| Message ID | 1562506649-3745-1-git-send-email-wenxu@ucloud.cn |
|---|---|
| State | Not Applicable |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | [nf-next,v3] netfilter:nft_meta: add NFT_META_VLAN support | expand |
On 07/07/2019 16:37, wenxu@ucloud.cn wrote: > From: wenxu <wenxu@ucloud.cn> > > This patch provide a meta vlan to set the vlan tag of the packet. > > for q-in-q outer vlan id 20: > meta vlan set 0x88a8:20 > > set the default 0x8100 vlan type with vlan id 20 > meta vlan set 20 > > Signed-off-by: wenxu <wenxu@ucloud.cn> > --- > include/net/netfilter/nft_meta.h | 5 ++++- > include/uapi/linux/netfilter/nf_tables.h | 4 ++++ > net/netfilter/nft_meta.c | 27 +++++++++++++++++++++++++++ > 3 files changed, 35 insertions(+), 1 deletion(-) > So mac_len is (mostly) only updated at receive, how do you deal with the mac header at egress, specifically if it's a locally originating packet ? I think it will be 0 and data will be pointing at the network header, take NF_INET_LOCAL_OUT for example.
On 7/8/2019 5:20 PM, Nikolay Aleksandrov wrote: > On 07/07/2019 16:37, wenxu@ucloud.cn wrote: >> From: wenxu <wenxu@ucloud.cn> >> >> This patch provide a meta vlan to set the vlan tag of the packet. >> >> for q-in-q outer vlan id 20: >> meta vlan set 0x88a8:20 >> >> set the default 0x8100 vlan type with vlan id 20 >> meta vlan set 20 >> >> Signed-off-by: wenxu <wenxu@ucloud.cn> >> --- >> include/net/netfilter/nft_meta.h | 5 ++++- >> include/uapi/linux/netfilter/nf_tables.h | 4 ++++ >> net/netfilter/nft_meta.c | 27 +++++++++++++++++++++++++++ >> 3 files changed, 35 insertions(+), 1 deletion(-) >> > So mac_len is (mostly) only updated at receive, how do you deal with the > mac header at egress, specifically if it's a locally originating packet ? > I think it will be 0 and data will be pointing at the network header, take > NF_INET_LOCAL_OUT for example. The nft_meta set mode in the bridge family is only limit for NF_BR_PRE_ROUTING( ingress) static int nft_meta_set_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, const struct nft_data **data) { struct nft_meta *priv = nft_expr_priv(expr); unsigned int hooks; if (priv->key != NFT_META_PKTTYPE) return 0; switch (ctx->family) { case NFPROTO_BRIDGE: hooks = 1 << NF_BR_PRE_ROUTING; break; > > > >
On 08/07/2019 12:20, Nikolay Aleksandrov wrote: > On 07/07/2019 16:37, wenxu@ucloud.cn wrote: >> From: wenxu <wenxu@ucloud.cn> >> >> This patch provide a meta vlan to set the vlan tag of the packet. >> >> for q-in-q outer vlan id 20: >> meta vlan set 0x88a8:20 >> >> set the default 0x8100 vlan type with vlan id 20 >> meta vlan set 20 >> >> Signed-off-by: wenxu <wenxu@ucloud.cn> >> --- >> include/net/netfilter/nft_meta.h | 5 ++++- >> include/uapi/linux/netfilter/nf_tables.h | 4 ++++ >> net/netfilter/nft_meta.c | 27 +++++++++++++++++++++++++++ >> 3 files changed, 35 insertions(+), 1 deletion(-) >> > > So mac_len is (mostly) only updated at receive, how do you deal with the > mac header at egress, specifically if it's a locally originating packet ? > I think it will be 0 and data will be pointing at the network header, take > NF_INET_LOCAL_OUT for example. > Obivously I should've checked the hook limits of nft_meta first. :) I see now that it is limited only to NF_INET_PRE_ROUTING for set, so that should be fine. Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
On Sun, Jul 07, 2019 at 09:37:29PM +0800, wenxu@ucloud.cn wrote: > From: wenxu <wenxu@ucloud.cn> > > This patch provide a meta vlan to set the vlan tag of the packet. > > for q-in-q outer vlan id 20: > meta vlan set 0x88a8:20 > > set the default 0x8100 vlan type with vlan id 20 > meta vlan set 20 Support for pushing and popping vlan will be needed soon, this design does not cover that usecase.
diff --git a/include/net/netfilter/nft_meta.h b/include/net/netfilter/nft_meta.h index 5c69e9b..cb0f1e8 100644 --- a/include/net/netfilter/nft_meta.h +++ b/include/net/netfilter/nft_meta.h @@ -6,7 +6,10 @@ struct nft_meta { enum nft_meta_keys key:8; union { enum nft_registers dreg:8; - enum nft_registers sreg:8; + struct { + enum nft_registers sreg:8; + enum nft_registers sreg2:8; + }; }; }; diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h index a0d1dbd..699524a 100644 --- a/include/uapi/linux/netfilter/nf_tables.h +++ b/include/uapi/linux/netfilter/nf_tables.h @@ -797,6 +797,7 @@ enum nft_exthdr_attributes { * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind) * @NFT_META_BRI_IIFPVID: packet input bridge port pvid * @NFT_META_BRI_IIFVPROTO: packet input bridge vlan proto + * @NFT_META_VLAN: packet vlan metadata */ enum nft_meta_keys { NFT_META_LEN, @@ -829,6 +830,7 @@ enum nft_meta_keys { NFT_META_OIFKIND, NFT_META_BRI_IIFPVID, NFT_META_BRI_IIFVPROTO, + NFT_META_VLAN, }; /** @@ -895,12 +897,14 @@ enum nft_hash_attributes { * @NFTA_META_DREG: destination register (NLA_U32) * @NFTA_META_KEY: meta data item to load (NLA_U32: nft_meta_keys) * @NFTA_META_SREG: source register (NLA_U32) + * @NFTA_META_SREG2: source register (NLA_U32) */ enum nft_meta_attributes { NFTA_META_UNSPEC, NFTA_META_DREG, NFTA_META_KEY, NFTA_META_SREG, + NFTA_META_SREG2, __NFTA_META_MAX }; #define NFTA_META_MAX (__NFTA_META_MAX - 1) diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index 18a848b..901ad2e 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -271,6 +271,22 @@ void nft_meta_set_eval(const struct nft_expr *expr, skb->secmark = value; break; #endif + case NFT_META_VLAN: { + u32 *sreg2 = ®s->data[meta->sreg2]; + u16 vlan_proto; + u16 vlan_tci; + + vlan_tci = nft_reg_load16(sreg); + vlan_proto = nft_reg_load16(sreg2); + + if (vlan_proto != ETH_P_8021Q && vlan_proto != ETH_P_8021AD) + return; + + skb_push_rcsum(skb, skb->mac_len); + skb_vlan_push(skb, htons(vlan_proto), vlan_tci & VLAN_VID_MASK); + skb_pull_rcsum(skb, skb->mac_len); + break; + } default: WARN_ON(1); } @@ -281,6 +297,7 @@ void nft_meta_set_eval(const struct nft_expr *expr, [NFTA_META_DREG] = { .type = NLA_U32 }, [NFTA_META_KEY] = { .type = NLA_U32 }, [NFTA_META_SREG] = { .type = NLA_U32 }, + [NFTA_META_SREG2] = { .type = NLA_U32 }, }; EXPORT_SYMBOL_GPL(nft_meta_policy); @@ -432,6 +449,13 @@ int nft_meta_set_init(const struct nft_ctx *ctx, case NFT_META_PKTTYPE: len = sizeof(u8); break; + case NFT_META_VLAN: + len = sizeof(u16); + priv->sreg2 = nft_parse_register(tb[NFTA_META_SREG2]); + err = nft_validate_register_load(priv->sreg2, len); + if (err < 0) + return err; + break; default: return -EOPNOTSUPP; } @@ -457,6 +481,9 @@ int nft_meta_get_dump(struct sk_buff *skb, goto nla_put_failure; if (nft_dump_register(skb, NFTA_META_DREG, priv->dreg)) goto nla_put_failure; + if (priv->key == NFT_META_VLAN && + nft_dump_register(skb, NFTA_META_SREG2, priv->sreg2)) + goto nla_put_failure; return 0; nla_put_failure: