Remove circular dependency between nf_nat module and nf_conntrack one moving bpf_ct_set_nat_info kfunc in nf_nat_bpf.c
Unified · Split
| @@ -4,6 +4,11 @@ · 3 unmodified lines | ||
| 4 | 4 | #define _NF_CONNTRACK_BPF_H |
| 5 | 5 | |
| 6 | 6 | #include <linux/kconfig.h> |
| 7 | +#include <net/netfilter/nf_conntrack.h> | |
| 8 | + | |
| 9 | +struct nf_conn___init { | |
| 10 | + struct nf_conn ct; | |
| 11 | +}; | |
| 7 | 12 | |
| 8 | 13 | #if (IS_BUILTIN(CONFIG_NF_CONNTRACK) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) || \ |
| 9 | 14 | (IS_MODULE(CONFIG_NF_CONNTRACK) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)) |
| @@ -24,4 +29,18 @@ static inline void cleanup_nf_conntrack_bpf(void) · 14 unmodified lines | ||
| 24 | 29 | |
| 25 | 30 | #endif |
| 26 | 31 | |
| 32 | +#if (IS_BUILTIN(CONFIG_NF_NAT) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) || \ | |
| 33 | + (IS_MODULE(CONFIG_NF_NAT) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)) | |
| 34 | + | |
| 35 | +extern int register_nf_nat_bpf(void); | |
| 36 | + | |
| 37 | +#else | |
| 38 | + | |
| 39 | +static inline int register_nf_nat_bpf(void) | |
| 40 | +{ | |
| 41 | + return 0; | |
| 42 | +} | |
| 43 | + | |
| 44 | +#endif | |
| 45 | + | |
| 27 | 46 | #endif /* _NF_CONNTRACK_BPF_H */ |
| @@ -60,6 +60,12 @@ obj-$(CONFIG_NF_NAT) += nf_nat.o · 59 unmodified lines | ||
| 60 | 60 | nf_nat-$(CONFIG_NF_NAT_REDIRECT) += nf_nat_redirect.o |
| 61 | 61 | nf_nat-$(CONFIG_NF_NAT_MASQUERADE) += nf_nat_masquerade.o |
| 62 | 62 | |
| 63 | +ifeq ($(CONFIG_NF_NAT),m) | |
| 64 | +nf_nat-$(CONFIG_DEBUG_INFO_BTF_MODULES) += nf_nat_bpf.o | |
| 65 | +else ifeq ($(CONFIG_NF_NAT),y) | |
| 66 | +nf_nat-$(CONFIG_DEBUG_INFO_BTF) += nf_nat_bpf.o | |
| 67 | +endif | |
| 68 | + | |
| 63 | 69 | # NAT helpers |
| 64 | 70 | obj-$(CONFIG_NF_NAT_AMANDA) += nf_nat_amanda.o |
| 65 | 71 | obj-$(CONFIG_NF_NAT_FTP) += nf_nat_ftp.o |
| @@ -14,10 +14,8 @@ · 13 unmodified lines | ||
| 14 | 14 | #include <linux/types.h> |
| 15 | 15 | #include <linux/btf_ids.h> |
| 16 | 16 | #include <linux/net_namespace.h> |
| 17 | −#include <net/netfilter/nf_conntrack.h> | |
| 18 | 17 | #include <net/netfilter/nf_conntrack_bpf.h> |
| 19 | 18 | #include <net/netfilter/nf_conntrack_core.h> |
| 20 | −#include <net/netfilter/nf_nat.h> | |
| 21 | 19 | |
| 22 | 20 | /* bpf_ct_opts - Options for CT lookup helpers |
| 23 | 21 | * |
| @@ -239,10 +237,6 @@ __diag_push(); · 215 unmodified lines | ||
| 239 | 237 | __diag_ignore_all("-Wmissing-prototypes", |
| 240 | 238 | "Global functions as their definitions will be in nf_conntrack BTF"); |
| 241 | 239 | |
| 242 | −struct nf_conn___init { | |
| 243 | − struct nf_conn ct; | |
| 244 | −}; | |
| 245 | − | |
| 246 | 240 | /* bpf_xdp_ct_alloc - Allocate a new CT entry |
| 247 | 241 | * |
| 248 | 242 | * Parameters: |
| @@ -476,49 +470,6 @@ int bpf_ct_change_status(struct nf_conn *nfct, u32 status) · 227 unmodified lines | ||
| 476 | 470 | return nf_ct_change_status_common(nfct, status); |
| 477 | 471 | } |
| 478 | 472 | |
| 479 | −/* bpf_ct_set_nat_info - Set source or destination nat address | |
| 480 | − * | |
| 481 | − * Set source or destination nat address of the newly allocated | |
