* [PATCH nf-next v2 1/3] netfilter: nf_offload: refactor the nft_flow_offload_chain function
2019-09-04 7:07 [PATCH nf-next v2 0/3] netfilter: nf_tables_offload: clean offload things when the device unregister wenxu
@ 2019-09-04 7:07 ` wenxu
2019-09-04 7:07 ` [PATCH nf-next v2 2/3] netfilter: nf_offload: refactor the nft_flow_offload_rule function wenxu
2019-09-04 7:07 ` [PATCH nf-next v2 3/3] netfilter: nf_tables_offload: clean offload things when the device unregister wenxu
2 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-09-04 7:07 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel
From: wenxu <wenxu@ucloud.cn>
Refactor nft_flow_offload_chain and make it more common
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
net/netfilter/nf_tables_offload.c | 23 +++++++++++++++--------
1 file changed, 15 insertions(+), 8 deletions(-)
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 3f49fe8..9419486 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -273,10 +273,9 @@ static int nft_indr_block_offload_cmd(struct nft_base_chain *chain,
#define FLOW_SETUP_BLOCK TC_SETUP_BLOCK
-static int nft_flow_offload_chain(struct nft_trans *trans,
+static int nft_flow_offload_chain(struct nft_chain *chain,
enum flow_block_command cmd)
{
- struct nft_chain *chain = trans->ctx.chain;
struct nft_base_chain *basechain;
struct net_device *dev;
@@ -288,16 +287,24 @@ static int nft_flow_offload_chain(struct nft_trans *trans,
if (!dev)
return -EOPNOTSUPP;
+ if (dev->netdev_ops->ndo_setup_tc)
+ return nft_block_offload_cmd(basechain, dev, cmd);
+ else
+ return nft_indr_block_offload_cmd(basechain, dev, cmd);
+}
+
+static int nft_flow_offload_chain_commit(struct nft_trans *trans,
+ enum flow_block_command cmd)
+{
+ struct nft_chain *chain = trans->ctx.chain;
+
/* Only default policy to accept is supported for now. */
if (cmd == FLOW_BLOCK_BIND &&
nft_trans_chain_policy(trans) != -1 &&
nft_trans_chain_policy(trans) != NF_ACCEPT)
return -EOPNOTSUPP;
- if (dev->netdev_ops->ndo_setup_tc)
- return nft_block_offload_cmd(basechain, dev, cmd);
- else
- return nft_indr_block_offload_cmd(basechain, dev, cmd);
+ return nft_flow_offload_chain(chain, cmd);
}
int nft_flow_rule_offload_commit(struct net *net)
@@ -314,13 +321,13 @@ int nft_flow_rule_offload_commit(struct net *net)
if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
continue;
- err = nft_flow_offload_chain(trans, FLOW_BLOCK_BIND);
+ err = nft_flow_offload_chain_commit(trans, FLOW_BLOCK_BIND);
break;
case NFT_MSG_DELCHAIN:
if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
continue;
- err = nft_flow_offload_chain(trans, FLOW_BLOCK_UNBIND);
+ err = nft_flow_offload_chain_commit(trans, FLOW_BLOCK_UNBIND);
break;
case NFT_MSG_NEWRULE:
if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH nf-next v2 2/3] netfilter: nf_offload: refactor the nft_flow_offload_rule function
2019-09-04 7:07 [PATCH nf-next v2 0/3] netfilter: nf_tables_offload: clean offload things when the device unregister wenxu
2019-09-04 7:07 ` [PATCH nf-next v2 1/3] netfilter: nf_offload: refactor the nft_flow_offload_chain function wenxu
@ 2019-09-04 7:07 ` wenxu
2019-09-04 7:07 ` [PATCH nf-next v2 3/3] netfilter: nf_tables_offload: clean offload things when the device unregister wenxu
2 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-09-04 7:07 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel
From: wenxu <wenxu@ucloud.cn>
Refactor nft_flow_offload_rule and make it more common
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
net/netfilter/nf_tables_offload.c | 24 +++++++++++++++++-------
1 file changed, 17 insertions(+), 7 deletions(-)
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 9419486..9657001 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -134,20 +134,20 @@ int nft_chain_offload_priority(struct nft_base_chain *basechain)
return 0;
}
-static int nft_flow_offload_rule(struct nft_trans *trans,
+static int nft_flow_offload_rule(struct nft_chain *chain,
+ struct nft_rule *rule,
+ struct nft_flow_rule *flow,
