From patchwork Thu Jul 6 23:25:48 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 116887 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:9f45:0:b0:3ea:f831:8777 with SMTP id v5csp2913528vqx; Thu, 6 Jul 2023 17:06:22 -0700 (PDT) X-Google-Smtp-Source: APBJJlHFMJ26qFk37MgzkkhtJ/Cd6TdL4Q+IEh0sn6t3zRGEiNP2ab7qyOWNx+sxFnJGgGwIoijX X-Received: by 2002:a05:6a00:2d23:b0:63d:260d:f9dd with SMTP id fa35-20020a056a002d2300b0063d260df9ddmr3630277pfb.33.1688688382253; Thu, 06 Jul 2023 17:06:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1688688382; cv=none; d=google.com; s=arc-20160816; b=BpVSZzqOz7fVJ4bl3Hb2DnbWNKajCRO1ne+fepe7DleTL45sKcWSftbn1tw8efE9B/ 5QOf8zaefINI+tBdtWsk4qjHQTXS/FpgrFbnBjLa0MmUCGHjjnEnE6+gt4o+HRWNrHiS U3iR9v/ApL/Wo6D+BuwBKefJNyn+Uutt/gpfW0OrvGO+VlTaahZUAZIDoHShk2ypsd0v 04MJCukZDLDnItgG1vxlmjtuigBhOwlkg8r4bSvv8CAzVtA0LueOOU34W5ao1EP2L/1c phw/XIlBX5IAl+69fAexDIGWqwGtn0z03T35XLQg1M8hQpNrdr+xt3LfN8ImTWwDbC9U v7Sg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=50Mq7yDH4SaalwjOr9VWbgSV3HaqQVn5wwG7OgrzEBE=; fh=qytofXQDSSx1dX/v4sq810d9TTT0D3jBo3qrg4CGWbs=; b=U3lldV8WAhd/D3Zhck7hw6bH4urYECC02ldMErcldiZmqb+j2kFkEUZV2NB6YCA53/ xdKPhF7lDPJgZKhHc8xIw4MA1C1wUtMuqhIuFomS3SS1e9p2zgvMwo5+bx9FVgHPpesi aNDbkDOidfp7DJng7+fE0wvnBozJX5GXEHnhltSVJNYIfepSN2r+x62yFln3oMKDhsdD Ti4BEds0yDJjUJajHHzflVNNblVIayNf4YWDluZVpTwnirP2fES2tOVGc8KtKAujDbIB GnDeNtfrxwYAQ+3X8eUqwISY0MdCXN6oz9zAQACrLLB9OIC6ZKW2+Z+IRqc9uiYOEFx1 Lt0w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=iMmC7Yyf; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=IyEO8iEM; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id n127-20020a632785000000b0055b07fcb6d1si2527657pgn.723.2023.07.06.17.06.07; Thu, 06 Jul 2023 17:06:22 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=iMmC7Yyf; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=IyEO8iEM; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231918AbjGFX0Y (ORCPT + 99 others); Thu, 6 Jul 2023 19:26:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38238 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229807AbjGFX0V (ORCPT ); Thu, 6 Jul 2023 19:26:21 -0400 Received: from out3-smtp.messagingengine.com (out3-smtp.messagingengine.com [66.111.4.27]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 51F811BC3; Thu, 6 Jul 2023 16:26:20 -0700 (PDT) Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailout.nyi.internal (Postfix) with ESMTP id 732195C00C8; Thu, 6 Jul 2023 19:26:18 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute5.internal (MEProxy); Thu, 06 Jul 2023 19:26:18 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to; s=fm1; t=1688685978; x= 1688772378; bh=50Mq7yDH4SaalwjOr9VWbgSV3HaqQVn5wwG7OgrzEBE=; b=i MmC7YyfNAqXjJdbhv9QlzlkYkxFoTRyeKZBYp77nwt/S6s3qqC9kHyn78vNhSDVd c41e1H2KeMcvcYxUi6JneGQRBjk5H4y2DxH9SdxQqBjA3gv9RzxbeNHlOUhXr/0m 37CYrGVXvVQCJhbLotc0TBfclhde8hLFdjJQ1QD/8xQvb22X4T+nQZVt+OQrbmzS Exwy0E57rSuZdd6aYn7y3euafKy6aylOCB0ZQtdvQjcK1ftZBzegpYRXvndmdUdm 0ELoYwCVhGq9Cytz4N2eaAZpdYkhLfYMnXXh0bJtnZnmcbFT5bi8sv/WQgWrch9/ LFHt4st8pUW55RFmIh8Sw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1688685978; x= 1688772378; bh=50Mq7yDH4SaalwjOr9VWbgSV3HaqQVn5wwG7OgrzEBE=; b=I yEO8iEM+w1uIEu2/YEr9VFqi4sYs4mbDj4ZZfHaiEmEkjdoDvq2euyIEActD2KVS Wfu2MbTzYFzygYgPX1rZJ8+Mfo4fZYOB/sYbppMq/mVqVT5RMhmqyTQ6sqhHwcQi XrNCWQEGRlNg8+FGpz9P2q3gZ0iDZ1box8M7/tMwB10svu2S4M1Ai6gA7TLXDpjq SX9HDGX/HWtAx2Mcd8Oq1zw1OCQ/AAQ7+VwXVizPqHedai+LFgO3cJPvSumdmPB9 /KNgepLZkRSLVp+wDz0qH7XH+KnWM6LeCWBXMhfQtsZaO4JVuhTw0phzJtSUhprj 5iq7kMnu2hJ8HLPgVwFsg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedviedrvddtgddvudcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecufghrlhcuvffnffculdejtddmnecujfgurhephffvve fufffkofgjfhgggfestdekredtredttdenucfhrhhomhepffgrnhhivghlucgiuhcuoegu gihusegugihuuhhurdighiiiqeenucggtffrrghtthgvrhhnpefgfefggeejhfduieekvd euteffleeifeeuvdfhheejleejjeekgfffgefhtddtteenucevlhhushhtvghrufhiiigv pedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpegugihusegugihuuhhurdighiii X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 6 Jul 2023 19:26:17 -0400 (EDT) From: Daniel Xu To: pabeni@redhat.com, edumazet@google.com, kuba@kernel.org, fw@strlen.de, davem@davemloft.net, pablo@netfilter.org, kadlec@netfilter.org, dsahern@kernel.org, daniel@iogearbox.net Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH bpf-next v2 1/6] netfilter: defrag: Add glue hooks for enabling/disabling defrag Date: Thu, 6 Jul 2023 17:25:48 -0600 Message-ID: <20411df83bf659ac202af13923d5a6d82bfd4087.1688685338.git.dxu@dxuuu.xyz> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS, SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1770718109226044251?