iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sfc: parse mangle actions (NAT) in conntrack entries

Browse Source 
The MAE can edit either address, L4 port, or both, for either source
 or destination.  These can't be mixed; i.e. it can edit source addr
 and source port, but not (say) source addr and dest port.

Reviewed-by: Pieter Jansen van Vuuren <pieter.jansen-van-vuuren@amd.com>
Signed-off-by: Edward Cree <ecree.xilinx@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Edward Cree 2023-10-10 22:51:59 +01:00 committed by David S. Miller
parent 4b714fd1a0
commit 38f9a08a3e
1 changed files with 89 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

91
drivers/net/ethernet/sfc/tc_conntrack.c
View File

@ -276,10 +276,84 @@ static int efx_tc_ct_parse_match(struct efx_nic *efx, struct flow_rule *fr,
return 0;
}
/**
* struct efx_tc_ct_mangler_state - tracks which fields have been pedited
*
* @ipv4: IP source or destination addr has been set
* @tcpudp: TCP/UDP source or destination port has been set
*/
struct efx_tc_ct_mangler_state {
u8 ipv4:1;
u8 tcpudp:1;
};
static int efx_tc_ct_mangle(struct efx_nic *efx, struct efx_tc_ct_entry *conn,
const struct flow_action_entry *fa,
struct efx_tc_ct_mangler_state *mung)
{
/* Is this the first mangle we've processed for this rule? */
bool first = !(mung->ipv4 || mung->tcpudp);
bool dnat = false;
switch (fa->mangle.htype) {
case FLOW_ACT_MANGLE_HDR_TYPE_IP4:
switch (fa->mangle.offset) {
case offsetof(struct iphdr, daddr):
dnat = true;
fallthrough;
case offsetof(struct iphdr, saddr):
if (fa->mangle.mask)
return -EOPNOTSUPP;
conn->nat_ip = htonl(fa->mangle.val);
mung->ipv4 = 1;
break;
default:
return -EOPNOTSUPP;
}
break;
case FLOW_ACT_MANGLE_HDR_TYPE_TCP:
case FLOW_ACT_MANGLE_HDR_TYPE_UDP:
/* Both struct tcphdr and struct udphdr start with
* __be16 source;
* __be16 dest;
* so we can use the same code for both.
*/
switch (fa->mangle.offset) {
case offsetof(struct tcphdr, dest):
BUILD_BUG_ON(offsetof(struct tcphdr, dest) !=
offsetof(struct udphdr, dest));
dnat = true;
fallthrough;
case offsetof(struct tcphdr, source):
BUILD_BUG_ON(offsetof(struct tcphdr, source) !=
offsetof(struct udphdr, source));
if (~fa->mangle.mask != 0xffff)
return -EOPNOTSUPP;
conn->l4_natport = htons(fa->mangle.val);
mung->tcpudp = 1;
break;
default:
return -EOPNOTSUPP;
}
break;
default:
return -EOPNOTSUPP;
}
/* first mangle tells us whether this is SNAT or DNAT;
* subsequent mangles must match that
*/
if (first)
conn->dnat = dnat;
else if (conn->dnat != dnat)
return -EOPNOTSUPP;
return 0;
}
static int efx_tc_ct_replace(struct efx_tc_ct_zone *ct_zone,
struct flow_cls_offload *tc)
{
struct flow_rule *fr = flow_cls_offload_flow_rule(tc);
struct efx_tc_ct_mangler_state mung = {};
struct efx_tc_ct_entry *conn, *old;
struct efx_nic *efx = ct_zone->efx;
const struct flow_action_entry *fa;
@ -326,6 +400,17 @@ static int efx_tc_ct_replace(struct efx_tc_ct_zone *ct_zone,
goto release;
}
break;
case FLOW_ACTION_MANGLE:
if (conn->eth_proto != htons(ETH_P_IP)) {
netif_dbg(efx, drv, efx->net_dev,
"NAT only supported for IPv4\n");
rc = -EOPNOTSUPP;
goto release;
}
rc = efx_tc_ct_mangle(efx, conn, fa, &mung);
if (rc)
goto release;
break;
default:
netif_dbg(efx, drv, efx->net_dev,
"Unhandled action %u for conntrack\n", fa->id);
@ -335,8 +420,10 @@ static int efx_tc_ct_replace(struct efx_tc_ct_zone *ct_zone,
}
/* fill in defaults for unmangled values */
conn->nat_ip = conn->dnat ? conn->dst_ip : conn->src_ip;
conn->l4_natport = conn->dnat ? conn->l4_dport : conn->l4_sport;
if (!mung.ipv4)
conn->nat_ip = conn->dnat ? conn->dst_ip : conn->src_ip;
if (!mung.tcpudp)
conn->l4_natport = conn->dnat ? conn->l4_dport : conn->l4_sport;
cnt = efx_tc_flower_allocate_counter(efx, EFX_TC_COUNTER_TYPE_CT);
if (IS_ERR(cnt)) {