From patchwork Wed Sep 16 15:42:59 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Mack X-Patchwork-Id: 518462 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id B8A0814018C for ; Thu, 17 Sep 2015 01:51:07 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753593AbbIPPvA (ORCPT ); Wed, 16 Sep 2015 11:51:00 -0400 Received: from svenfoo.org ([82.94.215.22]:47600 "EHLO mail.zonque.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751934AbbIPPu4 (ORCPT ); Wed, 16 Sep 2015 11:50:56 -0400 X-Greylist: delayed 466 seconds by postgrey-1.27 at vger.kernel.org; Wed, 16 Sep 2015 11:50:55 EDT Received: from localhost (localhost [127.0.0.1]) by mail.zonque.de (Postfix) with ESMTP id EB30BBC852; Wed, 16 Sep 2015 17:43:08 +0200 (CEST) Received: from mail.zonque.de ([127.0.0.1]) by localhost (rambrand.bugwerft.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ej7yoIOQ58sn; Wed, 16 Sep 2015 17:43:08 +0200 (CEST) Received: from cacofonix.fritz.box (p54AF492D.dip0.t-ipconnect.de [84.175.73.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.zonque.de (Postfix) with ESMTPSA id 786F2C0130; Wed, 16 Sep 2015 17:43:08 +0200 (CEST) From: Daniel Mack To: pablo@netfilter.org Cc: daniel@iogearbox.net, netfilter-devel@vger.kernel.org, netdev@vger.kernel.org, fw@strlen.de, balazs.scheidler@balabit.com, Daniel Mack Subject: [PATCH RFC 2/3] netfilter: nft_meta: mark skbs for postponed filter processing Date: Wed, 16 Sep 2015 17:42:59 +0200 Message-Id: <1442418180-14322-3-git-send-email-daniel@zonque.org> X-Mailer: git-send-email 2.5.0 In-Reply-To: <1442418180-14322-1-git-send-email-daniel@zonque.org> References: <1442418180-14322-1-git-send-email-daniel@zonque.org> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org When the cgroup matching code in nft_meta is called without a socket to look at, it currently bails out and lets the packet pass. This is bad, because the reason for skb->sk being NULL is simply that the packet was directed to a socket that hasn't been looked up yet by early demux. This patch does two things: a) it uses the newly introduced pkt->sk pointer rather than skb->sk to check for the net class ID. This allows us to look at the socket the user passed into nf_hook(). b) in case the socket can't be accessed, it marks the skb as 'nf_postponed', so that later dispatchers have a chance to re-iterate the chain for such packets, after a full demux was conducted. Note that the added flag in 'struct skb' does not increase the size of the struct, as it fits in the 'flags1' bitfield. Signed-off-by: Daniel Mack --- include/linux/skbuff.h | 3 ++- net/netfilter/nft_meta.c | 9 ++++++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 2738d35..3590101 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -584,7 +584,8 @@ struct sk_buff { fclone:2, peeked:1, head_frag:1, - xmit_more:1; + xmit_more:1, + nf_postponed:1; /* one bit hole */ kmemcheck_bitfield_end(flags1); diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index cb2f13e..33b8d23 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -29,8 +29,9 @@ void nft_meta_get_eval(const struct nft_expr *expr, const struct nft_pktinfo *pkt) { const struct nft_meta *priv = nft_expr_priv(expr); - const struct sk_buff *skb = pkt->skb; const struct net_device *in = pkt->in, *out = pkt->out; + struct sk_buff *skb = pkt->skb; + struct sock *sk = pkt->sk; u32 *dest = ®s->data[priv->dreg]; switch (priv->key) { @@ -168,9 +169,11 @@ void nft_meta_get_eval(const struct nft_expr *expr, break; #ifdef CONFIG_CGROUP_NET_CLASSID case NFT_META_CGROUP: - if (skb->sk == NULL || !sk_fullsock(skb->sk)) + if (sk == NULL || !sk_fullsock(sk)) { + skb->nf_postponed = 1; goto err; - *dest = skb->sk->sk_classid; + } + *dest = sk->sk_classid; break; #endif default: