1 files changed, 0 insertions, 410 deletions

diff --git a/target/linux/generic/backport-5.10/610-v5.13-20-netfilter-flowtable-add-vlan-support.patch b/target/linux/generic/backport-5.10/610-v5.13-20-netfilter-flowtable-add-vlan-support.patch
deleted file mode 100644
index 86a1129880..0000000000
--- a/target/linux/generic/backport-5.10/610-v5.13-20-netfilter-flowtable-add-vlan-support.patch
+++ /dev/null
@@ -1,410 +0,0 @@
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Wed, 24 Mar 2021 02:30:41 +0100
-Subject: [PATCH] netfilter: flowtable: add vlan support
-
-Add the vlan id and protocol to the flow tuple to uniquely identify
-flows from the receive path. For the transmit path, dev_hard_header() on
-the vlan device push the headers. This patch includes support for two
-vlan headers (QinQ) from the ingress path.
-
-Add a generic encap field to the flowtable entry which stores the
-protocol and the tag id. This allows to reuse these fields in the PPPoE
-support coming in a later patch.
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
-
---- a/include/net/netfilter/nf_flow_table.h
-+++ b/include/net/netfilter/nf_flow_table.h
-@@ -95,6 +95,8 @@ enum flow_offload_xmit_type {
- 	FLOW_OFFLOAD_XMIT_DIRECT,
- };
- 
-+#define NF_FLOW_TABLE_ENCAP_MAX		2
-+
- struct flow_offload_tuple {
- 	union {
- 		struct in_addr		src_v4;
-@@ -113,13 +115,17 @@ struct flow_offload_tuple {
- 
- 	u8				l3proto;
- 	u8				l4proto;
-+	struct {
-+		u16			id;
-+		__be16			proto;
-+	} encap[NF_FLOW_TABLE_ENCAP_MAX];
- 
- 	/* All members above are keys for lookups, see flow_offload_hash(). */
- 	struct { }			__hash;
- 
--	u8				dir:6,
--					xmit_type:2;
--
-+	u8				dir:4,
-+					xmit_type:2,
-+					encap_num:2;
- 	u16				mtu;
- 	union {
- 		struct dst_entry	*dst_cache;
-@@ -173,6 +179,11 @@ struct nf_flow_route {
- 		struct dst_entry		*dst;
- 		struct {
- 			u32			ifindex;
-+			struct {
-+				u16		id;
-+				__be16		proto;
-+			} encap[NF_FLOW_TABLE_ENCAP_MAX];
-+			u8			num_encaps;
- 		} in;
- 		struct {
- 			u32			ifindex;
---- a/net/netfilter/nf_flow_table_core.c
-+++ b/net/netfilter/nf_flow_table_core.c
-@@ -80,6 +80,7 @@ static int flow_offload_fill_route(struc
- {
- 	struct flow_offload_tuple *flow_tuple = &flow->tuplehash[dir].tuple;
- 	struct dst_entry *dst = route->tuple[dir].dst;
-+	int i, j = 0;
- 
- 	switch (flow_tuple->l3proto) {
- 	case NFPROTO_IPV4:
-@@ -91,6 +92,12 @@ static int flow_offload_fill_route(struc
- 	}
- 
- 	flow_tuple->iifidx = route->tuple[dir].in.ifindex;
-+	for (i = route->tuple[dir].in.num_encaps - 1; i >= 0; i--) {
-+		flow_tuple->encap[j].id = route->tuple[dir].in.encap[i].id;
-+		flow_tuple->encap[j].proto = route->tuple[dir].in.encap[i].proto;
-+		j++;
-+	}
-+	flow_tuple->encap_num = route->tuple[dir].in.num_encaps;
- 
- 	switch (route->tuple[dir].xmit_type) {
- 	case FLOW_OFFLOAD_XMIT_DIRECT:
---- a/net/netfilter/nf_flow_table_ip.c
-+++ b/net/netfilter/nf_flow_table_ip.c
-@@ -136,23 +136,44 @@ static bool ip_has_options(unsigned int
- 	return thoff != sizeof(struct iphdr);
- }
- 
-+static void nf_flow_tuple_encap(struct sk_buff *skb,
-+				struct flow_offload_tuple *tuple)
-+{
-+	int i = 0;
-+
