| Message ID | 1458978132-8006-3-git-send-email-stephane.ml.bryant@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
On Sat, Mar 26, 2016 at 08:42:12AM +0100, Stephane Bryant wrote: > This makes nf queues use NFQA_VLAN and NFQA_L2HDR in verdict to modify the > original skb Applied this too, thanks. Just one minor glitch. > Signed-off-by: Stephane Bryant <stephane.ml.bryant@gmail.com> > --- > net/netfilter/nfnetlink_queue.c | 45 +++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 45 insertions(+) > > diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c > index 6451f5d..a7ad25a 100644 > --- a/net/netfilter/nfnetlink_queue.c > +++ b/net/netfilter/nfnetlink_queue.c > @@ -967,12 +967,18 @@ static struct notifier_block nfqnl_rtnl_notifier = { > .notifier_call = nfqnl_rcv_nl_event, > }; > > +static const struct nla_policy nfqa_vlan_policy[NFQA_VLAN_MAX + 1] = { > + [NFQA_VLAN_TCI] = { .type = NLA_U16}, > + [NFQA_VLAN_PROTO] = { .type = NLA_U16}, > +}; > + > static const struct nla_policy nfqa_verdict_policy[NFQA_MAX+1] = { > [NFQA_VERDICT_HDR] = { .len = sizeof(struct nfqnl_msg_verdict_hdr) }, > [NFQA_MARK] = { .type = NLA_U32 }, > [NFQA_PAYLOAD] = { .type = NLA_UNSPEC }, > [NFQA_CT] = { .type = NLA_UNSPEC }, > [NFQA_EXP] = { .type = NLA_UNSPEC }, > + [NFQA_VLAN] = { .type = NLA_NESTED }, > }; > > static const struct nla_policy nfqa_verdict_batch_policy[NFQA_MAX+1] = { > @@ -1086,6 +1092,40 @@ static struct nf_conn *nfqnl_ct_parse(struct nfnl_ct_hook *nfnl_ct, > return ct; > } > > +static int nfqa_parse_bridge(struct nf_queue_entry *entry, > + const struct nlattr * const nfqa[]) > +{ > + if (nfqa[NFQA_VLAN]) { > + int err; > + struct nlattr *tb[NFQA_VLAN_MAX + 1]; > + > + err = nla_parse_nested(tb, NFQA_VLAN_MAX, nfqa[NFQA_VLAN], > + nfqa_vlan_policy); > + if (err < 0) > + return err; > + > + if (!tb[NFQA_VLAN_TCI] || !tb[NFQA_VLAN_PROTO]) > + return -EINVAL; > + > + entry->skb->vlan_tci = ntohs(nla_get_be16(tb[NFQA_VLAN_TCI])); > + entry->skb->vlan_proto = nla_get_be16(tb[NFQA_VLAN_PROTO]); > + } > + > + if (nfqa[NFQA_L2HDR]) { > + int mac_header_len = entry->skb->network_header - > + entry->skb->mac_header; > + > + if (mac_header_len != nla_len(nfqa[NFQA_L2HDR])) > + return -EINVAL; > + else if (mac_header_len > 0) > + memcpy(skb_mac_header(entry->skb), > + nla_data(nfqa[NFQA_L2HDR]), > + mac_header_len); > + } > + > + return 0; > +} > + > static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl, > struct sk_buff *skb, > const struct nlmsghdr *nlh, > @@ -1127,6 +1167,11 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl, > ct = nfqnl_ct_parse(nfnl_ct, nlh, nfqa, entry, &ctinfo); > } > > + if (entry->state.pf == PF_BRIDGE) { > + if (nfqa_parse_bridge(entry, nfqa) < 0) > + verdict = NF_DROP; I have changed this to return -EINVAL instead, so userspace knows that what it is doing is wrong. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c index 6451f5d..a7ad25a 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -967,12 +967,18 @@ static struct notifier_block nfqnl_rtnl_notifier = { .notifier_call = nfqnl_rcv_nl_event, }; +static const struct nla_policy nfqa_vlan_policy[NFQA_VLAN_MAX + 1] = { + [NFQA_VLAN_TCI] = { .type = NLA_U16}, + [NFQA_VLAN_PROTO] = { .type = NLA_U16}, +}; + static const struct nla_policy nfqa_verdict_policy[NFQA_MAX+1] = { [NFQA_VERDICT_HDR] = { .len = sizeof(struct nfqnl_msg_verdict_hdr) }, [NFQA_MARK] = { .type = NLA_U32 }, [NFQA_PAYLOAD] = { .type = NLA_UNSPEC }, [NFQA_CT] = { .type = NLA_UNSPEC }, [NFQA_EXP] = { .type = NLA_UNSPEC }, + [NFQA_VLAN] = { .type = NLA_NESTED }, }; static const struct nla_policy nfqa_verdict_batch_policy[NFQA_MAX+1] = { @@ -1086,6 +1092,40 @@ static struct nf_conn *nfqnl_ct_parse(struct nfnl_ct_hook *nfnl_ct, return ct; } +static int nfqa_parse_bridge(struct nf_queue_entry *entry, + const struct nlattr * const nfqa[]) +{ + if (nfqa[NFQA_VLAN]) { + int err; + struct nlattr *tb[NFQA_VLAN_MAX + 1]; + + err = nla_parse_nested(tb, NFQA_VLAN_MAX, nfqa[NFQA_VLAN], + nfqa_vlan_policy); + if (err < 0) + return err; + + if (!tb[NFQA_VLAN_TCI] || !tb[NFQA_VLAN_PROTO]) + return -EINVAL; + + entry->skb->vlan_tci = ntohs(nla_get_be16(tb[NFQA_VLAN_TCI])); + entry->skb->vlan_proto = nla_get_be16(tb[NFQA_VLAN_PROTO]); + } + + if (nfqa[NFQA_L2HDR]) { + int mac_header_len = entry->skb->network_header - + entry->skb->mac_header; + + if (mac_header_len != nla_len(nfqa[NFQA_L2HDR])) + return -EINVAL; + else if (mac_header_len > 0) + memcpy(skb_mac_header(entry->skb), + nla_data(nfqa[NFQA_L2HDR]), + mac_header_len); + } + + return 0; +} + static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl, struct sk_buff *skb, const struct nlmsghdr *nlh, @@ -1127,6 +1167,11 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl, ct = nfqnl_ct_parse(nfnl_ct, nlh, nfqa, entry, &ctinfo); } + if (entry->state.pf == PF_BRIDGE) { + if (nfqa_parse_bridge(entry, nfqa) < 0) + verdict = NF_DROP; + } + if (nfqa[NFQA_PAYLOAD]) { u16 payload_len = nla_len(nfqa[NFQA_PAYLOAD]); int diff = payload_len - entry->skb->len;
This makes nf queues use NFQA_VLAN and NFQA_L2HDR in verdict to modify the original skb Signed-off-by: Stephane Bryant <stephane.ml.bryant@gmail.com> --- net/netfilter/nfnetlink_queue.c | 45 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+)