net/netfilter/nf_tables_offload.c

   1 /* SPDX-License-Identifier: GPL-2.0 */
   2 #include <linux/init.h>
   3 #include <linux/module.h>
   4 #include <linux/netfilter.h>
   5 #include <net/flow_offload.h>
   6 #include <net/netfilter/nf_tables.h>
   7 #include <net/netfilter/nf_tables_offload.h>
   8 #include <net/pkt_cls.h>
   9
  10 static struct nft_flow_rule *nft_flow_rule_alloc(int num_actions)
  11 {
  12         struct nft_flow_rule *flow;
  13
  14         flow = kzalloc(sizeof(struct nft_flow_rule), GFP_KERNEL);
  15         if (!flow)
  16                 return NULL;
  17
  18         flow->rule = flow_rule_alloc(num_actions);
  19         if (!flow->rule) {
  20                 kfree(flow);
  21                 return NULL;
  22         }
  23
  24         flow->rule->match.dissector     = &flow->match.dissector;
  25         flow->rule->match.mask          = &flow->match.mask;
  26         flow->rule->match.key           = &flow->match.key;
  27
  28         return flow;
  29 }
  30
  31 struct nft_flow_rule *nft_flow_rule_create(const struct nft_rule *rule)
  32 {
  33         struct nft_offload_ctx ctx = {
  34                 .dep    = {
  35                         .type   = NFT_OFFLOAD_DEP_UNSPEC,
  36                 },
  37         };
  38         struct nft_flow_rule *flow;
  39         int num_actions = 0, err;
  40         struct nft_expr *expr;
  41
  42         expr = nft_expr_first(rule);
  43         while (expr->ops && expr != nft_expr_last(rule)) {
  44                 if (expr->ops->offload_flags & NFT_OFFLOAD_F_ACTION)
  45                         num_actions++;
  46
  47                 expr = nft_expr_next(expr);
  48         }
  49
  50         flow = nft_flow_rule_alloc(num_actions);
  51         if (!flow)
  52                 return ERR_PTR(-ENOMEM);
  53
  54         expr = nft_expr_first(rule);
  55         while (expr->ops && expr != nft_expr_last(rule)) {
  56                 if (!expr->ops->offload) {
  57                         err = -EOPNOTSUPP;
  58                         goto err_out;
  59                 }
  60                 err = expr->ops->offload(&ctx, flow, expr);
  61                 if (err < 0)
  62                         goto err_out;
  63
  64                 expr = nft_expr_next(expr);
  65         }
  66         flow->proto = ctx.dep.l3num;
  67
  68         return flow;
  69 err_out:
  70         nft_flow_rule_destroy(flow);
  71
  72         return ERR_PTR(err);
  73 }
  74
  75 void nft_flow_rule_destroy(struct nft_flow_rule *flow)
  76 {
  77         kfree(flow->rule);
  78         kfree(flow);
  79 }
  80
  81 void nft_offload_set_dependency(struct nft_offload_ctx *ctx,
  82                                 enum nft_offload_dep_type type)
  83 {
  84         ctx->dep.type = type;
  85 }
  86
  87 void nft_offload_update_dependency(struct nft_offload_ctx *ctx,
  88                                    const void *data, u32 len)
  89 {
  90         switch (ctx->dep.type) {
  91         case NFT_OFFLOAD_DEP_NETWORK:
  92                 WARN_ON(len != sizeof(__u16));
  93                 memcpy(&ctx->dep.l3num, data, sizeof(__u16));
  94                 break;
  95         case NFT_OFFLOAD_DEP_TRANSPORT:
  96                 WARN_ON(len != sizeof(__u8));
  97                 memcpy(&ctx->dep.protonum, data, sizeof(__u8));
  98                 break;
  99         default:
 100                 break;
 101         }
 102         ctx->dep.type = NFT_OFFLOAD_DEP_UNSPEC;
 103 }
 104
 105 static void nft_flow_offload_common_init(struct flow_cls_common_offload *common,
 106                                          __be16 proto, int priority,
 107                                          struct netlink_ext_ack *extack)
 108 {
 109         common->protocol = proto;
 110         common->prio = priority;
 111         common->extack = extack;
 112 }
 113
 114 static int nft_setup_cb_call(struct nft_base_chain *basechain,
 115                              enum tc_setup_type type, void *type_data)
 116 {
 117         struct flow_block_cb *block_cb;
 118         int err;
 119
 120         list_for_each_entry(block_cb, &basechain->flow_block.cb_list, list) {
 121                 err = block_cb->cb(type, type_data, block_cb->cb_priv);
 122                 if (err < 0)
 123                         return err;
 124         }
 125         return 0;
 126 }
 127
 128 int nft_chain_offload_priority(struct nft_base_chain *basechain)
 129 {
 130         if (basechain->ops.priority <= 0 ||
 131             basechain->ops.priority > USHRT_MAX)
 132                 return -1;
 133
 134         return 0;
 135 }
 136
 137 static int nft_flow_offload_rule(struct nft_trans *trans,
 138                                  enum flow_cls_command command)
 139 {
 140         struct nft_flow_rule *flow = nft_trans_flow_rule(trans);
 141         struct nft_rule *rule = nft_trans_rule(trans);
 142         struct flow_cls_offload cls_flow = {};
 143         struct nft_base_chain *basechain;
 144         struct netlink_ext_ack extack;
 145         __be16 proto = ETH_P_ALL;
 146
 147         if (!nft_is_base_chain(trans->ctx.chain))
 148                 return -EOPNOTSUPP;
 149
 150         basechain = nft_base_chain(trans->ctx.chain);
 151
 152         if (flow)
 153                 proto = flow->proto;
 154
 155         nft_flow_offload_common_init(&cls_flow.common, proto,
 156                                      basechain->ops.priority, &extack);
 157         cls_flow.command = command;
 158         cls_flow.cookie = (unsigned long) rule;
 159         if (flow)
 160                 cls_flow.rule = flow->rule;
 161
 162         return nft_setup_cb_call(basechain, TC_SETUP_CLSFLOWER, &cls_flow);
 163 }
 164
 165 static int nft_flow_offload_bind(struct flow_block_offload *bo,
 166                                  struct nft_base_chain *basechain)
 167 {
 168         list_splice(&bo->cb_list, &basechain->flow_block.cb_list);
 169         return 0;
 170 }
 171
 172 static int nft_flow_offload_unbind(struct flow_block_offload *bo,
 173                                    struct nft_base_chain *basechain)
 174 {
 175         struct flow_block_cb *block_cb, *next;
 176
 177         list_for_each_entry_safe(block_cb, next, &bo->cb_list, list) {
 178                 list_del(&block_cb->list);
 179                 flow_block_cb_free(block_cb);
 180         }
 181
 182         return 0;
 183 }
 184
 185 static int nft_block_setup(struct nft_base_chain *basechain,
 186                            struct flow_block_offload *bo,
 187                            enum flow_block_command cmd)
 188 {
 189         int err;
 190
 191         switch (cmd) {
 192         case FLOW_BLOCK_BIND:
 193                 err = nft_flow_offload_bind(bo, basechain);
 194                 break;
 195         case FLOW_BLOCK_UNBIND:
 196                 err = nft_flow_offload_unbind(bo, basechain);
 197                 break;
 198         default:
 199                 WARN_ON_ONCE(1);
 200                 err = -EOPNOTSUPP;
 201         }
 202
 203         return err;
 204 }
 205
 206 static int nft_block_offload_cmd(struct nft_base_chain *chain,
 207                                  struct net_device *dev,
 208                                  enum flow_block_command cmd)
 209 {
 210         struct netlink_ext_ack extack = {};
 211         struct flow_block_offload bo = {};
 212         int err;
 213
 214         bo.net = dev_net(dev);
 215         bo.block = &chain->flow_block;
 216         bo.command = cmd;
 217         bo.binder_type = FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
 218         bo.extack = &extack;
 219         INIT_LIST_HEAD(&bo.cb_list);
 220
 221         err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_BLOCK, &bo);
 222         if (err < 0)
 223                 return err;
 224
 225         return nft_block_setup(chain, &bo, cmd);
 226 }
 227
 228 static void nft_indr_block_ing_cmd(struct net_device *dev,
 229                                    struct nft_base_chain *chain,
 230                                    flow_indr_block_bind_cb_t *cb,
 231                                    void *cb_priv,
 232                                    enum flow_block_command cmd)
 233 {
 234         struct netlink_ext_ack extack = {};
 235         struct flow_block_offload bo = {};
 236
 237         if (!chain)
 238                 return;
 239
 240         bo.net = dev_net(dev);
 241         bo.block = &chain->flow_block;
 242         bo.command = cmd;
 243         bo.binder_type = FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
 244         bo.extack = &extack;
 245         INIT_LIST_HEAD(&bo.cb_list);
 246
 247         cb(dev, cb_priv, TC_SETUP_BLOCK, &bo);
 248
 249         nft_block_setup(chain, &bo, cmd);
 250 }
 251
 252 static int nft_indr_block_offload_cmd(struct nft_base_chain *chain,
 253                                       struct net_device *dev,
 254                                       enum flow_block_command cmd)
 255 {
 256         struct flow_block_offload bo = {};
 257         struct netlink_ext_ack extack = {};
 258
 259         bo.net = dev_net(dev);
 260         bo.block = &chain->flow_block;
 261         bo.command = cmd;
 262         bo.binder_type = FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
 263         bo.extack = &extack;
 264         INIT_LIST_HEAD(&bo.cb_list);
 265
 266         flow_indr_block_call(dev, &bo, cmd);
 267
 268         if (list_empty(&bo.cb_list))
 269                 return -EOPNOTSUPP;
 270
 271         return nft_block_setup(chain, &bo, cmd);
 272 }
 273
 274 #define FLOW_SETUP_BLOCK TC_SETUP_BLOCK
 275
 276 static int nft_flow_offload_chain(struct nft_trans *trans,
 277                                   enum flow_block_command cmd)
 278 {
 279         struct nft_chain *chain = trans->ctx.chain;
 280         struct nft_base_chain *basechain;
 281         struct net_device *dev;
 282
 283         if (!nft_is_base_chain(chain))
 284                 return -EOPNOTSUPP;
 285
 286         basechain = nft_base_chain(chain);
 287         dev = basechain->ops.dev;
 288         if (!dev)
 289                 return -EOPNOTSUPP;
 290
 291         /* Only default policy to accept is supported for now. */
 292         if (cmd == FLOW_BLOCK_BIND &&
 293             nft_trans_chain_policy(trans) != -1 &&
 294             nft_trans_chain_policy(trans) != NF_ACCEPT)
 295                 return -EOPNOTSUPP;
 296
 297         if (dev->netdev_ops->ndo_setup_tc)
 298                 return nft_block_offload_cmd(basechain, dev, cmd);
 299         else
 300                 return nft_indr_block_offload_cmd(basechain, dev, cmd);
 301 }
 302
 303 int nft_flow_rule_offload_commit(struct net *net)
 304 {
 305         struct nft_trans *trans;
 306         int err = 0;
 307
 308         list_for_each_entry(trans, &net->nft.commit_list, list) {
 309                 if (trans->ctx.family != NFPROTO_NETDEV)
 310                         continue;
 311
 312                 switch (trans->msg_type) {
 313                 case NFT_MSG_NEWCHAIN:
 314                         if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
 315                                 continue;
 316
 317                         err = nft_flow_offload_chain(trans, FLOW_BLOCK_BIND);
 318                         break;
 319                 case NFT_MSG_DELCHAIN:
 320                         if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
 321                                 continue;
 322
 323                         err = nft_flow_offload_chain(trans, FLOW_BLOCK_UNBIND);
 324                         break;
 325                 case NFT_MSG_NEWRULE:
 326                         if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
 327                                 continue;
 328
 329                         if (trans->ctx.flags & NLM_F_REPLACE ||
 330                             !(trans->ctx.flags & NLM_F_APPEND))
 331                                 return -EOPNOTSUPP;
 332
 333                         err = nft_flow_offload_rule(trans, FLOW_CLS_REPLACE);
 334                         nft_flow_rule_destroy(nft_trans_flow_rule(trans));
 335                         break;
 336                 case NFT_MSG_DELRULE:
 337                         if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
 338                                 continue;
 339
 340                         err = nft_flow_offload_rule(trans, FLOW_CLS_DESTROY);
 341                         break;
 342                 }
 343
 344                 if (err)
 345                         return err;
 346         }
 347
 348         return err;
 349 }
 350
 351 void nft_indr_block_get_and_ing_cmd(struct net_device *dev,
 352                                     flow_indr_block_bind_cb_t *cb,
 353                                     void *cb_priv,
 354                                     enum flow_block_command command)
 355 {
 356         struct net *net = dev_net(dev);
 357         const struct nft_table *table;
 358         const struct nft_chain *chain;
 359
 360         list_for_each_entry_rcu(table, &net->nft.tables, list) {
 361                 if (table->family != NFPROTO_NETDEV)
 362                         continue;
 363
 364                 list_for_each_entry_rcu(chain, &table->chains, list) {
 365                         if (nft_is_base_chain(chain)) {
 366                                 struct nft_base_chain *basechain;
 367
 368                                 basechain = nft_base_chain(chain);
 369                                 if (!strncmp(basechain->dev_name, dev->name,
 370                                              IFNAMSIZ)) {
 371                                         nft_indr_block_ing_cmd(dev, basechain,
 372                                                                cb, cb_priv,
 373                                                                command);
 374                                         return;
 375                                 }
 376                         }
 377                 }
 378         }
 379 }