1 /* SPDX-License-Identifier: GPL-2.0 */
2 #include <linux/init.h>
3 #include <linux/module.h>
4 #include <linux/netfilter.h>
5 #include <net/flow_offload.h>
6 #include <net/netfilter/nf_tables.h>
7 #include <net/netfilter/nf_tables_offload.h>
8 #include <net/pkt_cls.h>
9 
nft_flow_rule_alloc(int num_actions)10 static struct nft_flow_rule *nft_flow_rule_alloc(int num_actions)
11 {
12 	struct nft_flow_rule *flow;
13 
14 	flow = kzalloc(sizeof(struct nft_flow_rule), GFP_KERNEL);
15 	if (!flow)
16 		return NULL;
17 
18 	flow->rule = flow_rule_alloc(num_actions);
19 	if (!flow->rule) {
20 		kfree(flow);
21 		return NULL;
22 	}
23 
24 	flow->rule->match.dissector	= &flow->match.dissector;
25 	flow->rule->match.mask		= &flow->match.mask;
26 	flow->rule->match.key		= &flow->match.key;
27 
28 	return flow;
29 }
30 
nft_flow_rule_set_addr_type(struct nft_flow_rule * flow,enum flow_dissector_key_id addr_type)31 void nft_flow_rule_set_addr_type(struct nft_flow_rule *flow,
32 				 enum flow_dissector_key_id addr_type)
33 {
34 	struct nft_flow_match *match = &flow->match;
35 	struct nft_flow_key *mask = &match->mask;
36 	struct nft_flow_key *key = &match->key;
37 
38 	if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_CONTROL))
39 		return;
40 
41 	key->control.addr_type = addr_type;
42 	mask->control.addr_type = 0xffff;
43 	match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_CONTROL);
44 	match->dissector.offset[FLOW_DISSECTOR_KEY_CONTROL] =
45 		offsetof(struct nft_flow_key, control);
46 }
47 
48 struct nft_offload_ethertype {
49 	__be16 value;
50 	__be16 mask;
51 };
52 
nft_flow_rule_transfer_vlan(struct nft_offload_ctx * ctx,struct nft_flow_rule * flow)53 static void nft_flow_rule_transfer_vlan(struct nft_offload_ctx *ctx,
54 					struct nft_flow_rule *flow)
55 {
56 	struct nft_flow_match *match = &flow->match;
57 	struct nft_offload_ethertype ethertype = {
58 		.value	= match->key.basic.n_proto,
59 		.mask	= match->mask.basic.n_proto,
60 	};
61 
62 	if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_VLAN) &&
63 	    (match->key.vlan.vlan_tpid == htons(ETH_P_8021Q) ||
64 	     match->key.vlan.vlan_tpid == htons(ETH_P_8021AD))) {
65 		match->key.basic.n_proto = match->key.cvlan.vlan_tpid;
66 		match->mask.basic.n_proto = match->mask.cvlan.vlan_tpid;
67 		match->key.cvlan.vlan_tpid = match->key.vlan.vlan_tpid;
68 		match->mask.cvlan.vlan_tpid = match->mask.vlan.vlan_tpid;
69 		match->key.vlan.vlan_tpid = ethertype.value;
70 		match->mask.vlan.vlan_tpid = ethertype.mask;
71 		match->dissector.offset[FLOW_DISSECTOR_KEY_CVLAN] =
72 			offsetof(struct nft_flow_key, cvlan);
73 		match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_CVLAN);
74 	} else if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_BASIC) &&
75 		   (match->key.basic.n_proto == htons(ETH_P_8021Q) ||
76 		    match->key.basic.n_proto == htons(ETH_P_8021AD))) {
77 		match->key.basic.n_proto = match->key.vlan.vlan_tpid;
78 		match->mask.basic.n_proto = match->mask.vlan.vlan_tpid;
79 		match->key.vlan.vlan_tpid = ethertype.value;
80 		match->mask.vlan.vlan_tpid = ethertype.mask;
81 		match->dissector.offset[FLOW_DISSECTOR_KEY_VLAN] =
82 			offsetof(struct nft_flow_key, vlan);
83 		match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_VLAN);
