* [PATCH 1/2 nf-next] netfilter: nft_meta: add NFT_META_BRI_PVID support
@ 2019-06-19 7:16 wenxu
2019-06-19 7:16 ` [PATCH 2/2 nf-next] netfilter: nft_meta: Add NFT_META_BRI_VLAN support wenxu
2019-06-19 17:02 ` [PATCH 1/2 nf-next] netfilter: nft_meta: add NFT_META_BRI_PVID support Pablo Neira Ayuso
0 siblings, 2 replies; 5+ messages in thread
From: wenxu @ 2019-06-19 7:16 UTC (permalink / raw)
To: pablo, fw; +Cc: netfilter-devel, netdev
From: wenxu <wenxu@ucloud.cn>
nft add table bridge firewall
nft add chain bridge firewall zones { type filter hook prerouting priority - 300 \; }
nft add rule bridge firewall zones counter ct zone set vlan id map { 100 : 1, 200 : 2 }
As above set the bridge port with pvid, the received packet don't contain
the vlan tag which means the packet should belong to vlan 200 through pvid.
With this pacth user can get the pvid of bridge ports: "meta brpvid"
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
include/uapi/linux/netfilter/nf_tables.h | 2 ++
net/netfilter/nft_meta.c | 17 +++++++++++++++++
2 files changed, 19 insertions(+)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 31a6b8f..4a16124 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -793,6 +793,7 @@ enum nft_exthdr_attributes {
* @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
* @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
* @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
+ * @NFT_META_BRI_PVID: packet input bridge port pvid
*/
enum nft_meta_keys {
NFT_META_LEN,
@@ -823,6 +824,7 @@ enum nft_meta_keys {
NFT_META_SECPATH,
NFT_META_IIFKIND,
NFT_META_OIFKIND,
+ NFT_META_BRI_PVID,
};
/**
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 987d2d6..1fdb565 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -243,6 +243,18 @@ void nft_meta_get_eval(const struct nft_expr *expr,
goto err;
strncpy((char *)dest, p->br->dev->name, IFNAMSIZ);
return;
+ case NFT_META_BRI_PVID:
+ if (in == NULL || (p = br_port_get_rtnl_rcu(in)) == NULL)
+ goto err;
+ if (br_opt_get(p->br, BROPT_VLAN_ENABLED)) {
+ u16 pvid = br_get_pvid(nbp_vlan_group_rcu(p));
+
+ if (pvid) {
+ nft_reg_store16(dest, pvid);
+ return;
+ }
+ }
+ goto err;
#endif
case NFT_META_IIFKIND:
if (in == NULL || in->rtnl_link_ops == NULL)
@@ -370,6 +382,11 @@ static int nft_meta_get_init(const struct nft_ctx *ctx,
return -EOPNOTSUPP;
len = IFNAMSIZ;
break;
+ case NFT_META_BRI_PVID:
+ if (ctx->family != NFPROTO_BRIDGE)
+ return -EOPNOTSUPP;
+ len = sizeof(u16);
+ break;
#endif
default:
return -EOPNOTSUPP;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH 2/2 nf-next] netfilter: nft_meta: Add NFT_META_BRI_VLAN support
2019-06-19 7:16 [PATCH 1/2 nf-next] netfilter: nft_meta: add NFT_META_BRI_PVID support wenxu
@ 2019-06-19 7:16 ` wenxu
2019-06-19 17:06 ` Pablo Neira Ayuso
2019-06-19 17:02 ` [PATCH 1/2 nf-next] netfilter: nft_meta: add NFT_META_BRI_PVID support Pablo Neira Ayuso
1 sibling, 1 reply; 5+ messages in thread
From: wenxu @ 2019-06-19 7:16 UTC (permalink / raw)
To: pablo, fw; +Cc: netfilter-devel, netdev
From: wenxu <wenxu@ucloud.cn>
nft add table bridge firewall
nft add chain bridge firewall zones { type filter hook prerouting priority - 300 \; }
nft add rule bridge firewall zones counter ct zone set vlan id map { 100 : 1, 200 : 2 }
As above set the bridge port with pvid, the received packet don't contain
the vlan tag which means the packet should belong to vlan 200 through pvid.
With this pacth user can set the pvid in the prerouting hook before set zone
id and conntrack: "meta brvlan set meta brpvid"
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
include/uapi/linux/netfilter/nf_tables.h | 2 ++
net/netfilter/nft_meta.c | 20 ++++++++++++++++++++
2 files changed, 22 insertions(+)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 4a16124..7be0307 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -794,6 +794,7 @@ enum nft_exthdr_attributes {
* @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
* @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
* @NFT_META_BRI_PVID: packet input bridge port pvid
+ * @NFT_META_BRI_VLAN: set vlan tag on packet
*/
enum nft_meta_keys {
NFT_META_LEN,
@@ -825,6 +826,7 @@ enum nft_meta_keys {
NFT_META_IIFKIND,
NFT_META_OIFKIND,
NFT_META_BRI_PVID,
+ NFT_META_BRI_VLAN,
};
/**
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 1fdb565..5c3817b 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -282,8 +282,13 @@ static void nft_meta_set_eval(const struct nft_expr *expr,
{
const struct nft_meta *meta = nft_expr_priv(expr);
struct sk_buff *skb = pkt->skb;
+ const struct net_device *in = nft_in(pkt);
u32 *sreg = ®s->data[meta->sreg];
+#ifdef CONFIG_NF_TABLES_BRIDGE
+ const struct net_bridge_port *p;
+#endif
u32 value = *sreg;
+ u16 value16;
u8 value8;
switch (meta->key) {
@@ -306,6 +311,14 @@ static void nft_meta_set_eval(const struct nft_expr *expr,
skb->nf_trace = !!value8;
break;
+#ifdef CONFIG_NF_TABLES_BRIDGE
+ case NFT_META_BRI_VLAN:
+ value16 = nft_reg_load16(sreg);
+ if (in && (p = br_port_get_rtnl_rcu(in)) &&
+ !skb_vlan_tag_present(skb))
+ __vlan_hwaccel_put_tag(skb, p->br->vlan_proto, value16);
+ break;
+#endif
#ifdef CONFIG_NETWORK_SECMARK
case NFT_META_SECMARK:
skb->secmark = value;
@@ -481,6 +494,13 @@ static int nft_meta_set_init(const struct nft_ctx *ctx,
case NFT_META_PKTTYPE:
len = sizeof(u8);
break;
+#ifdef CONFIG_NF_TABLES_BRIDGE
+ case NFT_META_BRI_VLAN:
+ if (ctx->family != NFPROTO_BRIDGE)
+ return -EOPNOTSUPP;
+ len = sizeof(u16);
+ break;
+#endif
default:
return -EOPNOTSUPP;
}
--
1.8.3.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH 2/2 nf-next] netfilter: nft_meta: Add NFT_META_BRI_VLAN support
2019-06-19 7:16 ` [PATCH 2/2 nf-next] netfilter: nft_meta: Add NFT_META_BRI_VLAN support wenxu
@ 2019-06-19 17:06 ` Pablo Neira Ayuso
0 siblings, 0 replies; 5+ messages in thread
From: Pablo Neira Ayuso @ 2019-06-19 17:06 UTC (permalink / raw)
To: wenxu; +Cc: fw, netfilter-devel, netdev
On Wed, Jun 19, 2019 at 03:16:25PM +0800, wenxu@ucloud.cn wrote:
> From: wenxu <wenxu@ucloud.cn>
>
> nft add table bridge firewall
> nft add chain bridge firewall zones { type filter hook prerouting priority - 300 \; }
> nft add rule bridge firewall zones counter ct zone set vlan id map { 100 : 1, 200 : 2 }
>
> As above set the bridge port with pvid, the received packet don't contain
> the vlan tag which means the packet should belong to vlan 200 through pvid.
> With this pacth user can set the pvid in the prerouting hook before set zone
> id and conntrack: "meta brvlan set meta brpvid"
A real ruleset explaining how you use this would help in the commit
message would help. I also would like to see the patch for nftables.
> Signed-off-by: wenxu <wenxu@ucloud.cn>
> ---
> include/uapi/linux/netfilter/nf_tables.h | 2 ++
> net/netfilter/nft_meta.c | 20 ++++++++++++++++++++
> 2 files changed, 22 insertions(+)
>
> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> index 4a16124..7be0307 100644
> --- a/include/uapi/linux/netfilter/nf_tables.h
> +++ b/include/uapi/linux/netfilter/nf_tables.h
> @@ -794,6 +794,7 @@ enum nft_exthdr_attributes {
> * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
> * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
> * @NFT_META_BRI_PVID: packet input bridge port pvid
> + * @NFT_META_BRI_VLAN: set vlan tag on packet
> */
> enum nft_meta_keys {
> NFT_META_LEN,
> @@ -825,6 +826,7 @@ enum nft_meta_keys {
> NFT_META_IIFKIND,
> NFT_META_OIFKIND,
> NFT_META_BRI_PVID,
> + NFT_META_BRI_VLAN,
> };
>
> /**
> diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
> index 1fdb565..5c3817b 100644
> --- a/net/netfilter/nft_meta.c
> +++ b/net/netfilter/nft_meta.c
> @@ -282,8 +282,13 @@ static void nft_meta_set_eval(const struct nft_expr *expr,
> {
> const struct nft_meta *meta = nft_expr_priv(expr);
> struct sk_buff *skb = pkt->skb;
> + const struct net_device *in = nft_in(pkt);
> u32 *sreg = ®s->data[meta->sreg];
> +#ifdef CONFIG_NF_TABLES_BRIDGE
> + const struct net_bridge_port *p;
> +#endif
> u32 value = *sreg;
> + u16 value16;
> u8 value8;
>
> switch (meta->key) {
> @@ -306,6 +311,14 @@ static void nft_meta_set_eval(const struct nft_expr *expr,
>
> skb->nf_trace = !!value8;
> break;
> +#ifdef CONFIG_NF_TABLES_BRIDGE
> + case NFT_META_BRI_VLAN:
> + value16 = nft_reg_load16(sreg);
> + if (in && (p = br_port_get_rtnl_rcu(in)) &&
> + !skb_vlan_tag_present(skb))
Why does this skip if there is a vlan tag?
I guess it should be possible to update an existing vlan tag?
Thanks.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 1/2 nf-next] netfilter: nft_meta: add NFT_META_BRI_PVID support
2019-06-19 7:16 [PATCH 1/2 nf-next] netfilter: nft_meta: add NFT_META_BRI_PVID support wenxu
2019-06-19 7:16 ` [PATCH 2/2 nf-next] netfilter: nft_meta: Add NFT_META_BRI_VLAN support wenxu
@ 2019-06-19 17:02 ` Pablo Neira Ayuso
2019-06-20 1:19 ` wenxu
1 sibling, 1 reply; 5+ messages in thread
From: Pablo Neira Ayuso @ 2019-06-19 17:02 UTC (permalink / raw)
To: wenxu; +Cc: fw, netfilter-devel, netdev
On Wed, Jun 19, 2019 at 03:16:24PM +0800, wenxu@ucloud.cn wrote:
> From: wenxu <wenxu@ucloud.cn>
>
> nft add table bridge firewall
> nft add chain bridge firewall zones { type filter hook prerouting priority - 300 \; }
> nft add rule bridge firewall zones counter ct zone set vlan id map { 100 : 1, 200 : 2 }
> As above set the bridge port with pvid, the received packet don't contain
> the vlan tag which means the packet should belong to vlan 200 through pvid.
> With this pacth user can get the pvid of bridge ports: "meta brpvid"
Would you also post the patches for nftables for review?
Would you post an example on how you use "meta brpvid" in your
ruleset? I don't see this is used in the example above,
More comments below.
> Signed-off-by: wenxu <wenxu@ucloud.cn>
> ---
> include/uapi/linux/netfilter/nf_tables.h | 2 ++
> net/netfilter/nft_meta.c | 17 +++++++++++++++++
> 2 files changed, 19 insertions(+)
>
> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> index 31a6b8f..4a16124 100644
> --- a/include/uapi/linux/netfilter/nf_tables.h
> +++ b/include/uapi/linux/netfilter/nf_tables.h
> @@ -793,6 +793,7 @@ enum nft_exthdr_attributes {
> * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
> * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
> * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
> + * @NFT_META_BRI_PVID: packet input bridge port pvid
> */
> enum nft_meta_keys {
> NFT_META_LEN,
> @@ -823,6 +824,7 @@ enum nft_meta_keys {
> NFT_META_SECPATH,
> NFT_META_IIFKIND,
> NFT_META_OIFKIND,
> + NFT_META_BRI_PVID,
> };
>
> /**
> diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
> index 987d2d6..1fdb565 100644
> --- a/net/netfilter/nft_meta.c
> +++ b/net/netfilter/nft_meta.c
> @@ -243,6 +243,18 @@ void nft_meta_get_eval(const struct nft_expr *expr,
> goto err;
> strncpy((char *)dest, p->br->dev->name, IFNAMSIZ);
> return;
> + case NFT_META_BRI_PVID:
> + if (in == NULL || (p = br_port_get_rtnl_rcu(in)) == NULL)
> + goto err;
> + if (br_opt_get(p->br, BROPT_VLAN_ENABLED)) {
> + u16 pvid = br_get_pvid(nbp_vlan_group_rcu(p));
> +
> + if (pvid) {
> + nft_reg_store16(dest, pvid);
I think you should store pvid into dest if pvid is zero too, right?
You cannot assume destination register is set to zero.
> + return;
> + }
> + }
> + goto err;
> #endif
> case NFT_META_IIFKIND:
> if (in == NULL || in->rtnl_link_ops == NULL)
> @@ -370,6 +382,11 @@ static int nft_meta_get_init(const struct nft_ctx *ctx,
> return -EOPNOTSUPP;
> len = IFNAMSIZ;
> break;
> + case NFT_META_BRI_PVID:
> + if (ctx->family != NFPROTO_BRIDGE)
> + return -EOPNOTSUPP;
> + len = sizeof(u16);
> + break;
> #endif
> default:
> return -EOPNOTSUPP;
> --
> 1.8.3.1
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH 1/2 nf-next] netfilter: nft_meta: add NFT_META_BRI_PVID support
2019-06-19 17:02 ` [PATCH 1/2 nf-next] netfilter: nft_meta: add NFT_META_BRI_PVID support Pablo Neira Ayuso
@ 2019-06-20 1:19 ` wenxu
0 siblings, 0 replies; 5+ messages in thread
From: wenxu @ 2019-06-20 1:19 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: fw, netfilter-devel, netdev
I will post the nftable patches latter. Thanks!
在 2019/6/20 1:02, Pablo Neira Ayuso 写道:
> On Wed, Jun 19, 2019 at 03:16:24PM +0800, wenxu@ucloud.cn wrote:
>> From: wenxu <wenxu@ucloud.cn>
>>
>> nft add table bridge firewall
>> nft add chain bridge firewall zones { type filter hook prerouting priority - 300 \; }
>> nft add rule bridge firewall zones counter ct zone set vlan id map { 100 : 1, 200 : 2 }
>> As above set the bridge port with pvid, the received packet don't contain
>> the vlan tag which means the packet should belong to vlan 200 through pvid.
>> With this pacth user can get the pvid of bridge ports: "meta brpvid"
> Would you also post the patches for nftables for review?
>
> Would you post an example on how you use "meta brpvid" in your
> ruleset? I don't see this is used in the example above,
>
> More comments below.
>
>> Signed-off-by: wenxu <wenxu@ucloud.cn>
>> ---
>> include/uapi/linux/netfilter/nf_tables.h | 2 ++
>> net/netfilter/nft_meta.c | 17 +++++++++++++++++
>> 2 files changed, 19 insertions(+)
>>
>> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
>> index 31a6b8f..4a16124 100644
>> --- a/include/uapi/linux/netfilter/nf_tables.h
>> +++ b/include/uapi/linux/netfilter/nf_tables.h
>> @@ -793,6 +793,7 @@ enum nft_exthdr_attributes {
>> * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
>> * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
>> * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
>> + * @NFT_META_BRI_PVID: packet input bridge port pvid
>> */
>> enum nft_meta_keys {
>> NFT_META_LEN,
>> @@ -823,6 +824,7 @@ enum nft_meta_keys {
>> NFT_META_SECPATH,
>> NFT_META_IIFKIND,
>> NFT_META_OIFKIND,
>> + NFT_META_BRI_PVID,
>> };
>>
>> /**
>> diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
>> index 987d2d6..1fdb565 100644
>> --- a/net/netfilter/nft_meta.c
>> +++ b/net/netfilter/nft_meta.c
>> @@ -243,6 +243,18 @@ void nft_meta_get_eval(const struct nft_expr *expr,
>> goto err;
>> strncpy((char *)dest, p->br->dev->name, IFNAMSIZ);
>> return;
>> + case NFT_META_BRI_PVID:
>> + if (in == NULL || (p = br_port_get_rtnl_rcu(in)) == NULL)
>> + goto err;
>> + if (br_opt_get(p->br, BROPT_VLAN_ENABLED)) {
>> + u16 pvid = br_get_pvid(nbp_vlan_group_rcu(p));
>> +
>> + if (pvid) {
>> + nft_reg_store16(dest, pvid);
> I think you should store pvid into dest if pvid is zero too, right?
> You cannot assume destination register is set to zero.
>
>> + return;
>> + }
>> + }
>> + goto err;
>> #endif
>> case NFT_META_IIFKIND:
>> if (in == NULL || in->rtnl_link_ops == NULL)
>> @@ -370,6 +382,11 @@ static int nft_meta_get_init(const struct nft_ctx *ctx,
>> return -EOPNOTSUPP;
>> len = IFNAMSIZ;
>> break;
>> + case NFT_META_BRI_PVID:
>> + if (ctx->family != NFPROTO_BRIDGE)
>> + return -EOPNOTSUPP;
>> + len = sizeof(u16);
>> + break;
>> #endif
>> default:
>> return -EOPNOTSUPP;
>> --
>> 1.8.3.1
>>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2019-06-20 1:19 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-19 7:16 [PATCH 1/2 nf-next] netfilter: nft_meta: add NFT_META_BRI_PVID support wenxu
2019-06-19 7:16 ` [PATCH 2/2 nf-next] netfilter: nft_meta: Add NFT_META_BRI_VLAN support wenxu
2019-06-19 17:06 ` Pablo Neira Ayuso
2019-06-19 17:02 ` [PATCH 1/2 nf-next] netfilter: nft_meta: add NFT_META_BRI_PVID support Pablo Neira Ayuso
2019-06-20 1:19 ` wenxu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).