From patchwork Thu Jul 20 20:57:35 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 123456 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:c923:0:b0:3e4:2afc:c1 with SMTP id j3csp3395325vqt; Thu, 20 Jul 2023 14:43:15 -0700 (PDT) X-Google-Smtp-Source: APBJJlHnfZzxEMVxC6/eJ3iSHZ3BP+GpeNb9Aya4RkreZyVq+o8OB+j3npYWxs24ap0yu3qpSRkX X-Received: by 2002:a05:6358:3422:b0:135:89d6:22e9 with SMTP id h34-20020a056358342200b0013589d622e9mr6475839rwd.13.1689889394873; Thu, 20 Jul 2023 14:43:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1689889394; cv=none; d=google.com; s=arc-20160816; b=OQcpY4IZ4J3HH/dbe4oem1uOuZUIHxfGJ1WnB7RDpSLxOuwQfAX1d4JuZ1qdPePNZW k/4A4a9PxUQxRJSwfw+ugEnqq9MwgLUdDcr63gDjvInTeWSDIiGdQxLGQUZPNOJSwsw1 PqrxIeKwgiyTV+khBbxeumTiMz17SaGgEO2WVGrJcXH0Dh2dQr0zFWaaYkp7lLAFO/K3 f2OnP8InzA67Io9QVSEuKpslfmkB+eY7L4iZNR7+PcH2dfZXS+stOcTyIA07S+DjSHZb 6Siu3CGezePdOyEFWmi/G813ctkBfY48c+HzSCqq/jL6/pWE7SFJk6tlNg3m8o+uXogp m2FQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=U14PeO4+rXqVyLZW6g7EGR1pARLExleSWSzTTiiVnD0=; fh=VOIyriwpVa0e/zlTm+OKgKHuAWdzMVYjGFkznHCe46Y=; b=n3pNilhPpWUGpMasn1wt+ysLCRG82nynKvpNmq+y7TzwMBxcLueqmEi27zHenue8gG bUEqnohT004Lu628g9bFj13xthPVER6DJ/zQ56anwnoQ8m5bTvOfNhfV/7BBlkhgYY9M 8Pc5tiKy2bFqpvpbJg+vwsOawkebF3OL1mvee9rfcVK/Mzc628Zifuh0PCfJL+QPPFLq Rbl2xNQ+YIGu1xaNwd0VUw7DkohIolfHt3A99xV7LjAo9jYt8SyMwhAqrHhY+zuL+MUp 9nD/Rhi6e6IeMNJe/yOZKmRnyexCbMo3sjcH1zvGpxVmRYykG5qnGVMQzPca3/mTd0ht xNNA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm2 header.b=g95EkqIC; dkim=pass header.i=@messagingengine.com header.s=fm3 header.b=uDWKUPfN; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id v202-20020a6361d3000000b0055ffed935fbsi1124709pgb.393.2023.07.20.14.43.01; Thu, 20 Jul 2023 14:43:14 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm2 header.b=g95EkqIC; dkim=pass header.i=@messagingengine.com header.s=fm3 header.b=uDWKUPfN; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229771AbjGTU6R (ORCPT + 99 others); Thu, 20 Jul 2023 16:58:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42206 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229579AbjGTU6P (ORCPT ); Thu, 20 Jul 2023 16:58:15 -0400 Received: from wout5-smtp.messagingengine.com (wout5-smtp.messagingengine.com [64.147.123.21]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2CABF19A6; Thu, 20 Jul 2023 13:58:14 -0700 (PDT) Received: from compute6.internal (compute6.nyi.internal [10.202.2.47]) by mailout.west.internal (Postfix) with ESMTP id 216BC3202ACF; Thu, 20 Jul 2023 16:58:12 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute6.internal (MEProxy); Thu, 20 Jul 2023 16:58:13 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to; s=fm2; t=1689886691; x= 1689973091; bh=U14PeO4+rXqVyLZW6g7EGR1pARLExleSWSzTTiiVnD0=; b=g 95EkqICPP+S/4OCT6RZ/HqpfcNXvwEx4NTwxdFtpZKXIZN0yVu8fmtZO+us0PeFZ ic408ofSMg5x+tdKumpMRWz/TrbyCXkiQz2fvbHbxROhRSH553C5IUu9JL8hrb2j g+DQrL8CbaKlssehAgY1Apaech7tfh/5vhFwEBkTBQYb1PAZS7FNFiyeGM/keEjg 5XoU4KweUY5woKYsy6sbVoA+yk7662QEaJC3pP6QE/BYHdOqx2k+9ZeYJ+T99Eh3 7/WsGRN+EVp4GdPhATBnQog8fiVk62h4FAvgSmDRsPQKlZNGtjub4zLbENBAI75o xjL1+KX6HQ5kf4PGHwezg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1689886691; x= 1689973091; bh=U14PeO4+rXqVyLZW6g7EGR1pARLExleSWSzTTiiVnD0=; b=u DWKUPfNSRcjdGmpDAT8cMOMq0zRB2wr1dky37zz/CSgRKogoou807xsAINT7kVg/ lxA0NVKoDB2zP5kiaOgwYc/yoP+Wa9yuOpJQT1KDAo4xxarvL5AktgmFCOqCY9Il BwFQvP/CFTigomhoDZy6aY03u5xOxExxQKBM1YUr5bHnjCnT9Vu8mk+4xpSpk98X DdfFFYE0L0lUT6mq1ID2aok9QArLNJCaKgUHrDlqZa7uas5H48EbDPWtFdSYLWvD JjtD1652q0qZqXxwycS46bVDN3LP8CVkniM1iFWXEFqU5VAvAluWAa2R4zFlOl9H nCztjT4TvU+d9j4cPK0rg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedviedrhedtgdduheegucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucgfrhhlucfvnfffucdljedtmdenucfjughrpefhvf evufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeffrghnihgvlhcuighuuceo ugiguhesugiguhhuuhdrgiihiieqnecuggftrfgrthhtvghrnhepgfefgfegjefhudeike dvueetffelieefuedvhfehjeeljeejkefgffeghfdttdetnecuvehluhhsthgvrhfuihii vgeptdenucfrrghrrghmpehmrghilhhfrhhomhepugiguhesugiguhhuuhdrgiihii X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 20 Jul 2023 16:58:10 -0400 (EDT) From: Daniel Xu To: kuba@kernel.org, kadlec@netfilter.org, pablo@netfilter.org, dsahern@kernel.org, davem@davemloft.net, edumazet@google.com, pabeni@redhat.com, fw@strlen.de, alexei.starovoitov@gmail.com, daniel@iogearbox.net Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH bpf-next v5 1/5] netfilter: defrag: Add glue hooks for enabling/disabling defrag Date: Thu, 20 Jul 2023 14:57:35 -0600 Message-ID: X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED, SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1771977462117062589 X-GMAIL-MSGID: 1771977462117062589 We want to be able to enable/disable IP packet defrag from core bpf/netfilter code. In other words, execute code from core that could possibly be built as a module. To help avoid symbol resolution errors, use glue hooks that the modules will register callbacks with during module init. Signed-off-by: Daniel Xu --- include/linux/netfilter.h | 10 ++++++++++ net/ipv4/netfilter/nf_defrag_ipv4.c | 17 ++++++++++++++++- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 11 +++++++++++ net/netfilter/core.c | 6 ++++++ 4 files changed, 43 insertions(+), 1 deletion(-) diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index d4fed4c508ca..d68644b7c299 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -11,6 +11,7 @@ #include #include #include +#include #include #include #include @@ -481,6 +482,15 @@ struct nfnl_ct_hook { }; extern const struct nfnl_ct_hook __rcu *nfnl_ct_hook; +struct nf_defrag_hook { + struct module *owner; + int (*enable)(struct net *net); + void (*disable)(struct net *net); +}; + +extern const struct nf_defrag_hook __rcu *nf_defrag_v4_hook; +extern const struct nf_defrag_hook __rcu *nf_defrag_v6_hook; + /* * nf_skb_duplicated - TEE target has sent a packet * diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c index e61ea428ea18..a9ba7de092c4 100644 --- a/net/ipv4/netfilter/nf_defrag_ipv4.c +++ b/net/ipv4/netfilter/nf_defrag_ipv4.c @@ -7,6 +7,7 @@ #include #include #include +#include #include #include #include @@ -113,17 +114,31 @@ static void __net_exit defrag4_net_exit(struct net *net) } } +static const struct nf_defrag_hook defrag_hook = { + .owner = THIS_MODULE, + .enable = nf_defrag_ipv4_enable, + .disable = nf_defrag_ipv4_disable, +}; + static struct pernet_operations defrag4_net_ops = { .exit = defrag4_net_exit, }; static int __init nf_defrag_init(void) { - return register_pernet_subsys(&defrag4_net_ops); + int err; + + err = register_pernet_subsys(&defrag4_net_ops); + if (err) + return err; + + rcu_assign_pointer(nf_defrag_v4_hook, &defrag_hook); + return err; } static void __exit nf_defrag_fini(void) { + rcu_assign_pointer(nf_defrag_v4_hook, NULL); unregister_pernet_subsys(&defrag4_net_ops); } diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c index cb4eb1d2c620..d59b296b4f51 100644 --- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include @@ -96,6 +97,12 @@ static void __net_exit defrag6_net_exit(struct net *net) } } +static const struct nf_defrag_hook defrag_hook = { + .owner = THIS_MODULE, + .enable = nf_defrag_ipv6_enable, + .disable = nf_defrag_ipv6_disable, +}; + static struct pernet_operations defrag6_net_ops = { .exit = defrag6_net_exit, }; @@ -114,6 +121,9 @@ static int __init nf_defrag_init(void) pr_err("nf_defrag_ipv6: can't register pernet ops\n"); goto cleanup_frag6; } + + rcu_assign_pointer(nf_defrag_v6_hook, &defrag_hook); + return ret; cleanup_frag6: @@ -124,6 +134,7 @@ static int __init nf_defrag_init(void) static void __exit nf_defrag_fini(void) { + rcu_assign_pointer(nf_defrag_v6_hook, NULL); unregister_pernet_subsys(&defrag6_net_ops); nf_ct_frag6_cleanup(); } diff --git a/net/netfilter/core.c b/net/netfilter/core.c index 5f76ae86a656..ef4e76e5aef9 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -680,6 +680,12 @@ EXPORT_SYMBOL_GPL(nfnl_ct_hook); const struct nf_ct_hook __rcu *nf_ct_hook __read_mostly; EXPORT_SYMBOL_GPL(nf_ct_hook); +const struct nf_defrag_hook __rcu *nf_defrag_v4_hook __read_mostly; +EXPORT_SYMBOL_GPL(nf_defrag_v4_hook); + +const struct nf_defrag_hook __rcu *nf_defrag_v6_hook __read_mostly; +EXPORT_SYMBOL_GPL(nf_defrag_v6_hook); + #if IS_ENABLED(CONFIG_NF_CONNTRACK) u8 nf_ctnetlink_has_listener; EXPORT_SYMBOL_GPL(nf_ctnetlink_has_listener);