From nobody Mon Feb 9 17:24:19 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 796D7EB64DA for ; Wed, 12 Jul 2023 23:44:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232644AbjGLXod (ORCPT ); Wed, 12 Jul 2023 19:44:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49986 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232343AbjGLXo3 (ORCPT ); Wed, 12 Jul 2023 19:44:29 -0400 Received: from wout1-smtp.messagingengine.com (wout1-smtp.messagingengine.com [64.147.123.24]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 89D4B1986; Wed, 12 Jul 2023 16:44:28 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.west.internal (Postfix) with ESMTP id BC80C320093E; Wed, 12 Jul 2023 19:44:26 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute1.internal (MEProxy); Wed, 12 Jul 2023 19:44:28 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to; s=fm1; t=1689205466; x= 1689291866; bh=3RvQh4jFY2Kh9igZgTiTvyyFsNGKqOCVzW8Fk9+mwA0=; b=i NRH/v4y/adbQNUeASl7X2Ut3BZscCaKqyOVJAtoOj/9F0n7Z0atyr3SMw/Opou1a abL6MC5YAN9VN6TyK0dSZlAl3x04JHeK+SmLunnAjRyRC38afdReP3Xz2vrVBTGD N8PPQ6ctYi7t44NdhcWpp5mEDX9ehG7SL5XtsOTIM/NZ5zEg1bT4OM0AdCX1eUhD 2xqZRoFDpaGa5YqmuC3van8KJ60mVFR5Atlz1+8FiP4X31qT29Xl91FWHZYbACM7 glj5Ya7/F5Mc6+oO25dZQEQGKSfary9t7MBDbB5vfQbKUf7jmEVfmXyCO+7SbG2m ISJa7RNHFvvv80JvfF/cA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1689205466; x= 1689291866; bh=3RvQh4jFY2Kh9igZgTiTvyyFsNGKqOCVzW8Fk9+mwA0=; b=K Ny49kEWLKYYMGp8p7OJ2WvZzKlBWuFGwIRWby523Z31wieUT+hfBDlZhP+1agQ9f 03cTjmYwRej/BVPh4P/mXOytbGnvI39QNhk/wwil4NSqH4Y+LSLcnctSYf9f1FJX 3g5culy+GNDIxKdd7QFxAdQexeM0L31h3uDtiKwymYSqtf96/hqyiu9U8NawSGX8 cPzqx9Q9aTkGy4BZTrLB8QNYeR70VcuBesDfqZMeuLC58Sjk/kMJxiONbAL8T2s2 W5KNhqFkI+A4APT19k6CXGLCo4WI0RZ6Hg7/8DYiVyyu6BlJDquMdOi9EWgcxMj2 C/NdNuBRJMvk8aKWXR77A== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedviedrfeefgddvhecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecufghrlhcuvffnffculdefhedmnecujfgurhephffvve fufffkofgjfhgggfestdekredtredttdenucfhrhhomhepffgrnhhivghlucgiuhcuoegu gihusegugihuuhhurdighiiiqeenucggtffrrghtthgvrhhnpefgfefggeejhfduieekvd euteffleeifeeuvdfhheejleejjeekgfffgefhtddtteenucevlhhushhtvghrufhiiigv pedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpegugihusegugihuuhhurdighiii X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 12 Jul 2023 19:44:24 -0400 (EDT) From: Daniel Xu To: fw@strlen.de, davem@davemloft.net, pabeni@redhat.com, pablo@netfilter.org, dsahern@kernel.org, edumazet@google.com, kuba@kernel.org, kadlec@netfilter.org, alexei.starovoitov@gmail.com, daniel@iogearbox.net Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH bpf-next v4 1/6] netfilter: defrag: Add glue hooks for enabling/disabling defrag Date: Wed, 12 Jul 2023 17:43:56 -0600 Message-ID: X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" We want to be able to enable/disable IP packet defrag from core bpf/netfilter code. In other words, execute code from core that could possibly be built as a module. To help avoid symbol resolution errors, use glue hooks that the modules will register callbacks with during module init. Reviewed-by: Florian Westphal Signed-off-by: Daniel Xu --- include/linux/netfilter.h | 12 ++++++++++++ net/ipv4/netfilter/nf_defrag_ipv4.c | 16 +++++++++++++++- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 