Netfilter-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH nf-next v2 0/3] netfilter: nf_tables_offload: clean offload things when the device unregister
@ 2019-09-04  7:07 wenxu
  2019-09-04  7:07 ` [PATCH nf-next v2 1/3] netfilter: nf_offload: refactor the nft_flow_offload_chain function wenxu
                   ` (2 more replies)
  0 siblings, 3 replies; 6+ messages in thread
From: wenxu @ 2019-09-04  7:07 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel

From: wenxu <wenxu@ucloud.cn>

This series clean the offload things for both chain and rules when the
related device unregister

This version add a netdev notify to clean this things in the nft_offload_init

wenxu (3):
  netfilter: nf_offload: refactor the nft_flow_offload_chain function
  netfilter: nf_offload: refactor the nft_flow_offload_rule function
  netfilter: nf_offload: clean offload things when the device unregister

 include/net/netfilter/nf_tables_offload.h |   2 +-
 net/netfilter/nf_tables_api.c             |   9 ++-
 net/netfilter/nf_tables_offload.c         | 110 +++++++++++++++++++++++++-----
 3 files changed, 102 insertions(+), 19 deletions(-)

-- 
1.8.3.1


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH nf-next v2 1/3] netfilter: nf_offload: refactor the nft_flow_offload_chain function
  2019-09-04  7:07 [PATCH nf-next v2 0/3] netfilter: nf_tables_offload: clean offload things when the device unregister wenxu
@ 2019-09-04  7:07 ` wenxu
  2019-09-04  7:07 ` [PATCH nf-next v2 2/3] netfilter: nf_offload: refactor the nft_flow_offload_rule function wenxu
  2019-09-04  7:07 ` [PATCH nf-next v2 3/3] netfilter: nf_tables_offload: clean offload things when the device unregister wenxu
  2 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-09-04  7:07 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel

From: wenxu <wenxu@ucloud.cn>

Refactor nft_flow_offload_chain and make it more common

Signed-off-by: wenxu <wenxu@ucloud.cn>
---
 net/netfilter/nf_tables_offload.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 3f49fe8..9419486 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -273,10 +273,9 @@ static int nft_indr_block_offload_cmd(struct nft_base_chain *chain,
 
 #define FLOW_SETUP_BLOCK TC_SETUP_BLOCK
 
-static int nft_flow_offload_chain(struct nft_trans *trans,
+static int nft_flow_offload_chain(struct nft_chain *chain,
 				  enum flow_block_command cmd)
 {
-	struct nft_chain *chain = trans->ctx.chain;
 	struct nft_base_chain *basechain;
 	struct net_device *dev;
 
@@ -288,16 +287,24 @@ static int nft_flow_offload_chain(struct nft_trans *trans,
 	if (!dev)
 		return -EOPNOTSUPP;
 
+	if (dev->netdev_ops->ndo_setup_tc)
+		return nft_block_offload_cmd(basechain, dev, cmd);
+	else
+		return nft_indr_block_offload_cmd(basechain, dev, cmd);
+}
+
+static int nft_flow_offload_chain_commit(struct nft_trans *trans,
+					 enum flow_block_command cmd)
+{
+	struct nft_chain *chain = trans->ctx.chain;
+
 	/* Only default policy to accept is supported for now. */
 	if (cmd == FLOW_BLOCK_BIND &&
 	    nft_trans_chain_policy(trans) != -1 &&
 	    nft_trans_chain_policy(trans) != NF_ACCEPT)
 		return -EOPNOTSUPP;
 
-	if (dev->netdev_ops->ndo_setup_tc)
-		return nft_block_offload_cmd(basechain, dev, cmd);
-	else
-		return nft_indr_block_offload_cmd(basechain, dev, cmd);
+	return nft_flow_offload_chain(chain, cmd);
 }
 
 int nft_flow_rule_offload_commit(struct net *net)
@@ -314,13 +321,13 @@ int nft_flow_rule_offload_commit(struct net *net)
 			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
 				continue;
 
-			err = nft_flow_offload_chain(trans, FLOW_BLOCK_BIND);
+			err = nft_flow_offload_chain_commit(trans, FLOW_BLOCK_BIND);
 			break;
 		case NFT_MSG_DELCHAIN:
 			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
 				continue;
 
