leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: nf_tables_offload: add __nft_offload_get_chain function

Browse Source 
Add __nft_offload_get_chain function to get basechain from device. This
function requires that caller holds the per-netns nftables mutex. This
patch implicitly fixes missing offload flags check and proper mutex from
nft_indr_block_cb().

Fixes: 9a32669fec ("netfilter: nf_tables_offload: support indr block call")
Signed-off-by: wenxu <wenxu@ucloud.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
wenxu 2019-09-11 12:53:21 +08:00 committed by Pablo Neira Ayuso
parent be2861dc36
commit 504882db83
1 changed files with 33 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
net/netfilter/nf_tables_offload.c
View File

@ -369,33 +369,49 @@ int nft_flow_rule_offload_commit(struct net *net)
return err;
}
static void nft_indr_block_cb(struct net_device *dev,
flow_indr_block_bind_cb_t *cb, void *cb_priv,
enum flow_block_command command)
static struct nft_chain *__nft_offload_get_chain(struct net_device *dev)
{
struct nft_base_chain *basechain;
struct net *net = dev_net(dev);
const struct nft_table *table;
const struct nft_chain *chain;
struct nft_chain *chain;
list_for_each_entry_rcu(table, &net->nft.tables, list) {
list_for_each_entry(table, &net->nft.tables, list) {
if (table->family != NFPROTO_NETDEV)
continue;
list_for_each_entry_rcu(chain, &table->chains, list) {
if (nft_is_base_chain(chain)) {
list_for_each_entry(chain, &table->chains, list) {
if (!nft_is_base_chain(chain) ||
!(chain->flags & NFT_CHAIN_HW_OFFLOAD))
continue;
basechain = nft_base_chain(chain);
if (strncmp(basechain->dev_name, dev->name, IFNAMSIZ))
continue;
return chain;
}
}
return NULL;
}
static void nft_indr_block_cb(struct net_device *dev,
flow_indr_block_bind_cb_t *cb, void *cb_priv,
enum flow_block_command cmd)
{
struct net *net = dev_net(dev);
struct nft_chain *chain;
mutex_lock(&net->nft.commit_mutex);
chain = __nft_offload_get_chain(dev);
if (chain) {
struct nft_base_chain *basechain;
basechain = nft_base_chain(chain);
if (!strncmp(basechain->dev_name, dev->name,
IFNAMSIZ)) {
nft_indr_block_ing_cmd(dev, basechain,
cb, cb_priv,
command);
return;
}
}
}
nft_indr_block_ing_cmd(dev, basechain, cb, cb_priv, cmd);
}
mutex_unlock(&net->nft.commit_mutex);
}
static struct flow_indr_block_ing_entry block_ing_entry = {