From: Evgeniy Polyakov <johnpol@2ka•mipt.ru>
To: Herbert Xu <herbert@gondor•apana.org.au>
Cc: "David S. Miller" <davem@davemloft•net>,
netdev@vger•kernel.org, Alexey Kuznetsov <kuznet@ms2•inr.ac.ru>,
jamal <hadi@cyberus•ca>
Subject: Re: [PKT_SCHED]: Add stateless NAT
Date: Thu, 27 Sep 2007 13:25:12 +0400 [thread overview]
Message-ID: <20070927092512.GD29329@2ka.mipt.ru> (raw)
In-Reply-To: <20070927073446.GA14643@gondor.apana.org.au>
Hi Herbert.
On Thu, Sep 27, 2007 at 03:34:47PM +0800, Herbert Xu (herbert@gondor•apana.org.au) wrote:
> Hi:
>
> [PKT_SCHED]: Add stateless NAT
>
> Stateless NAT is useful in controlled environments where restrictions are
> placed on through traffic such that we don't need connection tracking to
> correctly NAT protocol-specific data.
Couple of comments below.
> --- a/net/sched/Kconfig
> +++ b/net/sched/Kconfig
> @@ -447,6 +447,17 @@ config NET_ACT_IPT
> To compile this code as a module, choose M here: the
> module will be called ipt.
>
> +config NET_ACT_NAT
> + tristate "Stateless NAT"
> + depends on NET_CLS_ACT
> + select NETFILTER
Argh... People usually do not understand such jokes :)
What about not using netfilter helpers and just move them to the
accessible header so that no additional slow path would ever be enabled?
> + ---help---
> + Say Y here to do stateless NAT on IPv4 packets. You should use
> + netfilter for NAT unless you know what you are doing.
> +
> + To compile this code as a module, choose M here: the
> + module will be called ipt.
> +
Modile will be called 'nat' I believe.
> +++ b/net/sched/act_nat.c
...
> +#define NAT_TAB_MASK 15
This really wants to be configurable at least via module parameter.
> +static struct tcf_common *tcf_nat_ht[NAT_TAB_MASK + 1];
> +static u32 nat_idx_gen;
> +static DEFINE_RWLOCK(nat_lock);
> +static struct tcf_hashinfo nat_hash_info = {
> + .htab = tcf_nat_ht,
> + .hmask = NAT_TAB_MASK,
> + .lock = &nat_lock,
> +};
When I read this I swear I heard 'I want to be RCU'.
But that is another task.
> +static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
> + struct tcf_result *res)
> +{
> + struct tcf_nat *p = a->priv;
> + struct iphdr *iph;
> + __be32 old_addr;
> + __be32 new_addr;
> + __be32 mask;
> + __be32 addr;
> + int egress;
> + int action;
> + int ihl;
> +
> + spin_lock(&p->tcf_lock);
> +
> + p->tcf_tm.lastuse = jiffies;
> + old_addr = p->old_addr;
> + new_addr = p->new_addr;
> + mask = p->mask;
> + egress = p->flags & TCA_NAT_FLAG_EGRESS;
> + action = p->tcf_action;
> +
> + p->tcf_bstats.bytes += skb->len;
> + p->tcf_bstats.packets++;
> +
> + spin_unlock(&p->tcf_lock);
> +
> + if (!pskb_may_pull(skb, sizeof(*iph)))
> + return TC_ACT_SHOT;
> +
> + iph = ip_hdr(skb);
> +
> + if (egress)
> + addr = iph->saddr;
> + else
> + addr = iph->daddr;
> +
> + if (!((old_addr ^ addr) & mask)) {
> + if (skb_cloned(skb) &&
> + !skb_clone_writable(skb, sizeof(*iph)) &&
> + pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
> + return TC_ACT_SHOT;
> +
> + new_addr &= mask;
> + new_addr |= addr & ~mask;
> +
> + /* Rewrite IP header */
> + iph = ip_hdr(skb);
> + if (egress)
> + iph->saddr = new_addr;
> + else
> + iph->daddr = new_addr;
> +
> + nf_csum_replace4(&iph->check, addr, new_addr);
> + }
> +
> + ihl = iph->ihl * 4;
> +
> + /* It would be nice to share code with stateful NAT. */
> + switch (iph->frag_off & htons(IP_OFFSET) ? 0 : iph->protocol) {
> + case IPPROTO_TCP:
> + {
> + struct tcphdr *tcph;
> +
> + if (!pskb_may_pull(skb, ihl + sizeof(*tcph)) ||
> + (skb_cloned(skb) &&
> + !skb_clone_writable(skb, ihl + sizeof(*tcph)) &&
> + pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
> + return TC_ACT_SHOT;
> +
> + tcph = (void *)(skb_network_header(skb) + ihl);
Were you too lazy to write struct tcphdr here and in other places? :)
--
Evgeniy Polyakov
next prev parent reply other threads:[~2007-09-27 9:27 UTC|newest]
Thread overview: 80+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-09-27 7:34 [PKT_SCHED]: Add stateless NAT Herbert Xu
2007-09-27 9:25 ` Evgeniy Polyakov [this message]
2007-09-27 9:33 ` Herbert Xu
2007-09-27 10:07 ` Evgeniy Polyakov
2007-09-27 10:29 ` Herbert Xu
2007-09-27 12:41 ` Evgeniy Polyakov
2007-09-27 12:45 ` Herbert Xu
2007-09-27 13:10 ` Evgeniy Polyakov
2007-09-27 13:16 ` Patrick McHardy
2007-09-27 13:25 ` Evgeniy Polyakov
2007-09-27 13:30 ` Patrick McHardy
2007-09-27 13:33 ` Evgeniy Polyakov
2007-09-27 13:34 ` jamal
2007-09-27 13:20 ` Herbert Xu
2007-09-27 13:29 ` Evgeniy Polyakov
2007-09-27 13:39 ` Patrick McHardy
2007-09-27 19:52 ` David Miller
2007-09-28 8:19 ` Evgeniy Polyakov
2007-09-28 9:16 ` Evgeniy Polyakov
2007-09-28 16:31 ` Patrick McHardy
2007-09-27 12:52 ` jamal
2007-09-27 13:06 ` Evgeniy Polyakov
2007-09-27 12:27 ` Herbert Xu
2007-09-27 12:46 ` jamal
2007-09-27 12:39 ` jamal
2007-09-27 12:58 ` Herbert Xu
2007-09-27 19:48 ` David Miller
2007-09-27 13:01 ` Herbert Xu
2007-09-27 13:16 ` jamal
2007-09-27 19:08 ` David Miller
2007-09-28 16:55 ` Patrick McHardy
2007-09-29 0:51 ` Herbert Xu
2007-09-29 3:37 ` Herbert Xu
2007-09-29 15:21 ` Patrick McHardy
2007-09-29 23:36 ` Herbert Xu
2007-09-30 0:13 ` David Miller
2007-09-30 0:26 ` Herbert Xu
2007-09-30 0:43 ` Herbert Xu
2007-09-30 15:38 ` Patrick McHardy
2007-10-14 4:26 ` [0/10] Remove sk_buff ** from netfilter API Herbert Xu
2007-10-14 4:27 ` [PATCH 1/10] [SKBUFF]: Merge common code between copy_skb_header and skb_clone Herbert Xu
2007-10-14 10:36 ` jamal
2007-10-14 4:27 ` [PATCH 2/10] [SKBUFF]: Add skb_morph Herbert Xu
2007-11-26 6:50 ` Yasuyuki KOZAKAI
[not found] ` <200711260650.lAQ6oOL9006774@toshiba.co.jp>
2007-11-26 15:10 ` Herbert Xu
2007-11-27 6:50 ` Yasuyuki KOZAKAI
2007-10-14 4:27 ` [PATCH 3/10] [IPV4]: Make ip_defrag return the same packet Herbert Xu
2007-10-14 4:27 ` [PATCH 4/10] [IPV4]: Change ip_defrag to return an integer Herbert Xu
2007-10-14 4:27 ` [PATCH 5/10] [NET]: Avoid unnecessary cloning for ingress filtering Herbert Xu
2007-10-14 10:49 ` jamal
2007-10-15 13:57 ` jamal
2007-10-15 14:28 ` Patrick McHardy
2007-10-15 14:55 ` Alexey Kuznetsov
2007-10-16 10:28 ` jamal
2007-10-14 4:27 ` [PATCH 6/10] [BRIDGE]: Unshare skb upon entry Herbert Xu
2007-10-15 7:20 ` Patrick McHardy
2007-10-15 8:04 ` Herbert Xu
2007-10-15 8:50 ` David Miller
2007-10-14 4:27 ` [PATCH 7/10] [NETFILTER]: Do not copy skb in skb_make_writable Herbert Xu
2007-10-14 4:27 ` [PATCH 8/10] [IPVS]: Replace local version of skb_make_writable Herbert Xu
2007-10-14 4:27 ` [PATCH 9/10] [NETFILTER]: Avoid skb_copy/pskb_copy/skb_realloc_headroom Herbert Xu
2007-10-14 4:27 ` [PATCH 10/10] [NETFILTER]: Replace sk_buff ** with sk_buff * Herbert Xu
2007-10-14 9:55 ` Herbert Xu
2007-10-14 14:46 ` [0/3] [IPV6]: Kill sk_buff ** usage on input path Herbert Xu
2007-10-14 14:49 ` [PATCH 1/3] [IPV6]: Make ipv6_frag_rcv return the same packet Herbert Xu
2007-10-15 8:28 ` David Miller
2007-10-14 14:49 ` [PATCH 2/3] [IPV6]: Avoid skb_copy/pskb_copy/skb_realloc_headroom on input Herbert Xu
2007-10-15 8:29 ` David Miller
2007-10-14 14:49 ` [PATCH 3/3] [IPV6]: Replace sk_buff ** with sk_buff * in input handlers Herbert Xu
2007-10-14 15:43 ` YOSHIFUJI Hideaki / 吉藤英明
2007-10-15 8:30 ` David Miller
2007-10-15 8:29 ` David Miller
2007-10-15 14:21 ` Herbert Xu
2007-10-15 8:27 ` [PATCH 10/10] [NETFILTER]: Replace sk_buff ** with sk_buff * David Miller
2007-10-15 6:25 ` [0/10] Remove sk_buff ** from netfilter API Patrick McHardy
2007-10-15 7:57 ` [IPV4]: Uninline netfilter okfns Patrick McHardy
2007-10-15 8:05 ` Herbert Xu
2007-10-15 8:30 ` [IPV6]: " Patrick McHardy
2007-10-15 8:51 ` David Miller
2007-10-15 8:49 ` [IPV4]: " David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20070927092512.GD29329@2ka.mipt.ru \
--to=johnpol@2ka$(echo .)mipt.ru \
--cc=davem@davemloft$(echo .)net \
--cc=hadi@cyberus$(echo .)ca \
--cc=herbert@gondor$(echo .)apana.org.au \
--cc=kuznet@ms2$(echo .)inr.ac.ru \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox