| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 23 Nov 2022 12:09:55 -0300
From: Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
To: Xin Long <lucien.xin@...il.com>
Cc: network dev <netdev@...r.kernel.org>, dev@...nvswitch.org,
ovs-dev@...nvswitch.org, davem@...emloft.net, kuba@...nel.org,
Eric Dumazet <edumazet@...gle.com>,
Paolo Abeni <pabeni@...hat.com>,
Pravin B Shelar <pshelar@....org>,
Jamal Hadi Salim <jhs@...atatu.com>,
Cong Wang <xiyou.wangcong@...il.com>,
Jiri Pirko <jiri@...nulli.us>,
Pablo Neira Ayuso <pablo@...filter.org>,
Florian Westphal <fw@...len.de>,
Davide Caratti <dcaratti@...hat.com>,
Oz Shlomo <ozsh@...dia.com>, Paul Blakey <paulb@...dia.com>,
Ilya Maximets <i.maximets@....org>,
Eelco Chaudron <echaudro@...hat.com>,
Aaron Conole <aconole@...hat.com>
Subject: Re: [PATCHv2 net-next 5/5] net: move the nat function to nf_nat_ovs
for ovs and tc
On Tue, Nov 22, 2022 at 12:32:21PM -0500, Xin Long wrote:
> +int nf_ct_nat(struct sk_buff *skb, struct nf_conn *ct,
> + enum ip_conntrack_info ctinfo, int *action,
> + const struct nf_nat_range2 *range, bool commit)
> +{
> + enum nf_nat_manip_type maniptype;
> + int err, ct_action = *action;
> +
> + *action = 0;
> +
> + /* Add NAT extension if not confirmed yet. */
> + if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct))
> + return NF_ACCEPT; /* Can't NAT. */
> +
> + if (ctinfo != IP_CT_NEW && (ct->status & IPS_NAT_MASK) &&
> + (ctinfo != IP_CT_RELATED || commit)) {
> + /* NAT an established or related connection like before. */
> + if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY)
> + /* This is the REPLY direction for a connection
> + * for which NAT was applied in the forward
> + * direction. Do the reverse NAT.
> + */
> + maniptype = ct->status & IPS_SRC_NAT
> + ? NF_NAT_MANIP_DST : NF_NAT_MANIP_SRC;
> + else
> + maniptype = ct->status & IPS_SRC_NAT
> + ? NF_NAT_MANIP_SRC : NF_NAT_MANIP_DST;
> + } else if (ct_action & (1 << NF_NAT_MANIP_SRC)) {
> + maniptype = NF_NAT_MANIP_SRC;
> + } else if (ct_action & (1 << NF_NAT_MANIP_DST)) {
> + maniptype = NF_NAT_MANIP_DST;
> + } else {
> + return NF_ACCEPT;
> + }
> +
> + err = nf_ct_nat_execute(skb, ct, ctinfo, action, range, maniptype);
> + if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) {
> + if (ct->status & IPS_SRC_NAT) {
> + if (maniptype == NF_NAT_MANIP_SRC)
> + maniptype = NF_NAT_MANIP_DST;
> + else
> + maniptype = NF_NAT_MANIP_SRC;
> +
> + err = nf_ct_nat_execute(skb, ct, ctinfo, action, range,
> + maniptype);
> + } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
> + err = nf_ct_nat_execute(skb, ct, ctinfo, action, NULL,
> + NF_NAT_MANIP_SRC);
> + }
> + }
> + return err;
> +}
> +EXPORT_SYMBOL_GPL(nf_ct_nat);
> diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
> index cc643a556ea1..d03c75165663 100644
> --- a/net/openvswitch/conntrack.c
> +++ b/net/openvswitch/conntrack.c
> @@ -726,144 +726,27 @@ static void ovs_nat_update_key(struct sw_flow_key *key,
> }
> }
>
> -/* Modelled after nf_nat_ipv[46]_fn().
> - * range is only used for new, uninitialized NAT state.
> - * Returns either NF_ACCEPT or NF_DROP.