-			err = nft_flow_offload_chain(trans, FLOW_BLOCK_UNBIND);
+			err = nft_flow_offload_chain_commit(trans, FLOW_BLOCK_UNBIND);
 			break;
 		case NFT_MSG_NEWRULE:
 			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
-- 
1.8.3.1


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH nf-next v2 2/3] netfilter: nf_offload: refactor the nft_flow_offload_rule function
  2019-09-04  7:07 [PATCH nf-next v2 0/3] netfilter: nf_tables_offload: clean offload things when the device unregister wenxu
  2019-09-04  7:07 ` [PATCH nf-next v2 1/3] netfilter: nf_offload: refactor the nft_flow_offload_chain function wenxu
@ 2019-09-04  7:07 ` wenxu
  2019-09-04  7:07 ` [PATCH nf-next v2 3/3] netfilter: nf_tables_offload: clean offload things when the device unregister wenxu
  2 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-09-04  7:07 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel

From: wenxu <wenxu@ucloud.cn>

Refactor nft_flow_offload_rule and make it more common

Signed-off-by: wenxu <wenxu@ucloud.cn>
---
 net/netfilter/nf_tables_offload.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 9419486..9657001 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -134,20 +134,20 @@ int nft_chain_offload_priority(struct nft_base_chain *basechain)
 	return 0;
 }
 
-static int nft_flow_offload_rule(struct nft_trans *trans,
+static int nft_flow_offload_rule(struct nft_chain *chain,
+				 struct nft_rule *rule,
+				 struct nft_flow_rule *flow,
 				 enum flow_cls_command command)
 {
-	struct nft_flow_rule *flow = nft_trans_flow_rule(trans);
-	struct nft_rule *rule = nft_trans_rule(trans);
 	struct flow_cls_offload cls_flow = {};
 	struct nft_base_chain *basechain;
 	struct netlink_ext_ack extack;
 	__be16 proto = ETH_P_ALL;
 
-	if (!nft_is_base_chain(trans->ctx.chain))
+	if (!nft_is_base_chain(chain))
 		return -EOPNOTSUPP;
 
-	basechain = nft_base_chain(trans->ctx.chain);
+	basechain = nft_base_chain(chain);
 
 	if (flow)
 		proto = flow->proto;
@@ -162,6 +162,16 @@ static int nft_flow_offload_rule(struct nft_trans *trans,
 	return nft_setup_cb_call(basechain, TC_SETUP_CLSFLOWER, &cls_flow);
 }
 
+static int nft_flow_offload_rule_commit(struct nft_trans *trans,
+					enum flow_cls_command command)
+{
+	struct nft_flow_rule *flow = nft_trans_flow_rule(trans);
+	struct nft_rule *rule = nft_trans_rule(trans);
+	struct nft_chain *chain = trans->ctx.chain;
+
+	return nft_flow_offload_rule(chain, rule, flow, command);
+}
+
 static int nft_flow_offload_bind(struct flow_block_offload *bo,
 				 struct nft_base_chain *basechain)
 {
@@ -337,14 +347,14 @@ int nft_flow_rule_offload_commit(struct net *net)
 			    !(trans->ctx.flags & NLM_F_APPEND))
 				return -EOPNOTSUPP;
 
-			err = nft_flow_offload_rule(trans, FLOW_CLS_REPLACE);
+			err = nft_flow_offload_rule_commit(trans, FLOW_CLS_REPLACE);
 			nft_flow_rule_destroy(nft_trans_flow_rule(trans));
 			break;
 		case NFT_MSG_DELRULE:
 			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
 				continue;
 
-			err = nft_flow_offload_rule(trans, FLOW_CLS_DESTROY);
+			err = nft_flow_offload_rule_commit(trans, FLOW_CLS_DESTROY);
 			break;
 		}
 
-- 
1.8.3.1


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH nf-next v2 3/3] netfilter: nf_tables_offload: clean offload things when the device unregister
  2019-09-04  7:07 [PATCH nf-next v2 0/3] netfilter: nf_tables_offload: clean offload things when the device unregister wenxu
  2019-09-04  7:07 ` [PATCH nf-next v2 1/3] netfilter: nf_offload: refactor the nft_flow_offload_chain function wenxu
  2019-09-04  7:07 ` [PATCH nf-next v2 2/3] netfilter: nf_offload: refactor the nft_flow_offload_rule function wenxu
@ 2019-09-04  7:07 ` wenxu
  2019-09-04 19:40   ` Pablo Neira Ayuso
  2 siblings, 1 reply; 6+ messages in thread
From: wenxu @ 2019-09-04  7:07 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel

From: wenxu <wenxu@ucloud.cn>

When the net_device unregister, the netdevice_notifier will release
the related netdev basedchain and rules in this chains. So it is also
need to clean the offload things before the chain is destroy.

Signed-off-by: wenxu <wenxu@ucloud.cn>
---
 include/net/netfilter/nf_tables_offload.h |  2 +-
 net/netfilter/nf_tables_api.c             |  9 ++++-
 net/netfilter/nf_tables_offload.c         | 63 ++++++++++++++++++++++++++++++-
 3 files changed, 70 insertions(+), 4 deletions(-)

diff --git a/include/net/netfilter/nf_tables_offload.h b/include/net/netfilter/nf_tables_offload.h
index 643152f..acb6621 100644
--- a/include/net/netfilter/nf_tables_offload.h
+++ b/include/net/netfilter/nf_tables_offload.h
@@ -80,7 +80,7 @@ void nft_indr_block_get_and_ing_cmd(struct net_device *dev,
 
 int nft_chain_offload_priority(struct nft_base_chain *basechain);
 
-void nft_offload_init(void);
+int nft_offload_init(void);
 void nft_offload_exit(void);
 
 #endif
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index a3d7e82..3c64b32 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -7691,15 +7691,20 @@ static int __init nf_tables_module_init(void)
 	if (err < 0)
 		goto err4;
 
+	err = nft_offload_init();
+	if (err < 0)
+		goto err5;
+
 	/* must be last */
 	err = nfnetlink_subsys_register(&nf_tables_subsys);
 	if (err < 0)
-		goto err5;
+		goto err6;
 
 	nft_chain_route_init();
-	nft_offload_init();
 
 	return err;
+err6:
+	nft_offload_exit();
 err5:
 	rhltable_destroy(&nft_objname_ht);
 err4:
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 9657001..9fa3bdb 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -396,17 +396,78 @@ static void nft_indr_block_cb(struct net_device *dev,
 	mutex_unlock(&net->nft.commit_mutex);
 }
 
+static void nft_offload_chain_clean(struct nft_chain *chain)
+{
+	struct nft_rule *rule;
+
+	list_for_each_entry(rule, &chain->rules, list) {
+		nft_flow_offload_rule(chain, rule,
+				      NULL, FLOW_CLS_DESTROY);
+	}
+
+	nft_flow_offload_chain(chain, FLOW_BLOCK_UNBIND);
+}
+
+static int nft_offload_netdev_event(struct notifier_block *this,
+				    unsigned long event, void *ptr)
+{
+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+	struct nft_base_chain *basechain;
+	struct net *net = dev_net(dev);
+	struct nft_table *table;
+	struct nft_chain *chain;
+
+	if (event != NETDEV_UNREGISTER)
+		return NOTIFY_DONE;
+
+	mutex_lock(&net->nft.commit_mutex);
+	list_for_each_entry(table, &net->nft.tables, list) {
+		if (table->family != NFPROTO_NETDEV)
+			continue;
+
+		list_for_each_entry(chain, &table->chains, list) {
+			if (!nft_is_base_chain(chain) ||
+			    !(chain->flags & NFT_CHAIN_HW_OFFLOAD))
+				continue;
+
+			basechain = nft_base_chain(chain);
+			if (strncmp(basechain->dev_name, dev->name, IFNAMSIZ))
+				continue;
+
+			nft_offload_chain_clean(chain);
+			mutex_unlock(&net->nft.commit_mutex);
+			return NOTIFY_DONE;
+		}
+	}
+	mutex_unlock(&net->nft.commit_mutex);
+
+	return NOTIFY_DONE;
+}
+
 static struct flow_indr_block_ing_entry block_ing_entry = {
 	.cb	= nft_indr_block_cb,
 	.list	= LIST_HEAD_INIT(block_ing_entry.list),
 };
 
