From patchwork Fri Sep 5 10:44:48 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ana Rey X-Patchwork-Id: 386293 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 01AC314003E for ; Fri, 5 Sep 2014 20:42:26 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756560AbaIEKmZ (ORCPT ); Fri, 5 Sep 2014 06:42:25 -0400 Received: from mail-wg0-f44.google.com ([74.125.82.44]:61106 "EHLO mail-wg0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756557AbaIEKmZ (ORCPT ); Fri, 5 Sep 2014 06:42:25 -0400 Received: by mail-wg0-f44.google.com with SMTP id m15so11483508wgh.27 for ; Fri, 05 Sep 2014 03:42:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=vErWiR6zQLn6+e5vN+AP3WUhcVwHu4NcPshEt1LGiJk=; b=j6aPEY4KWr5qtQoA+IocGfOq3PQe+UEn8fssx3xc2RocUlLPMnk0Z7KJkul7vGzPJo kxuovefHmeKmd63MjhRA766X1df/FMht8QF8nWX8XFdGCPJZwhI4S1fRBHxFzNwjPUR4 CPo+4eQmt44NxNN1OYrozE0CavI49xP33GreoAfFibfqdMOS0kXSq78B64K94hkhrCDo r6SuEdLwLkrwGOpwp/p0IRQrDpBAWNQdrR+qBnNn3t7Xck1sSV+3lC/fYsxZ9hvc3Bl+ x3dehVOD6IbhyVnkM4YQuIRVrWolpKKrat+xPFiOM3yB9pl2qRT0MpLBQYNO6daogMhR meXQ== X-Received: by 10.180.102.130 with SMTP id fo2mr2611837wib.29.1409913744002; Fri, 05 Sep 2014 03:42:24 -0700 (PDT) Received: from localhost.localdomain (186.169.216.87.static.jazztel.es. [87.216.169.186]) by mx.google.com with ESMTPSA id lh11sm1415255wic.17.2014.09.05.03.42.22 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 05 Sep 2014 03:42:23 -0700 (PDT) From: Ana Rey To: netfilter-devel@vger.kernel.org Cc: Ana Rey Subject: [PATCH] netfilter: nf_tables: Add bridge interface physical index and name Date: Fri, 5 Sep 2014 12:44:48 +0200 Message-Id: <1409913888-5145-1-git-send-email-anarey@gmail.com> X-Mailer: git-send-email 1.7.10.4 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org This allows us to match the packets that enter or leave through a bridge physical interface by name or index. This reuses the NFT_META_IIFNAME, NFT_META_OIFNAME, NFT_META_IIF and NFT_META_OIF labels. In the bridge context, these labels have a special meaning. The kernel chooses the behaviour depending on the family. Signed-off-by: Ana Rey --- net/bridge/netfilter/nft_meta_bridge.c | 36 +++++++++++++++++++++++++++++++- 1 file changed, 35 insertions(+), 1 deletion(-) diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c index 4f02109..247c0ef 100644 --- a/net/bridge/netfilter/nft_meta_bridge.c +++ b/net/bridge/netfilter/nft_meta_bridge.c @@ -26,21 +26,51 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr, const struct net_device *in = pkt->in, *out = pkt->out; struct nft_data *dest = &data[priv->dreg]; const struct net_bridge_port *p; + struct nf_bridge_info *nf_bridge; switch (priv->key) { case NFT_META_BRI_IIFNAME: if (in == NULL || (p = br_port_get_rcu(in)) == NULL) goto err; + strncpy((char *)dest->data, p->br->dev->name, + sizeof(dest->data)); break; case NFT_META_BRI_OIFNAME: if (out == NULL || (p = br_port_get_rcu(out)) == NULL) goto err; + strncpy((char *)dest->data, p->br->dev->name, + sizeof(dest->data)); + break; + case NFT_META_IIF: + nf_bridge = pkt->skb->nf_bridge; + if (nf_bridge == NULL || nf_bridge->physindev == NULL) + goto err; + dest->data[0] = nf_bridge->physindev->ifindex; + break; + case NFT_META_OIF: + nf_bridge = pkt->skb->nf_bridge; + if (nf_bridge == NULL || nf_bridge->physoutdev == NULL) + goto err; + dest->data[0] = nf_bridge->physoutdev->ifindex; + break; + case NFT_META_IIFNAME: + nf_bridge = pkt->skb->nf_bridge; + if (nf_bridge == NULL || nf_bridge->physindev == NULL) + goto err; + strncpy((char *)dest->data, nf_bridge->physindev->name, + sizeof(dest->data)); + break; + case NFT_META_OIFNAME: + nf_bridge = pkt->skb->nf_bridge; + if (nf_bridge == NULL || nf_bridge->physoutdev == NULL) + goto err; + strncpy((char *)dest->data, nf_bridge->physoutdev->name, + sizeof(dest->data)); break; default: goto out; } - strncpy((char *)dest->data, p->br->dev->name, sizeof(dest->data)); return; out: return nft_meta_get_eval(expr, data, pkt); @@ -59,6 +89,10 @@ static int nft_meta_bridge_get_init(const struct nft_ctx *ctx, switch (priv->key) { case NFT_META_BRI_IIFNAME: case NFT_META_BRI_OIFNAME: + case NFT_META_IIF: + case NFT_META_OIF: + case NFT_META_IIFNAME: + case NFT_META_OIFNAME: break; default: return nft_meta_get_init(ctx, expr, tb);