| 482 | − * nf_conn before insertion. This must be invoked for referenced | |
| 483 | − * PTR_TO_BTF_ID to nf_conn___init. | |
| 484 | − * | |
| 485 | − * Parameters: | |
| 486 | − * @nfct - Pointer to referenced nf_conn object, obtained using | |
| 487 | − * bpf_xdp_ct_alloc or bpf_skb_ct_alloc. | |
| 488 | − * @addr - Nat source/destination address | |
| 489 | − * @port - Nat source/destination port. Non-positive values are | |
| 490 | − * interpreted as select a random port. | |
| 491 | − * @manip - NF_NAT_MANIP_SRC or NF_NAT_MANIP_DST | |
| 492 | − */ | |
| 493 | −int bpf_ct_set_nat_info(struct nf_conn___init *nfct, | |
| 494 | − union nf_inet_addr *addr, int port, | |
| 495 | − enum nf_nat_manip_type manip) | |
| 496 | −{ | |
| 497 | −#if ((IS_MODULE(CONFIG_NF_NAT) && IS_MODULE(CONFIG_NF_CONNTRACK)) || \ | |
| 498 | − IS_BUILTIN(CONFIG_NF_NAT)) | |
| 499 | − struct nf_conn *ct = (struct nf_conn *)nfct; | |
| 500 | − u16 proto = nf_ct_l3num(ct); | |
| 501 | − struct nf_nat_range2 range; | |
| 502 | − | |
| 503 | − if (proto != NFPROTO_IPV4 && proto != NFPROTO_IPV6) | |
| 504 | − return -EINVAL; | |
| 505 | − | |
| 506 | − memset(&range, 0, sizeof(struct nf_nat_range2)); | |
| 507 | − range.flags = NF_NAT_RANGE_MAP_IPS; | |
| 508 | − range.min_addr = *addr; | |
| 509 | − range.max_addr = range.min_addr; | |
| 510 | − if (port > 0) { | |
| 511 | − range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; | |
| 512 | − range.min_proto.all = cpu_to_be16(port); | |
| 513 | − range.max_proto.all = range.min_proto.all; | |
| 514 | − } | |
| 515 | − | |
| 516 | − return nf_nat_setup_info(ct, &range, manip) == NF_DROP ? -ENOMEM : 0; | |
| 517 | −#else | |
| 518 | − return -EOPNOTSUPP; | |
| 519 | −#endif | |
| 520 | −} | |
| 521 | − | |
| 522 | 473 | __diag_pop() |
| 523 | 474 | |
| 524 | 475 | BTF_SET8_START(nf_ct_kfunc_set) |
| @@ -532,7 +483,6 @@ BTF_ID_FLAGS(func, bpf_ct_set_timeout, KF_TRUSTED_ARGS) · 7 unmodified lines | ||
| 532 | 483 | BTF_ID_FLAGS(func, bpf_ct_change_timeout, KF_TRUSTED_ARGS) |
| 533 | 484 | BTF_ID_FLAGS(func, bpf_ct_set_status, KF_TRUSTED_ARGS) |
| 534 | 485 | BTF_ID_FLAGS(func, bpf_ct_change_status, KF_TRUSTED_ARGS) |
| 535 | −BTF_ID_FLAGS(func, bpf_ct_set_nat_info, KF_TRUSTED_ARGS) | |
| 536 | 486 | BTF_SET8_END(nf_ct_kfunc_set) |
| 537 | 487 | |
| 538 | 488 | static const struct btf_kfunc_id_set nf_conntrack_kfunc_set = { |
| @@ -0,0 +1,79 @@ | ||
| 1 | +// SPDX-License-Identifier: GPL-2.0-only | |
| 2 | +/* Unstable NAT Helpers for XDP and TC-BPF hook | |
| 3 | + * | |
| 4 | + * These are called from the XDP and SCHED_CLS BPF programs. Note that it is | |
| 5 | + * allowed to break compatibility for these functions since the interface they | |
| 6 | + * are exposed through to BPF programs is explicitly unstable. | |
| 7 | + */ | |
| 8 | + | |
| 9 | +#include <linux/bpf.h> | |
| 10 | +#include <linux/btf_ids.h> | |
| 11 | +#include <net/netfilter/nf_conntrack_bpf.h> | |
| 12 | +#include <net/netfilter/nf_conntrack_core.h> | |
| 13 | +#include <net/netfilter/nf_nat.h> | |
| 14 | + | |
| 15 | +__diag_push(); | |
| 16 | +__diag_ignore_all("-Wmissing-prototypes", | |
| 17 | + "Global functions as their definitions will be in nf_nat BTF"); | |
| 18 | + | |