-void nft_offload_init(void)
+static struct notifier_block nft_offload_netdev_notifier = {
+	.notifier_call	= nft_offload_netdev_event,
+};
+
+int nft_offload_init(void)
 {
+	int err;
+
+	err = register_netdevice_notifier(&nft_offload_netdev_notifier);
+	if (err < 0)
+		return err;
+
 	flow_indr_add_block_ing_cb(&block_ing_entry);
+
+	return 0;
 }
 
 void nft_offload_exit(void)
 {
 	flow_indr_del_block_ing_cb(&block_ing_entry);
+	unregister_netdevice_notifier(&nft_offload_netdev_notifier);
 }
-- 
1.8.3.1


^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH nf-next v2 3/3] netfilter: nf_tables_offload: clean offload things when the device unregister
  2019-09-04  7:07 ` [PATCH nf-next v2 3/3] netfilter: nf_tables_offload: clean offload things when the device unregister wenxu
@ 2019-09-04 19:40   ` Pablo Neira Ayuso
  2019-09-05  3:26     ` wenxu
  0 siblings, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2019-09-04 19:40 UTC (permalink / raw)
  To: wenxu; +Cc: netfilter-devel

Thanks for working on this.

On Wed, Sep 04, 2019 at 03:07:31PM +0800, wenxu@ucloud.cn wrote:
> diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
> index 9657001..9fa3bdb 100644
> --- a/net/netfilter/nf_tables_offload.c
> +++ b/net/netfilter/nf_tables_offload.c
> @@ -396,17 +396,78 @@ static void nft_indr_block_cb(struct net_device *dev,
>  	mutex_unlock(&net->nft.commit_mutex);
>  }
>  
> +static void nft_offload_chain_clean(struct nft_chain *chain)
> +{
> +	struct nft_rule *rule;
> +
> +	list_for_each_entry(rule, &chain->rules, list) {
> +		nft_flow_offload_rule(chain, rule,
> +				      NULL, FLOW_CLS_DESTROY);
> +	}
> +
> +	nft_flow_offload_chain(chain, FLOW_BLOCK_UNBIND);
> +}
> +
> +static int nft_offload_netdev_event(struct notifier_block *this,
> +				    unsigned long event, void *ptr)
> +{
> +	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
> +	struct nft_base_chain *basechain;
> +	struct net *net = dev_net(dev);
> +	struct nft_table *table;
> +	struct nft_chain *chain;
> +
> +	if (event != NETDEV_UNREGISTER)
> +		return NOTIFY_DONE;
> +
> +	mutex_lock(&net->nft.commit_mutex);
> +	list_for_each_entry(table, &net->nft.tables, list) {
> +		if (table->family != NFPROTO_NETDEV)
> +			continue;
> +
> +		list_for_each_entry(chain, &table->chains, list) {
> +			if (!nft_is_base_chain(chain) ||
> +			    !(chain->flags & NFT_CHAIN_HW_OFFLOAD))
> +				continue;
> +
> +			basechain = nft_base_chain(chain);
> +			if (strncmp(basechain->dev_name, dev->name, IFNAMSIZ))
> +				continue;
> +
> +			nft_offload_chain_clean(chain);
> +			mutex_unlock(&net->nft.commit_mutex);
> +			return NOTIFY_DONE;
> +		}
> +	}
> +	mutex_unlock(&net->nft.commit_mutex);

This code around the mutex look very similar to nft_block_indr_cb(),
could you consolidate this? Probably something like
nft_offload_netdev_iterate() and add a callback.

> +	return NOTIFY_DONE;
> +}
> +
>  static struct flow_indr_block_ing_entry block_ing_entry = {
>  	.cb	= nft_indr_block_cb,
>  	.list	= LIST_HEAD_INIT(block_ing_entry.list),
>  };
>  
> -void nft_offload_init(void)
> +static struct notifier_block nft_offload_netdev_notifier = {
> +	.notifier_call	= nft_offload_netdev_event,

No need for priority because of registration order, right?

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH nf-next v2 3/3] netfilter: nf_tables_offload: clean offload things when the device unregister
  2019-09-04 19:40   ` Pablo Neira Ayuso
@ 2019-09-05  3:26     ` wenxu
  0 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-09-05  3:26 UTC (permalink / raw)
  To: Pablo Neira Ayuso; +Cc: netfilter-devel


On 9/5/2019 3:40 AM, Pablo Neira Ayuso wrote:
> Thanks for working on this.
>
> On Wed, Sep 04, 2019 at 03:07:31PM +0800, wenxu@ucloud.cn wrote:
>> diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
>> index 9657001..9fa3bdb 100644
>> --- a/net/netfilter/nf_tables_offload.c
>> +++ b/net/netfilter/nf_tables_offload.c
>> @@ -396,17 +396,78 @@ static void nft_indr_block_cb(struct net_device *dev,
>>  	mutex_unlock(&net->nft.commit_mutex);
>>  }
>>  
>> +static void nft_offload_chain_clean(struct nft_chain *chain)
>> +{
>> +	struct nft_rule *rule;
>> +
>> +	list_for_each_entry(rule, &chain->rules, list) {
>> +		nft_flow_offload_rule(chain, rule,
>> +				      NULL, FLOW_CLS_DESTROY);
>> +	}
>> +
>> +	nft_flow_offload_chain(chain, FLOW_BLOCK_UNBIND);
>> +}
>> +
>> +static int nft_offload_netdev_event(struct notifier_block *this,
>> +				    unsigned long event, void *ptr)
>> +{
>> +	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
>> +	struct nft_base_chain *basechain;
>> +	struct net *net = dev_net(dev);
>> +	struct nft_table *table;
>> +	struct nft_chain *chain;
>> +
>> +	if (event != NETDEV_UNREGISTER)
>> +		return NOTIFY_DONE;
>> +
>> +	mutex_lock(&net->nft.commit_mutex);
>> +	list_for_each_entry(table, &net->nft.tables, list) {
>> +		if (table->family != NFPROTO_NETDEV)
>> +			continue;
>> +
>> +		list_for_each_entry(chain, &table->chains, list) {
>> +			if (!nft_is_base_chain(chain) ||
>> +			    !(chain->flags & NFT_CHAIN_HW_OFFLOAD))
>> +				continue;
>> +
>> +			basechain = nft_base_chain(chain);
>> +			if (strncmp(basechain->dev_name, dev->name, IFNAMSIZ))
>> +				continue;
>> +
>> +			nft_offload_chain_clean(chain);
>> +			mutex_unlock(&net->nft.commit_mutex);
>> +			return NOTIFY_DONE;
>> +		}
>> +	}
>> +	mutex_unlock(&net->nft.commit_mutex);
> This code around the mutex look very similar to nft_block_indr_cb(),
> could you consolidate this? Probably something like
> nft_offload_netdev_iterate() and add a callback.

nft_offload_netdev_iterate is a good idear, But maybe it can't provide
a common callback. The nft_offload_netdev_iterate(without mutex) can return the chain
amke each function(with mutex) use it  

>
>> +	return NOTIFY_DONE;
>> +}
>> +
>>  static struct flow_indr_block_ing_entry block_ing_entry = {
>>  	.cb	= nft_indr_block_cb,
>>  	.list	= LIST_HEAD_INIT(block_ing_entry.list),
>>  };
>>  
>> -void nft_offload_init(void)
>> +static struct notifier_block nft_offload_netdev_notifier = {
>> +	.notifier_call	= nft_offload_netdev_event,
> No need for priority because of registration order, right?
yes,  nft_offload_init will early than nft_chain_filter mod init
>

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, back to index

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-04  7:07 [PATCH nf-next v2 0/3] netfilter: nf_tables_offload: clean offload things when the device unregister wenxu
2019-09-04  7:07 ` [PATCH nf-next v2 1/3] netfilter: nf_offload: refactor the nft_flow_offload_chain function wenxu
2019-09-04  7:07 ` [PATCH nf-next v2 2/3] netfilter: nf_offload: refactor the nft_flow_offload_rule function wenxu
2019-09-04  7:07 ` [PATCH nf-next v2 3/3] netfilter: nf_tables_offload: clean offload things when the device unregister wenxu
2019-09-04 19:40   ` Pablo Neira Ayuso
2019-09-05  3:26     ` wenxu

Netfilter-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netfilter-devel/0 netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ https://lore.kernel.org/netfilter-devel \
		netfilter-devel@vger.kernel.org netfilter-devel@archiver.kernel.org
	public-inbox-index netfilter-devel


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netfilter-devel


AGPL code for this site: git clone https://public-inbox.org/ public-inbox