[v2,5/6] netfilter: GSO packet handling

Handle >0 return value from outfn in __nf_queue(). This value
is not passed up the stack but intercepted by nf_queue(), which
returns 0 to upper layers.

Also add support for GSO skb. If __nf_queue() returns >0 to
indicate fail-open, we call okfn() immediately.

Signed-off-by: Krishna Kumar <krkumar2@in.ibm.com>
Signed-off-by: Vivek Kashyap <vivk@us.ibm.com>
Signed-off-by: Sridhar Samudrala <samudrala@us.ibm.com>
---
 net/netfilter/nf_queue.c |   33 +++++++++++++++++++++++++++------
 1 file changed, 27 insertions(+), 6 deletions(-)


--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

On Tue, May 08, 2012 at 03:14:42PM +0530, Krishna Kumar wrote:
> Handle >0 return value from outfn in __nf_queue(). This value
> is not passed up the stack but intercepted by nf_queue(), which
> returns 0 to upper layers.
> 
> Also add support for GSO skb. If __nf_queue() returns >0 to
> indicate fail-open, we call okfn() immediately.
> 
> Signed-off-by: Krishna Kumar <krkumar2@in.ibm.com>
> Signed-off-by: Vivek Kashyap <vivk@us.ibm.com>
> Signed-off-by: Sridhar Samudrala <samudrala@us.ibm.com>
> ---
>  net/netfilter/nf_queue.c |   33 +++++++++++++++++++++++++++------
>  1 file changed, 27 insertions(+), 6 deletions(-)
> 
> diff -ruNp org/net/netfilter/nf_queue.c new/net/netfilter/nf_queue.c
> --- org/net/netfilter/nf_queue.c	2012-05-08 13:02:18.163816400 +0530
> +++ new/net/netfilter/nf_queue.c	2012-05-08 15:08:11.028555335 +0530
> @@ -189,7 +189,7 @@ static int __nf_queue(struct sk_buff *sk
>  
>  	rcu_read_unlock();
>  
> -	if (status < 0) {
> +	if (status) {
>  		nf_queue_entry_release_refs(entry);
>  		goto err;
>  	}
> @@ -236,9 +236,18 @@ int nf_queue(struct sk_buff *skb,
>  	int err = -EINVAL;
>  	unsigned int queued;
>  
> -	if (!skb_is_gso(skb))
> -		return __nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
> +	if (!skb_is_gso(skb)) {
> +		err = __nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
>  				  queuenum);
> +		if (err > 0) {
> +			/* Queue failed due to queue-full and handler
> +			 * returned >0 indicating fail-open - temporarily
> +			 * accept packets.
> +			 */
> +			err = okfn(skb);

You cannot invoke okfn here. If you do so, you'll skip the remaining
hooks.

Return the error and handle the -ENOSPC in nf_hook_slow.

(Note that the -ENOSPC is the error value I'm proposing you to use for
this special case).

> +		}
> +		return err;
> +	}
>  
>  	switch (pf) {
>  	case NFPROTO_IPV4:
> @@ -268,14 +277,26 @@ int nf_queue(struct sk_buff *skb,
>  			err = __nf_queue(segs, elem, pf, hook, indev,
>  					   outdev, okfn, queuenum);
>  		}
> -		if (err == 0)
> +
> +		if (err == 0) {
>  			queued++;
> -		else
> +		} else if (err > 0) {
> +			/* Queue failed due to queue-full and handler
> +			 * returned >0 indicating fail-open - accept
> +			 * this and remaining segments.
> +			 */
> +			okfn(segs);
> +		} else {
> +			/* Queue failed due to queue-full and handler
> +			 * returned <0 - free this and remaining skb
> +			 * segments.
> +			 */
>  			kfree_skb(segs);
> +		}
>  		segs = nskb;
>  	} while (segs);
>  
> -	if (queued) {
> +	if (queued || err > 0) {
>  		kfree_skb(skb);
>  		return 0;
>  	}
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Pablo Neira Ayuso <pablo@netfilter.org> wrote on 05/08/2012 05:58:28 PM:


> > +   if (!skb_is_gso(skb)) {
> > +      err = __nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
> >                queuenum);
> > +      if (err > 0) {
> > +         /* Queue failed due to queue-full and handler
> > +          * returned >0 indicating fail-open - temporarily
> > +          * accept packets.
> > +          */
> > +         err = okfn(skb);
>
> You cannot invoke okfn here. If you do so, you'll skip the remaining
> hooks.
>
> Return the error and handle the -ENOSPC in nf_hook_slow.
>
> (Note that the -ENOSPC is the error value I'm proposing you to use for
> this special case).

Are you suggesting to change nf_hook_slow to:

	if (err == -ENOSPC || err == -ECANCELED)
		goto next_hook;

In that case, how should the GSO case be handled (code below)?

Thanks for your feedback,

- KK

> > @@ -268,14 +277,26 @@ int nf_queue(struct sk_buff *skb,
> >           err = __nf_queue(segs, elem, pf, hook, indev,
> >                    outdev, okfn, queuenum);
> >        }
> > -      if (err == 0)
> > +
> > +      if (err == 0) {
> >           queued++;
> > -      else
> > +      } else if (err > 0) {
> > +         /* Queue failed due to queue-full and handler
> > +          * returned >0 indicating fail-open - accept
> > +          * this and remaining segments.
> > +          */
> > +         okfn(segs);
> > +      } else {
> > +         /* Queue failed due to queue-full and handler
> > +          * returned <0 - free this and remaining skb
> > +          * segments.
> > +          */
> >           kfree_skb(segs);
> > +      }
> >        segs = nskb;
> >     } while (segs);
> >
> > -   if (queued) {
> > +   if (queued || err > 0) {
> >        kfree_skb(skb);
> >        return 0;
> >     }

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html