-+	if (skb_vlan_tag_present(skb)) {
-+		tuple->encap[i].id = skb_vlan_tag_get(skb);
-+		tuple->encap[i].proto = skb->vlan_proto;
-+		i++;
-+	}
-+	if (skb->protocol == htons(ETH_P_8021Q)) {
-+		struct vlan_ethhdr *veth = (struct vlan_ethhdr *)skb_mac_header(skb);
-+
-+		tuple->encap[i].id = ntohs(veth->h_vlan_TCI);
-+		tuple->encap[i].proto = skb->protocol;
-+	}
-+}
-+
- static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev,
--			    struct flow_offload_tuple *tuple, u32 *hdrsize)
-+			    struct flow_offload_tuple *tuple, u32 *hdrsize,
-+			    u32 offset)
- {
- 	struct flow_ports *ports;
- 	unsigned int thoff;
- 	struct iphdr *iph;
- 
--	if (!pskb_may_pull(skb, sizeof(*iph)))
-+	if (!pskb_may_pull(skb, sizeof(*iph) + offset))
- 		return -1;
- 
--	iph = ip_hdr(skb);
--	thoff = iph->ihl * 4;
-+	iph = (struct iphdr *)(skb_network_header(skb) + offset);
-+	thoff = (iph->ihl * 4);
- 
- 	if (ip_is_fragment(iph) ||
- 	    unlikely(ip_has_options(thoff)))
- 		return -1;
- 
-+	thoff += offset;
-+
- 	switch (iph->protocol) {
- 	case IPPROTO_TCP:
- 		*hdrsize = sizeof(struct tcphdr);
-@@ -167,11 +188,10 @@ static int nf_flow_tuple_ip(struct sk_bu
- 	if (iph->ttl <= 1)
- 		return -1;
- 
--	thoff = iph->ihl * 4;
- 	if (!pskb_may_pull(skb, thoff + *hdrsize))
- 		return -1;
- 
--	iph = ip_hdr(skb);
-+	iph = (struct iphdr *)(skb_network_header(skb) + offset);
- 	ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
- 
- 	tuple->src_v4.s_addr	= iph->saddr;
-@@ -181,6 +201,7 @@ static int nf_flow_tuple_ip(struct sk_bu
- 	tuple->l3proto		= AF_INET;
- 	tuple->l4proto		= iph->protocol;
- 	tuple->iifidx		= dev->ifindex;
-+	nf_flow_tuple_encap(skb, tuple);
- 
- 	return 0;
- }
-@@ -207,6 +228,43 @@ static unsigned int nf_flow_xmit_xfrm(st
- 	return NF_STOLEN;
- }
- 
-+static bool nf_flow_skb_encap_protocol(const struct sk_buff *skb, __be16 proto,
-+				       u32 *offset)
-+{
-+	if (skb->protocol == htons(ETH_P_8021Q)) {
-+		struct vlan_ethhdr *veth;
-+
-+		veth = (struct vlan_ethhdr *)skb_mac_header(skb);
-+		if (veth->h_vlan_encapsulated_proto == proto) {
-+			*offset += VLAN_HLEN;
-+			return true;
-+		}
-+	}
-+
-+	return false;
-+}
-+
-+static void nf_flow_encap_pop(struct sk_buff *skb,
-+			      struct flow_offload_tuple_rhash *tuplehash)
-+{
-+	struct vlan_hdr *vlan_hdr;
-+	int i;
-+
-+	for (i = 0; i < tuplehash->tuple.encap_num; i++) {
-+		if (skb_vlan_tag_present(skb)) {
-+			__vlan_hwaccel_clear_tag(skb);
-+			continue;
-+		}
-+		if (skb->protocol == htons(ETH_P_8021Q)) {
-+			vlan_hdr = (struct vlan_hdr *)skb->data;
-+			__skb_pull(skb, VLAN_HLEN);
-+			vlan_set_encap_proto(skb, vlan_hdr);
-+			skb_reset_network_header(skb);
-+			break;
-+		}
-+	}
-+}
-+
- static unsigned int nf_flow_queue_xmit(struct net *net, struct sk_buff *skb,
- 				       const struct flow_offload_tuple_rhash *tuplehash,
- 				       unsigned short type)
-@@ -235,17 +293,18 @@ nf_flow_offload_ip_hook(void *priv, stru
- 	enum flow_offload_tuple_dir dir;
- 	struct flow_offload *flow;
- 	struct net_device *outdev;
-+	u32 hdrsize, offset = 0;
-+	unsigned int thoff, mtu;
- 	struct rtable *rt;
--	unsigned int thoff;
- 	struct iphdr *iph;
- 	__be32 nexthop;
--	u32 hdrsize;
- 	int ret;
- 
--	if (skb->protocol != htons(ETH_P_IP))
-+	if (skb->protocol != htons(ETH_P_IP) &&
-+	    !nf_flow_skb_encap_protocol(skb, htons(ETH_P_IP), &offset))
- 		return NF_ACCEPT;
- 
--	if (nf_flow_tuple_ip(skb, state->in, &tuple, &hdrsize) < 0)
-+	if (nf_flow_tuple_ip(skb, state->in, &tuple, &hdrsize, offset) < 0)
- 		return NF_ACCEPT;
- 
- 	tuplehash = flow_offload_lookup(flow_table, &tuple);
-@@ -255,11 +314,12 @@ nf_flow_offload_ip_hook(void *priv, stru
- 	dir = tuplehash->tuple.dir;
- 	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
- 
--	if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
-+	mtu = flow->tuplehash[dir].tuple.mtu + offset;
-+	if (unlikely(nf_flow_exceeds_mtu(skb, mtu)))
- 		return NF_ACCEPT;
- 
--	iph = ip_hdr(skb);
--	thoff = iph->ihl * 4;
-+	iph = (struct iphdr *)(skb_network_header(skb) + offset);
-+	thoff = (iph->ihl * 4) + offset;
- 	if (nf_flow_state_check(flow, iph->protocol, skb, thoff))
- 		return NF_ACCEPT;
- 
-@@ -277,6 +337,9 @@ nf_flow_offload_ip_hook(void *priv, stru
- 
- 	flow_offload_refresh(flow_table, flow);
- 
-+	nf_flow_encap_pop(skb, tuplehash);
-+	thoff -= offset;
-+
- 	iph = ip_hdr(skb);
- 	nf_flow_nat_ip(flow, skb, thoff, dir, iph);
- 
-@@ -418,16 +481,18 @@ static void nf_flow_nat_ipv6(const struc
- }
- 
- static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
--			      struct flow_offload_tuple *tuple, u32 *hdrsize)
-+			      struct flow_offload_tuple *tuple, u32 *hdrsize,
-+			      u32 offset)
- {
- 	struct flow_ports *ports;
- 	struct ipv6hdr *ip6h;
- 	unsigned int thoff;
- 
--	if (!pskb_may_pull(skb, sizeof(*ip6h)))
-+	thoff = sizeof(*ip6h) + offset;
-+	if (!pskb_may_pull(skb, thoff))
- 		return -1;
- 
--	ip6h = ipv6_hdr(skb);
-+	ip6h = (struct ipv6hdr *)(skb_network_header(skb) + offset);
- 
- 	switch (ip6h->nexthdr) {
- 	case IPPROTO_TCP:
-@@ -443,11 +508,10 @@ static int nf_flow_tuple_ipv6(struct sk_
- 	if (ip6h->hop_limit <= 1)
- 		return -1;
- 
--	thoff = sizeof(*ip6h);
- 	if (!pskb_may_pull(skb, thoff + *hdrsize))
- 		return -1;
- 
--	ip6h = ipv6_hdr(skb);
-+	ip6h = (struct ipv6hdr *)(skb_network_header(skb) + offset);
- 	ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
- 
- 	tuple->src_v6		= ip6h->saddr;
-@@ -457,6 +521,7 @@ static int nf_flow_tuple_ipv6(struct sk_
- 	tuple->l3proto		= AF_INET6;
- 	tuple->l4proto		= ip6h->nexthdr;
- 	tuple->iifidx		= dev->ifindex;
-+	nf_flow_tuple_encap(skb, tuple);
- 
- 	return 0;
- }
-@@ -472,15 +537,17 @@ nf_flow_offload_ipv6_hook(void *priv, st
- 	const struct in6_addr *nexthop;
- 	struct flow_offload *flow;
- 	struct net_device *outdev;
-+	unsigned int thoff, mtu;
-+	u32 hdrsize, offset = 0;
- 	struct ipv6hdr *ip6h;
- 	struct rt6_info *rt;
--	u32 hdrsize;
- 	int ret;
- 
--	if (skb->protocol != htons(ETH_P_IPV6))
-+	if (skb->protocol != htons(ETH_P_IPV6) &&
-+	    !nf_flow_skb_encap_protocol(skb, htons(ETH_P_IPV6), &offset))
- 		return NF_ACCEPT;
- 
--	if (nf_flow_tuple_ipv6(skb, state->in, &tuple, &hdrsize) < 0)
-+	if (nf_flow_tuple_ipv6(skb, state->in, &tuple, &hdrsize, offset) < 0)
- 		return NF_ACCEPT;
- 
- 	tuplehash = flow_offload_lookup(flow_table, &tuple);
-@@ -490,11 +557,13 @@ nf_flow_offload_ipv6_hook(void *priv, st
- 	dir = tuplehash->tuple.dir;
- 	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
- 
--	if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
-+	mtu = flow->tuplehash[dir].tuple.mtu + offset;
-+	if (unlikely(nf_flow_exceeds_mtu(skb, mtu)))
- 		return NF_ACCEPT;
- 
--	if (nf_flow_state_check(flow, ipv6_hdr(skb)->nexthdr, skb,
--				sizeof(*ip6h)))
-+	ip6h = (struct ipv6hdr *)(skb_network_header(skb) + offset);
-+	thoff = sizeof(*ip6h) + offset;
-+	if (nf_flow_state_check(flow, ip6h->nexthdr, skb, thoff))
- 		return NF_ACCEPT;
- 
- 	if (tuplehash->tuple.xmit_type == FLOW_OFFLOAD_XMIT_NEIGH ||
-@@ -506,11 +575,13 @@ nf_flow_offload_ipv6_hook(void *priv, st
- 		}
- 	}
- 
--	if (skb_try_make_writable(skb, sizeof(*ip6h) + hdrsize))
-+	if (skb_try_make_writable(skb, thoff + hdrsize))
- 		return NF_DROP;
- 
- 	flow_offload_refresh(flow_table, flow);
- 
-+	nf_flow_encap_pop(skb, tuplehash);
-+
- 	ip6h = ipv6_hdr(skb);
- 	nf_flow_nat_ipv6(flow, skb, dir, ip6h);
- 
---- a/net/netfilter/nft_flow_offload.c
-+++ b/net/netfilter/nft_flow_offload.c
-@@ -66,6 +66,11 @@ static int nft_dev_fill_forward_path(con
- struct nft_forward_info {
- 	const struct net_device *indev;
- 	const struct net_device *outdev;
-+	struct id {
-+		__u16	id;
-+		__be16	proto;
-+	} encap[NF_FLOW_TABLE_ENCAP_MAX];
-+	u8 num_encaps;
- 	u8 h_source[ETH_ALEN];
- 	u8 h_dest[ETH_ALEN];
- 	enum flow_offload_xmit_type xmit_type;
-@@ -84,9 +89,23 @@ static void nft_dev_path_info(const stru
- 		path = &stack->path[i];
- 		switch (path->type) {
- 		case DEV_PATH_ETHERNET:
-+		case DEV_PATH_VLAN:
- 			info->indev = path->dev;
- 			if (is_zero_ether_addr(info->h_source))
- 				memcpy(info->h_source, path->dev->dev_addr, ETH_ALEN);
-+
-+			if (path->type == DEV_PATH_ETHERNET)
-+				break;
-+
-+			/* DEV_PATH_VLAN */
-+			if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) {
-+				info->indev = NULL;
-+				break;
-+			}
-+			info->outdev = path->dev;
-+			info->encap[info->num_encaps].id = path->encap.id;
-+			info->encap[info->num_encaps].proto = path->encap.proto;
-+			info->num_encaps++;
- 			break;
- 		case DEV_PATH_BRIDGE:
- 			if (is_zero_ether_addr(info->h_source))
-@@ -94,7 +113,6 @@ static void nft_dev_path_info(const stru
- 
- 			info->xmit_type = FLOW_OFFLOAD_XMIT_DIRECT;
- 			break;
--		case DEV_PATH_VLAN:
- 		default:
- 			info->indev = NULL;
- 			break;
-@@ -130,6 +148,7 @@ static void nft_dev_forward_path(struct
- 	struct net_device_path_stack stack;
- 	struct nft_forward_info info = {};
- 	unsigned char ha[ETH_ALEN];
-+	int i;
- 
- 	if (nft_dev_fill_forward_path(route, dst, ct, dir, ha, &stack) >= 0)
- 		nft_dev_path_info(&stack, &info, ha);
-@@ -138,6 +157,11 @@ static void nft_dev_forward_path(struct
- 		return;
- 
- 	route->tuple[!dir].in.ifindex = info.indev->ifindex;
-+	for (i = 0; i < info.num_encaps; i++) {
-+		route->tuple[!dir].in.encap[i].id = info.encap[i].id;
-+		route->tuple[!dir].in.encap[i].proto = info.encap[i].proto;
-+	}
-+	route->tuple[!dir].in.num_encaps = info.num_encaps;
- 
- 	if (info.xmit_type == FLOW_OFFLOAD_XMIT_DIRECT) {
- 		memcpy(route->tuple[dir].out.h_source, info.h_source, ETH_ALEN);