netfilter: flowtable: add pppoe support

Add the PPPoE protocol and session id to the flow tuple using the encap
fields to uniquely identify flows from the receive path. For the
transmit path, dev_hard_header() on the vlan device push the headers.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index d90636295b0d251c7fb25bd817c9bc0296e3df72..12cb0cc6958cb516d36f406bda5a8e9760950c16 100644 (file)
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -7,6 +7,9 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/netdevice.h>
+#include <linux/if_ether.h>
+#include <linux/if_pppox.h>
+#include <linux/ppp_defs.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
@@ -139,6 +142,8 @@ static bool ip_has_options(unsigned int thoff)
 static void nf_flow_tuple_encap(struct sk_buff *skb,
                                struct flow_offload_tuple *tuple)
 {
+       struct vlan_ethhdr *veth;
+       struct pppoe_hdr *phdr;
        int i = 0;
 
        if (skb_vlan_tag_present(skb)) {
@@ -146,11 +151,17 @@ static void nf_flow_tuple_encap(struct sk_buff *skb,
                tuple->encap[i].proto = skb->vlan_proto;
                i++;
        }
-       if (skb->protocol == htons(ETH_P_8021Q)) {
-               struct vlan_ethhdr *veth = (struct vlan_ethhdr *)skb_mac_header(skb);
-
+       switch (skb->protocol) {
+       case htons(ETH_P_8021Q):
+               veth = (struct vlan_ethhdr *)skb_mac_header(skb);
                tuple->encap[i].id = ntohs(veth->h_vlan_TCI);
                tuple->encap[i].proto = skb->protocol;
+               break;
+       case htons(ETH_P_PPP_SES):
+               phdr = (struct pppoe_hdr *)skb_mac_header(skb);
+               tuple->encap[i].id = ntohs(phdr->sid);
+               tuple->encap[i].proto = skb->protocol;
+               break;
        }
 }
 
@@ -228,17 +239,41 @@ static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb,
        return NF_STOLEN;
 }
 
+static inline __be16 nf_flow_pppoe_proto(const struct sk_buff *skb)
+{
+       __be16 proto;
+
+       proto = *((__be16 *)(skb_mac_header(skb) + ETH_HLEN +
+                            sizeof(struct pppoe_hdr)));
+       switch (proto) {
+       case htons(PPP_IP):
+               return htons(ETH_P_IP);
+       case htons(PPP_IPV6):
+               return htons(ETH_P_IPV6);
+       }
+
+       return 0;
+}
+
 static bool nf_flow_skb_encap_protocol(const struct sk_buff *skb, __be16 proto,
                                       u32 *offset)
 {
-       if (skb->protocol == htons(ETH_P_8021Q)) {
-               struct vlan_ethhdr *veth;
+       struct vlan_ethhdr *veth;
 
+       switch (skb->protocol) {
+       case htons(ETH_P_8021Q):
                veth = (struct vlan_ethhdr *)skb_mac_header(skb);
                if (veth->h_vlan_encapsulated_proto == proto) {
                        *offset += VLAN_HLEN;
                        return true;
                }
+               break;
+       case htons(ETH_P_PPP_SES):
+               if (nf_flow_pppoe_proto(skb) == proto) {
+                       *offset += PPPOE_SES_HLEN;
+                       return true;
+               }
+               break;
        }
 
        return false;
@@ -255,12 +290,18 @@ static void nf_flow_encap_pop(struct sk_buff *skb,
                        __vlan_hwaccel_clear_tag(skb);
                        continue;
                }
-               if (skb->protocol == htons(ETH_P_8021Q)) {
+               switch (skb->protocol) {
+               case htons(ETH_P_8021Q):
                        vlan_hdr = (struct vlan_hdr *)skb->data;
                        __skb_pull(skb, VLAN_HLEN);
                        vlan_set_encap_proto(skb, vlan_hdr);
                        skb_reset_network_header(skb);
                        break;
+               case htons(ETH_P_PPP_SES):
+                       skb->protocol = nf_flow_pppoe_proto(skb);
+                       skb_pull(skb, PPPOE_SES_HLEN);
+                       skb_reset_network_header(skb);
+                       break;
                }
        }
 }

diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index 651364d93efd5d3fb556996affe537e4f544b6cd..81a5e2b6c901de20ea5c237f0570b8262b7a6d89 100644 (file)
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -90,6 +90,7 @@ static void nft_dev_path_info(const struct net_device_path_stack *stack,
                switch (path->type) {
                case DEV_PATH_ETHERNET:
                case DEV_PATH_VLAN:
+               case DEV_PATH_PPPOE:
                        info->indev = path->dev;
                        if (is_zero_ether_addr(info->h_source))
                                memcpy(info->h_source, path->dev->dev_addr, ETH_ALEN);
@@ -97,7 +98,7 @@ static void nft_dev_path_info(const struct net_device_path_stack *stack,
                        if (path->type == DEV_PATH_ETHERNET)
                                break;
 
-                       /* DEV_PATH_VLAN */
+                       /* DEV_PATH_VLAN and DEV_PATH_PPPOE */
                        if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) {
                                info->indev = NULL;
                                break;
@@ -106,6 +107,8 @@ static void nft_dev_path_info(const struct net_device_path_stack *stack,
                        info->encap[info->num_encaps].id = path->encap.id;
                        info->encap[info->num_encaps].proto = path->encap.proto;
                        info->num_encaps++;
+                       if (path->type == DEV_PATH_PPPOE)
+                               memcpy(info->h_dest, path->encap.h_dest, ETH_ALEN);
                        break;
                case DEV_PATH_BRIDGE:
                        if (is_zero_ether_addr(info->h_source))