* Re: [PATCH v2] netfilter: nf_tables: add pkttype support to meta expression
2014-06-13 7:15 [PATCH v2] netfilter: nf_tables: add pkttype support to meta expression Ana Rey
@ 2014-06-27 11:09 ` Pablo Neira Ayuso
2014-08-05 18:27 ` [PATCH v3] " Ana Rey
2014-08-06 11:52 ` [PATCH v4] " Ana Rey
2 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2014-06-27 11:09 UTC (permalink / raw)
To: Ana Rey; +Cc: netfilter-devel, Alvaro Neira Ayuso
On Fri, Jun 13, 2014 at 09:15:20AM +0200, Ana Rey wrote:
> Joint work with Álvaro Neira Ayuso <alvaroneay@gmail.com>
>
> Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
> Signed-off-by: Ana Rey <anarey@gmail.com>
> ---
> [Changes in v2:]
> Put "case NFT_META_PKTTYPE:" outside of the #ifdef CONFIG_NETWORK_SECMARK.
> It was a mistake.
> Thanks to Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> for
> reporting this mistake.
>
>
> include/uapi/linux/netfilter/nf_tables.h | 2 ++
> net/netfilter/nft_meta.c | 17 +++++++++++++++++
> 2 files changed, 19 insertions(+)
>
> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> index 2a88f64..9eb5153 100644
> --- a/include/uapi/linux/netfilter/nf_tables.h
> +++ b/include/uapi/linux/netfilter/nf_tables.h
> @@ -571,6 +571,7 @@ enum nft_exthdr_attributes {
> * @NFT_META_L4PROTO: layer 4 protocol number
> * @NFT_META_BRI_IIFNAME: packet input bridge interface name
> * @NFT_META_BRI_OIFNAME: packet output bridge interface name
> + * @NFT_META_PKTTYPE: Packet class
^^^^^
type?
> */
> enum nft_meta_keys {
> NFT_META_LEN,
> @@ -592,6 +593,7 @@ enum nft_meta_keys {
> NFT_META_L4PROTO,
> NFT_META_BRI_IIFNAME,
> NFT_META_BRI_OIFNAME,
> + NFT_META_PKTTYPE,
> };
>
> /**
> diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
> index 852b178..eb9882e 100644
> --- a/net/netfilter/nft_meta.c
> +++ b/net/netfilter/nft_meta.c
> @@ -14,6 +14,9 @@
> #include <linux/netlink.h>
> #include <linux/netfilter.h>
> #include <linux/netfilter/nf_tables.h>
> +#include <linux/in.h>
> +#include <linux/ip.h>
> +#include <linux/ipv6.h>
> #include <net/dst.h>
> #include <net/sock.h>
> #include <net/tcp_states.h> /* for TCP_TIME_WAIT */
> @@ -124,6 +127,19 @@ void nft_meta_get_eval(const struct nft_expr *expr,
> dest->data[0] = skb->secmark;
> break;
> #endif
> + case NFT_META_PKTTYPE:
> + dest->data[0] = skb->pkt_type;
> + if (skb->pkt_type != PACKET_LOOPBACK)
> + dest->data[0] = skb->pkt_type;
> + else if (expr->ops->type->family == NFPROTO_IPV4 &&
^----------------------^
This has problems with NFPROTO_INET, NFPROTO_BRIDGE and NFPROTO_ARP
when handling the loopback case.
You have to add a nft_meta per family, something similar to:
05513e9 netfilter: nf_tables: add reject module for NFPROTO_INET
In NFPROTO_INET, you have to use:
if (pkt->ops->pf == NF_PROTO_IPV4)
...
In NFPROTO_BRIDGE, you have to use:
if (eth_hdr(skb)->h_proto == htons(ETH_P_IP)
...
In NFPROTO_ARP, you have to check the destination address:
if (is_broadcast_ether_addr(ethhdr->h_dest)
...