enum flow_cls_command command)
{
- struct nft_flow_rule *flow = nft_trans_flow_rule(trans);
- struct nft_rule *rule = nft_trans_rule(trans);
struct flow_cls_offload cls_flow = {};
struct nft_base_chain *basechain;
struct netlink_ext_ack extack;
__be16 proto = ETH_P_ALL;
- if (!nft_is_base_chain(trans->ctx.chain))
+ if (!nft_is_base_chain(chain))
return -EOPNOTSUPP;
- basechain = nft_base_chain(trans->ctx.chain);
+ basechain = nft_base_chain(chain);
if (flow)
proto = flow->proto;
@@ -162,6 +162,16 @@ static int nft_flow_offload_rule(struct nft_trans *trans,
return nft_setup_cb_call(basechain, TC_SETUP_CLSFLOWER, &cls_flow);
}
+static int nft_flow_offload_rule_commit(struct nft_trans *trans,
+ enum flow_cls_command command)
+{
+ struct nft_flow_rule *flow = nft_trans_flow_rule(trans);
+ struct nft_rule *rule = nft_trans_rule(trans);
+ struct nft_chain *chain = trans->ctx.chain;
+
+ return nft_flow_offload_rule(chain, rule, flow, command);
+}
+
static int nft_flow_offload_bind(struct flow_block_offload *bo,
struct nft_base_chain *basechain)
{
@@ -337,14 +347,14 @@ int nft_flow_rule_offload_commit(struct net *net)
!(trans->ctx.flags & NLM_F_APPEND))
return -EOPNOTSUPP;
- err = nft_flow_offload_rule(trans, FLOW_CLS_REPLACE);
+ err = nft_flow_offload_rule_commit(trans, FLOW_CLS_REPLACE);
nft_flow_rule_destroy(nft_trans_flow_rule(trans));
break;
case NFT_MSG_DELRULE:
if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
continue;
- err = nft_flow_offload_rule(trans, FLOW_CLS_DESTROY);
+ err = nft_flow_offload_rule_commit(trans, FLOW_CLS_DESTROY);
break;
}
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH nf-next v2 3/3] netfilter: nf_tables_offload: clean offload things when the device unregister
2019-09-04 7:07 [PATCH nf-next v2 0/3] netfilter: nf_tables_offload: clean offload things when the device unregister wenxu
2019-09-04 7:07 ` [PATCH nf-next v2 1/3] netfilter: nf_offload: refactor the nft_flow_offload_chain function wenxu
2019-09-04 7:07 ` [PATCH nf-next v2 2/3] netfilter: nf_offload: refactor the nft_flow_offload_rule function wenxu
@ 2019-09-04 7:07 ` wenxu
2019-09-04 19:40 ` Pablo Neira Ayuso
2 siblings, 1 reply; 6+ messages in thread
From: wenxu @ 2019-09-04 7:07 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel
From: wenxu <wenxu@ucloud.cn>
When the net_device unregister, the netdevice_notifier will release
the related netdev basedchain and rules in this chains. So it is also
need to clean the offload things before the chain is destroy.
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
include/net/netfilter/nf_tables_offload.h | 2 +-
net/netfilter/nf_tables_api.c | 9 ++++-
net/netfilter/nf_tables_offload.c | 63 ++++++++++++++++++++++++++++++-
3 files changed, 70 insertions(+), 4 deletions(-)
diff --git a/include/net/netfilter/nf_tables_offload.h b/include/net/netfilter/nf_tables_offload.h
index 643152f..acb6621 100644
--- a/include/net/netfilter/nf_tables_offload.h
+++ b/include/net/netfilter/nf_tables_offload.h
@@ -80,7 +80,7 @@ void nft_indr_block_get_and_ing_cmd(struct net_device *dev,
int nft_chain_offload_priority(struct nft_base_chain *basechain);
-void nft_offload_init(void);
+int nft_offload_init(void);
void nft_offload_exit(void);
#endif
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index a3d7e82..3c64b32 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -7691,15 +7691,20 @@ static int __init nf_tables_module_init(void)
if (err < 0)
goto err4;
+ err = nft_offload_init();
+ if (err < 0)
+ goto err5;
+
/* must be last */
err = nfnetlink_subsys_register(&nf_tables_subsys);
if (err < 0)
- goto err5;
+ goto err6;
nft_chain_route_init();
- nft_offload_init();
return err;
+err6:
+ nft_offload_exit();
err5:
rhltable_destroy(&nft_objname_ht);
err4:
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 9657001..9fa3bdb 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -396,17 +396,78 @@ static void nft_indr_block_cb(struct net_device *dev,
mutex_unlock(&net->nft.commit_mutex);
}
+static void nft_offload_chain_clean(struct nft_chain *chain)