| 19 | +/* bpf_ct_set_nat_info - Set source or destination nat address | |
| 20 | + * | |
| 21 | + * Set source or destination nat address of the newly allocated | |
| 22 | + * nf_conn before insertion. This must be invoked for referenced | |
| 23 | + * PTR_TO_BTF_ID to nf_conn___init. | |
| 24 | + * | |
| 25 | + * Parameters: | |
| 26 | + * @nfct - Pointer to referenced nf_conn object, obtained using | |
| 27 | + * bpf_xdp_ct_alloc or bpf_skb_ct_alloc. | |
| 28 | + * @addr - Nat source/destination address | |
| 29 | + * @port - Nat source/destination port. Non-positive values are | |
| 30 | + * interpreted as select a random port. | |
| 31 | + * @manip - NF_NAT_MANIP_SRC or NF_NAT_MANIP_DST | |
| 32 | + */ | |
| 33 | +int bpf_ct_set_nat_info(struct nf_conn___init *nfct, | |
| 34 | + union nf_inet_addr *addr, int port, | |
| 35 | + enum nf_nat_manip_type manip) | |
| 36 | +{ | |
| 37 | + struct nf_conn *ct = (struct nf_conn *)nfct; | |
| 38 | + u16 proto = nf_ct_l3num(ct); | |
| 39 | + struct nf_nat_range2 range; | |
| 40 | + | |
| 41 | + if (proto != NFPROTO_IPV4 && proto != NFPROTO_IPV6) | |
| 42 | + return -EINVAL; | |
| 43 | + | |
| 44 | + memset(&range, 0, sizeof(struct nf_nat_range2)); | |
| 45 | + range.flags = NF_NAT_RANGE_MAP_IPS; | |
| 46 | + range.min_addr = *addr; | |
| 47 | + range.max_addr = range.min_addr; | |
| 48 | + if (port > 0) { | |
| 49 | + range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; | |
| 50 | + range.min_proto.all = cpu_to_be16(port); | |
| 51 | + range.max_proto.all = range.min_proto.all; | |
| 52 | + } | |
| 53 | + | |
| 54 | + return nf_nat_setup_info(ct, &range, manip) == NF_DROP ? -ENOMEM : 0; | |
| 55 | +} | |
| 56 | + | |
| 57 | +__diag_pop() | |
| 58 | + | |
| 59 | +BTF_SET8_START(nf_nat_kfunc_set) | |
| 60 | +BTF_ID_FLAGS(func, bpf_ct_set_nat_info, KF_TRUSTED_ARGS) | |
| 61 | +BTF_SET8_END(nf_nat_kfunc_set) | |
| 62 | + | |
| 63 | +static const struct btf_kfunc_id_set nf_bpf_nat_kfunc_set = { | |
| 64 | + .owner = THIS_MODULE, | |
| 65 | + .set = &nf_nat_kfunc_set, | |
| 66 | +}; | |
| 67 | + | |
| 68 | +int register_nf_nat_bpf(void) | |
| 69 | +{ | |
| 70 | + int ret; | |
| 71 | + | |
| 72 | + ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP, | |
| 73 | + &nf_bpf_nat_kfunc_set); | |
| 74 | + if (ret) | |
| 75 | + return ret; | |
| 76 | + | |
| 77 | + return register_btf_kfunc_id_set(BPF_PROG_TYPE_SCHED_CLS, | |
| 78 | + &nf_bpf_nat_kfunc_set); | |
| 79 | +} | |
| @@ -16,7 +16,7 @@ · 15 unmodified lines | ||
| 16 | 16 | #include <linux/siphash.h> |
| 17 | 17 | #include <linux/rtnetlink.h> |
| 18 | 18 | |
| 19 | −#include <net/netfilter/nf_conntrack.h> | |
| 19 | +#include <net/netfilter/nf_conntrack_bpf.h> | |
| 20 | 20 | #include <net/netfilter/nf_conntrack_core.h> |
| 21 | 21 | #include <net/netfilter/nf_conntrack_helper.h> |
| 22 | 22 | #include <net/netfilter/nf_conntrack_seqadj.h> |
| @@ -1152,7 +1152,7 @@ static int __init nf_nat_init(void) · 1129 unmodified lines | ||
| 1152 | 1152 | WARN_ON(nf_nat_hook != NULL); |
| 1153 | 1153 | RCU_INIT_POINTER(nf_nat_hook, &nat_hook); |
| 1154 | 1154 | |
| 1155 | − return 0; | |
| 1155 | + return register_nf_nat_bpf(); | |
| 1156 | 1156 | } |
| 1157 | 1157 | |
| 1158 | 1158 | static void __exit nf_nat_cleanup(void) |