net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c

Remove circular dependency between nf_nat module and nf_conntrack one moving bpf_ct_set_nat_info kfunc in nf_nat_bpf.c

Lorenzo Bianconi committed 4 years ago

Commit 820dc051 parent 736baae5 files · +106 −52Browse files

Unified · Split

5 files

include/net/netfilter/nf_conntrack_bpf.h +19 −0
net/netfilter/Makefile +6 −0
net/netfilter/nf_conntrack_bpf.c +0 −50
net/netfilter/nf_nat_bpf.c +79 −0
net/netfilter/nf_nat_core.c +2 −2

include/net/netfilter/nf_conntrack_bpf.h+19−0

@@ -4,6 +4,11 @@ · 3 unmodified lines
4	#define _NF_CONNTRACK_BPF_H	4	#define _NF_CONNTRACK_BPF_H
5		5
6	#include <linux/kconfig.h>	6	#include <linux/kconfig.h>
		7	#include <net/netfilter/nf_conntrack.h>
		8
		9	struct nf_conn___init {
		10	struct nf_conn ct;
		11	};
7		12
8	#if (IS_BUILTIN(CONFIG_NF_CONNTRACK) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) \|\| \	13	#if (IS_BUILTIN(CONFIG_NF_CONNTRACK) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) \|\| \
9	(IS_MODULE(CONFIG_NF_CONNTRACK) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES))	14	(IS_MODULE(CONFIG_NF_CONNTRACK) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES))
@@ -24,4 +29,18 @@ static inline void cleanup_nf_conntrack_bpf(void) · 14 unmodified lines
24		29
25	#endif	30	#endif
26		31
		32	#if (IS_BUILTIN(CONFIG_NF_NAT) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) \|\| \
		33	(IS_MODULE(CONFIG_NF_NAT) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES))
		34
		35	extern int register_nf_nat_bpf(void);
		36
		37	#else
		38
		39	static inline int register_nf_nat_bpf(void)
		40	{
		41	return 0;
		42	}
		43
		44	#endif
		45
27	#endif /* _NF_CONNTRACK_BPF_H */	46	#endif /* _NF_CONNTRACK_BPF_H */

net/netfilter/Makefile+6−0

 nf_nat-$(CONFIG_NF_NAT_REDIRECT) += nf_nat_redirect.o
 nf_nat-$(CONFIG_NF_NAT_MASQUERADE) += nf_nat_masquerade.o
+ifeq ($(CONFIG_NF_NAT),m)
+nf_nat-$(CONFIG_DEBUG_INFO_BTF_MODULES) += nf_nat_bpf.o
+else ifeq ($(CONFIG_NF_NAT),y)
+nf_nat-$(CONFIG_DEBUG_INFO_BTF) += nf_nat_bpf.o
+endif
 # NAT helpers
 obj-$(CONFIG_NF_NAT_AMANDA) += nf_nat_amanda.o
 obj-$(CONFIG_NF_NAT_FTP) += nf_nat_ftp.o