+{
+ struct nft_rule *rule;
+
+ list_for_each_entry(rule, &chain->rules, list) {
+ nft_flow_offload_rule(chain, rule,
+ NULL, FLOW_CLS_DESTROY);
+ }
+
+ nft_flow_offload_chain(chain, FLOW_BLOCK_UNBIND);
+}
+
+static int nft_offload_netdev_event(struct notifier_block *this,
+ unsigned long event, void *ptr)
+{
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+ struct nft_base_chain *basechain;
+ struct net *net = dev_net(dev);
+ struct nft_table *table;
+ struct nft_chain *chain;
+
+ if (event != NETDEV_UNREGISTER)
+ return NOTIFY_DONE;
+
+ mutex_lock(&net->nft.commit_mutex);
+ list_for_each_entry(table, &net->nft.tables, list) {
+ if (table->family != NFPROTO_NETDEV)
+ continue;
+
+ list_for_each_entry(chain, &table->chains, list) {
+ if (!nft_is_base_chain(chain) ||
+ !(chain->flags & NFT_CHAIN_HW_OFFLOAD))
+ continue;
+
+ basechain = nft_base_chain(chain);
+ if (strncmp(basechain->dev_name, dev->name, IFNAMSIZ))
+ continue;
+
+ nft_offload_chain_clean(chain);
+ mutex_unlock(&net->nft.commit_mutex);
+ return NOTIFY_DONE;
+ }
+ }
+ mutex_unlock(&net->nft.commit_mutex);
+
+ return NOTIFY_DONE;
+}
+
static struct flow_indr_block_ing_entry block_ing_entry = {
.cb = nft_indr_block_cb,
.list = LIST_HEAD_INIT(block_ing_entry.list),
};
-void nft_offload_init(void)
+static struct notifier_block nft_offload_netdev_notifier = {
+ .notifier_call = nft_offload_netdev_event,
+};
+
+int nft_offload_init(void)
{
+ int err;
+
+ err = register_netdevice_notifier(&nft_offload_netdev_notifier);
+ if (err < 0)
+ return err;
+
flow_indr_add_block_ing_cb(&block_ing_entry);
+
+ return 0;
}
void nft_offload_exit(void)
{
flow_indr_del_block_ing_cb(&block_ing_entry);
+ unregister_netdevice_notifier(&nft_offload_netdev_notifier);
}
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH nf-next v2 3/3] netfilter: nf_tables_offload: clean offload things when the device unregister
2019-09-04 7:07 ` [PATCH nf-next v2 3/3] netfilter: nf_tables_offload: clean offload things when the device unregister wenxu
@ 2019-09-04 19:40 ` Pablo Neira Ayuso
2019-09-05 3:26 ` wenxu
0 siblings, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2019-09-04 19:40 UTC (permalink / raw)
To: wenxu; +Cc: netfilter-devel
Thanks for working on this.
On Wed, Sep 04, 2019 at 03:07:31PM +0800, wenxu@ucloud.cn wrote:
> diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
> index 9657001..9fa3bdb 100644
> --- a/net/netfilter/nf_tables_offload.c
> +++ b/net/netfilter/nf_tables_offload.c
> @@ -396,17 +396,78 @@ static void nft_indr_block_cb(struct net_device *dev,
> mutex_unlock(&net->nft.commit_mutex);
> }
>
> +static void nft_offload_chain_clean(struct nft_chain *chain)
> +{
> + struct nft_rule *rule;
> +
> + list_for_each_entry(rule, &chain->rules, list) {
> + nft_flow_offload_rule(chain, rule,
> + NULL, FLOW_CLS_DESTROY);
> + }
> +
> + nft_flow_offload_chain(chain, FLOW_BLOCK_UNBIND);
> +}
> +
> +static int nft_offload_netdev_event(struct notifier_block *this,
> + unsigned long event, void *ptr)
> +{
> + struct net_device *dev = netdev_notifier_info_to_dev(ptr);
> + struct nft_base_chain *basechain;
> + struct net *net = dev_net(dev);
> + struct nft_table *table;
> + struct nft_chain *chain;
> +
> + if (event != NETDEV_UNREGISTER)
> + return NOTIFY_DONE;
> +
> + mutex_lock(&net->nft.commit_mutex);
> + list_for_each_entry(table, &net->nft.tables, list) {
> + if (table->family != NFPROTO_NETDEV)
> + continue;
> +
> + list_for_each_entry(chain, &table->chains, list) {
> + if (!nft_is_base_chain(chain) ||
> + !(chain->flags & NFT_CHAIN_HW_OFFLOAD))
> + continue;
> +
> + basechain = nft_base_chain(chain);
> + if (strncmp(basechain->dev_name, dev->name, IFNAMSIZ))
> + continue;
> +
> + nft_offload_chain_clean(chain);
> + mutex_unlock(&net->nft.commit_mutex);
> + return NOTIFY_DONE;
> + }
> + }
> + mutex_unlock(&net->nft.commit_mutex);
This code around the mutex look very similar to nft_block_indr_cb(),
could you consolidate this? Probably something like
nft_offload_netdev_iterate() and add a callback.
> + return NOTIFY_DONE;
> +}
> +
> static struct flow_indr_block_ing_entry block_ing_entry = {
> .cb = nft_indr_block_cb,
> .list = LIST_HEAD_INIT(block_ing_entry.list),
> };
>
> -void nft_offload_init(void)
> +static struct notifier_block nft_offload_netdev_notifier = {
> + .notifier_call = nft_offload_netdev_event,
No need for priority because of registration order, right?
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH nf-next v2 3/3] netfilter: nf_tables_offload: clean offload things when the device unregister
2019-09-04 19:40 ` Pablo Neira Ayuso
@ 2019-09-05 3:26 ` wenxu
0 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-09-05 3:26 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
On 9/5/2019 3:40 AM, Pablo Neira Ayuso wrote:
> Thanks for working on this.
>
> On Wed, Sep 04, 2019 at 03:07:31PM +0800, wenxu@ucloud.cn wrote:
>> diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
>> index 9657001..9fa3bdb 100644
>> --- a/net/netfilter/nf_tables_offload.c
>> +++ b/net/netfilter/nf_tables_offload.c
>> @@ -396,17 +396,78 @@ static void nft_indr_block_cb(struct net_device *dev,
>> mutex_unlock(&net->nft.commit_mutex);
>> }
>>
>> +static void nft_offload_chain_clean(struct nft_chain *chain)
>> +{
>> + struct nft_rule *rule;
>> +
>> + list_for_each_entry(rule, &chain->rules, list) {
>> + nft_flow_offload_rule(chain, rule,
>> + NULL, FLOW_CLS_DESTROY);
>> + }
>> +
>> + nft_flow_offload_chain(chain, FLOW_BLOCK_UNBIND);
>> +}
>> +
>> +static int nft_offload_netdev_event(struct notifier_block *this,
>> + unsigned long event, void *ptr)
>> +{
>> + struct net_device *dev = netdev_notifier_info_to_dev(ptr);
>> + struct nft_base_chain *basechain;
>> + struct net *net = dev_net(dev);
>> + struct nft_table *table;
>> + struct nft_chain *chain;
>> +
>> + if (event != NETDEV_UNREGISTER)
>> + return NOTIFY_DONE;
>> +
>> + mutex_lock(&net->nft.commit_mutex);
>> + list_for_each_entry(table, &net->nft.tables, list) {
>> + if (table->family != NFPROTO_NETDEV)
>> + continue;
>> +
>> + list_for_each_entry(chain, &table->chains, list) {
>> + if (!nft_is_base_chain(chain) ||
>> + !(chain->flags & NFT_CHAIN_HW_OFFLOAD))
>> + continue;
>> +
>> + basechain = nft_base_chain(chain);
>> + if (strncmp(basechain->dev_name, dev->name, IFNAMSIZ))
>> + continue;
>> +
>> + nft_offload_chain_clean(chain);
>> + mutex_unlock(&net->nft.commit_mutex);
>> + return NOTIFY_DONE;
>> + }
>> + }
>> + mutex_unlock(&net->nft.commit_mutex);
> This code around the mutex look very similar to nft_block_indr_cb(),
> could you consolidate this? Probably something like
> nft_offload_netdev_iterate() and add a callback.
nft_offload_netdev_iterate is a good idear, But maybe it can't provide
a common callback. The nft_offload_netdev_iterate(without mutex) can return the chain
amke each function(with mutex) use it
>
>> + return NOTIFY_DONE;
>> +}
>> +
>> static struct flow_indr_block_ing_entry block_ing_entry = {
>> .cb = nft_indr_block_cb,
>> .list = LIST_HEAD_INIT(block_ing_entry.list),
>> };
>>
>> -void nft_offload_init(void)
>> +static struct notifier_block nft_offload_netdev_notifier = {
>> + .notifier_call = nft_offload_netdev_event,
> No need for priority because of registration order, right?
yes, nft_offload_init will early than nft_chain_filter mod init
>
^ permalink raw reply [flat|nested] 6+ messages in thread