diff options
author | 2020-03-04 13:49:38 +0200 | |
---|---|---|
committer | 2020-03-04 11:05:04 -0800 | |
commit | 07ac9d16b4a5d1cf303215ad7e9829824246be55 (patch) | |
tree | 4a189e449dccdebaa4cf1bd58306790bf0089b47 /net | |
parent | gianfar: remove unnecessary zeroing coalesce settings (diff) | |
download | linux-07ac9d16b4a5d1cf303215ad7e9829824246be55.tar.gz linux-07ac9d16b4a5d1cf303215ad7e9829824246be55.tar.bz2 linux-07ac9d16b4a5d1cf303215ad7e9829824246be55.zip |
net/sched: act_ct: Fix ipv6 lookup of offloaded connections
When checking the protocol number tcf_ct_flow_table_lookup() handles
the flow as if it's always ipv4, while it can be ipv6.
Instead, refactor the code to fetch the tcp header, if available,
in the relevant family (ipv4/ipv6) filler function, and do the
check on the returned tcp header.
Fixes: 46475bb20f4b ("net/sched: act_ct: Software offload of established flows")
Signed-off-by: Paul Blakey <paulb@mellanox.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r-- | net/sched/act_ct.c | 60 |
1 files changed, 26 insertions, 34 deletions
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c index a2d5582a701e..f434db750328 100644 --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -188,7 +188,8 @@ static void tcf_ct_flow_table_process_conn(struct tcf_ct_flow_table *ct_ft, static bool tcf_ct_flow_table_fill_tuple_ipv4(struct sk_buff *skb, - struct flow_offload_tuple *tuple) + struct flow_offload_tuple *tuple, + struct tcphdr **tcph) { struct flow_ports *ports; unsigned int thoff; @@ -211,11 +212,16 @@ tcf_ct_flow_table_fill_tuple_ipv4(struct sk_buff *skb, if (iph->ttl <= 1) return false; - if (!pskb_may_pull(skb, thoff + sizeof(*ports))) + if (!pskb_may_pull(skb, iph->protocol == IPPROTO_TCP ? + thoff + sizeof(struct tcphdr) : + thoff + sizeof(*ports))) return false; - ports = (struct flow_ports *)(skb_network_header(skb) + thoff); + iph = ip_hdr(skb); + if (iph->protocol == IPPROTO_TCP) + *tcph = (void *)(skb_network_header(skb) + thoff); + ports = (struct flow_ports *)(skb_network_header(skb) + thoff); tuple->src_v4.s_addr = iph->saddr; tuple->dst_v4.s_addr = iph->daddr; tuple->src_port = ports->source; @@ -228,7 +234,8 @@ tcf_ct_flow_table_fill_tuple_ipv4(struct sk_buff *skb, static bool tcf_ct_flow_table_fill_tuple_ipv6(struct sk_buff *skb, - struct flow_offload_tuple *tuple) + struct flow_offload_tuple *tuple, + struct tcphdr **tcph) { struct flow_ports *ports; struct ipv6hdr *ip6h; @@ -247,11 +254,16 @@ tcf_ct_flow_table_fill_tuple_ipv6(struct sk_buff *skb, return false; thoff = sizeof(*ip6h); - if (!pskb_may_pull(skb, thoff + sizeof(*ports))) + if (!pskb_may_pull(skb, ip6h->nexthdr == IPPROTO_TCP ? + thoff + sizeof(struct tcphdr) : + thoff + sizeof(*ports))) return false; - ports = (struct flow_ports *)(skb_network_header(skb) + thoff); + ip6h = ipv6_hdr(skb); + if (ip6h->nexthdr == IPPROTO_TCP) + *tcph = (void *)(skb_network_header(skb) + thoff); + ports = (struct flow_ports *)(skb_network_header(skb) + thoff); tuple->src_v6 = ip6h->saddr; tuple->dst_v6 = ip6h->daddr; tuple->src_port = ports->source; @@ -262,24 +274,6 @@ tcf_ct_flow_table_fill_tuple_ipv6(struct sk_buff *skb, return true; } -static bool tcf_ct_flow_table_check_tcp(struct flow_offload *flow, - struct sk_buff *skb, - unsigned int thoff) -{ - struct tcphdr *tcph; - - if (!pskb_may_pull(skb, thoff + sizeof(*tcph))) - return false; - - tcph = (void *)(skb_network_header(skb) + thoff); - if (unlikely(tcph->fin || tcph->rst)) { - flow_offload_teardown(flow); - return false; - } - - return true; -} - static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p, struct sk_buff *skb, u8 family) @@ -288,10 +282,9 @@ static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p, struct flow_offload_tuple_rhash *tuplehash; struct flow_offload_tuple tuple = {}; enum ip_conntrack_info ctinfo; + struct tcphdr *tcph = NULL; struct flow_offload *flow; struct nf_conn *ct; - unsigned int thoff; - int ip_proto; u8 dir; /* Previously seen or loopback */ @@ -301,11 +294,11 @@ static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p, switch (family) { case NFPROTO_IPV4: - if (!tcf_ct_flow_table_fill_tuple_ipv4(skb, &tuple)) + if (!tcf_ct_flow_table_fill_tuple_ipv4(skb, &tuple, &tcph)) return false; break; case NFPROTO_IPV6: - if (!tcf_ct_flow_table_fill_tuple_ipv6(skb, &tuple)) + if (!tcf_ct_flow_table_fill_tuple_ipv6(skb, &tuple, &tcph)) return false; break; default: @@ -320,15 +313,14 @@ static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p, flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); ct = flow->ct; + if (tcph && (unlikely(tcph->fin || tcph->rst))) { + flow_offload_teardown(flow); + return false; + } + ctinfo = dir == FLOW_OFFLOAD_DIR_ORIGINAL ? IP_CT_ESTABLISHED : IP_CT_ESTABLISHED_REPLY; - thoff = ip_hdr(skb)->ihl * 4; - ip_proto = ip_hdr(skb)->protocol; - if (ip_proto == IPPROTO_TCP && - !tcf_ct_flow_table_check_tcp(flow, skb, thoff)) - return false; - nf_conntrack_get(&ct->ct_general); nf_ct_set(skb, ct, ctinfo); |