> - */
> -static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
> - enum ip_conntrack_info ctinfo,
> - const struct nf_nat_range2 *range,
> - enum nf_nat_manip_type maniptype, struct sw_flow_key *key)
> -{
> - int hooknum, err = NF_ACCEPT;
> -
> - /* See HOOK2MANIP(). */
> - if (maniptype == NF_NAT_MANIP_SRC)
> - hooknum = NF_INET_LOCAL_IN; /* Source NAT */
> - else
> - hooknum = NF_INET_LOCAL_OUT; /* Destination NAT */
> -
> - switch (ctinfo) {
> - case IP_CT_RELATED:
> - case IP_CT_RELATED_REPLY:
> - if (IS_ENABLED(CONFIG_NF_NAT) &&
> - skb->protocol == htons(ETH_P_IP) &&
> - ip_hdr(skb)->protocol == IPPROTO_ICMP) {
> - if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
> - hooknum))
> - err = NF_DROP;
> - goto out;
> - } else if (IS_ENABLED(CONFIG_IPV6) &&
> - skb->protocol == htons(ETH_P_IPV6)) {
> - __be16 frag_off;
> - u8 nexthdr = ipv6_hdr(skb)->nexthdr;
> - int hdrlen = ipv6_skip_exthdr(skb,
> - sizeof(struct ipv6hdr),
> - &nexthdr, &frag_off);
> -
> - if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) {
> - if (!nf_nat_icmpv6_reply_translation(skb, ct,
> - ctinfo,
> - hooknum,
> - hdrlen))
> - err = NF_DROP;
> - goto out;
> - }
> - }
> - /* Non-ICMP, fall thru to initialize if needed. */
> - fallthrough;
> - case IP_CT_NEW:
> - /* Seen it before? This can happen for loopback, retrans,
> - * or local packets.
> - */
> - if (!nf_nat_initialized(ct, maniptype)) {
> - /* Initialize according to the NAT action. */
> - err = (range && range->flags & NF_NAT_RANGE_MAP_IPS)
> - /* Action is set up to establish a new
> - * mapping.
> - */
> - ? nf_nat_setup_info(ct, range, maniptype)
> - : nf_nat_alloc_null_binding(ct, hooknum);
> - if (err != NF_ACCEPT)
> - goto out;
> - }
> - break;
> -
> - case IP_CT_ESTABLISHED:
> - case IP_CT_ESTABLISHED_REPLY:
> - break;
> -
> - default:
> - err = NF_DROP;
> - goto out;
> - }
> -
> - err = nf_nat_packet(ct, ctinfo, hooknum, skb);
> -out:
> - /* Update the flow key if NAT successful. */
> - if (err == NF_ACCEPT)
> - ovs_nat_update_key(key, skb, maniptype);
> -
> - return err;
> -}
> -
> /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */
> static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
> const struct ovs_conntrack_info *info,
> struct sk_buff *skb, struct nf_conn *ct,
> enum ip_conntrack_info ctinfo)
> {
> - enum nf_nat_manip_type maniptype;
> - int err;
> + int err, action = 0;
>
> if (!(info->nat & OVS_CT_NAT))
> return NF_ACCEPT;
> + if (info->nat & OVS_CT_SRC_NAT)
> + action |= (1 << NF_NAT_MANIP_SRC);
> + if (info->nat & OVS_CT_DST_NAT)
> + action |= (1 << NF_NAT_MANIP_DST);
I'm wondering why this dance at this level with supporting multiple
MANIPs while actually only one can be used at a time.
act_ct will reject an action using both:
if ((p->ct_action & TCA_CT_ACT_NAT_SRC) &&
(p->ct_action & TCA_CT_ACT_NAT_DST)) {
NL_SET_ERR_MSG_MOD(extack, "dnat and snat can't be enabled at the same time");
return -EOPNOTSUPP;
I couldn't find this kind of check in ovs code right now (didn't look much, I
confess :)), but even the code here was already doing:
- } else if (info->nat & OVS_CT_SRC_NAT) {
- maniptype = NF_NAT_MANIP_SRC;
- } else if (info->nat & OVS_CT_DST_NAT) {
- maniptype = NF_NAT_MANIP_DST;
And in case of tuple conflict, maniptype will be forcibly updated in
[*] below.
Anyhow, if really needed, it would be nice to use BIT(NF_NAT_MANIP_..)
instead.
>
> - /* Add NAT extension if not confirmed yet. */
> - if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct))
> - return NF_ACCEPT; /* Can't NAT. */
> + err = nf_ct_nat(skb, ct, ctinfo, &action, &info->range, info->commit);
>
> - /* Determine NAT type.