net/netfilter/nf_conntrack_bpf.c+0−50

@@ -14,10 +14,8 @@ · 13 unmodified lines
14	#include <linux/types.h>	14	#include <linux/types.h>
15	#include <linux/btf_ids.h>	15	#include <linux/btf_ids.h>
16	#include <linux/net_namespace.h>	16	#include <linux/net_namespace.h>
17	#include <net/netfilter/nf_conntrack.h>
18	#include <net/netfilter/nf_conntrack_bpf.h>	17	#include <net/netfilter/nf_conntrack_bpf.h>
19	#include <net/netfilter/nf_conntrack_core.h>	18	#include <net/netfilter/nf_conntrack_core.h>
20	#include <net/netfilter/nf_nat.h>
21		19
22	/* bpf_ct_opts - Options for CT lookup helpers	20	/* bpf_ct_opts - Options for CT lookup helpers
23	*	21	*
@@ -239,10 +237,6 @@ __diag_push(); · 215 unmodified lines
239	__diag_ignore_all("-Wmissing-prototypes",	237	__diag_ignore_all("-Wmissing-prototypes",
240	"Global functions as their definitions will be in nf_conntrack BTF");	238	"Global functions as their definitions will be in nf_conntrack BTF");
241		239
242	struct nf_conn___init {
243	struct nf_conn ct;
244	};
245
246	/* bpf_xdp_ct_alloc - Allocate a new CT entry	240	/* bpf_xdp_ct_alloc - Allocate a new CT entry
247	*	241	*
248	* Parameters:	242	* Parameters:
@@ -476,49 +470,6 @@ int bpf_ct_change_status(struct nf_conn *nfct, u32 status) · 227 unmodified lines
476	return nf_ct_change_status_common(nfct, status);	470	return nf_ct_change_status_common(nfct, status);
477	}	471	}
478		472
479	/* bpf_ct_set_nat_info - Set source or destination nat address
480	*
481	* Set source or destination nat address of the newly allocated
482	* nf_conn before insertion. This must be invoked for referenced
483	* PTR_TO_BTF_ID to nf_conn___init.
484	*
485	* Parameters:
486	* @nfct - Pointer to referenced nf_conn object, obtained using
487	* bpf_xdp_ct_alloc or bpf_skb_ct_alloc.
488	* @addr - Nat source/destination address
489	* @port - Nat source/destination port. Non-positive values are
490	* interpreted as select a random port.
491	* @manip - NF_NAT_MANIP_SRC or NF_NAT_MANIP_DST
492	*/
493	int bpf_ct_set_nat_info(struct nf_conn___init *nfct,
494	union nf_inet_addr *addr, int port,
495	enum nf_nat_manip_type manip)
496	{
497	#if ((IS_MODULE(CONFIG_NF_NAT) && IS_MODULE(CONFIG_NF_CONNTRACK)) \|\| \
498	IS_BUILTIN(CONFIG_NF_NAT))
499	struct nf_conn ct = (struct nf_conn )nfct;
500	u16 proto = nf_ct_l3num(ct);
501	struct nf_nat_range2 range;
502
503	if (proto != NFPROTO_IPV4 && proto != NFPROTO_IPV6)
504	return -EINVAL;
505
506	memset(&range, 0, sizeof(struct nf_nat_range2));
507	range.flags = NF_NAT_RANGE_MAP_IPS;
508	range.min_addr = *addr;
509	range.max_addr = range.min_addr;
510	if (port > 0) {
511	range.flags \|= NF_NAT_RANGE_PROTO_SPECIFIED;
512	range.min_proto.all = cpu_to_be16(port);
513	range.max_proto.all = range.min_proto.all;
514	}
515
516	return nf_nat_setup_info(ct, &range, manip) == NF_DROP ? -ENOMEM : 0;
517	#else
518	return -EOPNOTSUPP;
519	#endif
520	}
521
522	__diag_pop()	473	__diag_pop()
523		474
524	BTF_SET8_START(nf_ct_kfunc_set)	475	BTF_SET8_START(nf_ct_kfunc_set)
@@ -532,7 +483,6 @@ BTF_ID_FLAGS(func, bpf_ct_set_timeout, KF_TRUSTED_ARGS) · 7 unmodified lines
532	BTF_ID_FLAGS(func, bpf_ct_change_timeout, KF_TRUSTED_ARGS)	483	BTF_ID_FLAGS(func, bpf_ct_change_timeout, KF_TRUSTED_ARGS)
533	BTF_ID_FLAGS(func, bpf_ct_set_status, KF_TRUSTED_ARGS)	484	BTF_ID_FLAGS(func, bpf_ct_set_status, KF_TRUSTED_ARGS)
534	BTF_ID_FLAGS(func, bpf_ct_change_status, KF_TRUSTED_ARGS)	485	BTF_ID_FLAGS(func, bpf_ct_change_status, KF_TRUSTED_ARGS)
535	BTF_ID_FLAGS(func, bpf_ct_set_nat_info, KF_TRUSTED_ARGS)
536	BTF_SET8_END(nf_ct_kfunc_set)	486	BTF_SET8_END(nf_ct_kfunc_set)
537		487
538	static const struct btf_kfunc_id_set nf_conntrack_kfunc_set = {	488	static const struct btf_kfunc_id_set nf_conntrack_kfunc_set = {

