13b49e2e9SPablo Neira Ayuso #ifndef _NF_FLOW_TABLE_H 23b49e2e9SPablo Neira Ayuso #define _NF_FLOW_TABLE_H 33b49e2e9SPablo Neira Ayuso 4ac2a6666SPablo Neira Ayuso #include <linux/in.h> 5ac2a6666SPablo Neira Ayuso #include <linux/in6.h> 6ac2a6666SPablo Neira Ayuso #include <linux/netdevice.h> 70eb71a9dSNeilBrown #include <linux/rhashtable-types.h> 8ac2a6666SPablo Neira Ayuso #include <linux/rcupdate.h> 9a1b2f04eSJeremy Sowden #include <linux/netfilter.h> 10af81f9e7SFelix Fietkau #include <linux/netfilter/nf_conntrack_tuple_common.h> 118bb69f3bSPablo Neira Ayuso #include <net/flow_offload.h> 12ac2a6666SPablo Neira Ayuso #include <net/dst.h> 133b49e2e9SPablo Neira Ayuso 143b49e2e9SPablo Neira Ayuso struct nf_flowtable; 15c29f74e0SPablo Neira Ayuso struct nf_flow_rule; 16c29f74e0SPablo Neira Ayuso struct flow_offload; 17c29f74e0SPablo Neira Ayuso enum flow_offload_tuple_dir; 183b49e2e9SPablo Neira Ayuso 199c26ba9bSPaul Blakey struct nf_flow_key { 209c26ba9bSPaul Blakey struct flow_dissector_key_meta meta; 219c26ba9bSPaul Blakey struct flow_dissector_key_control control; 22cfab6dbdSwenxu struct flow_dissector_key_control enc_control; 239c26ba9bSPaul Blakey struct flow_dissector_key_basic basic; 24*3e1b0c16Swenxu struct flow_dissector_key_vlan vlan; 25*3e1b0c16Swenxu struct flow_dissector_key_vlan cvlan; 269c26ba9bSPaul Blakey union { 279c26ba9bSPaul Blakey struct flow_dissector_key_ipv4_addrs ipv4; 289c26ba9bSPaul Blakey struct flow_dissector_key_ipv6_addrs ipv6; 299c26ba9bSPaul Blakey }; 30cfab6dbdSwenxu struct flow_dissector_key_keyid enc_key_id; 31cfab6dbdSwenxu union { 32cfab6dbdSwenxu struct flow_dissector_key_ipv4_addrs enc_ipv4; 33cfab6dbdSwenxu struct flow_dissector_key_ipv6_addrs enc_ipv6; 34cfab6dbdSwenxu }; 359c26ba9bSPaul Blakey struct flow_dissector_key_tcp tcp; 369c26ba9bSPaul Blakey struct flow_dissector_key_ports tp; 379c26ba9bSPaul Blakey } __aligned(BITS_PER_LONG / 8); /* Ensure that we can do comparisons as longs. */ 389c26ba9bSPaul Blakey 399c26ba9bSPaul Blakey struct nf_flow_match { 409c26ba9bSPaul Blakey struct flow_dissector dissector; 419c26ba9bSPaul Blakey struct nf_flow_key key; 429c26ba9bSPaul Blakey struct nf_flow_key mask; 439c26ba9bSPaul Blakey }; 449c26ba9bSPaul Blakey 459c26ba9bSPaul Blakey struct nf_flow_rule { 469c26ba9bSPaul Blakey struct nf_flow_match match; 479c26ba9bSPaul Blakey struct flow_rule *rule; 489c26ba9bSPaul Blakey }; 499c26ba9bSPaul Blakey 503b49e2e9SPablo Neira Ayuso struct nf_flowtable_type { 513b49e2e9SPablo Neira Ayuso struct list_head list; 523b49e2e9SPablo Neira Ayuso int family; 53a268de77SFelix Fietkau int (*init)(struct nf_flowtable *ft); 548bb69f3bSPablo Neira Ayuso int (*setup)(struct nf_flowtable *ft, 