> + ipv4_is_multicast(ip_hdr(skb)->daddr))
> + dest->data[0] = PACKET_MULTICAST;
> + else if (expr->ops->type->family == NFPROTO_IPV6 &&
> + ipv6_hdr(skb)->daddr.s6_addr[0] == 0xFF)
> + dest->data[0] = PACKET_MULTICAST;
> + else
> + dest->data[0] = PACKET_BROADCAST;
> + break;
> default:
> WARN_ON(1);
> goto err;
> @@ -195,6 +211,7 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
> #ifdef CONFIG_NETWORK_SECMARK
> case NFT_META_SECMARK:
> #endif
> + case NFT_META_PKTTYPE:
> break;
> default:
> return -EOPNOTSUPP;
> --
> 2.0.0
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH v3] netfilter: nf_tables: add pkttype support to meta expression
2014-06-13 7:15 [PATCH v2] netfilter: nf_tables: add pkttype support to meta expression Ana Rey
2014-06-27 11:09 ` Pablo Neira Ayuso
@ 2014-08-05 18:27 ` Ana Rey
2014-08-06 8:52 ` Pablo Neira Ayuso
2014-08-06 11:52 ` [PATCH v4] " Ana Rey
2 siblings, 1 reply; 6+ messages in thread
From: Ana Rey @ 2014-08-05 18:27 UTC (permalink / raw)
To: netfilter-devel; +Cc: Álvaro Neira Ayuso, Ana Rey
From: Álvaro Neira Ayuso <alvaroneay@gmail.com>
Add pkttype support for all families of tables.
Joint work with Álvaro Neira Ayuso <alvaroneay@gmail.com>
Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
Signed-off-by: Ana Rey <anarey@gmail.com>
---
[Changes in v3:]
* Add support for NFPROTO_INET when handing the loopback case.
(NFPROTO_BRIDGE and NFPROTO_ARP families do not make sense when
handing the loopback case)
* Delete the broadcast case when handing the lookback case. This does not make
sense.
* Fix the description of NFT_META_PKTTYPE key.
[Changes in v2]
Put "case NFT_META_PKTTYPE:" outside of the #ifdef CONFIG_NETWORK_SECMARK.
It was a mistake.
Thanks to Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> for
reporting this mistake.
include/uapi/linux/netfilter/nf_tables.h | 2 ++
net/netfilter/nft_meta.c | 34 ++++++++++++++++++++++++++++++
2 files changed, 36 insertions(+)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 801bdd1..72ad208 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -571,6 +571,7 @@ enum nft_exthdr_attributes {
* @NFT_META_L4PROTO: layer 4 protocol number
* @NFT_META_BRI_IIFNAME: packet input bridge interface name
* @NFT_META_BRI_OIFNAME: packet output bridge interface name
+ * @NFT_META_PKTTYPE: Packet type
*/
enum nft_meta_keys {
NFT_META_LEN,
@@ -592,6 +593,7 @@ enum nft_meta_keys {
NFT_META_L4PROTO,
NFT_META_BRI_IIFNAME,
NFT_META_BRI_OIFNAME,
+ NFT_META_PKTTYPE,
};
/**
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 852b178..c46d9ac 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -14,6 +14,9 @@
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
#include <net/dst.h>
#include <net/sock.h>
#include <net/tcp_states.h> /* for TCP_TIME_WAIT */
@@ -124,6 +127,36 @@ void nft_meta_get_eval(const struct nft_expr *expr,
dest->data[0] = skb->secmark;
break;
#endif
+ case NFT_META_PKTTYPE:
+ if (skb->pkt_type != PACKET_LOOPBACK) {
+ dest->data[0] = skb->pkt_type;
+ break;
+ }
+
+ switch (pkt->ops->pf) {
+ case NFPROTO_IPV4:
+ if (ipv4_is_multicast(ip_hdr(skb)->daddr))
+ dest->data[0] = PACKET_MULTICAST;
+ else
+ dest->data[0] = PACKET_HOST;
+ break;
+ case NFPROTO_IPV6:
+ if (ipv6_hdr(skb)->daddr.s6_addr[0] == 0xFF)
+ dest->data[0] = PACKET_MULTICAST;
+ else
+ dest->data[0] = PACKET_HOST;
+ break;
+ case NFPROTO_INET:
+ if (ipv6_hdr(skb)->daddr.s6_addr[0] == 0xFF ||
+ ipv4_is_multicast(ip_hdr(skb)->daddr))
+ dest->data[0] = PACKET_MULTICAST;
+ else
+ dest->data[0] = PACKET_HOST;
+ break;
+ default:
+ goto err;
+ }
+ break;
default:
WARN_ON(1);
goto err;
@@ -195,6 +228,7 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
#ifdef CONFIG_NETWORK_SECMARK
case NFT_META_SECMARK:
#endif
+ case NFT_META_PKTTYPE:
break;
default:
return -EOPNOTSUPP;
--
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v3] netfilter: nf_tables: add pkttype support to meta expression
2014-08-05 18:27 ` [PATCH v3] " Ana Rey
@ 2014-08-06 8:52 ` Pablo Neira Ayuso
0 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2014-08-06 8:52 UTC (permalink / raw)
To: Ana Rey; +Cc: netfilter-devel, Álvaro Neira Ayuso
On Tue, Aug 05, 2014 at 08:27:22PM +0200, Ana Rey wrote:
> From: Álvaro Neira Ayuso <alvaroneay@gmail.com>
>
> Add pkttype support for all families of tables.
Please, include in the description something like:
This allows you to fetch the meta packet type based on the link layer
information. The loopback traffic is a special case, the packet type
is guessed from the network layer header.
No special handling for bridge and arp since we're not going to see
such traffic in the loopback interface.
> diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
> index 852b178..c46d9ac 100644
> --- a/net/netfilter/nft_meta.c
> +++ b/net/netfilter/nft_meta.c
> @@ -14,6 +14,9 @@
> #include <linux/netlink.h>
> #include <linux/netfilter.h>
> #include <linux/netfilter/nf_tables.h>
> +#include <linux/in.h>
> +#include <linux/ip.h>
> +#include <linux/ipv6.h>
> #include <net/dst.h>
> #include <net/sock.h>
> #include <net/tcp_states.h> /* for TCP_TIME_WAIT */
> @@ -124,6 +127,36 @@ void nft_meta_get_eval(const struct nft_expr *expr,
> dest->data[0] = skb->secmark;
> break;
> #endif
> + case NFT_META_PKTTYPE:
> + if (skb->pkt_type != PACKET_LOOPBACK) {
> + dest->data[0] = skb->pkt_type;
> + break;
> + }
> +
> + switch (pkt->ops->pf) {
> + case NFPROTO_IPV4:
> + if (ipv4_is_multicast(ip_hdr(skb)->daddr))
> + dest->data[0] = PACKET_MULTICAST;
> + else
> + dest->data[0] = PACKET_HOST;
Please, replace the PACKET_HOST by PACKET_BROADCAST so this looks
exactly like xt_pkttype.
> + break;
> + case NFPROTO_IPV6:
> + if (ipv6_hdr(skb)->daddr.s6_addr[0] == 0xFF)
> + dest->data[0] = PACKET_MULTICAST;
> + else
> + dest->data[0] = PACKET_HOST;
> + break;
> + case NFPROTO_INET:
> + if (ipv6_hdr(skb)->daddr.s6_addr[0] == 0xFF ||
> + ipv4_is_multicast(ip_hdr(skb)->daddr))
> + dest->data[0] = PACKET_MULTICAST;
> + else
> + dest->data[0] = PACKET_HOST;
> + break;
We're almost there. You have to remove NFPROTO_INET, the pkt->ops->pf
is already allowing you to indentify the family. So the NFPROTO_INET
part seems dead code to me, remove it.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v4] netfilter: nf_tables: add pkttype support to meta expression
2014-06-13 7:15 [PATCH v2] netfilter: nf_tables: add pkttype support to meta expression Ana Rey
2014-06-27 11:09 ` Pablo Neira Ayuso
2014-08-05 18:27 ` [PATCH v3] " Ana Rey
@ 2014-08-06 11:52 ` Ana Rey
2014-08-24 12:55 ` Pablo Neira Ayuso
2 siblings, 1 reply; 6+ messages in thread
From: Ana Rey @ 2014-08-06 11:52 UTC (permalink / raw)
To: netfilter-devel; +Cc: Álvaro Neira Ayuso, Ana Rey
From: Álvaro Neira Ayuso <alvaroneay@gmail.com>
Add pkttype support for ip, ipv6 and inet families of tables.
This allows you to fetch the meta packet type based on the link layer
information. The loopback traffic is a special case, the packet type
is guessed from the network layer header.
No special handling for bridge and arp since we're not going to see
such traffic in the loopback interface.
