Re: [PATCH nf-next 6/7] netfilter: flowtable: move ipv4 and ipv6 xmit path to function

> Move the existing ipv4 and ipv6 transmit path to functions in
> preparation of the IPv4 over IPv6 and SIT support.
> 
> Signed-off-by: Pablo Neira Ayuso <[email protected]>

Nice :)

Acked-by: Lorenzo Bianconi <[email protected]>

> ---
>  net/netfilter/nf_flow_table_ip.c | 92 +++++++++++++++++++-------------
>  1 file changed, 54 insertions(+), 38 deletions(-)
> 
> diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
> index 4437f3a13cb2..18febca1dcef 100644
> --- a/net/netfilter/nf_flow_table_ip.c
> +++ b/net/netfilter/nf_flow_table_ip.c
> @@ -800,33 +800,17 @@ static unsigned int nf_flow_queue_xmit(struct net *net, struct sk_buff *skb,
>  	return NF_STOLEN;
>  }
>  
> -unsigned int
> -nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
> -			const struct nf_hook_state *state)
> +static int nf_flow_queue_xmit4(struct sk_buff *skb,
> +			       struct flow_offload_tuple_rhash *tuplehash,
> +			       const struct nf_hook_state *state)
>  {
> -	struct flow_offload_tuple_rhash *tuplehash;
> -	struct nf_flowtable *flow_table = priv;
>  	struct flow_offload_tuple *other_tuple;
>  	enum flow_offload_tuple_dir dir;
> -	struct nf_flowtable_ctx ctx = {
> -		.in	= state->in,
> -	};
>  	struct nf_flow_xmit xmit = {};
>  	struct flow_offload *flow;
>  	struct neighbour *neigh;
>  	struct rtable *rt;
>  	__be32 ip_daddr;
> -	int ret;
> -
> -	tuplehash = nf_flow_offload_lookup(&ctx, flow_table, skb);
> -	if (!tuplehash)
> -		return NF_ACCEPT;
> -
> -	ret = nf_flow_offload_forward(&ctx, flow_table, tuplehash, skb);
> -	if (ret < 0)
> -		return NF_DROP;
> -	else if (ret == 0)
> -		return NF_ACCEPT;
>  
>  	if (unlikely(tuplehash->tuple.xmit_type == FLOW_OFFLOAD_XMIT_XFRM)) {
>  		rt = dst_rtable(tuplehash->tuple.dst_cache);
> @@ -879,6 +863,30 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
>  
>  	return nf_flow_queue_xmit(state->net, skb, &xmit);
>  }
> +
> +unsigned int
> +nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
> +			const struct nf_hook_state *state)
> +{
> +	struct flow_offload_tuple_rhash *tuplehash;
> +	struct nf_flowtable *flow_table = priv;
> +	struct nf_flowtable_ctx ctx = {
> +		.in	= state->in,
> +	};
> +	int ret;
> +
> +	tuplehash = nf_flow_offload_lookup(&ctx, flow_table, skb);
> +	if (!tuplehash)
> +		return NF_ACCEPT;
> +
> +	ret = nf_flow_offload_forward(&ctx, flow_table, tuplehash, skb);
> +	if (ret < 0)
> +		return NF_DROP;
> +	else if (ret == 0)
> +		return NF_ACCEPT;
> +
> +	return nf_flow_queue_xmit4(skb, tuplehash, state);
> +}
>  EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook);
>  
>  static void nf_flow_nat_ipv6_tcp(struct sk_buff *skb, unsigned int thoff,
> @@ -1119,33 +1127,17 @@ nf_flow_offload_ipv6_lookup(struct nf_flowtable_ctx *ctx,
>  	return flow_offload_lookup(flow_table, &tuple);
>  }
>  
> -unsigned int
> -nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
> -			  const struct nf_hook_state *state)
> +static int nf_flow_queue_xmit6(struct sk_buff *skb,
> +			       struct flow_offload_tuple_rhash *tuplehash,
> +			       const struct nf_hook_state *state)
>  {
> -	struct flow_offload_tuple_rhash *tuplehash;
> -	struct nf_flowtable *flow_table = priv;
>  	struct flow_offload_tuple *other_tuple;
>  	enum flow_offload_tuple_dir dir;
> -	struct nf_flowtable_ctx ctx = {
> -		.in	= state->in,
> -	};
>  	struct nf_flow_xmit xmit = {};
>  	struct in6_addr *ip6_daddr;
>  	struct flow_offload *flow;
>  	struct neighbour *neigh;
>  	struct rt6_info *rt;
> -	int ret;
> -
> -	tuplehash = nf_flow_offload_ipv6_lookup(&ctx, flow_table, skb);
> -	if (tuplehash == NULL)
> -		return NF_ACCEPT;
> -
> -	ret = nf_flow_offload_ipv6_forward(&ctx, flow_table, tuplehash, skb);
> -	if (ret < 0)
> -		return NF_DROP;
> -	else if (ret == 0)
> -		return NF_ACCEPT;
>  
>  	if (unlikely(tuplehash->tuple.xmit_type == FLOW_OFFLOAD_XMIT_XFRM)) {
>  		rt = dst_rt6_info(tuplehash->tuple.dst_cache);
> @@ -1199,4 +1191,28 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
>  
>  	return nf_flow_queue_xmit(state->net, skb, &xmit);
>  }
> +
> +unsigned int
> +nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
> +			  const struct nf_hook_state *state)
> +{
> +	struct flow_offload_tuple_rhash *tuplehash;
> +	struct nf_flowtable *flow_table = priv;
> +	struct nf_flowtable_ctx ctx = {
> +		.in	= state->in,
> +	};
> +	int ret;
> +
> +	tuplehash = nf_flow_offload_ipv6_lookup(&ctx, flow_table, skb);
> +	if (!tuplehash)
> +		return NF_ACCEPT;
> +
> +	ret = nf_flow_offload_ipv6_forward(&ctx, flow_table, tuplehash, skb);
> +	if (ret < 0)
> +		return NF_DROP;
> +	else if (ret == 0)
> +		return NF_ACCEPT;
> +
> +	return nf_flow_queue_xmit6(skb, tuplehash, state);
> +}
>  EXPORT_SYMBOL_GPL(nf_flow_offload_ipv6_hook);
> -- 
> 2.47.3
>

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQTquNwa3Txd3rGGn7Y6cBh0uS2trAUCanWhoQAKCRA6cBh0uS2t
rLhvAQD75tWt1w921wSm6ZGR/02hj9wwsjDbRMFtBuapc1GXbgEAuesMarEbU2wV
DDdg/qOojgC/Qtjg52I2FBWhvK08GAY=
=xzg+
-----END PGP SIGNATURE-----