558bb69f3bSPablo Neira Ayuso struct net_device *dev, 568bb69f3bSPablo Neira Ayuso enum flow_block_command cmd); 57c29f74e0SPablo Neira Ayuso int (*action)(struct net *net, 58c29f74e0SPablo Neira Ayuso const struct flow_offload *flow, 59c29f74e0SPablo Neira Ayuso enum flow_offload_tuple_dir dir, 60c29f74e0SPablo Neira Ayuso struct nf_flow_rule *flow_rule); 61b408c5b0SPablo Neira Ayuso void (*free)(struct nf_flowtable *ft); 623b49e2e9SPablo Neira Ayuso nf_hookfn *hook; 633b49e2e9SPablo Neira Ayuso struct module *owner; 643b49e2e9SPablo Neira Ayuso }; 653b49e2e9SPablo Neira Ayuso 668bb69f3bSPablo Neira Ayuso enum nf_flowtable_flags { 67cfbd1125SPablo Neira Ayuso NF_FLOWTABLE_HW_OFFLOAD = 0x1, /* NFT_FLOWTABLE_HW_OFFLOAD */ 6853c2b289SPablo Neira Ayuso NF_FLOWTABLE_COUNTER = 0x2, /* NFT_FLOWTABLE_COUNTER */ 698bb69f3bSPablo Neira Ayuso }; 708bb69f3bSPablo Neira Ayuso 713b49e2e9SPablo Neira Ayuso struct nf_flowtable { 7284453a90SFelix Fietkau struct list_head list; 733b49e2e9SPablo Neira Ayuso struct rhashtable rhashtable; 7471a8a63bSPablo Neira Ayuso int priority; 753b49e2e9SPablo Neira Ayuso const struct nf_flowtable_type *type; 763b49e2e9SPablo Neira Ayuso struct delayed_work gc_work; 778bb69f3bSPablo Neira Ayuso unsigned int flags; 788bb69f3bSPablo Neira Ayuso struct flow_block flow_block; 79422c032aSPaul Blakey struct rw_semaphore flow_block_lock; /* Guards flow_block */ 808bb69f3bSPablo Neira Ayuso possible_net_t net; 813b49e2e9SPablo Neira Ayuso }; 823b49e2e9SPablo Neira Ayuso 83a5449cdcSPablo Neira Ayuso static inline bool nf_flowtable_hw_offload(struct nf_flowtable *flowtable) 84a5449cdcSPablo Neira Ayuso { 85a5449cdcSPablo Neira Ayuso return flowtable->flags & NF_FLOWTABLE_HW_OFFLOAD; 86a5449cdcSPablo Neira Ayuso } 87a5449cdcSPablo Neira Ayuso 88ac2a6666SPablo Neira Ayuso enum flow_offload_tuple_dir { 89af81f9e7SFelix Fietkau FLOW_OFFLOAD_DIR_ORIGINAL = IP_CT_DIR_ORIGINAL, 90af81f9e7SFelix Fietkau FLOW_OFFLOAD_DIR_REPLY = IP_CT_DIR_REPLY, 91ac2a6666SPablo Neira Ayuso }; 924f08f173SPablo Neira Ayuso #define FLOW_OFFLOAD_DIR_MAX IP_CT_DIR_MAX 93ac2a6666SPablo Neira Ayuso 945139c0c0SPablo Neira Ayuso enum flow_offload_xmit_type { 955139c0c0SPablo Neira Ayuso FLOW_OFFLOAD_XMIT_NEIGH = 0, 965139c0c0SPablo Neira Ayuso FLOW_OFFLOAD_XMIT_XFRM, 977a27f6abSPablo Neira Ayuso FLOW_OFFLOAD_XMIT_DIRECT, 985139c0c0SPablo Neira Ayuso }; 995139c0c0SPablo Neira Ayuso 1004cd91f7cSPablo Neira Ayuso #define NF_FLOW_TABLE_ENCAP_MAX 2 1014cd91f7cSPablo Neira Ayuso 102ac2a6666SPablo Neira Ayuso struct flow_offload_tuple { 103ac2a6666SPablo Neira Ayuso union { 104ac2a6666SPablo Neira Ayuso struct in_addr src_v4; 105ac2a6666SPablo Neira Ayuso struct in6_addr src_v6; 106ac2a6666SPablo Neira Ayuso }; 107ac2a6666SPablo Neira Ayuso union { 108ac2a6666SPablo Neira Ayuso struct in_addr dst_v4; 109ac2a6666SPablo Neira Ayuso struct in6_addr dst_v6; 110ac2a6666SPablo Neira Ayuso }; 111ac2a6666SPablo Neira Ayuso struct { 112ac2a6666SPablo Neira Ayuso __be16 src_port; 113ac2a6666SPablo Neira Ayuso __be16 dst_port; 114ac2a6666SPablo Neira Ayuso }; 115ac2a6666SPablo Neira Ayuso 116ac2a6666SPablo Neira Ayuso int iifidx; 117ac2a6666SPablo Neira Ayuso 118ac2a6666SPablo Neira Ayuso u8 l3proto; 119ac2a6666SPablo Neira Ayuso u8 l4proto; 1204cd91f7cSPablo Neira Ayuso struct { 1214cd91f7cSPablo Neira Ayuso u16 id; 1224cd91f7cSPablo Neira Ayuso __be16 proto; 1234cd91f7cSPablo Neira Ayuso } encap[NF_FLOW_TABLE_ENCAP_MAX]; 124dbc859d9SPablo Neira Ayuso 125dbc859d9SPablo Neira Ayuso /* All members above are keys for lookups, see flow_offload_hash(). */ 126dbc859d9SPablo Neira Ayuso struct { } __hash; 127dbc859d9SPablo Neira Ayuso 12826267bf9SFelix Fietkau u8 dir:2, 1294cd91f7cSPablo Neira Ayuso xmit_type:2, 13026267bf9SFelix Fietkau encap_num:2, 13126267bf9SFelix Fietkau in_vlan_ingress:2; 1324f3780c0SFelix Fietkau u16 mtu; 1337a27f6abSPablo Neira Ayuso union { 1348b9229d1SPablo Neira Ayuso struct { 135ac2a6666SPablo Neira Ayuso struct dst_entry *dst_cache; 1368b9229d1SPablo Neira Ayuso u32 dst_cookie; 1378b9229d1SPablo Neira Ayuso }; 1387a27f6abSPablo Neira Ayuso struct { 1397a27f6abSPablo Neira Ayuso u32 ifidx; 14073f97025SPablo Neira Ayuso u32 hw_ifidx; 1417a27f6abSPablo Neira Ayuso u8 h_source[ETH_ALEN]; 1427a27f6abSPablo Neira Ayuso u8 h_dest[ETH_ALEN]; 1437a27f6abSPablo Neira Ayuso } out; 1447a27f6abSPablo Neira Ayuso }; 145ac2a6666SPablo Neira Ayuso }; 146ac2a6666SPablo Neira Ayuso 147ac2a6666SPablo Neira Ayuso struct flow_offload_tuple_rhash { 148ac2a6666SPablo Neira Ayuso struct rhash_head node; 149ac2a6666SPablo Neira Ayuso struct flow_offload_tuple tuple; 150ac2a6666SPablo Neira Ayuso }; 151ac2a6666SPablo Neira Ayuso 152355a8b13SPablo Neira Ayuso enum nf_flow_flags { 153355a8b13SPablo Neira Ayuso NF_FLOW_SNAT, 154355a8b13SPablo Neira Ayuso NF_FLOW_DNAT, 155355a8b13SPablo Neira Ayuso NF_FLOW_TEARDOWN, 156355a8b13SPablo Neira Ayuso NF_FLOW_HW, 157355a8b13SPablo Neira Ayuso NF_FLOW_HW_DYING, 158355a8b13SPablo Neira Ayuso NF_FLOW_HW_DEAD, 159f698fe40SPablo Neira Ayuso NF_FLOW_HW_REFRESH, 1602c889795SPaul Blakey NF_FLOW_HW_PENDING, 161355a8b13SPablo Neira Ayuso }; 162ac2a6666SPablo Neira Ayuso 163f1363e05SPablo Neira Ayuso enum flow_offload_type { 164f1363e05SPablo Neira Ayuso NF_FLOW_OFFLOAD_UNSPEC = 0, 165f1363e05SPablo Neira Ayuso NF_FLOW_OFFLOAD_ROUTE, 166f1363e05SPablo Neira Ayuso }; 167f1363e05SPablo Neira Ayuso 168ac2a6666SPablo Neira Ayuso struct flow_offload { 169ac2a6666SPablo Neira Ayuso struct flow_offload_tuple_rhash tuplehash[FLOW_OFFLOAD_DIR_MAX]; 170b32d2f34SPablo Neira Ayuso struct nf_conn *ct; 171355a8b13SPablo Neira Ayuso unsigned long flags; 172f1363e05SPablo Neira Ayuso u16 type; 173ac2a6666SPablo Neira Ayuso u32 timeout; 17462248df8SPablo Neira Ayuso struct rcu_head rcu_head; 175ac2a6666SPablo Neira Ayuso }; 176ac2a6666SPablo Neira Ayuso 177ac2a6666SPablo Neira Ayuso #define NF_FLOW_TIMEOUT (30 * HZ) 178fb46f1b7SPablo Neira Ayuso #define nf_flowtable_time_stamp (u32)jiffies 179fb46f1b7SPablo Neira Ayuso 180fb46f1b7SPablo Neira Ayuso static inline __s32 nf_flow_timeout_delta(unsigned int timeout) 181fb46f1b7SPablo Neira Ayuso { 182fb46f1b7SPablo Neira Ayuso return (__s32)(timeout - nf_flowtable_time_stamp); 183fb46f1b7SPablo Neira Ayuso } 184ac2a6666SPablo Neira Ayuso 185ac2a6666SPablo Neira Ayuso struct nf_flow_route { 186ac2a6666SPablo Neira Ayuso struct { 187ac2a6666SPablo Neira Ayuso struct dst_entry *dst; 188c63a7cc4SPablo Neira Ayuso struct { 189c63a7cc4SPablo Neira Ayuso u32 ifindex; 1904cd91f7cSPablo Neira Ayuso struct { 1914cd91f7cSPablo Neira Ayuso u16 id; 1924cd91f7cSPablo Neira Ayuso __be16 proto; 1934cd91f7cSPablo Neira Ayuso } encap[NF_FLOW_TABLE_ENCAP_MAX]; 19426267bf9SFelix Fietkau u8 num_encaps:2, 19526267bf9SFelix Fietkau ingress_vlans:2; 196c63a7cc4SPablo Neira Ayuso } in; 1977a27f6abSPablo Neira Ayuso struct { 1987a27f6abSPablo Neira Ayuso u32 ifindex; 19973f97025SPablo Neira Ayuso u32 hw_ifindex; 2007a27f6abSPablo Neira Ayuso u8 h_source[ETH_ALEN]; 2017a27f6abSPablo Neira Ayuso u8 h_dest[ETH_ALEN]; 2027a27f6abSPablo Neira Ayuso } out; 2035139c0c0SPablo Neira Ayuso enum flow_offload_xmit_type xmit_type; 204ac2a6666SPablo Neira Ayuso } tuple[FLOW_OFFLOAD_DIR_MAX]; 205ac2a6666SPablo Neira Ayuso }; 206ac2a6666SPablo Neira Ayuso 207f1363e05SPablo Neira Ayuso struct flow_offload *flow_offload_alloc(struct nf_conn *ct); 208ac2a6666SPablo Neira Ayuso void flow_offload_free(struct flow_offload *flow); 209ac2a6666SPablo Neira Ayuso 210505ee3a1SAlaa Hleihel static inline int 211505ee3a1SAlaa Hleihel nf_flow_table_offload_add_cb(struct nf_flowtable *flow_table, 212505ee3a1SAlaa Hleihel flow_setup_cb_t *cb, void *cb_priv) 213505ee3a1SAlaa Hleihel { 214505ee3a1SAlaa Hleihel struct flow_block *block = &flow_table->flow_block; 215505ee3a1SAlaa Hleihel struct flow_block_cb *block_cb; 216505ee3a1SAlaa Hleihel int err = 0; 217505ee3a1SAlaa Hleihel 218505ee3a1SAlaa Hleihel down_write(&flow_table->flow_block_lock); 219505ee3a1SAlaa Hleihel block_cb = flow_block_cb_lookup(block, cb, cb_priv); 220505ee3a1SAlaa Hleihel if (block_cb) { 221505ee3a1SAlaa Hleihel err = -EEXIST; 222505ee3a1SAlaa Hleihel goto unlock; 223505ee3a1SAlaa Hleihel } 224505ee3a1SAlaa Hleihel 225505ee3a1SAlaa Hleihel block_cb = flow_block_cb_alloc(cb, cb_priv, cb_priv, NULL); 226505ee3a1SAlaa Hleihel if (IS_ERR(block_cb)) { 227505ee3a1SAlaa Hleihel err = PTR_ERR(block_cb); 228505ee3a1SAlaa Hleihel goto unlock; 229505ee3a1SAlaa Hleihel } 230505ee3a1SAlaa Hleihel 231505ee3a1SAlaa Hleihel list_add_tail(&block_cb->list, &block->cb_list); 232505ee3a1SAlaa Hleihel 233505ee3a1SAlaa Hleihel unlock: 234505ee3a1SAlaa Hleihel up_write(&flow_table->flow_block_lock); 235505ee3a1SAlaa Hleihel return err; 236505ee3a1SAlaa Hleihel } 237505ee3a1SAlaa Hleihel 238505ee3a1SAlaa Hleihel static inline void 239505ee3a1SAlaa Hleihel nf_flow_table_offload_del_cb(struct nf_flowtable *flow_table, 240505ee3a1SAlaa Hleihel flow_setup_cb_t *cb, void *cb_priv) 241505ee3a1SAlaa Hleihel { 242505ee3a1SAlaa Hleihel struct flow_block *block = &flow_table->flow_block; 243505ee3a1SAlaa Hleihel struct flow_block_cb *block_cb; 244505ee3a1SAlaa Hleihel 245505ee3a1SAlaa Hleihel down_write(&flow_table->flow_block_lock); 246505ee3a1SAlaa Hleihel block_cb = flow_block_cb_lookup(block, cb, cb_priv); 247505ee3a1SAlaa Hleihel if (block_cb) { 248505ee3a1SAlaa Hleihel list_del(&block_cb->list); 249505ee3a1SAlaa Hleihel flow_block_cb_free(block_cb); 250505ee3a1SAlaa Hleihel } else { 251505ee3a1SAlaa Hleihel WARN_ON(true); 252505ee3a1SAlaa Hleihel } 253505ee3a1SAlaa Hleihel up_write(&flow_table->flow_block_lock); 254505ee3a1SAlaa Hleihel } 255978703f4SPaul Blakey 256f1363e05SPablo Neira Ayuso int flow_offload_route_init(struct flow_offload *flow, 257f1363e05SPablo Neira Ayuso const struct nf_flow_route *route); 258f1363e05SPablo Neira Ayuso 259ac2a6666SPablo Neira Ayuso int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow); 2608b3646d6SPaul Blakey void flow_offload_refresh(struct nf_flowtable *flow_table, 2618b3646d6SPaul Blakey struct flow_offload *flow); 2628b3646d6SPaul Blakey 263ac2a6666SPablo Neira Ayuso struct flow_offload_tuple_rhash *flow_offload_lookup(struct nf_flowtable *flow_table, 264ac2a6666SPablo Neira Ayuso struct flow_offload_tuple *tuple); 265a8284c68SPablo Neira Ayuso void nf_flow_table_gc_cleanup(struct nf_flowtable *flowtable, 266a8284c68SPablo Neira Ayuso struct net_device *dev); 2675f1be84aSTaehee Yoo void nf_flow_table_cleanup(struct net_device *dev); 268c0ea1bcbSPablo Neira Ayuso 269a268de77SFelix Fietkau int nf_flow_table_init(struct nf_flowtable *flow_table); 270b408c5b0SPablo Neira Ayuso void nf_flow_table_free(struct nf_flowtable *flow_table); 271ac2a6666SPablo Neira Ayuso 27259c466ddSFelix Fietkau void flow_offload_teardown(struct flow_offload *flow); 273ac2a6666SPablo Neira Ayuso 274f4401262SPablo Neira Ayuso void nf_flow_snat_port(const struct flow_offload *flow, 275ac2a6666SPablo Neira Ayuso struct sk_buff *skb, unsigned int thoff, 276ac2a6666SPablo Neira Ayuso u8 protocol, enum flow_offload_tuple_dir dir); 277f4401262SPablo Neira Ayuso void nf_flow_dnat_port(const struct flow_offload *flow, 278ac2a6666SPablo Neira Ayuso struct sk_buff *skb, unsigned int thoff, 279ac2a6666SPablo Neira Ayuso u8 protocol, enum flow_offload_tuple_dir dir); 280ac2a6666SPablo Neira Ayuso 281ac2a6666SPablo Neira Ayuso struct flow_ports { 282ac2a6666SPablo Neira Ayuso __be16 source, dest; 283ac2a6666SPablo Neira Ayuso }; 284ac2a6666SPablo Neira Ayuso 2857c23b629SPablo Neira Ayuso unsigned int nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, 2867c23b629SPablo Neira Ayuso const struct nf_hook_state *state); 2877c23b629SPablo Neira Ayuso unsigned int nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, 2887c23b629SPablo Neira Ayuso const struct nf_hook_state *state); 2897c23b629SPablo Neira Ayuso 290ac2a6666SPablo Neira Ayuso #define MODULE_ALIAS_NF_FLOWTABLE(family) \ 291ac2a6666SPablo Neira Ayuso MODULE_ALIAS("nf-flowtable-" __stringify(family)) 292ac2a6666SPablo Neira Ayuso 293c29f74e0SPablo Neira Ayuso void nf_flow_offload_add(struct nf_flowtable *flowtable, 294c29f74e0SPablo Neira Ayuso struct flow_offload *flow); 295c29f74e0SPablo Neira Ayuso void nf_flow_offload_del(struct nf_flowtable *flowtable, 296c29f74e0SPablo Neira Ayuso struct flow_offload *flow); 297c29f74e0SPablo Neira Ayuso void nf_flow_offload_stats(struct nf_flowtable *flowtable, 298c29f74e0SPablo Neira Ayuso struct flow_offload *flow); 299c29f74e0SPablo Neira Ayuso 300c29f74e0SPablo Neira Ayuso void nf_flow_table_offload_flush(struct nf_flowtable *flowtable); 301c29f74e0SPablo Neira Ayuso int nf_flow_table_offload_setup(struct nf_flowtable *flowtable, 3028bb69f3bSPablo Neira Ayuso struct net_device *dev, 303c29f74e0SPablo Neira Ayuso enum flow_block_command cmd); 3045c27d8d7SPablo Neira Ayuso int nf_flow_rule_route_ipv4(struct net *net, const struct flow_offload *flow, 3055c27d8d7SPablo Neira Ayuso enum flow_offload_tuple_dir dir, 3065c27d8d7SPablo Neira Ayuso struct nf_flow_rule *flow_rule); 3075c27d8d7SPablo Neira Ayuso int nf_flow_rule_route_ipv6(struct net *net, const struct flow_offload *flow, 308c29f74e0SPablo Neira Ayuso enum flow_offload_tuple_dir dir, 309c29f74e0SPablo Neira Ayuso struct nf_flow_rule *flow_rule); 310c29f74e0SPablo Neira Ayuso 311c29f74e0SPablo Neira Ayuso int nf_flow_table_offload_init(void); 312c29f74e0SPablo Neira Ayuso void nf_flow_table_offload_exit(void); 3138bb69f3bSPablo Neira Ayuso 3140286fbc6SJeremy Sowden #endif /* _NF_FLOW_TABLE_H */ 315