Re: [PATCH 2/2 nf-next] netfilter: nft_meta: Add NFT_META_BRI_VLAN support

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Jun 19, 2019 at 03:16:25PM +0800, wenxu@ucloud.cn wrote:
> From: wenxu <wenxu@ucloud.cn>
> 
> nft add table bridge firewall
> nft add chain bridge firewall zones { type filter hook prerouting priority - 300 \; }
> nft add rule bridge firewall zones counter ct zone set vlan id map { 100 : 1, 200 : 2 }
> 
> As above set the bridge port with pvid, the received packet don't contain
> the vlan tag which means the packet should belong to vlan 200 through pvid.
> With this pacth user can set the pvid in the prerouting hook before set zone
> id and conntrack: "meta brvlan set meta brpvid"

A real ruleset explaining how you use this would help in the commit
message would help. I also would like to see the patch for nftables.

> Signed-off-by: wenxu <wenxu@ucloud.cn>
> ---
>  include/uapi/linux/netfilter/nf_tables.h |  2 ++
>  net/netfilter/nft_meta.c                 | 20 ++++++++++++++++++++
>  2 files changed, 22 insertions(+)
> 
> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> index 4a16124..7be0307 100644
> --- a/include/uapi/linux/netfilter/nf_tables.h
> +++ b/include/uapi/linux/netfilter/nf_tables.h
> @@ -794,6 +794,7 @@ enum nft_exthdr_attributes {
>   * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
>   * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
>   * @NFT_META_BRI_PVID: packet input bridge port pvid
> + * @NFT_META_BRI_VLAN: set vlan tag on packet
>   */
>  enum nft_meta_keys {
>  	NFT_META_LEN,
> @@ -825,6 +826,7 @@ enum nft_meta_keys {
>  	NFT_META_IIFKIND,
>  	NFT_META_OIFKIND,
>  	NFT_META_BRI_PVID,
> +	NFT_META_BRI_VLAN,
>  };
>  
>  /**
> diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
> index 1fdb565..5c3817b 100644
> --- a/net/netfilter/nft_meta.c
> +++ b/net/netfilter/nft_meta.c
> @@ -282,8 +282,13 @@ static void nft_meta_set_eval(const struct nft_expr *expr,
>  {
>  	const struct nft_meta *meta = nft_expr_priv(expr);
>  	struct sk_buff *skb = pkt->skb;
> +	const struct net_device *in = nft_in(pkt);
>  	u32 *sreg = &regs->data[meta->sreg];
> +#ifdef CONFIG_NF_TABLES_BRIDGE
> +	const struct net_bridge_port *p;
> +#endif
>  	u32 value = *sreg;
> +	u16 value16;
>  	u8 value8;
>  
>  	switch (meta->key) {
> @@ -306,6 +311,14 @@ static void nft_meta_set_eval(const struct nft_expr *expr,
>  
>  		skb->nf_trace = !!value8;
>  		break;
> +#ifdef CONFIG_NF_TABLES_BRIDGE
> +	case NFT_META_BRI_VLAN:
> +		value16 = nft_reg_load16(sreg);
> +		if (in && (p = br_port_get_rtnl_rcu(in)) &&
> +		    !skb_vlan_tag_present(skb))

Why does this skip if there is a vlan tag?

I guess it should be possible to update an existing vlan tag?

Thanks.