[nf-next,v6,8/8] netfilter: Support the bridge family in flow table
diff mbox series

Message ID 1564053176-28605-9-git-send-email-wenxu@ucloud.cn
State Under Review
Delegated to: Pablo Neira
Headers show
Series
  • netfilter: nf_flow_offload: support bridge family offload for both ipv4 and ipv6
Related show

Commit Message

wenxu July 25, 2019, 11:12 a.m. UTC
From: wenxu <wenxu@ucloud.cn>

This patch add the bridge flow table type. Implement the datapath
flow table to forward both IPV4 and IPV6 traffic through bridge.

Signed-off-by: wenxu <wenxu@ucloud.cn>
---
v6: rebase Kconfig file to master

 net/bridge/netfilter/Kconfig                |  8 +++++
 net/bridge/netfilter/Makefile               |  1 +
 net/bridge/netfilter/nf_flow_table_bridge.c | 48 +++++++++++++++++++++++++++++
 3 files changed, 57 insertions(+)
 create mode 100644 net/bridge/netfilter/nf_flow_table_bridge.c

Comments

wenxu Aug. 13, 2019, 10:56 a.m. UTC | #1
Hi pablo,


How about this patch? There are any question about this series?


BR

wenxu

On 7/25/2019 7:12 PM, wenxu@ucloud.cn wrote:
> From: wenxu <wenxu@ucloud.cn>
>
> This patch add the bridge flow table type. Implement the datapath
> flow table to forward both IPV4 and IPV6 traffic through bridge.
>
> Signed-off-by: wenxu <wenxu@ucloud.cn>
> ---
> v6: rebase Kconfig file to master
>
>  net/bridge/netfilter/Kconfig                |  8 +++++
>  net/bridge/netfilter/Makefile               |  1 +
>  net/bridge/netfilter/nf_flow_table_bridge.c | 48 +++++++++++++++++++++++++++++
>  3 files changed, 57 insertions(+)
>  create mode 100644 net/bridge/netfilter/nf_flow_table_bridge.c
>
> diff --git a/net/bridge/netfilter/Kconfig b/net/bridge/netfilter/Kconfig
> index 5040fe4..ad100cb 100644
> --- a/net/bridge/netfilter/Kconfig
> +++ b/net/bridge/netfilter/Kconfig
> @@ -41,6 +41,14 @@ config NF_CONNTRACK_BRIDGE
>  
>  	  To compile it as a module, choose M here.  If unsure, say N.
>  
> +config NF_FLOW_TABLE_BRIDGE
> +	tristate "Netfilter flow table bridge module"
> +	depends on NF_FLOW_TABLE && NF_CONNTRACK_BRIDGE
> +	help
> +          This option adds the flow table bridge support.
> +
> +	  To compile it as a module, choose M here.
> +
>  menuconfig BRIDGE_NF_EBTABLES
>  	tristate "Ethernet Bridge tables (ebtables) support"
>  	depends on BRIDGE && NETFILTER && NETFILTER_XTABLES
> diff --git a/net/bridge/netfilter/Makefile b/net/bridge/netfilter/Makefile
> index 8e2c575..627b269 100644
> --- a/net/bridge/netfilter/Makefile
> +++ b/net/bridge/netfilter/Makefile
> @@ -8,6 +8,7 @@ obj-$(CONFIG_NFT_BRIDGE_REJECT)  += nft_reject_bridge.o
>  
>  # connection tracking
>  obj-$(CONFIG_NF_CONNTRACK_BRIDGE) += nf_conntrack_bridge.o
> +obj-$(CONFIG_NF_FLOW_TABLE_BRIDGE) += nf_flow_table_bridge.o
>  
>  # packet logging
>  obj-$(CONFIG_NF_LOG_BRIDGE) += nf_log_bridge.o
> diff --git a/net/bridge/netfilter/nf_flow_table_bridge.c b/net/bridge/netfilter/nf_flow_table_bridge.c
> new file mode 100644
> index 0000000..c4fdd4a
> --- /dev/null
> +++ b/net/bridge/netfilter/nf_flow_table_bridge.c
> @@ -0,0 +1,48 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +#include <linux/kernel.h>
> +#include <linux/init.h>
> +#include <linux/module.h>
> +#include <linux/netfilter.h>
> +#include <net/netfilter/nf_flow_table.h>
> +#include <net/netfilter/nf_tables.h>
> +
> +static unsigned int
> +nf_flow_offload_bridge_hook(void *priv, struct sk_buff *skb,
> +			    const struct nf_hook_state *state)
> +{
> +	switch (skb->protocol) {
> +	case htons(ETH_P_IP):
> +		return nf_flow_offload_ip_hook(priv, skb, state);
> +	case htons(ETH_P_IPV6):
> +		return nf_flow_offload_ipv6_hook(priv, skb, state);
> +	}
> +
> +	return NF_ACCEPT;
> +}
> +
> +static struct nf_flowtable_type flowtable_bridge = {
> +	.family		= NFPROTO_BRIDGE,
> +	.init		= nf_flow_table_init,
> +	.free		= nf_flow_table_free,
> +	.hook		= nf_flow_offload_bridge_hook,
> +	.owner		= THIS_MODULE,
> +};
> +
> +static int __init nf_flow_bridge_module_init(void)
> +{
> +	nft_register_flowtable_type(&flowtable_bridge);
> +
> +	return 0;
> +}
> +
> +static void __exit nf_flow_bridge_module_exit(void)
> +{
> +	nft_unregister_flowtable_type(&flowtable_bridge);
> +}
> +
> +module_init(nf_flow_bridge_module_init);
> +module_exit(nf_flow_bridge_module_exit);
> +
> +MODULE_LICENSE("GPL");
> +MODULE_AUTHOR("wenxu <wenxu@ucloud.cn>");
> +MODULE_ALIAS_NF_FLOWTABLE(7); /* NFPROTO_BRIDGE */