10 ++++++++++ net/netfilter/core.c | 6 ++++++ 4 files changed, 43 insertions(+), 1 deletion(-) diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index d4fed4c508ca..77a637b681f2 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -481,6 +481,18 @@ struct nfnl_ct_hook { }; extern const struct nfnl_ct_hook __rcu *nfnl_ct_hook; =20 +struct nf_defrag_v4_hook { + int (*enable)(struct net *net); + void (*disable)(struct net *net); +}; +extern const struct nf_defrag_v4_hook __rcu *nf_defrag_v4_hook; + +struct nf_defrag_v6_hook { + int (*enable)(struct net *net); + void (*disable)(struct net *net); +}; +extern const struct nf_defrag_v6_hook __rcu *nf_defrag_v6_hook; + /* * nf_skb_duplicated - TEE target has sent a packet * diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_de= frag_ipv4.c index e61ea428ea18..1f3e0e893b7a 100644 --- a/net/ipv4/netfilter/nf_defrag_ipv4.c +++ b/net/ipv4/netfilter/nf_defrag_ipv4.c @@ -7,6 +7,7 @@ #include #include #include +#include #include #include #include @@ -113,17 +114,30 @@ static void __net_exit defrag4_net_exit(struct net *n= et) } } =20 +static const struct nf_defrag_v4_hook defrag_hook =3D { + .enable =3D nf_defrag_ipv4_enable, + .disable =3D nf_defrag_ipv4_disable, +}; + static struct pernet_operations defrag4_net_ops =3D { .exit =3D defrag4_net_exit, }; =20 static int __init nf_defrag_init(void) { - return register_pernet_subsys(&defrag4_net_ops); + int err; + + err =3D register_pernet_subsys(&defrag4_net_ops); + if (err) + return err; + + rcu_assign_pointer(nf_defrag_v4_hook, &defrag_hook); + return err; } =20 static void __exit nf_defrag_fini(void) { + rcu_assign_pointer(nf_defrag_v4_hook, NULL); unregister_pernet_subsys(&defrag4_net_ops); } =20 diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter= /nf_defrag_ipv6_hooks.c index cb4eb1d2c620..f7c7ee31c472 100644 --- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include =20 @@ -96,6 +97,11 @@ static void __net_exit defrag6_net_exit(struct net *net) } } =20 +static const struct nf_defrag_v6_hook defrag_hook =3D { + .enable =3D nf_defrag_ipv6_enable, + .disable =3D nf_defrag_ipv6_disable, +}; + static struct pernet_operations defrag6_net_ops =3D { .exit =3D defrag6_net_exit, }; @@ -114,6 +120,9 @@ static int __init nf_defrag_init(void) pr_err("nf_defrag_ipv6: can't register pernet ops\n"); goto cleanup_frag6; } + + rcu_assign_pointer(nf_defrag_v6_hook, &defrag_hook); + return ret; =20 cleanup_frag6: @@ -124,6 +133,7 @@ static int __init nf_defrag_init(void) =20 static void __exit nf_defrag_fini(void) { + rcu_assign_pointer(nf_defrag_v6_hook, NULL); unregister_pernet_subsys(&defrag6_net_ops); nf_ct_frag6_cleanup(); } diff --git a/net/netfilter/core.c b/net/netfilter/core.c index 5f76ae86a656..34845155bb85 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -680,6 +680,12 @@ EXPORT_SYMBOL_GPL(nfnl_ct_hook); const struct nf_ct_hook __rcu *nf_ct_hook __read_mostly; EXPORT_SYMBOL_GPL(nf_ct_hook); =20 +const struct nf_defrag_v4_hook __rcu *nf_defrag_v4_hook __read_mostly; +EXPORT_SYMBOL_GPL(nf_defrag_v4_hook); + +const struct nf_defrag_v6_hook __rcu *nf_defrag_v6_hook __read_mostly; +EXPORT_SYMBOL_GPL(nf_defrag_v6_hook); + #if IS_ENABLED(CONFIG_NF_CONNTRACK) u8 nf_ctnetlink_has_listener; EXPORT_SYMBOL_GPL(nf_ctnetlink_has_listener); --=20 2.41.0