p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

netfilter: nf_tables: map basechain priority to hardware priority 

This patch adds initial support for offloading basechains using the
priority range from 1 to 65535. This is restricting the netfilter
priority range to 16-bit integer since this is what most drivers assume
so far from tc. It should be possible to extend this range of supported
priorities later on once drivers are updated to support for 32-bit
integer priorities.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Pablo Neira Ayuso 2019-08-16 03:24:10 +02:00 committed by David S. Miller
parent ef01adae0e
commit 3bc158f8d0
3 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/net/netfilter/nf_tables_offload.h
View File

@ -73,4 +73,6 @@ int nft_flow_rule_offload_commit(struct net *net);
(__reg)->key = __key; \ (__reg)->key = __key; \
memset(&(__reg)->mask, 0xff, (__reg)->len); memset(&(__reg)->mask, 0xff, (__reg)->len);
int nft_chain_offload_priority(struct nft_base_chain *basechain);
#endif #endif

4
net/netfilter/nf_tables_api.c
View File

@ -1667,6 +1667,10 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
chain->flags |= NFT_BASE_CHAIN | flags; chain->flags |= NFT_BASE_CHAIN | flags;
basechain->policy = NF_ACCEPT; basechain->policy = NF_ACCEPT;
if (chain->flags & NFT_CHAIN_HW_OFFLOAD &&
nft_chain_offload_priority(basechain) < 0)
return -EOPNOTSUPP;
flow_block_init(&basechain->flow_block); flow_block_init(&basechain->flow_block);
} else { } else {
chain = kzalloc(sizeof(*chain), GFP_KERNEL); chain = kzalloc(sizeof(*chain), GFP_KERNEL);

17
net/netfilter/nf_tables_offload.c
View File

@ -103,10 +103,11 @@ void nft_offload_update_dependency(struct nft_offload_ctx *ctx,
} }
static void nft_flow_offload_common_init(struct flow_cls_common_offload *common, static void nft_flow_offload_common_init(struct flow_cls_common_offload *common,
__be16 proto, __be16 proto, int priority,
struct netlink_ext_ack *extack) struct netlink_ext_ack *extack)
{ {
common->protocol = proto; common->protocol = proto;
common->prio = priority;
common->extack = extack; common->extack = extack;
} }
@ -124,6 +125,15 @@ static int nft_setup_cb_call(struct nft_base_chain *basechain,
return 0; return 0;
} }
int nft_chain_offload_priority(struct nft_base_chain *basechain)
{
if (basechain->ops.priority <= 0 ||
basechain->ops.priority > USHRT_MAX)
return -1;
return 0;
}
static int nft_flow_offload_rule(struct nft_trans *trans, static int nft_flow_offload_rule(struct nft_trans *trans,
enum flow_cls_command command) enum flow_cls_command command)
{ {
@ -142,7 +152,8 @@ static int nft_flow_offload_rule(struct nft_trans *trans,
if (flow) if (flow)
proto = flow->proto; proto = flow->proto;
nft_flow_offload_common_init(&cls_flow.common, proto, &extack); nft_flow_offload_common_init(&cls_flow.common, proto,
basechain->ops.priority, &extack);
cls_flow.command = command; cls_flow.command = command;
cls_flow.cookie = (unsigned long) rule; cls_flow.cookie = (unsigned long) rule;
if (flow) if (flow)