Patch
diff mbox series

diff --git a/net/bridge/netfilter/Kconfig b/net/bridge/netfilter/Kconfig
index 5040fe4..ad100cb 100644
--- a/net/bridge/netfilter/Kconfig
+++ b/net/bridge/netfilter/Kconfig
@@ -41,6 +41,14 @@  config NF_CONNTRACK_BRIDGE
 
 	  To compile it as a module, choose M here.  If unsure, say N.
 
+config NF_FLOW_TABLE_BRIDGE
+	tristate "Netfilter flow table bridge module"
+	depends on NF_FLOW_TABLE && NF_CONNTRACK_BRIDGE
+	help
+          This option adds the flow table bridge support.
+
+	  To compile it as a module, choose M here.
+
 menuconfig BRIDGE_NF_EBTABLES
 	tristate "Ethernet Bridge tables (ebtables) support"
 	depends on BRIDGE && NETFILTER && NETFILTER_XTABLES
diff --git a/net/bridge/netfilter/Makefile b/net/bridge/netfilter/Makefile
index 8e2c575..627b269 100644
--- a/net/bridge/netfilter/Makefile
+++ b/net/bridge/netfilter/Makefile
@@ -8,6 +8,7 @@  obj-$(CONFIG_NFT_BRIDGE_REJECT)  += nft_reject_bridge.o
 
 # connection tracking
 obj-$(CONFIG_NF_CONNTRACK_BRIDGE) += nf_conntrack_bridge.o
+obj-$(CONFIG_NF_FLOW_TABLE_BRIDGE) += nf_flow_table_bridge.o
 
 # packet logging
 obj-$(CONFIG_NF_LOG_BRIDGE) += nf_log_bridge.o
diff --git a/net/bridge/netfilter/nf_flow_table_bridge.c b/net/bridge/netfilter/nf_flow_table_bridge.c
new file mode 100644
index 0000000..c4fdd4a
--- /dev/null
+++ b/net/bridge/netfilter/nf_flow_table_bridge.c
@@ -0,0 +1,48 @@ 
+// SPDX-License-Identifier: GPL-2.0-only
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netfilter.h>
+#include <net/netfilter/nf_flow_table.h>
+#include <net/netfilter/nf_tables.h>
+
+static unsigned int
+nf_flow_offload_bridge_hook(void *priv, struct sk_buff *skb,
+			    const struct nf_hook_state *state)
+{
+	switch (skb->protocol) {
+	case htons(ETH_P_IP):
+		return nf_flow_offload_ip_hook(priv, skb, state);
+	case htons(ETH_P_IPV6):
+		return nf_flow_offload_ipv6_hook(priv, skb, state);
+	}
+
+	return NF_ACCEPT;
+}
+
+static struct nf_flowtable_type flowtable_bridge = {
+	.family		= NFPROTO_BRIDGE,
+	.init		= nf_flow_table_init,
+	.free		= nf_flow_table_free,
+	.hook		= nf_flow_offload_bridge_hook,
+	.owner		= THIS_MODULE,
+};
+
+static int __init nf_flow_bridge_module_init(void)
+{
+	nft_register_flowtable_type(&flowtable_bridge);
+
+	return 0;
+}
+
+static void __exit nf_flow_bridge_module_exit(void)
+{
+	nft_unregister_flowtable_type(&flowtable_bridge);
+}
+
+module_init(nf_flow_bridge_module_init);
+module_exit(nf_flow_bridge_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("wenxu <wenxu@ucloud.cn>");
+MODULE_ALIAS_NF_FLOWTABLE(7); /* NFPROTO_BRIDGE */