From: Florian Westphal <fw@strlen•de>
To: Daniel Xu <dxu@dxuuu•xyz>
Cc: daniel@iogearbox•net, edumazet@google•com, kuba@kernel•org,
fw@strlen•de, pabeni@redhat•com, pablo@netfilter•org,
andrii@kernel•org, davem@davemloft•net, ast@kernel•org,
kadlec@netfilter•org, martin.lau@linux•dev, song@kernel•org,
yhs@fb•com, john.fastabend@gmail•com, kpsingh@kernel•org,
sdf@google•com, haoluo@google•com, jolsa@kernel•org,
bpf@vger•kernel.org, linux-kernel@vger•kernel.org,
netfilter-devel@vger•kernel.org, coreteam@netfilter•org,
netdev@vger•kernel.org, dsahern@kernel•org
Subject: Re: [PATCH bpf-next 4/7] netfilter: bpf: Support BPF_F_NETFILTER_IP_DEFRAG in netfilter link
Date: Tue, 27 Jun 2023 13:12:48 +0200 [thread overview]
Message-ID: <20230627111248.GH3207@breakpoint.cc> (raw)
In-Reply-To: <242c66138bf4ec8aa26b29d736fb48242b4164ce.1687819413.git.dxu@dxuuu.xyz>
Daniel Xu <dxu@dxuuu•xyz> wrote:
> +static int bpf_nf_enable_defrag(struct bpf_nf_link *link)
> +{
> + int err;
> +
> + switch (link->hook_ops.pf) {
> +#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
> + case NFPROTO_IPV4:
> + const struct nf_defrag_v4_hook *v4_hook;
> +
> + err = request_module("nf_defrag_ipv4");
> + if (err)
> + return err;
> +
> + rcu_read_lock();
> + v4_hook = rcu_dereference(nf_defrag_v4_hook);
> + err = v4_hook->enable(link->net);
> + rcu_read_unlock();
I'd reverse this, first try rcu_dereference(), then modprobe
if thats returned NULL.
> +static void bpf_nf_disable_defrag(struct bpf_nf_link *link)
> +{
> + switch (link->hook_ops.pf) {
> +#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
> + case NFPROTO_IPV4:
> + const struct nf_defrag_v4_hook *v4_hook;
> +
> + rcu_read_lock();
> + v4_hook = rcu_dereference(nf_defrag_v4_hook);
> + v4_hook->disable(link->net);
> + rcu_read_unlock();
if (v4_hook)
v4_hook->disable()
Else we get trouble on manual 'rmmod'.
> + /* make sure conntrack confirm is always last */
> + prio = attr->link_create.netfilter.priority;
> + if (prio == NF_IP_PRI_FIRST)
> + return -ERANGE; /* sabotage_in and other warts */
> + else if (prio == NF_IP_PRI_LAST)
> + return -ERANGE; /* e.g. conntrack confirm */
> + else if ((attr->link_create.netfilter.flags & BPF_F_NETFILTER_IP_DEFRAG) &&
> + (prio > NF_IP_PRI_FIRST && prio <= NF_IP_PRI_CONNTRACK_DEFRAG))
> + return -ERANGE; /* cannot use defrag if prog runs before nf_defrag */
You could elide the (prio > NF_IP_PRI_FIRST, its already handled by
first conditional. Otherwise this looks good to me.
next prev parent reply other threads:[~2023-06-27 11:13 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-26 23:02 [PATCH bpf-next 0/7] Support defragmenting IPv(4|6) packets in BPF Daniel Xu
2023-06-26 23:02 ` [PATCH bpf-next 3/7] netfilter: defrag: Add glue hooks for enabling/disabling defrag Daniel Xu
2023-06-27 11:04 ` Florian Westphal
2023-06-26 23:02 ` [PATCH bpf-next 4/7] netfilter: bpf: Support BPF_F_NETFILTER_IP_DEFRAG in netfilter link Daniel Xu
2023-06-27 11:12 ` Florian Westphal [this message]
2023-06-27 15:35 ` Daniel Xu
2023-06-27 10:48 ` [PATCH bpf-next 0/7] Support defragmenting IPv(4|6) packets in BPF Florian Westphal
2023-06-27 14:18 ` Daniel Xu
2023-06-27 14:25 ` Toke Høiland-Jørgensen
2023-06-27 14:51 ` Daniel Xu
2023-06-27 15:44 ` Florian Westphal
2023-06-29 12:16 ` Toke Høiland-Jørgensen
2023-06-29 13:21 ` Florian Westphal
2023-06-29 14:35 ` Toke Høiland-Jørgensen
2023-06-29 14:53 ` Florian Westphal
2023-06-29 17:59 ` Daniel Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230627111248.GH3207@breakpoint.cc \
--to=fw@strlen$(echo .)de \
--cc=andrii@kernel$(echo .)org \
--cc=ast@kernel$(echo .)org \
--cc=bpf@vger$(echo .)kernel.org \
--cc=coreteam@netfilter$(echo .)org \
--cc=daniel@iogearbox$(echo .)net \
--cc=davem@davemloft$(echo .)net \
--cc=dsahern@kernel$(echo .)org \
--cc=dxu@dxuuu$(echo .)xyz \
--cc=edumazet@google$(echo .)com \
--cc=haoluo@google$(echo .)com \
--cc=john.fastabend@gmail$(echo .)com \
--cc=jolsa@kernel$(echo .)org \
--cc=kadlec@netfilter$(echo .)org \
--cc=kpsingh@kernel$(echo .)org \
--cc=kuba@kernel$(echo .)org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=martin.lau@linux$(echo .)dev \
--cc=netdev@vger$(echo .)kernel.org \
--cc=netfilter-devel@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=pablo@netfilter$(echo .)org \
--cc=sdf@google$(echo .)com \
--cc=song@kernel$(echo .)org \
--cc=yhs@fb$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox