diff options
Diffstat (limited to 'target/linux/generic/pending-5.10/640-13-netfilter-flowtable-add-pppoe-support.patch')
-rw-r--r-- | target/linux/generic/pending-5.10/640-13-netfilter-flowtable-add-pppoe-support.patch | 263 |
1 files changed, 263 insertions, 0 deletions
diff --git a/target/linux/generic/pending-5.10/640-13-netfilter-flowtable-add-pppoe-support.patch b/target/linux/generic/pending-5.10/640-13-netfilter-flowtable-add-pppoe-support.patch new file mode 100644 index 0000000000..6a14514565 --- /dev/null +++ b/target/linux/generic/pending-5.10/640-13-netfilter-flowtable-add-pppoe-support.patch @@ -0,0 +1,263 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Mon, 1 Mar 2021 23:52:49 +0100 +Subject: [PATCH] netfilter: flowtable: add pppoe support + +--- + +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -1453,7 +1453,7 @@ static void ppp_dev_priv_destructor(stru + static int ppp_fill_forward_path(struct net_device_path_ctx *ctx, + struct net_device_path *path) + { +- struct ppp *ppp = netdev_priv(path->dev); ++ struct ppp *ppp = netdev_priv(ctx->dev); + struct ppp_channel *chan; + struct channel *pch; + +--- a/drivers/net/ppp/pppoe.c ++++ b/drivers/net/ppp/pppoe.c +@@ -987,6 +987,7 @@ static int pppoe_fill_forward_path(struc + path->type = DEV_PATH_PPPOE; + path->encap.proto = htons(ETH_P_PPP_SES); + path->encap.id = be16_to_cpu(po->num); ++ memcpy(path->encap.h_dest, po->pppoe_pa.remote, ETH_ALEN); + path->dev = ctx->dev; + ctx->dev = dev; + +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -848,6 +848,7 @@ struct net_device_path { + struct { + u16 id; + __be16 proto; ++ u8 h_dest[ETH_ALEN]; + } encap; + struct { + enum { +--- a/net/netfilter/nf_flow_table_ip.c ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -7,6 +7,9 @@ + #include <linux/ip.h> + #include <linux/ipv6.h> + #include <linux/netdevice.h> ++#include <linux/if_ether.h> ++#include <linux/if_pppox.h> ++#include <linux/ppp_defs.h> + #include <net/ip.h> + #include <net/ipv6.h> + #include <net/ip6_route.h> +@@ -162,6 +165,8 @@ static bool ip_has_options(unsigned int + static void nf_flow_tuple_encap(struct sk_buff *skb, + struct flow_offload_tuple *tuple) + { ++ struct vlan_ethhdr *veth; ++ struct pppoe_hdr *phdr; + int i = 0; + + if (skb_vlan_tag_present(skb)) { +@@ -169,23 +174,35 @@ static void nf_flow_tuple_encap(struct s + tuple->encap[i].proto = skb->vlan_proto; + i++; + } +- if (skb->protocol == htons(ETH_P_8021Q)) { +- struct vlan_ethhdr *veth = (struct vlan_ethhdr *)skb_mac_header(skb); +- ++ switch (skb->protocol) { ++ case htons(ETH_P_8021Q): ++ veth = (struct vlan_ethhdr *)skb_mac_header(skb); + tuple->encap[i].id = ntohs(veth->h_vlan_TCI); + tuple->encap[i].proto = skb->protocol; ++ break; ++ case htons(ETH_P_PPP_SES): ++ phdr = (struct pppoe_hdr *)skb_mac_header(skb); ++ tuple->encap[i].id = ntohs(phdr->sid); ++ tuple->encap[i].proto = skb->protocol; ++ break; + } + } + + static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev, +- struct flow_offload_tuple *tuple) ++ struct flow_offload_tuple *tuple, u32 *nhoff) + { + unsigned int thoff, hdrsize, offset = 0; + struct flow_ports *ports; + struct iphdr *iph; + +- if (skb->protocol == htons(ETH_P_8021Q)) ++ switch (skb->protocol) { ++ case htons(ETH_P_8021Q): + offset += VLAN_HLEN; ++ break; ++ case htons(ETH_P_PPP_SES): ++ offset += PPPOE_SES_HLEN; ++ break; ++ } + + if (!pskb_may_pull(skb, sizeof(*iph) + offset)) + return -1; +@@ -226,6 +243,7 @@ static int nf_flow_tuple_ip(struct sk_bu + tuple->l4proto = iph->protocol; + tuple->iifidx = dev->ifindex; + nf_flow_tuple_encap(skb, tuple); ++ *nhoff = offset; + + return 0; + } +@@ -270,14 +288,36 @@ static unsigned int nf_flow_xmit_xfrm(st + return NF_STOLEN; + } + ++static inline __be16 nf_flow_pppoe_proto(const struct sk_buff *skb) ++{ ++ __be16 proto; ++ ++ proto = *((__be16 *)(skb_mac_header(skb) + ETH_HLEN + ++ sizeof(struct pppoe_hdr))); ++ switch (proto) { ++ case htons(PPP_IP): ++ return htons(ETH_P_IP); ++ case htons(PPP_IPV6): ++ return htons(ETH_P_IPV6); ++ } ++ ++ return 0; ++} ++ + static bool