7 @@ static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
        tuple->l3proto          = AF_INET6;
        tuple->l4proto          = ip6h->nexthdr;
        tuple->iifidx           = dev->ifindex;
+       nf_flow_tuple_encap(skb, tuple);
 
        return 0;
 }
@@ -472,15 +537,17 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
        const struct in6_addr *nexthop;
        struct flow_offload *flow;
        struct net_device *outdev;
+       unsigned int thoff, mtu;
+       u32 hdrsize, offset = 0;
        struct ipv6hdr *ip6h;
        struct rt6_info *rt;
-       u32 hdrsize;
        int ret;
 
-       if (skb->protocol != htons(ETH_P_IPV6))
+       if (skb->protocol != htons(ETH_P_IPV6) &&
+           !nf_flow_skb_encap_protocol(skb, htons(ETH_P_IPV6), &offset))
                return NF_ACCEPT;
 
-       if (nf_flow_tuple_ipv6(skb, state->in, &tuple, &hdrsize) < 0)
+       if (nf_flow_tuple_ipv6(skb, state->in, &tuple, &hdrsize, offset) < 0)
                return NF_ACCEPT;
 
        tuplehash = flow_offload_lookup(flow_table, &tuple);
@@ -490,11 +557,13 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
        dir = tuplehash->tuple.dir;
        flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
 
-       if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
+       mtu = flow->tuplehash[dir].tuple.mtu + offset;
+       if (unlikely(nf_flow_exceeds_mtu(skb, mtu)))
                return NF_ACCEPT;
 
-       if (nf_flow_state_check(flow, ipv6_hdr(skb)->nexthdr, skb,
-                               sizeof(*ip6h)))
+       ip6h = (struct ipv6hdr *)(skb_network_header(skb) + offset);
+       thoff = sizeof(*ip6h) + offset;
+       if (nf_flow_state_check(flow, ip6h->nexthdr, skb, thoff))
                return NF_ACCEPT;
 
        if (tuplehash->tuple.xmit_type == FLOW_OFFLOAD_XMIT_NEIGH ||
@@ -506,11 +575,13 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
                }
        }
 
-       if (skb_try_make_writable(skb, sizeof(*ip6h) + hdrsize))
+       if (skb_try_make_writable(skb, thoff + hdrsize))
                return NF_DROP;
 
        flow_offload_refresh(flow_table, flow);
 
+       nf_flow_encap_pop(skb, tuplehash);
+
        ip6h = ipv6_hdr(skb);
        nf_flow_nat_ipv6(flow, skb, dir, ip6h);