= X-GMAIL-MSGID: =?utf-8?q?1770718109226044251?= We want to be able to enable/disable IP packet defrag from core bpf/netfilter code. In other words, execute code from core that could possibly be built as a module. To help avoid symbol resolution errors, use glue hooks that the modules will register callbacks with during module init. Signed-off-by: Daniel Xu --- include/linux/netfilter.h | 12 ++++++++++++ net/ipv4/netfilter/nf_defrag_ipv4.c | 16 +++++++++++++++- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 10 ++++++++++ net/netfilter/core.c | 6 ++++++ 4 files changed, 43 insertions(+), 1 deletion(-) diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index d4fed4c508ca..77a637b681f2 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -481,6 +481,18 @@ struct nfnl_ct_hook { }; extern const struct nfnl_ct_hook __rcu *nfnl_ct_hook; +struct nf_defrag_v4_hook { + int (*enable)(struct net *net); + void (*disable)(struct net *net); +}; +extern const struct nf_defrag_v4_hook __rcu *nf_defrag_v4_hook; + +struct nf_defrag_v6_hook { + int (*enable)(struct net *net); + void (*disable)(struct net *net); +}; +extern const struct nf_defrag_v6_hook __rcu *nf_defrag_v6_hook; + /* * nf_skb_duplicated - TEE target has sent a packet * diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c index e61ea428ea18..1f3e0e893b7a 100644 --- a/net/ipv4/netfilter/nf_defrag_ipv4.c +++ b/net/ipv4/netfilter/nf_defrag_ipv4.c @@ -7,6 +7,7 @@ #include #include #include +#include #include #include #include @@ -113,17 +114,30 @@ static void __net_exit defrag4_net_exit(struct net *net) } } +static const struct nf_defrag_v4_hook defrag_hook = { + .enable = nf_defrag_ipv4_enable, + .disable = nf_defrag_ipv4_disable, +}; + static struct pernet_operations defrag4_net_ops = { .exit = defrag4_net_exit, }; static int __init nf_defrag_init(void) { - return register_pernet_subsys(&defrag4_net_ops); + int err; + + err = register_pernet_subsys(&defrag4_net_ops); + if (err) + return err; + + rcu_assign_pointer(nf_defrag_v4_hook, &defrag_hook); + return err; } static void __exit nf_defrag_fini(void) { + rcu_assign_pointer(nf_defrag_v4_hook, NULL); unregister_pernet_subsys(&defrag4_net_ops); } diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c index cb4eb1d2c620..f7c7ee31c472 100644 --- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include @@ -96,6 +97,11 @@ static void __net_exit defrag6_net_exit(struct net *net) } } +static const struct nf_defrag_v6_hook defrag_hook = { + .enable = nf_defrag_ipv6_enable, + .disable = nf_defrag_ipv6_disable, +}; + static struct pernet_operations defrag6_net_ops = { .exit = defrag6_net_exit, }; @@ -114,6 +120,9 @@ static int __init nf_defrag_init(void) pr_err("nf_defrag_ipv6: can't register pernet ops\n"); goto cleanup_frag6; } + + rcu_assign_pointer(nf_defrag_v6_hook, &defrag_hook); + return ret; cleanup_frag6: @@ -124,6 +133,7 @@ static int __init nf_defrag_init(void) static void __exit nf_defrag_fini(void) { + rcu_assign_pointer(nf_defrag_v6_hook, NULL); unregister_pernet_subsys(&defrag6_net_ops); nf_ct_frag6_cleanup(); } diff --git a/net/netfilter/core.c b/net/netfilter/core.c index 5f76ae86a656..34845155bb85 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -680,6 +680,12 @@ EXPORT_SYMBOL_GPL(nfnl_ct_hook); const struct nf_ct_hook __rcu *nf_ct_hook __read_mostly; EXPORT_SYMBOL_GPL(nf_ct_hook); +const struct nf_defrag_v4_hook __rcu *nf_defrag_v4_hook __read_mostly; +EXPORT_SYMBOL_GPL(nf_defrag_v4_hook); + +const struct nf_defrag_v6_hook __rcu *nf_defrag_v6_hook __read_mostly; +EXPORT_SYMBOL_GPL(nf_defrag_v6_hook); + #if IS_ENABLED(CONFIG_NF_CONNTRACK) u8 nf_ctnetlink_has_listener; EXPORT_SYMBOL_GPL(nf_ctnetlink_has_listener);