From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: kaber@trash.net, netdev@vger.kernel.org, davem@davemloft.net
Subject: [PATCH 0/7 RFC] Netfilter/nf_tables ingress support
Date: Fri, 10 Apr 2015 14:15:35 +0200 [thread overview]
Message-ID: <1428668142-4006-1-git-send-email-pablo@netfilter.org> (raw)
This patchset adds the Netfilter hook at the ingress path, in a per-device
fashion. This also comes with the new nf_tables 'netdev' family support to
provide access to users to the existing nf_tables features. This includes the
transactional netlink API and the enhanced set infrastructure. Several patches
come in first place to prepare this support, including the refactoring of
__netif_receive_skb_core() to accomodate the new hook.
As in other netfilter hooks, a static key is used to disable the hook path when
no hooks are registered, so the ingress path remains similar to what we already
have. The static key that governs this is global.
The netfilter ingress hook comes just after handle_ing() to honor the existing
qdisc ingress infrastructure.
You can find a simple example ruleset file to account traffic at:
http://people.netfilter.org/pablo/nft-ingress.ruleset
Comments are welcome, thanks.
Pablo Neira Ayuso (7):
net: refactor __netif_receive_skb_core
netfilter: add nf_hook_list_active()
netfilter: add hook list to nf_hook_state
netfilter: cleanup struct nf_hook_ops struct indentation
net: add netfilter ingress hook
netfilter: nf_tables: allow to bind table to net_device
netfilter: nf_tables: add netdev table to filter from ingress
include/linux/netdevice.h | 4 +-
include/linux/netfilter.h | 39 +++---
include/linux/netfilter_ingress.h | 80 +++++++++++++
include/net/netfilter/nf_tables.h | 8 ++
include/net/netns/nftables.h | 1 +
include/uapi/linux/netfilter.h | 6 +
include/uapi/linux/netfilter/nf_tables.h | 2 +
net/core/dev.c | 190 +++++++++++++++++++-----------
net/netfilter/Kconfig | 6 +
net/netfilter/Makefile | 1 +
net/netfilter/core.c | 28 ++++-
net/netfilter/nf_tables_api.c | 47 +++++++-
net/netfilter/nf_tables_netdev.c | 182 ++++++++++++++++++++++++++++
13 files changed, 502 insertions(+), 92 deletions(-)
create mode 100644 include/linux/netfilter_ingress.h
create mode 100644 net/netfilter/nf_tables_netdev.c
--
1.7.10.4
next reply other threads:[~2015-04-10 12:15 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-04-10 12:15 Pablo Neira Ayuso [this message]
2015-04-10 12:15 ` [PATCH 1/7] net: refactor __netif_receive_skb_core Pablo Neira Ayuso
2015-04-10 13:47 ` Daniel Borkmann
2015-04-15 16:09 ` Jesper Dangaard Brouer
2015-04-16 5:49 ` Patrick McHardy
2015-04-10 19:56 ` Alexander Duyck
2015-04-15 12:44 ` David Laight
2015-04-15 13:28 ` Alexander Duyck
2015-04-10 12:15 ` [PATCH 2/7] netfilter: add nf_hook_list_active() Pablo Neira Ayuso
2015-04-10 12:15 ` [PATCH 3/7] netfilter: add hook list to nf_hook_state Pablo Neira Ayuso
2015-04-10 12:15 ` [PATCH 4/7] netfilter: cleanup struct nf_hook_ops struct indentation Pablo Neira Ayuso
2015-04-10 13:27 ` Sergei Shtylyov
2015-04-10 12:15 ` [PATCH 5/7] net: add netfilter ingress hook Pablo Neira Ayuso
2015-04-10 13:21 ` Thomas Graf
2015-04-10 13:36 ` Patrick McHardy
2015-04-10 20:17 ` Pablo Neira Ayuso
2015-04-10 21:33 ` Patrick McHardy
2015-04-11 12:55 ` Pablo Neira Ayuso
2015-04-11 13:06 ` Patrick McHardy
2015-04-11 13:32 ` Pablo Neira Ayuso
2015-04-10 20:08 ` Pablo Neira Ayuso
2015-04-10 12:15 ` [PATCH 6/7] netfilter: nf_tables: allow to bind table to net_device Pablo Neira Ayuso
2015-04-10 12:15 ` [PATCH 7/7] netfilter: nf_tables: add netdev table to filter from ingress Pablo Neira Ayuso
2015-04-10 13:22 ` [PATCH 0/7 RFC] Netfilter/nf_tables ingress support Thomas Graf
2015-04-10 20:09 ` Pablo Neira Ayuso
2015-04-13 1:14 ` David Miller
2015-04-13 20:19 ` Patrick McHardy
2015-04-14 9:00 ` Thomas Graf
2015-04-14 9:06 ` Patrick McHardy
2015-04-14 10:08 ` Thomas Graf
2015-04-14 10:13 ` Patrick McHardy
2015-04-14 10:32 ` Thomas Graf
2015-04-14 20:05 ` Jesper Dangaard Brouer
2015-04-14 12:27 ` Jamal Hadi Salim
2015-04-14 15:12 ` John Fastabend
2015-04-14 15:36 ` Alexei Starovoitov
2015-04-15 7:35 ` John Fastabend
2015-04-15 9:19 ` Daniel Borkmann
2015-04-15 16:24 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1428668142-4006-1-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=kaber@trash.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.