net/netfilter/nf_nat_bpf.c+79−0

@@ -0,0 +1,79 @@
	1	// SPDX-License-Identifier: GPL-2.0-only
	2	/* Unstable NAT Helpers for XDP and TC-BPF hook
	3	*
	4	* These are called from the XDP and SCHED_CLS BPF programs. Note that it is
	5	* allowed to break compatibility for these functions since the interface they
	6	* are exposed through to BPF programs is explicitly unstable.
	7	*/
	8
	9	#include <linux/bpf.h>
	10	#include <linux/btf_ids.h>
	11	#include <net/netfilter/nf_conntrack_bpf.h>
	12	#include <net/netfilter/nf_conntrack_core.h>
	13	#include <net/netfilter/nf_nat.h>
	14
	15	__diag_push();
	16	__diag_ignore_all("-Wmissing-prototypes",
	17	"Global functions as their definitions will be in nf_nat BTF");
	18
	19	/* bpf_ct_set_nat_info - Set source or destination nat address
	20	*
	21	* Set source or destination nat address of the newly allocated
	22	* nf_conn before insertion. This must be invoked for referenced
	23	* PTR_TO_BTF_ID to nf_conn___init.
	24	*
	25	* Parameters:
	26	* @nfct - Pointer to referenced nf_conn object, obtained using
	27	* bpf_xdp_ct_alloc or bpf_skb_ct_alloc.
	28	* @addr - Nat source/destination address
	29	* @port - Nat source/destination port. Non-positive values are
	30	* interpreted as select a random port.
	31	* @manip - NF_NAT_MANIP_SRC or NF_NAT_MANIP_DST
	32	*/
	33	int bpf_ct_set_nat_info(struct nf_conn___init *nfct,
	34	union nf_inet_addr *addr, int port,
	35	enum nf_nat_manip_type manip)
	36	{
	37	struct nf_conn ct = (struct nf_conn )nfct;
	38	u16 proto = nf_ct_l3num(ct);
	39	struct nf_nat_range2 range;
	40
	41	if (proto != NFPROTO_IPV4 && proto != NFPROTO_IPV6)
	42	return -EINVAL;
	43
	44	memset(&range, 0, sizeof(struct nf_nat_range2));
	45	range.flags = NF_NAT_RANGE_MAP_IPS;
	46	range.min_addr = *addr;
	47	range.max_addr = range.min_addr;
	48	if (port > 0) {
	49	range.flags \|= NF_NAT_RANGE_PROTO_SPECIFIED;
	50	range.min_proto.all = cpu_to_be16(port);
	51	range.max_proto.all = range.min_proto.all;
	52	}
	53
	54	return nf_nat_setup_info(ct, &range, manip) == NF_DROP ? -ENOMEM : 0;
	55	}
	56
	57	__diag_pop()
	58
	59	BTF_SET8_START(nf_nat_kfunc_set)
	60	BTF_ID_FLAGS(func, bpf_ct_set_nat_info, KF_TRUSTED_ARGS)
	61	BTF_SET8_END(nf_nat_kfunc_set)
	62
	63	static const struct btf_kfunc_id_set nf_bpf_nat_kfunc_set = {
	64	.owner = THIS_MODULE,
	65	.set = &nf_nat_kfunc_set,
	66	};
	67
	68	int register_nf_nat_bpf(void)
	69	{
	70	int ret;
	71
	72	ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP,
	73	&nf_bpf_nat_kfunc_set);
	74	if (ret)
	75	return ret;
	76
	77	return register_btf_kfunc_id_set(BPF_PROG_TYPE_SCHED_CLS,
	78	&nf_bpf_nat_kfunc_set);
	79	}

net/netfilter/nf_nat_core.c+2−2

@@ -16,7 +16,7 @@ · 15 unmodified lines
16	#include <linux/siphash.h>	16	#include <linux/siphash.h>
17	#include <linux/rtnetlink.h>	17	#include <linux/rtnetlink.h>
18		18
19	#include <net/netfilter/nf_conntrack.h>	19	#include <net/netfilter/nf_conntrack_bpf.h>
20	#include <net/netfilter/nf_conntrack_core.h>	20	#include <net/netfilter/nf_conntrack_core.h>
21	#include <net/netfilter/nf_conntrack_helper.h>	21	#include <net/netfilter/nf_conntrack_helper.h>
22	#include <net/netfilter/nf_conntrack_seqadj.h>	22	#include <net/netfilter/nf_conntrack_seqadj.h>
@@ -1152,7 +1152,7 @@ static int __init nf_nat_init(void) · 1129 unmodified lines
1152	WARN_ON(nf_nat_hook != NULL);	1152	WARN_ON(nf_nat_hook != NULL);
1153	RCU_INIT_POINTER(nf_nat_hook, &nat_hook);	1153	RCU_INIT_POINTER(nf_nat_hook, &nat_hook);
1154		1154
1155	return 0;	1155	return register_nf_nat_bpf();
1156	}	1156	}
1157		1157
1158	static void __exit nf_nat_cleanup(void)	1158	static void __exit nf_nat_cleanup(void)

net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code