From: Florian Westphal <f...@strlen.de>

Upstream Commit:
    commit 93e66024b0249cec81e91328c55a754efd3192e0
    Author: Florian Westphal <f...@strlen.de>
    Date:   Wed Sep 12 15:19:07 2018 +0200

    netfilter: conntrack: pass nf_hook_state to packet and error handlers
    
    nf_hook_state contains all the hook meta-information: netns, protocol 
family,
    hook location, and so on.
    
    Instead of only passing selected information, pass a pointer to entire
    structure.
    
    This will allow to merge the error and the packet handlers and remove
    the ->new() function in followup patches.
    
    Signed-off-by: Florian Westphal <f...@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>

This patch backports the above upstream patch to OVS and fixes compiling
errors on RHEL kernels.

Cc: Florian Westphal <f...@strlen.de>
Signed-off-by: Yifeng Sun <pkusunyif...@gmail.com>
---
 acinclude.m4                                          |  5 +++++
 datapath/conntrack.c                                  |  8 ++++++--
 datapath/linux/Modules.mk                             |  4 +++-
 datapath/linux/compat/include/linux/netfilter.h       | 19 +++++++++++++++++++
 .../compat/include/net/netfilter/nf_conntrack_core.h  | 11 +++++++++++
 5 files changed, 44 insertions(+), 3 deletions(-)
 create mode 100644 datapath/linux/compat/include/linux/netfilter.h

diff --git a/acinclude.m4 b/acinclude.m4
index c9b744db0b94..372be5f4dccd 100644
--- a/acinclude.m4
+++ b/acinclude.m4
@@ -603,6 +603,8 @@ AC_DEFUN([OVS_CHECK_LINUX_COMPAT], [
                         [ndo_change_mtu], [OVS_DEFINE([HAVE_RHEL7_MAX_MTU])])
 
   OVS_GREP_IFELSE([$KSRC/include/linux/netfilter.h], [nf_hook_state])
+  OVS_FIND_FIELD_IFELSE([$KSRC/include/linux/netfilter.h], [nf_hook_state],
+                        [struct net ], [OVS_DEFINE([HAVE_NF_HOOK_STATE_NET])])
   OVS_GREP_IFELSE([$KSRC/include/linux/netfilter.h], [nf_register_net_hook])
   OVS_GREP_IFELSE([$KSRC/include/linux/netfilter.h], [nf_hookfn.*nf_hook_ops],
                   [OVS_DEFINE([HAVE_NF_HOOKFN_ARG_OPS])])
@@ -929,6 +931,9 @@ AC_DEFUN([OVS_CHECK_LINUX_COMPAT], [
   OVS_GREP_IFELSE([$KSRC/include/net/netfilter/nf_conntrack_l3proto.h],
                   [nf_conntrack_l3proto],
                   [OVS_DEFINE([HAVE_NF_CONNTRACK_L3PROATO_H])])
+  OVS_FIND_PARAM_IFELSE([$KSRC/include/net/netfilter/nf_conntrack_core.h],
+                        [nf_conntrack_in], [nf_hook_state],
+                        
[OVS_DEFINE([HAVE_NF_CONNTRACK_IN_TAKES_NF_HOOK_STATE])])
 
   if cmp -s datapath/linux/kcompat.h.new \
             datapath/linux/kcompat.h >/dev/null 2>&1; then
diff --git a/datapath/conntrack.c b/datapath/conntrack.c
index 52208bad3029..8c1a80308d6a 100644
--- a/datapath/conntrack.c
+++ b/datapath/conntrack.c
@@ -987,6 +987,11 @@ static int __ovs_ct_lookup(struct net *net, struct 
sw_flow_key *key,
        struct nf_conn *ct;
 
        if (!cached) {
+               struct nf_hook_state state = {
+                       .hook = NF_INET_PRE_ROUTING,
+                       .pf = info->family,
+                       .net = net,
+               };
                struct nf_conn *tmpl = info->ct;
                int err;
 
@@ -998,8 +1003,7 @@ static int __ovs_ct_lookup(struct net *net, struct 
sw_flow_key *key,
                        nf_ct_set(skb, tmpl, IP_CT_NEW);
                }
 
-               err = nf_conntrack_in(net, info->family,
-                                     NF_INET_PRE_ROUTING, skb);
+               err = nf_conntrack_in(skb, &state);
                if (err != NF_ACCEPT)
                        return -ENOENT;
 
diff --git a/datapath/linux/Modules.mk b/datapath/linux/Modules.mk
index caa2525ff0ab..e8483385dcbb 100644
--- a/datapath/linux/Modules.mk
+++ b/datapath/linux/Modules.mk
@@ -114,5 +114,7 @@ openvswitch_headers += \
        linux/compat/include/net/erspan.h \
        linux/compat/include/uapi/linux/netfilter.h \
        linux/compat/include/linux/mm.h \
-       linux/compat/include/linux/overflow.h
+       linux/compat/include/linux/overflow.h \
+       linux/compat/include/net/ipv6_frag.h \
+       linux/compat/include/linux/netfilter.h
 EXTRA_DIST += linux/compat/build-aux/export-check-whitelist
diff --git a/datapath/linux/compat/include/linux/netfilter.h 
b/datapath/linux/compat/include/linux/netfilter.h
new file mode 100644
index 000000000000..a6ed6172d49f
--- /dev/null
+++ b/datapath/linux/compat/include/linux/netfilter.h
@@ -0,0 +1,19 @@
+#ifndef __NETFILTER_WRAPPER_H
+#define __NETFILTER_WRAPPER_H
+
+#include_next <linux/netfilter.h>
+
+#if !defined(HAVE_NF_HOOK_STATE) || !defined(HAVE_NF_HOOK_STATE_NET)
+struct rpl_nf_hook_state {
+       unsigned int hook;
+       u_int8_t pf;
+       struct net_device *in;
+       struct net_device *out;
+       struct sock *sk;
+       struct net *net;
+       int (*okfn)(struct net *, struct sock *, struct sk_buff *);
+};
+#define nf_hook_state rpl_nf_hook_state
+#endif
+
+#endif /* __NETFILTER_WRAPPER_H */
diff --git a/datapath/linux/compat/include/net/netfilter/nf_conntrack_core.h 
b/datapath/linux/compat/include/net/netfilter/nf_conntrack_core.h
index 7834c8c25f79..d0e9aadcba76 100644
--- a/datapath/linux/compat/include/net/netfilter/nf_conntrack_core.h
+++ b/datapath/linux/compat/include/net/netfilter/nf_conntrack_core.h
@@ -104,4 +104,15 @@ static inline bool rpl_nf_ct_delete(struct nf_conn *ct, 
u32 portid, int report)
 #define nf_ct_delete rpl_nf_ct_delete
 #endif /* HAVE_NF_CONN_TIMER */
 
+static inline unsigned int
+rpl_nf_conntrack_in(struct sk_buff *skb, const struct nf_hook_state *state)
+{
+#ifdef HAVE_NF_CONNTRACK_IN_TAKES_NF_HOOK_STATE
+       return nf_conntrack_in(skb, state);
+#else
+       return nf_conntrack_in(state->net, state->pf, state->hook, skb);
+#endif /* HAVE_NF_CONNTRACK_IN_TAKES_NF_HOOK_STATE */
+}
+#define nf_conntrack_in rpl_nf_conntrack_in
+
 #endif /* _NF_CONNTRACK_CORE_WRAPPER_H */
-- 
2.7.4

_______________________________________________
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev

Reply via email to