We now have a formal array of forwarding rules. However, we don't actually
consult it when we forward a new flow. Instead we rely on (a) implicit
information (we wouldn't be here if there wasn't a listening socket for the
rule) and (b) the legacy delta[] data structure.
Start addressing this, by searching for a matching forwarding rule when
attempting to forward a new flow. For now this is incomplete:
* We only do this for socket-initiated flows
* We make a potentially costly linear lookup
* We don't actually use the matching rule for anything yet
We'll address each of those in later patches.
Signed-off-by: David Gibson
---
flow.c | 43 ++++++++++++++++++++++++++++++++++---------
fwd.c | 34 ++++++++++++++++++++++++++++++++++
fwd.h | 2 ++
3 files changed, 70 insertions(+), 9 deletions(-)
diff --git a/flow.c b/flow.c
index cefe6c8b..0d97f161 100644
--- a/flow.c
+++ b/flow.c
@@ -526,7 +526,7 @@ struct flowside *flow_initiate_sa(union flow *flow, uint8_t pif,
struct flowside *flow_target(const struct ctx *c, union flow *flow,
uint8_t proto)
{
- char estr[INANY_ADDRSTRLEN], fstr[INANY_ADDRSTRLEN];
+ char estr[INANY_ADDRSTRLEN], ostr[INANY_ADDRSTRLEN];
struct flow_common *f = &flow->f;
const struct flowside *ini = &f->side[INISIDE];
struct flowside *tgt = &f->side[TGTSIDE];
@@ -537,6 +537,30 @@ struct flowside *flow_target(const struct ctx *c, union flow *flow,
ASSERT(f->pif[INISIDE] != PIF_NONE && f->pif[TGTSIDE] == PIF_NONE);
ASSERT(flow->f.state == FLOW_STATE_INI);
+ if (pif_is_socket(f->pif[INISIDE])) {
+ const struct fwd_ports *fwd;
+
+ if (f->pif[INISIDE] == PIF_HOST && proto == IPPROTO_TCP)
+ fwd = &c->tcp.fwd_in;
+ else if (f->pif[INISIDE] == PIF_HOST && proto == IPPROTO_UDP)
+ fwd = &c->udp.fwd_in;
+ else if (f->pif[INISIDE] == PIF_SPLICE && proto == IPPROTO_TCP)
+ fwd = &c->tcp.fwd_out;
+ else if (f->pif[INISIDE] == PIF_SPLICE && proto == IPPROTO_UDP)
+ fwd = &c->udp.fwd_out;
+ else
+ goto nofwd;
+
+ if (!fwd_rule_search(fwd, ini)) {
+ /* This shouldn't happen, because if there's no rule for
+ * it we should have no listening socket that would let
+ * us get here
+ */
+ flow_dbg(flow, "Unexpected missing forward rule");
+ goto nofwd;
+ }
+ }
+
switch (f->pif[INISIDE]) {
case PIF_TAP:
memcpy(f->tap_omac, MAC_UNDEF, ETH_ALEN);
@@ -551,22 +575,23 @@ struct flowside *flow_target(const struct ctx *c, union flow *flow,
tgtpif = fwd_nat_from_host(c, proto, ini, tgt);
fwd_neigh_mac_get(c, &tgt->oaddr, f->tap_omac);
break;
-
default:
- flow_err(flow, "No rules to forward %s [%s]:%hu -> [%s]:%hu",
- pif_name(f->pif[INISIDE]),
- inany_ntop(&ini->eaddr, estr, sizeof(estr)),
- ini->eport,
- inany_ntop(&ini->oaddr, fstr, sizeof(fstr)),
- ini->oport);
+ goto nofwd;
}
if (tgtpif == PIF_NONE)
- return NULL;
+ goto nofwd;
f->pif[TGTSIDE] = tgtpif;
flow_set_state(f, FLOW_STATE_TGT);
return tgt;
+
+nofwd:
+ flow_err(flow, "No rules to forward %s %s [%s]:%hu -> [%s]:%hu",
+ pif_name(f->pif[INISIDE]), ipproto_name(proto),
+ inany_ntop(&ini->eaddr, estr, sizeof(estr)), ini->eport,
+ inany_ntop(&ini->oaddr, ostr, sizeof(ostr)), ini->oport);
+ return NULL;
}
/**
diff --git a/fwd.c b/fwd.c
index 266e2410..4b83f2f9 100644
--- a/fwd.c
+++ b/fwd.c
@@ -415,6 +415,40 @@ void fwd_rule_add(struct fwd_ports *fwd, uint8_t flags,
}
}
+/**
+ * fwd_rule_match() - Does a prospective flow match a given forwarding rule?
+ * @rule: Forwarding rule
+ * @ini: Initiating side flow information
+ *
+ * Returns: true if the rule applies to the flow, false otherwise
+ */
+static bool fwd_rule_match(const struct fwd_rule *rule,
+ const struct flowside *ini)
+{
+ return inany_matches(&ini->oaddr, fwd_rule_addr(rule)) &&
+ ini->oport >= rule->first && ini->oport <= rule->last;
+}
+
+/**
+ * fwd_rule_search() - Find a rule which matches a prospective flow
+ * @fwd: Forwarding table
+ * @ini: Initiating side flow information
+ *
+ * Returns: first matching rule, or NULL if there is none
+ */
+const struct fwd_rule *fwd_rule_search(const struct fwd_ports *fwd,
+ const struct flowside *ini)
+{
+ unsigned i;
+
+ for (i = 0; i < fwd->count; i++) {
+ if (fwd_rule_match(&fwd->rules[i], ini))
+ return &fwd->rules[i];
+ }
+
+ return NULL;
+}
+
/**
* fwd_rules_print() - Print forwarding rules for debugging
* @fwd: Table to print
diff --git a/fwd.h b/fwd.h
index ccf8b8ca..954db021 100644
--- a/fwd.h
+++ b/fwd.h
@@ -106,6 +106,8 @@ struct fwd_ports {
void fwd_rule_add(struct fwd_ports *fwd, uint8_t flags,
const union inany_addr *addr, const char *ifname,
in_port_t first, in_port_t last, in_port_t to);
+const struct fwd_rule *fwd_rule_search(const struct fwd_ports *fwd,
+ const struct flowside *ini);
void fwd_rules_print(const struct fwd_ports *fwd);
void fwd_scan_ports_init(struct ctx *c);
--
2.52.0