From patchwork Wed Jun 19 07:16:24 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: wenxu X-Patchwork-Id: 1118504 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=ucloud.cn Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45TGTf1GyNz9sNR for ; Wed, 19 Jun 2019 17:16:38 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731105AbfFSHQf (ORCPT ); Wed, 19 Jun 2019 03:16:35 -0400 Received: from m9784.mail.qiye.163.com ([220.181.97.84]:28124 "EHLO m9784.mail.qiye.163.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730999AbfFSHQe (ORCPT ); Wed, 19 Jun 2019 03:16:34 -0400 Received: from localhost.localdomain (unknown [123.59.132.129]) by m9784.mail.qiye.163.com (Hmail) with ESMTPA id 011D541A51; Wed, 19 Jun 2019 15:16:25 +0800 (CST) From: wenxu@ucloud.cn To: pablo@netfilter.org, fw@strlen.de Cc: netfilter-devel@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH 1/2 nf-next] netfilter: nft_meta: add NFT_META_BRI_PVID support Date: Wed, 19 Jun 2019 15:16:24 +0800 Message-Id: <1560928585-18352-1-git-send-email-wenxu@ucloud.cn> X-Mailer: git-send-email 1.8.3.1 X-HM-Spam-Status: e1kfGhgUHx5ZQUtXWQgYFAkeWUFZSVVNTElCQkJDTkNDTk1JWVdZKFlBSU I3V1ktWUFJV1kJDhceCFlBWTU0KTY6NyQpLjc#WQY+ X-HM-Sender-Digest: e1kMHhlZQR0aFwgeV1kSHx4VD1lBWUc6Oio6Tio6Fjg3HBALNB4WDhQj GVEaCzdVSlVKTk1LQklDTkNNS0xIVTMWGhIXVQweFQMOOw4YFxQOH1UYFUVZV1kSC1lBWUpJSFVO QlVKSElVSklCWVdZCAFZQUhLTkI3Bg++ X-HM-Tid: 0a6b6e9809352086kuqy011d541a51 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org From: wenxu nft add table bridge firewall nft add chain bridge firewall zones { type filter hook prerouting priority - 300 \; } nft add rule bridge firewall zones counter ct zone set vlan id map { 100 : 1, 200 : 2 } As above set the bridge port with pvid, the received packet don't contain the vlan tag which means the packet should belong to vlan 200 through pvid. With this pacth user can get the pvid of bridge ports: "meta brpvid" Signed-off-by: wenxu --- include/uapi/linux/netfilter/nf_tables.h | 2 ++ net/netfilter/nft_meta.c | 17 +++++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h index 31a6b8f..4a16124 100644 --- a/include/uapi/linux/netfilter/nf_tables.h +++ b/include/uapi/linux/netfilter/nf_tables.h @@ -793,6 +793,7 @@ enum nft_exthdr_attributes { * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp) * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind) * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind) + * @NFT_META_BRI_PVID: packet input bridge port pvid */ enum nft_meta_keys { NFT_META_LEN, @@ -823,6 +824,7 @@ enum nft_meta_keys { NFT_META_SECPATH, NFT_META_IIFKIND, NFT_META_OIFKIND, + NFT_META_BRI_PVID, }; /** diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index 987d2d6..1fdb565 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -243,6 +243,18 @@ void nft_meta_get_eval(const struct nft_expr *expr, goto err; strncpy((char *)dest, p->br->dev->name, IFNAMSIZ); return; + case NFT_META_BRI_PVID: + if (in == NULL || (p = br_port_get_rtnl_rcu(in)) == NULL) + goto err; + if (br_opt_get(p->br, BROPT_VLAN_ENABLED)) { + u16 pvid = br_get_pvid(nbp_vlan_group_rcu(p)); + + if (pvid) { + nft_reg_store16(dest, pvid); + return; + } + } + goto err; #endif case NFT_META_IIFKIND: if (in == NULL || in->rtnl_link_ops == NULL) @@ -370,6 +382,11 @@ static int nft_meta_get_init(const struct nft_ctx *ctx, return -EOPNOTSUPP; len = IFNAMSIZ; break; + case NFT_META_BRI_PVID: + if (ctx->family != NFPROTO_BRIDGE) + return -EOPNOTSUPP; + len = sizeof(u16); + break; #endif default: return -EOPNOTSUPP; From patchwork Wed Jun 19 07:16:25 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: wenxu X-Patchwork-Id: 1118505 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=ucloud.cn Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45TGTf6Wkhz9sNT for ; Wed, 19 Jun 2019 17:16:38 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731063AbfFSHQd (ORCPT ); Wed, 19 Jun 2019 03:16:33 -0400 Received: from m9784.mail.qiye.163.com ([220.181.97.84]:28122 "EHLO m9784.mail.qiye.163.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725946AbfFSHQd (ORCPT ); Wed, 19 Jun 2019 03:16:33 -0400 Received: from localhost.localdomain (unknown [123.59.132.129]) by m9784.mail.qiye.163.com (Hmail) with ESMTPA id 17DB741AB0; Wed, 19 Jun 2019 15:16:26 +0800 (CST) From: wenxu@ucloud.cn To: pablo@netfilter.org, fw@strlen.de Cc: netfilter-devel@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH 2/2 nf-next] netfilter: nft_meta: Add NFT_META_BRI_VLAN support Date: Wed, 19 Jun 2019 15:16:25 +0800 Message-Id: <1560928585-18352-2-git-send-email-wenxu@ucloud.cn> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1560928585-18352-1-git-send-email-wenxu@ucloud.cn> References: <1560928585-18352-1-git-send-email-wenxu@ucloud.cn> X-HM-Spam-Status: e1kfGhgUHx5ZQUtXWQgYFAkeWUFZVklVS0NJS0tLS0pMSk1NSk9ZV1koWU FJQjdXWS1ZQUlXWQkOFx4IWUFZNTQpNjo3JCkuNz5ZBg++ X-HM-Sender-Digest: e1kMHhlZQR0aFwgeV1kSHx4VD1lBWUc6Ky46Aio6Kjg6TRBNQx0TDgk3 GC4wFC9VSlVKTk1LQklDTkNNSk5MVTMWGhIXVQweFQMOOw4YFxQOH1UYFUVZV1kSC1lBWUpJSFVO QlVKSElVSklCWVdZCAFZQUhMSUI3Bg++ X-HM-Tid: 0a6b6e9809852086kuqy17db741ab0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org From: wenxu nft add table bridge firewall nft add chain bridge firewall zones { type filter hook prerouting priority - 300 \; } nft add rule bridge firewall zones counter ct zone set vlan id map { 100 : 1, 200 : 2 } As above set the bridge port with pvid, the received packet don't contain the vlan tag which means the packet should belong to vlan 200 through pvid. With this pacth user can set the pvid in the prerouting hook before set zone id and conntrack: "meta brvlan set meta brpvid" Signed-off-by: wenxu --- include/uapi/linux/netfilter/nf_tables.h | 2 ++ net/netfilter/nft_meta.c | 20 ++++++++++++++++++++ 2 files changed, 22 insertions(+) diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h index 4a16124..7be0307 100644 --- a/include/uapi/linux/netfilter/nf_tables.h +++ b/include/uapi/linux/netfilter/nf_tables.h @@ -794,6 +794,7 @@ enum nft_exthdr_attributes { * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind) * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind) * @NFT_META_BRI_PVID: packet input bridge port pvid + * @NFT_META_BRI_VLAN: set vlan tag on packet */ enum nft_meta_keys { NFT_META_LEN, @@ -825,6 +826,7 @@ enum nft_meta_keys { NFT_META_IIFKIND, NFT_META_OIFKIND, NFT_META_BRI_PVID, + NFT_META_BRI_VLAN, }; /** diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index 1fdb565..5c3817b 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -282,8 +282,13 @@ static void nft_meta_set_eval(const struct nft_expr *expr, { const struct nft_meta *meta = nft_expr_priv(expr); struct sk_buff *skb = pkt->skb; + const struct net_device *in = nft_in(pkt); u32 *sreg = ®s->data[meta->sreg]; +#ifdef CONFIG_NF_TABLES_BRIDGE + const struct net_bridge_port *p; +#endif u32 value = *sreg; + u16 value16; u8 value8; switch (meta->key) { @@ -306,6 +311,14 @@ static void nft_meta_set_eval(const struct nft_expr *expr, skb->nf_trace = !!value8; break; +#ifdef CONFIG_NF_TABLES_BRIDGE + case NFT_META_BRI_VLAN: + value16 = nft_reg_load16(sreg); + if (in && (p = br_port_get_rtnl_rcu(in)) && + !skb_vlan_tag_present(skb)) + __vlan_hwaccel_put_tag(skb, p->br->vlan_proto, value16); + break; +#endif #ifdef CONFIG_NETWORK_SECMARK case NFT_META_SECMARK: skb->secmark = value; @@ -481,6 +494,13 @@ static int nft_meta_set_init(const struct nft_ctx *ctx, case NFT_META_PKTTYPE: len = sizeof(u8); break; +#ifdef CONFIG_NF_TABLES_BRIDGE + case NFT_META_BRI_VLAN: + if (ctx->family != NFPROTO_BRIDGE) + return -EOPNOTSUPP; + len = sizeof(u16); + break; +#endif default: return -EOPNOTSUPP; }