Commit 947e326c authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'net-wean-netfilter-from-fib_nh' 



David Ahern says:

====================
net: wean netfilter from fib_nh

Two netfilter modules reference fib_nh. In both cases the code is
only checking if a nexthop in a fib_info uses a specific device.
Both instances essentially duplicate code from __fib_validate_source,
so move that code into a helper and flip the netfilter modules to
use it.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 5678cb3c 9f18b6b6

include/net/ip_fib.h

+1 −0
Original line number Diff line number Diff line
@@ -373,6 +373,7 @@ static inline bool fib4_rules_early_flow_dissect(struct net *net, 
extern const struct nla_policy rtm_ipv4_policy[];

void ip_fib_init(void);

__be32 fib_compute_spec_dst(struct sk_buff *skb);

bool fib_info_nh_uses_dev(struct fib_info *fi, const struct net_device *dev);

int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,

			u8 tos, int oif, struct net_device *dev,

			struct in_device *idev, u32 *itag);

net/ipv4/fib_frontend.c

+27 −17
Original line number Diff line number Diff line
@@ -315,6 +315,32 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb) 
	return inet_select_addr(dev, ip_hdr(skb)->saddr, scope);

}



bool fib_info_nh_uses_dev(struct fib_info *fi, const struct net_device *dev)

{

	bool dev_match = false;

	int ret;



#ifdef CONFIG_IP_ROUTE_MULTIPATH

	for (ret = 0; ret < fi->fib_nhs; ret++) {

		struct fib_nh *nh = &fi->fib_nh[ret];



		if (nh->nh_dev == dev) {

			dev_match = true;

			break;

		} else if (l3mdev_master_ifindex_rcu(nh->nh_dev) == dev->ifindex) {

			dev_match = true;

			break;

		}

	}

#else

	if (fi->fib_nh[0].nh_dev == dev)

		dev_match = true;

#endif



	return dev_match;

}

EXPORT_SYMBOL_GPL(fib_info_nh_uses_dev);



/* Given (packet source, input interface) and optional (dst, oif, tos):

 * - (main) check, that source is valid i.e. not broadcast or our local

 *   address.
@@ -361,24 +387,8 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, 
	    (res.type != RTN_LOCAL || !IN_DEV_ACCEPT_LOCAL(idev)))

		goto e_inval;

	fib_combine_itag(itag, &res);

	dev_match = false;



#ifdef CONFIG_IP_ROUTE_MULTIPATH

	for (ret = 0; ret < res.fi->fib_nhs; ret++) {

		struct fib_nh *nh = &res.fi->fib_nh[ret];



		if (nh->nh_dev == dev) {

			dev_match = true;

			break;

		} else if (l3mdev_master_ifindex_rcu(nh->nh_dev) == dev->ifindex) {

			dev_match = true;

			break;

		}

	}

#else

	if (FIB_RES_DEV(res) == dev)

		dev_match = true;

#endif

	dev_match = fib_info_nh_uses_dev(res.fi, dev);

	if (dev_match) {

		ret = FIB_RES_NH(res).nh_scope >= RT_SCOPE_HOST;

		return ret;

net/ipv4/netfilter/ipt_rpfilter.c

+1 −16
Original line number Diff line number Diff line
@@ -36,7 +36,6 @@ static bool rpfilter_lookup_reverse(struct net *net, struct flowi4 *fl4, 
				const struct net_device *dev, u8 flags)

{

	struct fib_result res;

	bool dev_match;

	int ret __maybe_unused;



	if (fib_lookup(net, fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE))
@@ -46,21 +45,7 @@ static bool rpfilter_lookup_reverse(struct net *net, struct flowi4 *fl4, 
		if (res.type != RTN_LOCAL || !(flags & XT_RPFILTER_ACCEPT_LOCAL))

			return false;

	}

	dev_match = false;

#ifdef CONFIG_IP_ROUTE_MULTIPATH

	for (ret = 0; ret < res.fi->fib_nhs; ret++) {

		struct fib_nh *nh = &res.fi->fib_nh[ret];



		if (nh->nh_dev == dev) {

			dev_match = true;

			break;

		}

	}

#else

	if (FIB_RES_DEV(res) == dev)

		dev_match = true;

#endif

	return dev_match || flags & XT_RPFILTER_LOOSE;

	return fib_info_nh_uses_dev(res.fi, dev) || flags & XT_RPFILTER_LOOSE;

}



static bool

net/ipv4/netfilter/nft_fib_ipv4.c

+6 −21
Original line number Diff line number Diff line
@@ -76,10 +76,7 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, 
		.flowi4_iif = LOOPBACK_IFINDEX,

	};

	const struct net_device *oif;

	struct net_device *found;

#ifdef CONFIG_IP_ROUTE_MULTIPATH

	int i;

#endif

	const struct net_device *found;



	/*

	 * Do not set flowi4_oif, it restricts results (for example, asking
@@ -146,25 +143,13 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, 


       if (!oif) {

               found = FIB_RES_DEV(res);

               goto ok;

       }



#ifdef CONFIG_IP_ROUTE_MULTIPATH

	for (i = 0; i < res.fi->fib_nhs; i++) {

		struct fib_nh *nh = &res.fi->fib_nh[i];

	} else {

		if (!fib_info_nh_uses_dev(res.fi, oif))

			return;



		if (nh->nh_dev == oif) {

			found = nh->nh_dev;

			goto ok;

		}

		found = oif;

	}

	return;

#else

	found = FIB_RES_DEV(res);

	if (found != oif)

		return;

#endif

ok:



	switch (priv->result) {

	case NFT_FIB_RESULT_OIF:

		*dest = found->ifindex;

CRA Git | Maintained and supported by SUSTech CRA and CCSE