From: Ana Rey <anarey@gmail.com>
To: netfilter-devel@vger.kernel.org
Cc: "Álvaro Neira Ayuso" <alvaroneay@gmail.com>,
"Ana Rey" <anarey@gmail.com>
Subject: [PATCH v4] netfilter: nf_tables: add pkttype support to meta expression
Date: Wed, 6 Aug 2014 13:52:49 +0200 [thread overview]
Message-ID: <1407325969-14531-1-git-send-email-anarey@gmail.com> (raw)
In-Reply-To: <1402643720-6915-1-git-send-email-anarey@gmail.com>
From: Álvaro Neira Ayuso <alvaroneay@gmail.com>
Add pkttype support for ip, ipv6 and inet families of tables.
This allows you to fetch the meta packet type based on the link layer
information. The loopback traffic is a special case, the packet type
is guessed from the network layer header.
No special handling for bridge and arp since we're not going to see
such traffic in the loopback interface.
Joint work with Alvaro Neira Ayuso <alvaroneay@gmail.com>
Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
Signed-off-by: Ana Rey <anarey@gmail.com>
---
[Changes in v4:]
* Improvements in the description of this path.
* Replace the PACKET_HOST by PACKET_BROADCAST so this looks
exactly like xt_pkttype
* Remove NFPROTO_INET because the pkt->ops->pf is already allowing
you to indentify this family.
These improvements were suggested by Pablo Neira.
[Changes in v3:]
* Add support for NFPROTO_INET when handing the loopback case.
(NFPROTO_BRIDGE and NFPROTO_ARP families do not make sense when
handing the loopback case)
* Delete the broadcast case when handing the lookback case. This does not make
sense.
* Fix the description of NFT_META_PKTTYPE key.
[Changes in v2]
Put "case NFT_META_PKTTYPE:" outside of the #ifdef CONFIG_NETWORK_SECMARK.
It was a mistake.
Thanks to Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> for
reporting this mistake.
include/uapi/linux/netfilter/nf_tables.h | 2 ++
net/netfilter/nft_meta.c | 27 +++++++++++++++++++++++++++
2 files changed, 29 insertions(+)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 801bdd1..72ad208 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -571,6 +571,7 @@ enum nft_exthdr_attributes {
* @NFT_META_L4PROTO: layer 4 protocol number
* @NFT_META_BRI_IIFNAME: packet input bridge interface name
* @NFT_META_BRI_OIFNAME: packet output bridge interface name
+ * @NFT_META_PKTTYPE: Packet type
*/
enum nft_meta_keys {
NFT_META_LEN,
@@ -592,6 +593,7 @@ enum nft_meta_keys {
NFT_META_L4PROTO,
NFT_META_BRI_IIFNAME,
NFT_META_BRI_OIFNAME,
+ NFT_META_PKTTYPE,
};
/**
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 852b178..dbf7fe1 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -14,6 +14,9 @@
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
#include <net/dst.h>
#include <net/sock.h>
#include <net/tcp_states.h> /* for TCP_TIME_WAIT */
@@ -124,6 +127,29 @@ void nft_meta_get_eval(const struct nft_expr *expr,
dest->data[0] = skb->secmark;
break;
#endif
+ case NFT_META_PKTTYPE:
+ if (skb->pkt_type != PACKET_LOOPBACK) {
+ dest->data[0] = skb->pkt_type;
+ break;
+ }
+
+ switch (pkt->ops->pf) {
+ case NFPROTO_IPV4:
+ if (ipv4_is_multicast(ip_hdr(skb)->daddr))
+ dest->data[0] = PACKET_MULTICAST;
+ else
+ dest->data[0] = PACKET_BROADCAST;
+ break;
+ case NFPROTO_IPV6:
+ if (ipv6_hdr(skb)->daddr.s6_addr[0] == 0xFF)
+ dest->data[0] = PACKET_MULTICAST;
+ else
+ dest->data[0] = PACKET_BROADCAST;
+ break;
+ default:
+ goto err;
+ }
+ break;
default:
WARN_ON(1);
goto err;
@@ -195,6 +221,7 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
#ifdef CONFIG_NETWORK_SECMARK
case NFT_META_SECMARK:
#endif
+ case NFT_META_PKTTYPE:
break;
default:
return -EOPNOTSUPP;
--
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2014-08-06 11:50 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-06-13 7:15 [PATCH v2] netfilter: nf_tables: add pkttype support to meta expression Ana Rey
2014-06-27 11:09 ` Pablo Neira Ayuso
2014-08-05 18:27 ` [PATCH v3] " Ana Rey
2014-08-06 8:52 ` Pablo Neira Ayuso
2014-08-06 11:52 ` Ana Rey [this message]
2014-08-24 12:55 ` [PATCH v4] " Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1407325969-14531-1-git-send-email-anarey@gmail.com \
--to=anarey@gmail.com \
--cc=alvaroneay@gmail.com \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).