From: wenxu <wenxu@ucloud.cn>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: fw@strlen.de, netfilter-devel@vger.kernel.org, netdev@vger.kernel.org
Subject: Re: [PATCH 1/2 nf-next] netfilter: nft_meta: add NFT_META_BRI_PVID support
Date: Thu, 20 Jun 2019 09:19:36 +0800 [thread overview]
Message-ID: <26bb807a-4021-b06e-53cb-d30f3f188555@ucloud.cn> (raw)
In-Reply-To: <20190619170254.an2aklx6abqh646l@salvia>
I will post the nftable patches latter. Thanks!
在 2019/6/20 1:02, Pablo Neira Ayuso 写道:
> On Wed, Jun 19, 2019 at 03:16:24PM +0800, wenxu@ucloud.cn wrote:
>> From: wenxu <wenxu@ucloud.cn>
>>
>> nft add table bridge firewall
>> nft add chain bridge firewall zones { type filter hook prerouting priority - 300 \; }
>> nft add rule bridge firewall zones counter ct zone set vlan id map { 100 : 1, 200 : 2 }
>> As above set the bridge port with pvid, the received packet don't contain
>> the vlan tag which means the packet should belong to vlan 200 through pvid.
>> With this pacth user can get the pvid of bridge ports: "meta brpvid"
> Would you also post the patches for nftables for review?
>
> Would you post an example on how you use "meta brpvid" in your
> ruleset? I don't see this is used in the example above,
>
> More comments below.
>
>> Signed-off-by: wenxu <wenxu@ucloud.cn>
>> ---
>> include/uapi/linux/netfilter/nf_tables.h | 2 ++
>> net/netfilter/nft_meta.c | 17 +++++++++++++++++
>> 2 files changed, 19 insertions(+)
>>
>> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
>> index 31a6b8f..4a16124 100644
>> --- a/include/uapi/linux/netfilter/nf_tables.h
>> +++ b/include/uapi/linux/netfilter/nf_tables.h
>> @@ -793,6 +793,7 @@ enum nft_exthdr_attributes {
>> * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
>> * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
>> * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
>> + * @NFT_META_BRI_PVID: packet input bridge port pvid
>> */
>> enum nft_meta_keys {
>> NFT_META_LEN,
>> @@ -823,6 +824,7 @@ enum nft_meta_keys {
>> NFT_META_SECPATH,
>> NFT_META_IIFKIND,
>> NFT_META_OIFKIND,
>> + NFT_META_BRI_PVID,
>> };
>>
>> /**
>> diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
>> index 987d2d6..1fdb565 100644
>> --- a/net/netfilter/nft_meta.c
>> +++ b/net/netfilter/nft_meta.c
>> @@ -243,6 +243,18 @@ void nft_meta_get_eval(const struct nft_expr *expr,
>> goto err;
>> strncpy((char *)dest, p->br->dev->name, IFNAMSIZ);
>> return;
>> + case NFT_META_BRI_PVID:
>> + if (in == NULL || (p = br_port_get_rtnl_rcu(in)) == NULL)
>> + goto err;
>> + if (br_opt_get(p->br, BROPT_VLAN_ENABLED)) {
>> + u16 pvid = br_get_pvid(nbp_vlan_group_rcu(p));
>> +
>> + if (pvid) {
>> + nft_reg_store16(dest, pvid);
> I think you should store pvid into dest if pvid is zero too, right?
> You cannot assume destination register is set to zero.
>
>> + return;
>> + }
>> + }
>> + goto err;
>> #endif
>> case NFT_META_IIFKIND:
>> if (in == NULL || in->rtnl_link_ops == NULL)
>> @@ -370,6 +382,11 @@ static int nft_meta_get_init(const struct nft_ctx *ctx,
>> return -EOPNOTSUPP;
>> len = IFNAMSIZ;
>> break;
>> + case NFT_META_BRI_PVID:
>> + if (ctx->family != NFPROTO_BRIDGE)
>> + return -EOPNOTSUPP;
>> + len = sizeof(u16);
>> + break;
>> #endif
>> default:
>> return -EOPNOTSUPP;
>> --
>> 1.8.3.1
>>
prev parent reply other threads:[~2019-06-20 1:19 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-19 7:16 [PATCH 1/2 nf-next] netfilter: nft_meta: add NFT_META_BRI_PVID support wenxu
2019-06-19 7:16 ` [PATCH 2/2 nf-next] netfilter: nft_meta: Add NFT_META_BRI_VLAN support wenxu
2019-06-19 17:06 ` Pablo Neira Ayuso
2019-06-19 17:02 ` [PATCH 1/2 nf-next] netfilter: nft_meta: add NFT_META_BRI_PVID support Pablo Neira Ayuso
2019-06-20 1:19 ` wenxu [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=26bb807a-4021-b06e-53cb-d30f3f188555@ucloud.cn \
--to=wenxu@ucloud.cn \
--cc=fw@strlen.de \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).