Joint work with Alvaro Neira Ayuso <alvaroneay@gmail.com>
Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
Signed-off-by: Ana Rey <anarey@gmail.com>
---
[Changes in v4:]
* Improvements in the description of this path.
* Replace the PACKET_HOST by PACKET_BROADCAST so this looks
exactly like xt_pkttype
* Remove NFPROTO_INET because the pkt->ops->pf is already allowing
you to indentify this family.
These improvements were suggested by Pablo Neira.
[Changes in v3:]
* Add support for NFPROTO_INET when handing the loopback case.
(NFPROTO_BRIDGE and NFPROTO_ARP families do not make sense when
handing the loopback case)
* Delete the broadcast case when handing the lookback case. This does not make
sense.
* Fix the description of NFT_META_PKTTYPE key.
[Changes in v2]
Put "case NFT_META_PKTTYPE:" outside of the #ifdef CONFIG_NETWORK_SECMARK.
It was a mistake.
Thanks to Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> for
reporting this mistake.
include/uapi/linux/netfilter/nf_tables.h | 2 ++
net/netfilter/nft_meta.c | 27 +++++++++++++++++++++++++++
2 files changed, 29 insertions(+)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 801bdd1..72ad208 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -571,6 +571,7 @@ enum nft_exthdr_attributes {
* @NFT_META_L4PROTO: layer 4 protocol number
* @NFT_META_BRI_IIFNAME: packet input bridge interface name
* @NFT_META_BRI_OIFNAME: packet output bridge interface name
+ * @NFT_META_PKTTYPE: Packet type
*/
enum nft_meta_keys {
NFT_META_LEN,
@@ -592,6 +593,7 @@ enum nft_meta_keys {
NFT_META_L4PROTO,
NFT_META_BRI_IIFNAME,
NFT_META_BRI_OIFNAME,
+ NFT_META_PKTTYPE,
};
/**
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 852b178..dbf7fe1 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -14,6 +14,9 @@
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
#include <net/dst.h>
#include <net/sock.h>
#include <net/tcp_states.h> /* for TCP_TIME_WAIT */
@@ -124,6 +127,29 @@ void nft_meta_get_eval(const struct nft_expr *expr,
dest->data[0] = skb->secmark;
break;
#endif
+ case NFT_META_PKTTYPE:
+ if (skb->pkt_type != PACKET_LOOPBACK) {
+ dest->data[0] = skb->pkt_type;
+ break;
+ }
+
+ switch (pkt->ops->pf) {
+ case NFPROTO_IPV4:
+ if (ipv4_is_multicast(ip_hdr(skb)->daddr))
+ dest->data[0] = PACKET_MULTICAST;
+ else
+ dest->data[0] = PACKET_BROADCAST;
+ break;
+ case NFPROTO_IPV6:
+ if (ipv6_hdr(skb)->daddr.s6_addr[0] == 0xFF)
+ dest->data[0] = PACKET_MULTICAST;
+ else
+ dest->data[0] = PACKET_BROADCAST;
+ break;
+ default:
+ goto err;
+ }
+ break;
default:
WARN_ON(1);
goto err;
@@ -195,6 +221,7 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
#ifdef CONFIG_NETWORK_SECMARK
case NFT_META_SECMARK:
#endif
+ case NFT_META_PKTTYPE:
break;
default:
return -EOPNOTSUPP;
--
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v4] netfilter: nf_tables: add pkttype support to meta expression
2014-08-06 11:52 ` [PATCH v4] " Ana Rey
@ 2014-08-24 12:55 ` Pablo Neira Ayuso
0 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2014-08-24 12:55 UTC (permalink / raw)
To: Ana Rey; +Cc: netfilter-devel, Álvaro Neira Ayuso
On Wed, Aug 06, 2014 at 01:52:49PM +0200, Ana Rey wrote:
> From: Álvaro Neira Ayuso <alvaroneay@gmail.com>
>
> Add pkttype support for ip, ipv6 and inet families of tables.
>
> This allows you to fetch the meta packet type based on the link layer
> information. The loopback traffic is a special case, the packet type
> is guessed from the network layer header.
>
> No special handling for bridge and arp since we're not going to see
> such traffic in the loopback interface.
>
> Joint work with Alvaro Neira Ayuso <alvaroneay@gmail.com>
Applied with minor change in the documentation area in nf_tables.h.
Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread