* [PATCH nf v3 1/3] netfilter: nf_flow_table_offload: fix incorrect ethernet dst address
2019-12-20 4:14 [PATCH nf v3 0/3] netfilter: nf_flow_table_offload: something fixes wenxu
@ 2019-12-20 4:14 ` wenxu
2019-12-20 4:14 ` [PATCH nf v3 2/3] netfilter: nf_flow_table_offload: check the status of dst_neigh wenxu
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-12-20 4:14 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel
From: wenxu <wenxu@ucloud.cn>
original: A -> B
reply: B -> A
Ethernet destination for original traffic takes the source ethernet address
in the reply direction. For reply traffic, this takes the source
ethernet address of the original direction.
Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
net/netfilter/nf_flow_table_offload.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index 0d72e5c..ee9edbe 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -166,14 +166,16 @@ static int flow_offload_eth_dst(struct net *net,
enum flow_offload_tuple_dir dir,
struct nf_flow_rule *flow_rule)
{
- const struct flow_offload_tuple *tuple = &flow->tuplehash[dir].tuple;
struct flow_action_entry *entry0 = flow_action_entry_next(flow_rule);
struct flow_action_entry *entry1 = flow_action_entry_next(flow_rule);
+ const void *daddr = &flow->tuplehash[!dir].tuple.src_v4;
+ const struct dst_entry *dst_cache;
struct neighbour *n;
u32 mask, val;
u16 val16;
- n = dst_neigh_lookup(tuple->dst_cache, &tuple->dst_v4);
+ dst_cache = flow->tuplehash[dir].tuple.dst_cache;
+ n = dst_neigh_lookup(dst_cache, daddr);
if (!n)
return -ENOENT;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH nf v3 2/3] netfilter: nf_flow_table_offload: check the status of dst_neigh
2019-12-20 4:14 [PATCH nf v3 0/3] netfilter: nf_flow_table_offload: something fixes wenxu
2019-12-20 4:14 ` [PATCH nf v3 1/3] netfilter: nf_flow_table_offload: fix incorrect ethernet dst address wenxu
@ 2019-12-20 4:14 ` wenxu
2019-12-20 4:14 ` [PATCH nf v3 3/3] netfilter: nf_flow_table_offload: fix the nat port mangle wenxu
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-12-20 4:14 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel
From: wenxu <wenxu@ucloud.cn>
It is better to get the dst_neigh with neigh->lock and check the
nud_state is VALID. If there is not neigh previous, the lookup will
Create a non NUD_VALID with 00:00:00:00:00:00 mac.
Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
net/netfilter/nf_flow_table_offload.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index ee9edbe..92b0bd2 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -170,8 +170,10 @@ static int flow_offload_eth_dst(struct net *net,
struct flow_action_entry *entry1 = flow_action_entry_next(flow_rule);
const void *daddr = &flow->tuplehash[!dir].tuple.src_v4;
const struct dst_entry *dst_cache;
+ unsigned char ha[ETH_ALEN];
struct neighbour *n;
u32 mask, val;
+ u8 nud_state;
u16 val16;
dst_cache = flow->tuplehash[dir].tuple.dst_cache;
@@ -179,13 +181,23 @@ static int flow_offload_eth_dst(struct net *net,
if (!n)
return -ENOENT;
+ read_lock_bh(&n->lock);
+ nud_state = n->nud_state;
+ ether_addr_copy(ha, n->ha);
+ read_unlock_bh(&n->lock);
+
+ if (!(nud_state & NUD_VALID)) {
+ neigh_release(n);
+ return -ENOENT;
+ }
+
mask = ~0xffffffff;
- memcpy(&val, n->ha, 4);
+ memcpy(&val, ha, 4);
flow_offload_mangle(entry0, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 0,
&val, &mask);
mask = ~0x0000ffff;
- memcpy(&val16, n->ha + 4, 2);
+ memcpy(&val16, ha + 4, 2);
val = val16;
flow_offload_mangle(entry1, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 4,
&val, &mask);
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH nf v3 3/3] netfilter: nf_flow_table_offload: fix the nat port mangle.