> - * Check if the NAT type can be deduced from the tracked connection.
> - * Make sure new expected connections (IP_CT_RELATED) are NATted only
> - * when committing.
> - */
> - if (ctinfo != IP_CT_NEW && ct->status & IPS_NAT_MASK &&
> - (ctinfo != IP_CT_RELATED || info->commit)) {
> - /* NAT an established or related connection like before. */
> - if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY)
> - /* This is the REPLY direction for a connection
> - * for which NAT was applied in the forward
> - * direction. Do the reverse NAT.
> - */
> - maniptype = ct->status & IPS_SRC_NAT
> - ? NF_NAT_MANIP_DST : NF_NAT_MANIP_SRC;
> - else
> - maniptype = ct->status & IPS_SRC_NAT
> - ? NF_NAT_MANIP_SRC : NF_NAT_MANIP_DST;
> - } else if (info->nat & OVS_CT_SRC_NAT) {
> - maniptype = NF_NAT_MANIP_SRC;
> - } else if (info->nat & OVS_CT_DST_NAT) {
> - maniptype = NF_NAT_MANIP_DST;
> - } else {
> - return NF_ACCEPT; /* Connection is not NATed. */
> - }
> - err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype, key);
> -
> - if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) {
> - if (ct->status & IPS_SRC_NAT) {
> - if (maniptype == NF_NAT_MANIP_SRC)
> - maniptype = NF_NAT_MANIP_DST;
> - else
> - maniptype = NF_NAT_MANIP_SRC;
[*]
> -
> - err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range,
> - maniptype, key);
> - } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
> - err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL,
> - NF_NAT_MANIP_SRC, key);
> - }
> - }
> + if (action & (1 << NF_NAT_MANIP_SRC))
> + ovs_nat_update_key(key, skb, NF_NAT_MANIP_SRC);
> + if (action & (1 << NF_NAT_MANIP_DST))
> + ovs_nat_update_key(key, skb, NF_NAT_MANIP_DST);
>
> return err;
> }
> diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
> index c7782c9a6ab6..0c410220239f 100644
> --- a/net/sched/act_ct.c
> +++ b/net/sched/act_ct.c
> @@ -863,90 +863,6 @@ static void tcf_ct_params_free_rcu(struct rcu_head *head)
> tcf_ct_params_free(params);
> }
>
> -#if IS_ENABLED(CONFIG_NF_NAT)
> -/* Modelled after nf_nat_ipv[46]_fn().
> - * range is only used for new, uninitialized NAT state.
> - * Returns either NF_ACCEPT or NF_DROP.
> - */
> -static int ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
> - enum ip_conntrack_info ctinfo,
> - const struct nf_nat_range2 *range,
> - enum nf_nat_manip_type maniptype)
> -{
> - __be16 proto = skb_protocol(skb, true);
> - int hooknum, err = NF_ACCEPT;
> -
> - /* See HOOK2MANIP(). */
> - if (maniptype == NF_NAT_MANIP_SRC)
> - hooknum = NF_INET_LOCAL_IN; /* Source NAT */
> - else
> - hooknum = NF_INET_LOCAL_OUT; /* Destination NAT */
> -
> - switch (ctinfo) {
> - case IP_CT_RELATED:
> - case IP_CT_RELATED_REPLY:
> - if (proto == htons(ETH_P_IP) &&
> - ip_hdr(skb)->protocol == IPPROTO_ICMP) {
> - if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
> - hooknum))
> - err = NF_DROP;
> - goto out;
> - } else if (IS_ENABLED(CONFIG_IPV6) && proto == htons(ETH_P_IPV6)) {
> - __be16 frag_off;
> - u8 nexthdr = ipv6_hdr(skb)->nexthdr;
> - int hdrlen = ipv6_skip_exthdr(skb,
> - sizeof(struct ipv6hdr),
> - &nexthdr, &frag_off);
> -
> - if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) {
> - if (!nf_nat_icmpv6_reply_translation(skb, ct,
> - ctinfo,
> - hooknum,
> - hdrlen))
> - err = NF_DROP;
> - goto out;
> - }
> - }
> - /* Non-ICMP, fall thru to initialize if needed. */
> - fallthrough;
> - case IP_CT_NEW:
> - /* Seen it before? This can happen for loopback, retrans,
> - * or local packets.
> - */
> - if (!nf_nat_initialized(ct, maniptype)) {
> - /* Initialize according to the NAT action. */
> - err = (range && range->flags & NF_NAT_RANGE_MAP_IPS)
> - /* Action is set up to establish a new
> - * mapping.
> - */
> - ? nf_nat_setup_info(ct, range, maniptype)
> - : nf_nat_alloc_null_binding(ct, hooknum);
> - if (err != NF_ACCEPT)
> - goto out;
> - }
> - break;
> -
> - case IP_CT_ESTABLISHED:
> - case IP_CT_ESTABLISHED_REPLY:
> - break;
> -
> - default:
> - err = NF_DROP;
> - goto out;
> - }
> -
> - err = nf_nat_packet(ct, ctinfo, hooknum, skb);
> -out:
> - if (err == NF_ACCEPT) {
> - if (maniptype == NF_NAT_MANIP_SRC)
> - tc_skb_cb(skb)->post_ct_snat = 1;
> - if (maniptype == NF_NAT_MANIP_DST)
> - tc_skb_cb(skb)->post_ct_dnat = 1;
> - }
> - return err;
> -}
> -#endif /* CONFIG_NF_NAT */
> -
> static void tcf_ct_act_set_mark(struct nf_conn *ct, u32 mark, u32 mask)
> {
> #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
> @@ -986,52 +902,22 @@ static int tcf_ct_act_nat(struct sk_buff *skb,
> bool commit)
> {
> #if IS_ENABLED(CONFIG_NF_NAT)
> - int err;
> - enum nf_nat_manip_type maniptype;
> + int err, action = 0;
>
> if (!(ct_action & TCA_CT_ACT_NAT))
> return NF_ACCEPT;
> + if (ct_action & TCA_CT_ACT_NAT_SRC)
> + action |= (1 << NF_NAT_MANIP_SRC);
> + if (ct_action & TCA_CT_ACT_NAT_DST)
> + action |= (1 << NF_NAT_MANIP_DST);
>
> - /* Add NAT extension if not confirmed yet. */
> - if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct))
> - return NF_ACCEPT; /* Can't NAT. */
> -
> - if (ctinfo != IP_CT_NEW && (ct->status & IPS_NAT_MASK) &&
> - (ctinfo != IP_CT_RELATED || commit)) {
> - /* NAT an established or related connection like before. */
> - if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY)
> - /* This is the REPLY direction for a connection
> - * for which NAT was applied in the forward
> - * direction. Do the reverse NAT.
> - */
> - maniptype = ct->status & IPS_SRC_NAT
> - ? NF_NAT_MANIP_DST : NF_NAT_MANIP_SRC;
> - else
> - maniptype = ct->status & IPS_SRC_NAT
> - ? NF_NAT_MANIP_SRC : NF_NAT_MANIP_DST;
> - } else if (ct_action & TCA_CT_ACT_NAT_SRC) {
> - maniptype = NF_NAT_MANIP_SRC;
> - } else if (ct_action & TCA_CT_ACT_NAT_DST) {
> - maniptype = NF_NAT_MANIP_DST;
> - } else {
> - return NF_ACCEPT;
> - }
> + err = nf_ct_nat(skb, ct, ctinfo, &action, range, commit);
> +
> + if (action & (1 << NF_NAT_MANIP_SRC))
> + tc_skb_cb(skb)->post_ct_snat = 1;
> + if (action & (1 << NF_NAT_MANIP_DST))
> + tc_skb_cb(skb)->post_ct_dnat = 1;
>
> - err = ct_nat_execute(skb, ct, ctinfo, range, maniptype);
> - if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) {
> - if (ct->status & IPS_SRC_NAT) {
> - if (maniptype == NF_NAT_MANIP_SRC)
> - maniptype = NF_NAT_MANIP_DST;
> - else
> - maniptype = NF_NAT_MANIP_SRC;
> -
> - err = ct_nat_execute(skb, ct, ctinfo, range,
> - maniptype);
> - } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
> - err = ct_nat_execute(skb, ct, ctinfo, NULL,
> - NF_NAT_MANIP_SRC);
> - }
> - }
> return err;
> #else
> return NF_ACCEPT;
> --
> 2.31.1
>
Powered by blists - more mailing lists