nf_flow_skb_encap_protocol(const struct sk_buff *skb, __be16 proto) + { +- if (skb->protocol == htons(ETH_P_8021Q)) { +- struct vlan_ethhdr *veth; ++ struct vlan_ethhdr *veth; + ++ switch (skb->protocol) { ++ case htons(ETH_P_8021Q): + veth = (struct vlan_ethhdr *)skb_mac_header(skb); + if (veth->h_vlan_encapsulated_proto == proto) + return true; ++ break; ++ case htons(ETH_P_PPP_SES): ++ if (nf_flow_pppoe_proto(skb) == proto) ++ return true; ++ break; + } + + return false; +@@ -294,12 +334,18 @@ static void nf_flow_encap_pop(struct sk_ + __vlan_hwaccel_clear_tag(skb); + continue; + } +- if (skb->protocol == htons(ETH_P_8021Q)) { ++ switch (skb->protocol) { ++ case htons(ETH_P_8021Q): + vlan_hdr = (struct vlan_hdr *)skb->data; + __skb_pull(skb, VLAN_HLEN); + vlan_set_encap_proto(skb, vlan_hdr); + skb_reset_network_header(skb); + break; ++ case htons(ETH_P_PPP_SES): ++ skb->protocol = nf_flow_pppoe_proto(skb); ++ skb_pull(skb, PPPOE_SES_HLEN); ++ skb_reset_network_header(skb); ++ break; + } + } + } +@@ -343,7 +389,7 @@ nf_flow_offload_ip_hook(void *priv, stru + !nf_flow_skb_encap_protocol(skb, htons(ETH_P_IP))) + return NF_ACCEPT; + +- if (nf_flow_tuple_ip(skb, state->in, &tuple) < 0) ++ if (nf_flow_tuple_ip(skb, state->in, &tuple, &offset) < 0) + return NF_ACCEPT; + + tuplehash = flow_offload_lookup(flow_table, &tuple); +@@ -357,9 +403,6 @@ nf_flow_offload_ip_hook(void *priv, stru + if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) + return NF_ACCEPT; + +- if (skb->protocol == htons(ETH_P_8021Q)) +- offset += VLAN_HLEN; +- + if (skb_try_make_writable(skb, sizeof(*iph) + offset)) + return NF_DROP; + +@@ -543,14 +586,20 @@ static int nf_flow_nat_ipv6(const struct + } + + static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev, +- struct flow_offload_tuple *tuple) ++ struct flow_offload_tuple *tuple, u32 *nhoff) + { + unsigned int thoff, hdrsize, offset = 0; + struct flow_ports *ports; + struct ipv6hdr *ip6h; + +- if (skb->protocol == htons(ETH_P_8021Q)) ++ switch (skb->protocol) { ++ case htons(ETH_P_8021Q): + offset += VLAN_HLEN; ++ break; ++ case htons(ETH_P_PPP_SES): ++ offset += PPPOE_SES_HLEN; ++ break; ++ } + + if (!pskb_may_pull(skb, sizeof(*ip6h) + offset)) + return -1; +@@ -586,6 +635,7 @@ static int nf_flow_tuple_ipv6(struct sk_ + tuple->l4proto = ip6h->nexthdr; + tuple->iifidx = dev->ifindex; + nf_flow_tuple_encap(skb, tuple); ++ *nhoff = offset; + + return 0; + } +@@ -611,7 +661,7 @@ nf_flow_offload_ipv6_hook(void *priv, st + !nf_flow_skb_encap_protocol(skb, htons(ETH_P_IPV6))) + return NF_ACCEPT; + +- if (nf_flow_tuple_ipv6(skb, state->in, &tuple) < 0) ++ if (nf_flow_tuple_ipv6(skb, state->in, &tuple, &offset) < 0) + return NF_ACCEPT; + + tuplehash = flow_offload_lookup(flow_table, &tuple); +@@ -625,9 +675,6 @@ nf_flow_offload_ipv6_hook(void *priv, st + if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) + return NF_ACCEPT; + +- if (skb->protocol == htons(ETH_P_8021Q)) +- offset += VLAN_HLEN; +- + ip6h = (struct ipv6hdr *)(skb_network_header(skb) + offset); + if (nf_flow_state_check(flow, ip6h->nexthdr, skb, sizeof(*ip6h))) + return NF_ACCEPT; +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -90,6 +90,7 @@ static void nft_dev_path_info(const stru + switch (path->type) { + case DEV_PATH_ETHERNET: + case DEV_PATH_VLAN: ++ case DEV_PATH_PPPOE: + info->indev = path->dev; + if (is_zero_ether_addr(info->h_source)) + memcpy(info->h_source, path->dev->dev_addr, ETH_ALEN); +@@ -97,7 +98,7 @@ static void nft_dev_path_info(const stru + if (path->type == DEV_PATH_ETHERNET) + break; + +- /* DEV_PATH_VLAN */ ++ /* DEV_PATH_VLAN and DEV_PATH_PPPOE */ + if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) { + info->indev = NULL; + break; +@@ -106,6 +107,8 @@ static void nft_dev_path_info(const stru + info->encap[info->num_encaps].id = path->encap.id; + info->encap[info->num_encaps].proto = path->encap.proto; + info->num_encaps++; ++ if (path->type == DEV_PATH_PPPOE) ++ memcpy(info->h_dest, path->encap.h_dest, ETH_ALEN); + break; + case DEV_PATH_BRIDGE: + if (is_zero_ether_addr(info->h_source)) |