From: Pablo Neira Ayuso Date: Mon, 1 Mar 2021 23:52:49 +0100 Subject: [PATCH] netfilter: flowtable: add pppoe support --- --- a/drivers/net/ppp/ppp_generic.c +++ b/drivers/net/ppp/ppp_generic.c @@ -1453,7 +1453,7 @@ static void ppp_dev_priv_destructor(stru static int ppp_fill_forward_path(struct net_device_path_ctx *ctx, struct net_device_path *path) { - struct ppp *ppp = netdev_priv(path->dev); + struct ppp *ppp = netdev_priv(ctx->dev); struct ppp_channel *chan; struct channel *pch; --- a/drivers/net/ppp/pppoe.c +++ b/drivers/net/ppp/pppoe.c @@ -987,6 +987,7 @@ static int pppoe_fill_forward_path(struc path->type = DEV_PATH_PPPOE; path->encap.proto = htons(ETH_P_PPP_SES); path->encap.id = be16_to_cpu(po->num); + memcpy(path->encap.h_dest, po->pppoe_pa.remote, ETH_ALEN); path->dev = ctx->dev; ctx->dev = dev; --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -842,6 +842,7 @@ struct net_device_path { struct { u16 id; __be16 proto; + u8 h_dest[ETH_ALEN]; } encap; struct { enum { --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -7,6 +7,9 @@ #include #include #include +#include +#include +#include #include #include #include @@ -162,6 +165,8 @@ static bool ip_has_options(unsigned int static void nf_flow_tuple_encap(struct sk_buff *skb, struct flow_offload_tuple *tuple) { + struct vlan_ethhdr *veth; + struct pppoe_hdr *phdr; int i = 0; if (skb_vlan_tag_present(skb)) { @@ -169,23 +174,35 @@ static void nf_flow_tuple_encap(struct s tuple->encap[i].proto = skb->vlan_proto; i++; } - if (skb->protocol == htons(ETH_P_8021Q)) { - struct vlan_ethhdr *veth = (struct vlan_ethhdr *)skb_mac_header(skb); - + switch (skb->protocol) { + case htons(ETH_P_8021Q): + veth = (struct vlan_ethhdr *)skb_mac_header(skb); tuple->encap[i].id = ntohs(veth->h_vlan_TCI); tuple->encap[i].proto = skb->protocol; + break; + case htons(ETH_P_PPP_SES): + phdr = (struct pppoe_hdr *)skb_mac_header(skb); + tuple->encap[i].id = ntohs(phdr->sid); + tuple->encap[i].proto = skb->protocol; + break; } } static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev, - struct flow_offload_tuple *tuple) + struct flow_offload_tuple *tuple, u32 *nhoff) { unsigned int thoff, hdrsize, offset = 0; struct flow_ports *ports; struct iphdr *iph; - if (skb->protocol == htons(ETH_P_8021Q)) + switch (skb->protocol) { + case htons(ETH_P_8021Q): offset += VLAN_HLEN; + break; + case htons(ETH_P_PPP_SES): + offset += PPPOE_SES_HLEN; + break; + } if (!pskb_may_pull(skb, sizeof(*iph) + offset)) return -1; @@ -226,6 +243,7 @@ static int nf_flow_tuple_ip(struct sk_bu tuple->l4proto = iph->protocol; tuple->iifidx = dev->ifindex; nf_flow_tuple_encap(skb, tuple); + *nhoff = offset; return 0; } @@ -270,14 +288,36 @@ static unsigned int nf_flow_xmit_xfrm(st return NF_STOLEN; } +static inline __be16 nf_flow_pppoe_proto(const struct sk_buff *skb) +{ + __be16 proto; + + proto = *((__be16 *)(skb_mac_header(skb) + ETH_HLEN + + sizeof(struct pppoe_hdr))); + switch (proto) { + case htons(PPP_IP): + return htons(ETH_P_IP); + case htons(PPP_IPV6): + return htons(ETH_P_IPV6); + } + + return 0; +} + static bool nf_flow_skb_encap_protocol(const struct sk_buff *skb, __be16 proto) { - if (skb->protocol == htons(ETH_P_8021Q)) { - struct vlan_ethhdr *veth; + struct vlan_ethhdr *veth; + switch (skb->protocol) { + case htons(ETH_P_8021Q): veth = (struct vlan_ethhdr *)skb_mac_header(skb); if (veth->h_vlan_encapsulated_proto == proto) return true; + break; + case htons(ETH_P_PPP_SES): + if (nf_flow_pppoe_proto(skb) == proto) + return true; + break; } return false; @@ -294,12 +334,18 @@ static void nf_flow_encap_pop(struct sk_ __vlan_hwaccel_clear_tag(skb); continue; } - if (skb->protocol == htons(ETH_P_8021Q)) { + switch (skb->protocol) { + case htons(ETH_P_8021Q): vlan_hdr = (struct vlan_hdr *)skb->data; __skb_pull(skb, VLAN_HLEN); vlan_set_encap_proto(skb, vlan_hdr); skb_reset_network_header(skb); break; + case htons(ETH_P_PPP_SES): + skb->protocol = nf_flow_pppoe_proto(skb); + skb_pull(skb, PPPOE_SES_HLEN); + skb_reset_network_header(skb); + break; } } } @@ -343,7 +389,7 @@ nf_flow_offload_ip_hook(void *priv, stru !nf_flow_skb_encap_protocol(skb, htons(ETH_P_IP))) return NF_ACCEPT; - if (nf_flow_tuple_ip(skb, state->in, &tuple) < 0) + if (nf_flow_tuple_ip(skb, state->in, &tuple, &offset) < 0) return NF_ACCEPT; tuplehash = flow_offload_lookup(flow_table, &tuple); @@ -357,9 +403,6 @@ nf_flow_offload_ip_hook(void *priv, stru if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) return NF_ACCEPT; - if (skb->protocol == htons(ETH_P_8021Q)) - offset += VLAN_HLEN; - if (skb_try_make_writable(skb, sizeof(*iph) + offset)) return NF_DROP; @@ -543,14 +586,20 @@ static int nf_flow_nat_ipv6(const struct } static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev, - struct flow_offload_tuple *tuple) + struct flow_offload_tuple *tuple, u32 *nhoff) { unsigned int thoff, hdrsize, offset = 0; struct flow_ports *ports; struct ipv6hdr *ip6h; - if (skb->protocol == htons(ETH_P_8021Q)) + switch (skb->protocol) { + case htons(ETH_P_8021Q): offset += VLAN_HLEN; + break; + case htons(ETH_P_PPP_SES): + offset += PPPOE_SES_HLEN; + break; + } if (!pskb_may_pull(skb, sizeof(*ip6h) + offset)) return -1; @@ -586,6 +635,7 @@ static int nf_flow_tuple_ipv6(struct sk_ tuple->l4proto = ip6h->nexthdr; tuple->iifidx = dev->ifindex; nf_flow_tuple_encap(skb, tuple); + *nhoff = offset; return 0; } @@ -611,7 +661,7 @@ nf_flow_offload_ipv6_hook(void *priv, st !nf_flow_skb_encap_protocol(skb, htons(ETH_P_IPV6))) return NF_ACCEPT; - if (nf_flow_tuple_ipv6(skb, state->in, &tuple) < 0) + if (nf_flow_tuple_ipv6(skb, state->in, &tuple, &offset) < 0) return NF_ACCEPT; tuplehash = flow_offload_lookup(flow_table, &tuple); @@ -625,9 +675,6 @@ nf_flow_offload_ipv6_hook(void *priv, st if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) return NF_ACCEPT; - if (skb->protocol == htons(ETH_P_8021Q)) - offset += VLAN_HLEN; - ip6h = (struct ipv6hdr *)(skb_network_header(skb) + offset); if (nf_flow_state_check(flow, ip6h->nexthdr, skb, sizeof(*ip6h))) return NF_ACCEPT; --- a/net/netfilter/nft_flow_offload.c +++ b/net/netfilter/nft_flow_offload.c @@ -90,6 +90,7 @@ static void nft_dev_path_info(const stru switch (path->type) { case DEV_PATH_ETHERNET: case DEV_PATH_VLAN: + case DEV_PATH_PPPOE: info->indev = path->dev; if (is_zero_ether_addr(info->h_source)) memcpy(info->h_source, path->dev->dev_addr, ETH_ALEN); @@ -97,7 +98,7 @@ static void nft_dev_path_info(const stru if (path->type == DEV_PATH_ETHERNET) break; - /* DEV_PATH_VLAN */ + /* DEV_PATH_VLAN and DEV_PATH_PPPOE */ if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) { info->indev = NULL; break; @@ -106,6 +107,8 @@ static void nft_dev_path_info(const stru info->encap[info->num_encaps].id = path->encap.id; info->encap[info->num_encaps].proto = path->encap.proto; info->num_encaps++; + if (path->type == DEV_PATH_PPPOE) + memcpy(info->h_dest, path->encap.h_dest, ETH_ALEN); break; case DEV_PATH_BRIDGE: if (is_zero_ether_addr(info->h_source))