Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

[linux.git] / net / netfilter / nf_tables_offload.c

diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index c0d18c1d77ac05e0c9b1f98a33f2e18616bc3add..3c2725ade61b208170b0d897d7f003046fe52a7f 100644 (file)
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -182,24 +182,110 @@ static int nft_flow_offload_unbind(struct flow_block_offload *bo,
        return 0;
 }
 
+static int nft_block_setup(struct nft_base_chain *basechain,
+                          struct flow_block_offload *bo,
+                          enum flow_block_command cmd)
+{
+       int err;
+
+       switch (cmd) {
+       case FLOW_BLOCK_BIND:
+               err = nft_flow_offload_bind(bo, basechain);
+               break;
+       case FLOW_BLOCK_UNBIND:
+               err = nft_flow_offload_unbind(bo, basechain);
+               break;
+       default:
+               WARN_ON_ONCE(1);
+               err = -EOPNOTSUPP;
+       }
+
+       return err;
+}
+
+static int nft_block_offload_cmd(struct nft_base_chain *chain,
+                                struct net_device *dev,
+                                enum flow_block_command cmd)
+{
+       struct netlink_ext_ack extack = {};
+       struct flow_block_offload bo = {};
+       int err;
+
+       bo.net = dev_net(dev);
+       bo.block = &chain->flow_block;
+       bo.command = cmd;
+       bo.binder_type = FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
+       bo.extack = &extack;
+       INIT_LIST_HEAD(&bo.cb_list);
+
+       err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_BLOCK, &bo);
+       if (err < 0)
+               return err;
+
+       return nft_block_setup(chain, &bo, cmd);
+}
+
+static void nft_indr_block_ing_cmd(struct net_device *dev,
+                                  struct nft_base_chain *chain,
+                                  flow_indr_block_bind_cb_t *cb,
+                                  void *cb_priv,
+                                  enum flow_block_command cmd)
+{
+       struct netlink_ext_ack extack = {};
+       struct flow_block_offload bo = {};
+
+       if (!chain)
+               return;
+
+       bo.net = dev_net(dev);
+       bo.block = &chain->flow_block;
+       bo.command = cmd;
+       bo.binder_type = FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
+       bo.extack = &extack;
+       INIT_LIST_HEAD(&bo.cb_list);
+
+       cb(dev, cb_priv, TC_SETUP_BLOCK, &bo);
+
+       nft_block_setup(chain, &bo, cmd);
+}
+
+static int nft_indr_block_offload_cmd(struct nft_base_chain *chain,
+                                     struct net_device *dev,
+                                     enum flow_block_command cmd)
+{
+       struct flow_block_offload bo = {};
+       struct netlink_ext_ack extack = {};
+
+       bo.net = dev_net(dev);
+       bo.block = &chain->flow_block;
+       bo.command = cmd;
+       bo.binder_type = FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
+       bo.extack = &extack;
+       INIT_LIST_HEAD(&bo.cb_list);
+
+       flow_indr_block_call(dev, &bo, cmd);
+
+       if (list_empty(&bo.cb_list))
+               return -EOPNOTSUPP;
+
+       return nft_block_setup(chain, &bo, cmd);
+}
+
 #define FLOW_SETUP_BLOCK TC_SETUP_BLOCK
 
 static int nft_flow_offload_chain(struct nft_trans *trans,
                                  enum flow_block_command cmd)
 {
        struct nft_chain *chain = trans->ctx.chain;
-       struct netlink_ext_ack extack = {};
-       struct flow_block_offload bo = {};
        struct nft_base_chain *basechain;
        struct net_device *dev;
-       int err;
 
        if (!nft_is_base_chain(chain))
                return -EOPNOTSUPP;
 
        basechain = nft_base_chain(chain);
        dev = basechain->ops.dev;
-       if (!dev || !dev->netdev_ops->ndo_setup_tc)
+       if (!dev)
                return -EOPNOTSUPP;
 
        /* Only default policy to accept is supported for now. */
@@ -208,26 +294,10 @@ static int nft_flow_offload_chain(struct nft_trans *trans,
            nft_trans_chain_policy(trans) != NF_ACCEPT)
                return -EOPNOTSUPP;
 
-       bo.command = cmd;
-       bo.block = &basechain->flow_block;
-       bo.binder_type = FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
-       bo.extack = &extack;
-       INIT_LIST_HEAD(&bo.cb_list);
-
-       err = dev->netdev_ops->ndo_setup_tc(dev, FLOW_SETUP_BLOCK, &bo);
-       if (err < 0)
-               return err;
-
-       switch (cmd) {
-       case FLOW_BLOCK_BIND:
-               err = nft_flow_offload_bind(&bo, basechain);
-               break;
-       case FLOW_BLOCK_UNBIND:
-               err = nft_flow_offload_unbind(&bo, basechain);
-               break;
-       }
-
-       return err;
+       if (dev->netdev_ops->ndo_setup_tc)
+               return nft_block_offload_cmd(basechain, dev, cmd);
+       else
+               return nft_indr_block_offload_cmd(basechain, dev, cmd);
 }
 
 int nft_flow_rule_offload_commit(struct net *net)
@@ -277,3 +347,33 @@ int nft_flow_rule_offload_commit(struct net *net)
 
        return err;
 }
+
+void nft_indr_block_get_and_ing_cmd(struct net_device *dev,
+                                   flow_indr_block_bind_cb_t *cb,
+                                   void *cb_priv,
+                                   enum flow_block_command command)
+{
+       struct net *net = dev_net(dev);
+       const struct nft_table *table;
+       const struct nft_chain *chain;
+
+       list_for_each_entry_rcu(table, &net->nft.tables, list) {
+               if (table->family != NFPROTO_NETDEV)
+                       continue;
+
+               list_for_each_entry_rcu(chain, &table->chains, list) {
+                       if (nft_is_base_chain(chain)) {
+                               struct nft_base_chain *basechain;
+
+                               basechain = nft_base_chain(chain);
+                               if (!strncmp(basechain->dev_name, dev->name,
+                                            IFNAMSIZ)) {
+                                       nft_indr_block_ing_cmd(dev, basechain,
+                                                              cb, cb_priv,
+                                                              command);
+                                       return;
+                               }
+                       }
+               }
+       }
+}