84 	}
85 }
86 
nft_flow_rule_create(struct net * net,const struct nft_rule * rule)87 struct nft_flow_rule *nft_flow_rule_create(struct net *net,
88 					   const struct nft_rule *rule)
89 {
90 	struct nft_offload_ctx *ctx;
91 	struct nft_flow_rule *flow;
92 	int num_actions = 0, err;
93 	struct nft_expr *expr;
94 
95 	expr = nft_expr_first(rule);
96 	while (nft_expr_more(rule, expr)) {
97 		if (expr->ops->offload_action &&
98 		    expr->ops->offload_action(expr))
99 			num_actions++;
100 
101 		expr = nft_expr_next(expr);
102 	}
103 
104 	if (num_actions == 0)
105 		return ERR_PTR(-EOPNOTSUPP);
106 
107 	flow = nft_flow_rule_alloc(num_actions);
108 	if (!flow)
109 		return ERR_PTR(-ENOMEM);
110 
111 	expr = nft_expr_first(rule);
112 
113 	ctx = kzalloc(sizeof(struct nft_offload_ctx), GFP_KERNEL);
114 	if (!ctx) {
115 		err = -ENOMEM;
116 		goto err_out;
117 	}
118 	ctx->net = net;
119 	ctx->dep.type = NFT_OFFLOAD_DEP_UNSPEC;
120 
121 	while (nft_expr_more(rule, expr)) {
122 		if (!expr->ops->offload) {
123 			err = -EOPNOTSUPP;
124 			goto err_out;
125 		}
126 		err = expr->ops->offload(ctx, flow, expr);
127 		if (err < 0)
128 			goto err_out;
129 
130 		expr = nft_expr_next(expr);
131 	}
132 	nft_flow_rule_transfer_vlan(ctx, flow);
133 
134 	flow->proto = ctx->dep.l3num;
135 	kfree(ctx);
136 
137 	return flow;
138 err_out:
139 	kfree(ctx);
140 	nft_flow_rule_destroy(flow);
141 
142 	return ERR_PTR(err);
143 }
144 
nft_flow_rule_destroy(struct nft_flow_rule * flow)145 void nft_flow_rule_destroy(struct nft_flow_rule *flow)
146 {
147 	struct flow_action_entry *entry;
148 	int i;
149 
150 	flow_action_for_each(i, entry, &flow->rule->action) {
151 		switch (entry->id) {
152 		case FLOW_ACTION_REDIRECT:
153 		case FLOW_ACTION_MIRRED:
154 			dev_put(entry->dev);
155 			break;
156 		default:
157 			break;
158 		}
159 	}
160 	kfree(flow->rule);
161 	kfree(flow);
162 }
163 
nft_offload_set_dependency(struct nft_offload_ctx * ctx,enum nft_offload_dep_type type)164 void nft_offload_set_dependency(struct nft_offload_ctx *ctx,
165 				enum nft_offload_dep_type type)
166 {
167 	ctx->dep.type = type;
168 }
169 
nft_offload_update_dependency(struct nft_offload_ctx * ctx,const void * data,u32 len)170 void nft_offload_update_dependency(struct nft_offload_ctx *ctx,
171 				   const void *data, u32 len)
172 {
173 	switch (ctx->dep.type) {
174 	case NFT_OFFLOAD_DEP_NETWORK:
175 		WARN_ON(len != sizeof(__u16));
176 		memcpy(&ctx->dep.l3num, data, sizeof(__u16));
177 		break;
178 	case NFT_OFFLOAD_DEP_TRANSPORT:
179 		WARN_ON(len != sizeof(__u8));
180 		memcpy(&ctx->dep.protonum, data, sizeof(__u8));
181 		break;
182 	default:
183 		break;
184 	}
185 	ctx->dep.type = NFT_OFFLOAD_DEP_UNSPEC;
186 }
187 
nft_flow_offload_common_init(struct flow_cls_common_offload * common,__be16 proto,int priority,struct netlink_ext_ack * extack)188 static void nft_flow_offload_common_init(struct flow_cls_common_offload *common,
189 					 __be16 proto, int priority,
190 					 struct netlink_ext_ack *extack)
191 {
192 	common->protocol = proto;
193 	common->prio = priority;
194 	common->extack = extack;
195 }
196 
nft_setup_cb_call(enum tc_setup_type type,void * type_data,struct list_head * cb_list)197 static int nft_setup_cb_call(enum tc_setup_type type, void *type_data,
198 			     struct list_head *cb_list)
199 {
200 	struct flow_block_cb *block_cb;
201 	int err;
202 
203 	list_for_each_entry(block_cb, cb_list, list) {
204 		err = block_cb->cb(type, type_data, block_cb->cb_priv);
205 		if (err < 0)
206 			return err;
207 	}
208 	return 0;
209 }
210 
nft_chain_offload_priority(const struct nft_base_chain * basechain)211 static int nft_chain_offload_priority(const struct nft_base_chain *basechain)
212 {
213 	if (basechain->ops.priority <= 0 ||
214 	    basechain->ops.priority > USHRT_MAX)
215 		return -1;
216 
217 	return 0;
218 }
219 
nft_chain_offload_support(const struct nft_base_chain * basechain)220 bool nft_chain_offload_support(const struct nft_base_chain *basechain)
221 {
222 	struct net_device *dev;
223 	struct nft_hook *hook;
224 
225 	if (nft_chain_offload_priority(basechain) < 0)
226 		return false;
227 
228 	list_for_each_entry(hook, &basechain->hook_list, list) {
229 		if (hook->ops.pf != NFPROTO_NETDEV ||
230 		    hook->ops.hooknum != NF_NETDEV_INGRESS)
231 			return false;
232 
233 		dev = hook->ops.dev;
234 		if (!dev->netdev_ops->ndo_setup_tc && !flow_indr_dev_exists())
235 			return false;
236 	}
237 
238 	return true;
239 }
240 
nft_flow_cls_offload_setup(struct flow_cls_offload * cls_flow,const struct nft_base_chain * basechain,const struct nft_rule * rule,const struct nft_flow_rule * flow,struct netlink_ext_ack * extack,enum flow_cls_command command)241 static void nft_flow_cls_offload_setup(struct flow_cls_offload *cls_flow,
242 				       const struct nft_base_chain *basechain,
243 				       const struct nft_rule *rule,
244 				       const struct nft_flow_rule *flow,
245 				       struct netlink_ext_ack *extack,
246 				       enum flow_cls_command command)
247 {
248 	__be16 proto = ETH_P_ALL;
249 
250 	memset(cls_flow, 0, sizeof(*cls_flow));
251 
252 	if (flow)
253 		proto = flow->proto;
254 
255 	nft_flow_offload_common_init(&cls_flow->common, proto,
256 				     basechain->ops.priority, extack);
257 	cls_flow->command = command;
258 	cls_flow->cookie = (unsigned long) rule;
259 	if (flow)
260 		cls_flow->rule = flow->rule;
261 }
262 
nft_flow_offload_cmd(const struct nft_chain * chain,const struct nft_rule * rule,struct nft_flow_rule * flow,enum flow_cls_command command,struct flow_cls_offload * cls_flow)263 static int nft_flow_offload_cmd(const struct nft_chain *chain,
264 				const struct nft_rule *rule,
265 				struct nft_flow_rule *flow,
266 				enum flow_cls_command command,
267 				struct flow_cls_offload *cls_flow)
268 {
269 	struct netlink_ext_ack extack = {};
270 	struct nft_base_chain *basechain;
271 
272 	if (!nft_is_base_chain(chain))
273 		return -EOPNOTSUPP;
274 
275 	basechain = nft_base_chain(chain);
276 	nft_flow_cls_offload_setup(cls_flow, basechain, rule, flow, &extack,
277 				   command);
278 
279 	return nft_setup_cb_call(TC_SETUP_CLSFLOWER, cls_flow,
280 				 &basechain->flow_block.cb_list);
281 }
282 
nft_flow_offload_rule(const struct nft_chain * chain,struct nft_rule * rule,struct nft_flow_rule * flow,enum flow_cls_command command)283 static int nft_flow_offload_rule(const struct nft_chain *chain,
284 				 struct nft_rule *rule,
285 				 struct nft_flow_rule *flow,
286 				 enum flow_cls_command command)
287 {
288 	struct flow_cls_offload cls_flow;
289 
290 	return nft_flow_offload_cmd(chain, rule, flow, command, &cls_flow);
291 }
292 
nft_flow_rule_stats(const struct nft_chain * chain,const struct nft_rule * rule)293 int nft_flow_rule_stats(const struct nft_chain *chain,
294 			const struct nft_rule *rule)
295 {
296 	struct flow_cls_offload cls_flow = {};
297 	struct nft_expr *expr, *next;
298 	int err;
299 
300 	err = nft_flow_offload_cmd(chain, rule, NULL, FLOW_CLS_STATS,
301 				   &cls_flow);
302 	if (err < 0)
303 		return err;
304 
305 	nft_rule_for_each_expr(expr, next, rule) {
306 		if (expr->ops->offload_stats)
307 			expr->ops->offload_stats(expr, &cls_flow.stats);
308 	}
309 
310 	return 0;
311 }
312 
nft_flow_offload_bind(struct flow_block_offload * bo,struct nft_base_chain * basechain)313 static int nft_flow_offload_bind(struct flow_block_offload *bo,
314 				 struct nft_base_chain *basechain)
315 {
316 	list_splice(&bo->cb_list, &basechain->flow_block.cb_list);
317 	return 0;
318 }
319 
nft_flow_offload_unbind(struct flow_block_offload * bo,struct nft_base_chain * basechain)320 static int nft_flow_offload_unbind(struct flow_block_offload *bo,
321 				   struct nft_base_chain *basechain)
322 {
323 	struct flow_block_cb *block_cb, *next;
324 	struct flow_cls_offload cls_flow;
325 	struct netlink_ext_ack extack;
326 	struct nft_chain *chain;
327 	struct nft_rule *rule;
328 
329 	chain = &basechain->chain;
330 	list_for_each_entry(rule, &chain->rules, list) {
331 		memset(&extack, 0, sizeof(extack));
332 		nft_flow_cls_offload_setup(&cls_flow, basechain, rule, NULL,
333 					   &extack, FLOW_CLS_DESTROY);
334 		nft_setup_cb_call(TC_SETUP_CLSFLOWER, &cls_flow, &bo->cb_list);
335 	}
336 
337 	list_for_each_entry_safe(block_cb, next, &bo->cb_list, list) {
338 		list_del(&block_cb->list);
339 		flow_block_cb_free(block_cb);
340 	}
341 
342 	return 0;
343 }
344 
nft_block_setup(struct nft_base_chain * basechain,struct flow_block_offload * bo,enum flow_block_command cmd)345 static int nft_block_setup(struct nft_base_chain *basechain,
346 			   struct flow_block_offload *bo,
347 			   enum flow_block_command cmd)
348 {
349 	int err;
350 
351 	switch (cmd) {
352 	case FLOW_BLOCK_BIND:
353 		err = nft_flow_offload_bind(bo, basechain);
354 		break;
355 	case FLOW_BLOCK_UNBIND:
356 		err = nft_flow_offload_unbind(bo, basechain);
357 		break;
358 	default:
359 		WARN_ON_ONCE(1);
360 		err = -EOPNOTSUPP;
361 	}
362 
363 	return err;
364 }
365 
nft_flow_block_offload_init(struct flow_block_offload * bo,struct net * net,enum flow_block_command cmd,struct nft_base_chain * basechain,struct netlink_ext_ack * extack)366 static void nft_flow_block_offload_init(struct flow_block_offload *bo,
367 					struct net *net,
368 					enum flow_block_command cmd,
369 					struct nft_base_chain *basechain,
370 					struct netlink_ext_ack *extack)
371 {
372 	memset(bo, 0, sizeof(*bo));
373 	bo->net		= net;
374 	bo->block	= &basechain->flow_block;
375 	bo->command	= cmd;
376 	bo->binder_type	= FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
377 	bo->extack	= extack;
378 	bo->cb_list_head = &basechain->flow_block.cb_list;