2019-12-20 4:14 [PATCH nf v3 0/3] netfilter: nf_flow_table_offload: something fixes wenxu
2019-12-20 4:14 ` [PATCH nf v3 1/3] netfilter: nf_flow_table_offload: fix incorrect ethernet dst address wenxu
2019-12-20 4:14 ` [PATCH nf v3 2/3] netfilter: nf_flow_table_offload: check the status of dst_neigh wenxu
@ 2019-12-20 4:14 ` wenxu
2019-12-30 13:27 ` [PATCH nf v3 0/3] netfilter: nf_flow_table_offload: something fixes wenxu
2020-01-03 17:56 ` Pablo Neira Ayuso
4 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-12-20 4:14 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel
From: wenxu <wenxu@ucloud.cn>
SNAT after mangling
original A -> B => _FW_ -> B
reply B -> FW => B -> _A_
DNAT after mangling
original A -> FW => A -> _B_
reply B -> A => _FW_-> A
Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
Fixes: 7acd9378dc652 ("netfilter: nf_flow_table_offload: Correct memcpy size for flow_overload_mangle()")
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
net/netfilter/nf_flow_table_offload.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index 92b0bd2..6c162c9 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -349,22 +349,26 @@ static void flow_offload_port_snat(struct net *net,
struct nf_flow_rule *flow_rule)
{
struct flow_action_entry *entry = flow_action_entry_next(flow_rule);
- u32 mask = ~htonl(0xffff0000), port;
+ u32 mask, port;
u32 offset;
switch (dir) {
case FLOW_OFFLOAD_DIR_ORIGINAL:
port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port);
offset = 0; /* offsetof(struct tcphdr, source); */
+ port = htonl(port << 16);
+ mask = ~htonl(0xffff0000);
break;
case FLOW_OFFLOAD_DIR_REPLY:
port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port);
offset = 0; /* offsetof(struct tcphdr, dest); */
+ port = htonl(port);
+ mask = ~htonl(0xffff);
break;
default:
return;
}
- port = htonl(port << 16);
+
flow_offload_mangle(entry, flow_offload_l4proto(flow), offset,
&port, &mask);
}
@@ -375,22 +379,26 @@ static void flow_offload_port_dnat(struct net *net,
struct nf_flow_rule *flow_rule)
{
struct flow_action_entry *entry = flow_action_entry_next(flow_rule);
- u32 mask = ~htonl(0xffff), port;
+ u32 mask, port;
u32 offset;
switch (dir) {
case FLOW_OFFLOAD_DIR_ORIGINAL:
- port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port);
- offset = 0; /* offsetof(struct tcphdr, source); */
+ port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port);
+ offset = 0; /* offsetof(struct tcphdr, dest); */
+ port = htonl(port);
+ mask = ~htonl(0xffff);
break;
case FLOW_OFFLOAD_DIR_REPLY:
- port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port);
- offset = 0; /* offsetof(struct tcphdr, dest); */
+ port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port);
+ offset = 0; /* offsetof(struct tcphdr, source); */
+ port = htonl(port << 16);
+ mask = ~htonl(0xffff0000);
break;
default:
return;
}
- port = htonl(port);
+
flow_offload_mangle(entry, flow_offload_l4proto(flow), offset,
&port, &mask);
}
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH nf v3 0/3] netfilter: nf_flow_table_offload: something fixes
2019-12-20 4:14 [PATCH nf v3 0/3] netfilter: nf_flow_table_offload: something fixes wenxu
` (2 preceding siblings ...)
2019-12-20 4:14 ` [PATCH nf v3 3/3] netfilter: nf_flow_table_offload: fix the nat port mangle wenxu
@ 2019-12-30 13:27 ` wenxu
2020-01-03 17:56 ` Pablo Neira Ayuso
4 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-12-30 13:27 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel
Hi pablo,
Any idea for this series?
BR
wenxu
在 2019/12/20 12:14, wenxu@ucloud.cn 写道:
> From: wenxu <wenxu@ucloud.cn>
>
> This version just modify the description of patch 1 and 3
>
> wenxu (3):
> netfilter: nf_flow_table_offload: fix incorrect ethernet dst address
> netfilter: nf_flow_table_offload: check the status of dst_neigh
> netfilter: nf_flow_table_offload: fix the nat port mangle.
>
> net/netfilter/nf_flow_table_offload.c | 46 ++++++++++++++++++++++++++---------
> 1 file changed, 34 insertions(+), 12 deletions(-)
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH nf v3 0/3] netfilter: nf_flow_table_offload: something fixes
2019-12-20 4:14 [PATCH nf v3 0/3] netfilter: nf_flow_table_offload: something fixes wenxu
` (3 preceding siblings ...)
2019-12-30 13:27 ` [PATCH nf v3 0/3] netfilter: nf_flow_table_offload: something fixes wenxu
@ 2020-01-03 17:56 ` Pablo Neira Ayuso
4 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2020-01-03 17:56 UTC (permalink / raw)
To: wenxu; +Cc: netfilter-devel
Series applied.
^ permalink raw reply [flat|nested] 6+ messages in thread