From: wenxu@ucloud.cn
To: pablo@netfilter.org, netfilter-devel@vger.kernel.org
Cc: netdev@vger.kernel.org
Subject: [PATCH] netfilter: nft_paylaod: add base type NFT_PAYLOAD_LL_HEADER_NO_TAG
Date: Mon, 10 Jun 2019 15:21:20 +0800 [thread overview]
Message-ID: <1560151280-28908-1-git-send-email-wenxu@ucloud.cn> (raw)
From: wenxu <wenxu@ucloud.cn>
nft add rule bridge firewall rule-100-ingress ip protocol icmp drop
The rule like above "ip protocol icmp", the packet will not be
matched, It tracelate base=NFT_PAYLOAD_LL_HEADER off=12 &&
base=NFT_PAYLOAD_NETWORK_HEADER off=11
if the packet contained with tag info. But the user don't care about
the vlan tag.
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
include/uapi/linux/netfilter/nf_tables.h | 2 ++
net/netfilter/nft_payload.c | 10 +++++++++-
2 files changed, 11 insertions(+), 1 deletion(-)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 505393c..345787f 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -673,11 +673,13 @@ enum nft_dynset_attributes {
* @NFT_PAYLOAD_LL_HEADER: link layer header
* @NFT_PAYLOAD_NETWORK_HEADER: network header
* @NFT_PAYLOAD_TRANSPORT_HEADER: transport header
+ * @NFT_PAYLOAD_LL_HEADER_NO_TAG: link layer header ignore vlan tag
*/
enum nft_payload_bases {
NFT_PAYLOAD_LL_HEADER,
NFT_PAYLOAD_NETWORK_HEADER,
NFT_PAYLOAD_TRANSPORT_HEADER,
+ NFT_PAYLOAD_LL_HEADER_NO_TAG,
};
/**
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 1465b7d..3cc7398 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -93,6 +93,12 @@ void nft_payload_eval(const struct nft_expr *expr,
}
offset = skb_mac_header(skb) - skb->data;
break;
+ case NFT_PAYLOAD_LL_HEADER_NO_TAG:
+ if (!skb_mac_header_was_set(skb))
+ goto err;
+
+ offset = skb_mac_header(skb) - skb->data;
+ break;
case NFT_PAYLOAD_NETWORK_HEADER:
offset = skb_network_offset(skb);
break;
@@ -403,6 +409,7 @@ static int nft_payload_set_dump(struct sk_buff *skb, const struct nft_expr *expr
case NFT_PAYLOAD_LL_HEADER:
case NFT_PAYLOAD_NETWORK_HEADER:
case NFT_PAYLOAD_TRANSPORT_HEADER:
+ case NFT_PAYLOAD_LL_HEADER_NO_TAG:
break;
default:
return ERR_PTR(-EOPNOTSUPP);
@@ -421,7 +428,8 @@ static int nft_payload_set_dump(struct sk_buff *skb, const struct nft_expr *expr
len = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));
if (len <= 4 && is_power_of_2(len) && IS_ALIGNED(offset, len) &&
- base != NFT_PAYLOAD_LL_HEADER)
+ base != NFT_PAYLOAD_LL_HEADER &&
+ base != NFT_PAYLOAD_LL_HEADER_NO_TAG)
return &nft_payload_fast_ops;
else
return &nft_payload_ops;
--
1.8.3.1
next reply other threads:[~2019-06-10 7:21 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-10 7:21 wenxu [this message]
2019-06-10 9:44 ` [PATCH] netfilter: nft_paylaod: add base type NFT_PAYLOAD_LL_HEADER_NO_TAG Florian Westphal
2019-06-11 3:01 ` wenxu
2019-06-17 22:30 ` Pablo Neira Ayuso
2019-06-17 22:42 ` Florian Westphal
2019-06-18 8:26 ` wenxu
2019-06-18 9:37 ` Florian Westphal
2019-06-18 14:27 ` wenxu
2019-06-18 15:33 ` Pablo Neira Ayuso
2019-06-18 9:35 ` Pablo Neira Ayuso
2019-06-18 9:46 ` Florian Westphal
2019-06-18 10:04 ` Pablo Neira Ayuso
2019-06-18 10:45 ` Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1560151280-28908-1-git-send-email-wenxu@ucloud.cn \
--to=wenxu@ucloud.cn \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).