379 	INIT_LIST_HEAD(&bo->cb_list);
380 }
381 
nft_block_offload_cmd(struct nft_base_chain * chain,struct net_device * dev,enum flow_block_command cmd)382 static int nft_block_offload_cmd(struct nft_base_chain *chain,
383 				 struct net_device *dev,
384 				 enum flow_block_command cmd)
385 {
386 	struct netlink_ext_ack extack = {};
387 	struct flow_block_offload bo;
388 	int err;
389 
390 	nft_flow_block_offload_init(&bo, dev_net(dev), cmd, chain, &extack);
391 
392 	err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_BLOCK, &bo);
393 	if (err < 0)
394 		return err;
395 
396 	return nft_block_setup(chain, &bo, cmd);
397 }
398 
nft_indr_block_cleanup(struct flow_block_cb * block_cb)399 static void nft_indr_block_cleanup(struct flow_block_cb *block_cb)
400 {
401 	struct nft_base_chain *basechain = block_cb->indr.data;
402 	struct net_device *dev = block_cb->indr.dev;
403 	struct netlink_ext_ack extack = {};
404 	struct nftables_pernet *nft_net;
405 	struct net *net = dev_net(dev);
406 	struct flow_block_offload bo;
407 
408 	nft_flow_block_offload_init(&bo, dev_net(dev), FLOW_BLOCK_UNBIND,
409 				    basechain, &extack);
410 	nft_net = nft_pernet(net);
411 	mutex_lock(&nft_net->commit_mutex);
412 	list_del(&block_cb->driver_list);
413 	list_move(&block_cb->list, &bo.cb_list);
414 	nft_flow_offload_unbind(&bo, basechain);
415 	mutex_unlock(&nft_net->commit_mutex);
416 }
417 
nft_indr_block_offload_cmd(struct nft_base_chain * basechain,struct net_device * dev,enum flow_block_command cmd)418 static int nft_indr_block_offload_cmd(struct nft_base_chain *basechain,
419 				      struct net_device *dev,
420 				      enum flow_block_command cmd)
421 {
422 	struct netlink_ext_ack extack = {};
423 	struct flow_block_offload bo;
424 	int err;
425 
426 	nft_flow_block_offload_init(&bo, dev_net(dev), cmd, basechain, &extack);
427 
428 	err = flow_indr_dev_setup_offload(dev, NULL, TC_SETUP_BLOCK, basechain, &bo,
429 					  nft_indr_block_cleanup);
430 	if (err < 0)
431 		return err;
432 
433 	if (list_empty(&bo.cb_list))
434 		return -EOPNOTSUPP;
435 
436 	return nft_block_setup(basechain, &bo, cmd);
437 }
438 
nft_chain_offload_cmd(struct nft_base_chain * basechain,struct net_device * dev,enum flow_block_command cmd)439 static int nft_chain_offload_cmd(struct nft_base_chain *basechain,
440 				 struct net_device *dev,
441 				 enum flow_block_command cmd)
442 {
443 	int err;
444 
445 	if (dev->netdev_ops->ndo_setup_tc)
446 		err = nft_block_offload_cmd(basechain, dev, cmd);
447 	else
448 		err = nft_indr_block_offload_cmd(basechain, dev, cmd);
449 
450 	return err;
451 }
452 
nft_flow_block_chain(struct nft_base_chain * basechain,const struct net_device * this_dev,enum flow_block_command cmd)453 static int nft_flow_block_chain(struct nft_base_chain *basechain,
454 				const struct net_device *this_dev,
455 				enum flow_block_command cmd)
456 {
457 	struct net_device *dev;
458 	struct nft_hook *hook;
459 	int err, i = 0;
460 
461 	list_for_each_entry(hook, &basechain->hook_list, list) {
462 		dev = hook->ops.dev;
463 		if (this_dev && this_dev != dev)
464 			continue;
465 
466 		err = nft_chain_offload_cmd(basechain, dev, cmd);
467 		if (err < 0 && cmd == FLOW_BLOCK_BIND) {
468 			if (!this_dev)
469 				goto err_flow_block;
470 
471 			return err;
472 		}
473 		i++;
474 	}
475 
476 	return 0;
477 
478 err_flow_block:
479 	list_for_each_entry(hook, &basechain->hook_list, list) {
480 		if (i-- <= 0)
481 			break;
482 
483 		dev = hook->ops.dev;
484 		nft_chain_offload_cmd(basechain, dev, FLOW_BLOCK_UNBIND);
485 	}
486 	return err;
487 }
488 
nft_flow_offload_chain(struct nft_chain * chain,u8 * ppolicy,enum flow_block_command cmd)489 static int nft_flow_offload_chain(struct nft_chain *chain, u8 *ppolicy,
490 				  enum flow_block_command cmd)
491 {
492 	struct nft_base_chain *basechain;
493 	u8 policy;
494 
495 	if (!nft_is_base_chain(chain))
496 		return -EOPNOTSUPP;
497 
498 	basechain = nft_base_chain(chain);
499 	policy = ppolicy ? *ppolicy : basechain->policy;
500 
501 	/* Only default policy to accept is supported for now. */
502 	if (cmd == FLOW_BLOCK_BIND && policy == NF_DROP)
503 		return -EOPNOTSUPP;
504 
505 	return nft_flow_block_chain(basechain, NULL, cmd);
506 }
507 
nft_flow_rule_offload_abort(struct net * net,struct nft_trans * trans)508 static void nft_flow_rule_offload_abort(struct net *net,
509 					struct nft_trans *trans)
510 {
511 	struct nftables_pernet *nft_net = nft_pernet(net);
512 	int err = 0;
513 
514 	list_for_each_entry_continue_reverse(trans, &nft_net->commit_list, list) {
515 		if (trans->ctx.family != NFPROTO_NETDEV)
516 			continue;
517 
518 		switch (trans->msg_type) {
519 		case NFT_MSG_NEWCHAIN:
520 			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) ||
521 			    nft_trans_chain_update(trans))
522 				continue;
523 
524 			err = nft_flow_offload_chain(trans->ctx.chain, NULL,
525 						     FLOW_BLOCK_UNBIND);
526 			break;
527 		case NFT_MSG_DELCHAIN:
528 			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
529 				continue;
530 
531 			err = nft_flow_offload_chain(trans->ctx.chain, NULL,
532 						     FLOW_BLOCK_BIND);
533 			break;
534 		case NFT_MSG_NEWRULE:
535 			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
536 				continue;
537 
538 			err = nft_flow_offload_rule(trans->ctx.chain,
539 						    nft_trans_rule(trans),
540 						    NULL, FLOW_CLS_DESTROY);
541 			break;
542 		case NFT_MSG_DELRULE:
543 			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
544 				continue;
545 
546 			err = nft_flow_offload_rule(trans->ctx.chain,
547 						    nft_trans_rule(trans),
548 						    nft_trans_flow_rule(trans),
549 						    FLOW_CLS_REPLACE);
550 			break;
551 		}
552 
553 		if (WARN_ON_ONCE(err))
554 			break;
555 	}
556 }
557 
nft_flow_rule_offload_commit(struct net * net)558 int nft_flow_rule_offload_commit(struct net *net)
559 {
560 	struct nftables_pernet *nft_net = nft_pernet(net);
561 	struct nft_trans *trans;
562 	int err = 0;
563 	u8 policy;
564 
565 	list_for_each_entry(trans, &nft_net->commit_list, list) {
566 		if (trans->ctx.family != NFPROTO_NETDEV)
567 			continue;
568 
569 		switch (trans->msg_type) {
570 		case NFT_MSG_NEWCHAIN:
571 			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) ||
572 			    nft_trans_chain_update(trans))
573 				continue;
574 
575 			policy = nft_trans_chain_policy(trans);
576 			err = nft_flow_offload_chain(trans->ctx.chain, &policy,
577 						     FLOW_BLOCK_BIND);
578 			break;
579 		case NFT_MSG_DELCHAIN:
580 			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
581 				continue;
582 
583 			policy = nft_trans_chain_policy(trans);
584 			err = nft_flow_offload_chain(trans->ctx.chain, &policy,
585 						     FLOW_BLOCK_UNBIND);
586 			break;
587 		case NFT_MSG_NEWRULE:
588 			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
589 				continue;
590 
591 			if (trans->ctx.flags & NLM_F_REPLACE ||
592 			    !(trans->ctx.flags & NLM_F_APPEND)) {
593 				err = -EOPNOTSUPP;
594 				break;
595 			}
596 			err = nft_flow_offload_rule(trans->ctx.chain,
597 						    nft_trans_rule(trans),
598 						    nft_trans_flow_rule(trans),
599 						    FLOW_CLS_REPLACE);
600 			break;
601 		case NFT_MSG_DELRULE:
602 			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
603 				continue;
604 
605 			err = nft_flow_offload_rule(trans->ctx.chain,
606 						    nft_trans_rule(trans),
607 						    NULL, FLOW_CLS_DESTROY);
608 			break;
609 		}
610 
611 		if (err) {
612 			nft_flow_rule_offload_abort(net, trans);
613 			break;
614 		}
615 	}
616 
617 	return err;
618 }
619 
__nft_offload_get_chain(const struct nftables_pernet * nft_net,struct net_device * dev)620 static struct nft_chain *__nft_offload_get_chain(const struct nftables_pernet *nft_net,
621 						 struct net_device *dev)
622 {
623 	struct nft_base_chain *basechain;
624 	struct nft_hook *hook, *found;
625 	const struct nft_table *table;
626 	struct nft_chain *chain;
627 
628 	list_for_each_entry(table, &nft_net->tables, list) {
629 		if (table->family != NFPROTO_NETDEV)
630 			continue;
631 
632 		list_for_each_entry(chain, &table->chains, list) {
633 			if (!nft_is_base_chain(chain) ||
634 			    !(chain->flags & NFT_CHAIN_HW_OFFLOAD))
635 				continue;
636 
637 			found = NULL;
638 			basechain = nft_base_chain(chain);
639 			list_for_each_entry(hook, &basechain->hook_list, list) {
640 				if (hook->ops.dev != dev)
641 					continue;
642 
643 				found = hook;
644 				break;
645 			}
646 			if (!found)
647 				continue;
648 
649 			return chain;
650 		}
651 	}
652 
653 	return NULL;
654 }
655 
nft_offload_netdev_event(struct notifier_block * this,unsigned long event,void * ptr)656 static int nft_offload_netdev_event(struct notifier_block *this,
657 				    unsigned long event, void *ptr)
658 {
659 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
660 	struct nftables_pernet *nft_net;
661 	struct net *net = dev_net(dev);
662 	struct nft_chain *chain;
663 
664 	if (event != NETDEV_UNREGISTER)
665 		return NOTIFY_DONE;
666 
667 	nft_net = nft_pernet(net);
668 	mutex_lock(&nft_net->commit_mutex);
669 	chain = __nft_offload_get_chain(nft_net, dev);
670 	if (chain)
671 		nft_flow_block_chain(nft_base_chain(chain), dev,
672 				     FLOW_BLOCK_UNBIND);
673 
674 	mutex_unlock(&nft_net->commit_mutex);
675 
676 	return NOTIFY_DONE;
677 }
678 
679 static struct notifier_block nft_offload_netdev_notifier = {
680 	.notifier_call	= nft_offload_netdev_event,
681 };
682 
nft_offload_init(void)683 int nft_offload_init(void)
684 {
685 	return register_netdevice_notifier(&nft_offload_netdev_notifier);
686 }
687 
nft_offload_exit(void)688 void nft_offload_exit(void)
689 {
690 	unregister_netdevice_notifier(&nft_offload_netdev_notifier);
691 }
692