* [PATCH 0/2] Netfilter updates for net-next @ 2015-02-10 5:34 Pablo Neira Ayuso 2015-02-10 5:34 ` [PATCH 1/2] netfilter: nft_compat: add ebtables support Pablo Neira Ayuso ` (2 more replies) 0 siblings, 3 replies; 6+ messages in thread From: Pablo Neira Ayuso @ 2015-02-10 5:34 UTC (permalink / raw) To: netfilter-devel; +Cc: davem, netdev Hi David, The following patchset contains two small Netfilter updates for your net-next tree, they are: 1) Add ebtables support to nft_compat, from Arturo Borrero. 2) Fix missing validation of the SET_ID attribute in the lookup expressions, from Patrick McHardy. You can pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git Thanks! ---------------------------------------------------------------- The following changes since commit 4c72c53be5e3c8cf319a020ea671ab0fc32ec96f: Merge tag 'linux-can-next-for-3.20-20150128' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next (2015-01-29 14:54:45 -0800) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git master for you to fetch changes up to 4c1017aa80c95a74703139bb95c4ce0d130efe4d: netfilter: nft_lookup: add missing attribute validation for NFTA_LOOKUP_SET_ID (2015-01-30 19:08:20 +0100) ---------------------------------------------------------------- Arturo Borrero (1): netfilter: nft_compat: add ebtables support Patrick McHardy (1): netfilter: nft_lookup: add missing attribute validation for NFTA_LOOKUP_SET_ID net/netfilter/nft_compat.c | 63 +++++++++++++++++++++++++++++++++++++++----- net/netfilter/nft_lookup.c | 1 + 2 files changed, 58 insertions(+), 6 deletions(-) ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/2] netfilter: nft_compat: add ebtables support 2015-02-10 5:34 [PATCH 0/2] Netfilter updates for net-next Pablo Neira Ayuso @ 2015-02-10 5:34 ` Pablo Neira Ayuso 2015-02-10 5:34 ` [PATCH 2/2] netfilter: nft_lookup: add missing attribute validation for NFTA_LOOKUP_SET_ID Pablo Neira Ayuso 2015-02-11 22:27 ` [PATCH 0/2] Netfilter updates for net-next David Miller 2 siblings, 0 replies; 6+ messages in thread From: Pablo Neira Ayuso @ 2015-02-10 5:34 UTC (permalink / raw) To: netfilter-devel; +Cc: davem, netdev From: Arturo Borrero <arturo.borrero.glez@gmail.com> This patch extends nft_compat to support ebtables extensions. ebtables verdict codes are translated to the ones used by the nf_tables engine, so we can properly use ebtables target extensions from nft_compat. This patch extends previous work by Giuseppe Longo <giuseppelng@gmail.com>. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nft_compat.c | 63 +++++++++++++++++++++++++++++++++++++++----- 1 file changed, 57 insertions(+), 6 deletions(-) diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c index 265e190..c598f74 100644 --- a/net/netfilter/nft_compat.c +++ b/net/netfilter/nft_compat.c @@ -19,6 +19,7 @@ #include <linux/netfilter/x_tables.h> #include <linux/netfilter_ipv4/ip_tables.h> #include <linux/netfilter_ipv6/ip6_tables.h> +#include <linux/netfilter_bridge/ebtables.h> #include <net/netfilter/nf_tables.h> static int nft_compat_chain_validate_dependency(const char *tablename, @@ -40,6 +41,7 @@ static int nft_compat_chain_validate_dependency(const char *tablename, union nft_entry { struct ipt_entry e4; struct ip6t_entry e6; + struct ebt_entry ebt; }; static inline void @@ -50,9 +52,9 @@ nft_compat_set_par(struct xt_action_param *par, void *xt, const void *xt_info) par->hotdrop = false; } -static void nft_target_eval(const struct nft_expr *expr, - struct nft_data data[NFT_REG_MAX + 1], - const struct nft_pktinfo *pkt) +static void nft_target_eval_xt(const struct nft_expr *expr, + struct nft_data data[NFT_REG_MAX + 1], + const struct nft_pktinfo *pkt) { void *info = nft_expr_priv(expr); struct xt_target *target = expr->ops->data; @@ -66,7 +68,7 @@ static void nft_target_eval(const struct nft_expr *expr, if (pkt->xt.hotdrop) ret = NF_DROP; - switch(ret) { + switch (ret) { case XT_CONTINUE: data[NFT_REG_VERDICT].verdict = NFT_CONTINUE; break; @@ -74,7 +76,41 @@ static void nft_target_eval(const struct nft_expr *expr, data[NFT_REG_VERDICT].verdict = ret; break; } - return; +} + +static void nft_target_eval_bridge(const struct nft_expr *expr, + struct nft_data data[NFT_REG_MAX + 1], + const struct nft_pktinfo *pkt) +{ + void *info = nft_expr_priv(expr); + struct xt_target *target = expr->ops->data; + struct sk_buff *skb = pkt->skb; + int ret; + + nft_compat_set_par((struct xt_action_param *)&pkt->xt, target, info); + + ret = target->target(skb, &pkt->xt); + + if (pkt->xt.hotdrop) + ret = NF_DROP; + + switch (ret) { + case EBT_ACCEPT: + data[NFT_REG_VERDICT].verdict = NF_ACCEPT; + break; + case EBT_DROP: + data[NFT_REG_VERDICT].verdict = NF_DROP; + break; + case EBT_CONTINUE: + data[NFT_REG_VERDICT].verdict = NFT_CONTINUE; + break; + case EBT_RETURN: + data[NFT_REG_VERDICT].verdict = NFT_RETURN; + break; + default: + data[NFT_REG_VERDICT].verdict = ret; + break; + } } static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = { @@ -100,6 +136,10 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par, entry->e6.ipv6.proto = proto; entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; break; + case NFPROTO_BRIDGE: + entry->ebt.ethproto = proto; + entry->ebt.invflags = inv ? EBT_IPROTO : 0; + break; } par->entryinfo = entry; par->target = target; @@ -307,6 +347,10 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx, entry->e6.ipv6.proto = proto; entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; break; + case NFPROTO_BRIDGE: + entry->ebt.ethproto = proto; + entry->ebt.invflags = inv ? EBT_IPROTO : 0; + break; } par->entryinfo = entry; par->match = match; @@ -490,6 +534,9 @@ nfnl_compat_get(struct sock *nfnl, struct sk_buff *skb, case AF_INET6: fmt = "ip6t_%s"; break; + case NFPROTO_BRIDGE: + fmt = "ebt_%s"; + break; default: pr_err("nft_compat: unsupported protocol %d\n", nfmsg->nfgen_family); @@ -663,13 +710,17 @@ nft_target_select_ops(const struct nft_ctx *ctx, nft_target->ops.type = &nft_target_type; nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize)); - nft_target->ops.eval = nft_target_eval; nft_target->ops.init = nft_target_init; nft_target->ops.destroy = nft_target_destroy; nft_target->ops.dump = nft_target_dump; nft_target->ops.validate = nft_target_validate; nft_target->ops.data = target; + if (family == NFPROTO_BRIDGE) + nft_target->ops.eval = nft_target_eval_bridge; + else + nft_target->ops.eval = nft_target_eval_xt; + list_add(&nft_target->head, &nft_target_list); return &nft_target->ops; -- 1.7.10.4 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] netfilter: nft_lookup: add missing attribute validation for NFTA_LOOKUP_SET_ID 2015-02-10 5:34 [PATCH 0/2] Netfilter updates for net-next Pablo Neira Ayuso 2015-02-10 5:34 ` [PATCH 1/2] netfilter: nft_compat: add ebtables support Pablo Neira Ayuso @ 2015-02-10 5:34 ` Pablo Neira Ayuso 2015-02-11 22:27 ` [PATCH 0/2] Netfilter updates for net-next David Miller 2 siblings, 0 replies; 6+ messages in thread From: Pablo Neira Ayuso @ 2015-02-10 5:34 UTC (permalink / raw) To: netfilter-devel; +Cc: davem, netdev From: Patrick McHardy <kaber@trash.net> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nft_lookup.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c index 6404a72..9615b8b 100644 --- a/net/netfilter/nft_lookup.c +++ b/net/netfilter/nft_lookup.c @@ -39,6 +39,7 @@ static void nft_lookup_eval(const struct nft_expr *expr, static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = { [NFTA_LOOKUP_SET] = { .type = NLA_STRING }, + [NFTA_LOOKUP_SET_ID] = { .type = NLA_U32 }, [NFTA_LOOKUP_SREG] = { .type = NLA_U32 }, [NFTA_LOOKUP_DREG] = { .type = NLA_U32 }, }; -- 1.7.10.4 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 0/2] Netfilter updates for net-next 2015-02-10 5:34 [PATCH 0/2] Netfilter updates for net-next Pablo Neira Ayuso 2015-02-10 5:34 ` [PATCH 1/2] netfilter: nft_compat: add ebtables support Pablo Neira Ayuso 2015-02-10 5:34 ` [PATCH 2/2] netfilter: nft_lookup: add missing attribute validation for NFTA_LOOKUP_SET_ID Pablo Neira Ayuso @ 2015-02-11 22:27 ` David Miller 2 siblings, 0 replies; 6+ messages in thread From: David Miller @ 2015-02-11 22:27 UTC (permalink / raw) To: pablo; +Cc: netfilter-devel, netdev From: Pablo Neira Ayuso <pablo@netfilter.org> Date: Tue, 10 Feb 2015 06:34:32 +0100 > The following patchset contains two small Netfilter updates for your > net-next tree, they are: > > 1) Add ebtables support to nft_compat, from Arturo Borrero. > > 2) Fix missing validation of the SET_ID attribute in the lookup > expressions, from Patrick McHardy. Pulled, thanks Pablo. ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 0/2] Netfilter updates for net-next @ 2019-08-14 21:43 Pablo Neira Ayuso 2019-08-15 2:59 ` David Miller 0 siblings, 1 reply; 6+ messages in thread From: Pablo Neira Ayuso @ 2019-08-14 21:43 UTC (permalink / raw) To: netfilter-devel; +Cc: davem, netdev Hi, The following patchset contains Netfilter updates for net-next. This round addresses fallout from previous pull request: 1) Remove #warning from ipt_LOG.h and ip6t_LOG.h headers, from Jeremy Sowden. 2) Incorrect parens in memcmp() in nft_bitwise, from Nathan Chancellor. You can pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git Thanks. ---------------------------------------------------------------- The following changes since commit 5181b473d64ee278f24035ce335b89ddc4520fc0: net: phy: realtek: add NBase-T PHY auto-detection (2019-08-14 13:26:08 -0400) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git HEAD for you to fetch changes up to 83c156d3ecc0121d27dc2b7f34e829b265c70c4f: netfilter: nft_bitwise: Adjust parentheses to fix memcmp size argument (2019-08-14 23:36:45 +0200) ---------------------------------------------------------------- Jeremy Sowden (1): netfilter: remove deprecation warnings from uapi headers. Nathan Chancellor (1): netfilter: nft_bitwise: Adjust parentheses to fix memcmp size argument include/uapi/linux/netfilter_ipv4/ipt_LOG.h | 2 -- include/uapi/linux/netfilter_ipv6/ip6t_LOG.h | 2 -- net/netfilter/nft_bitwise.c | 4 ++-- 3 files changed, 2 insertions(+), 6 deletions(-) ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 0/2] Netfilter updates for net-next 2019-08-14 21:43 Pablo Neira Ayuso @ 2019-08-15 2:59 ` David Miller 0 siblings, 0 replies; 6+ messages in thread From: David Miller @ 2019-08-15 2:59 UTC (permalink / raw) To: pablo; +Cc: netfilter-devel, netdev From: Pablo Neira Ayuso <pablo@netfilter.org> Date: Wed, 14 Aug 2019 23:43:45 +0200 > The following patchset contains Netfilter updates for net-next. > This round addresses fallout from previous pull request: > > 1) Remove #warning from ipt_LOG.h and ip6t_LOG.h headers, > from Jeremy Sowden. > > 2) Incorrect parens in memcmp() in nft_bitwise, from Nathan Chancellor. > > You can pull these changes from: > > git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git Pulled, thanks. ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-08-15 2:59 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2015-02-10 5:34 [PATCH 0/2] Netfilter updates for net-next Pablo Neira Ayuso 2015-02-10 5:34 ` [PATCH 1/2] netfilter: nft_compat: add ebtables support Pablo Neira Ayuso 2015-02-10 5:34 ` [PATCH 2/2] netfilter: nft_lookup: add missing attribute validation for NFTA_LOOKUP_SET_ID Pablo Neira Ayuso 2015-02-11 22:27 ` [PATCH 0/2] Netfilter updates for net-next David Miller 2019-08-14 21:43 Pablo Neira Ayuso 2019-08-15 2:59 ` David Miller
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).