[PATCH] [libnftnl] expr: meta: Add cpu support for meta expresion

[PATCH] [libnftnl] expr: meta: Add cpu support for meta expresion

[Ana Rey]

The cpu attribute does not set.

Signed-off-by: Ana Rey <anarey@gmail.com>
---
 include/linux/netfilter/nf_tables.h |    2 ++
 src/expr/meta.c                     |    5 +++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index 72ad208..67218f3 100644
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -572,6 +572,7 @@ enum nft_exthdr_attributes {
  * @NFT_META_BRI_IIFNAME: packet input bridge interface name
  * @NFT_META_BRI_OIFNAME: packet output bridge interface name
  * @NFT_META_PKTTYPE: Packet type
+ * @NFT_META_CPU: Packet cpu
  */
 enum nft_meta_keys {
 	NFT_META_LEN,
@@ -594,6 +595,7 @@ enum nft_meta_keys {
 	NFT_META_BRI_IIFNAME,
 	NFT_META_BRI_OIFNAME,
 	NFT_META_PKTTYPE,
+	NFT_META_CPU,
 };
 
 /**
diff --git a/src/expr/meta.c b/src/expr/meta.c
index 35ca177..9e884d6 100644
--- a/src/expr/meta.c
+++ b/src/expr/meta.c
@@ -23,7 +23,7 @@
 #include "expr_ops.h"
 
 #ifndef NFT_META_MAX
-#define NFT_META_MAX (NFT_META_PKTTYPE + 1)
+#define NFT_META_MAX (NFT_META_CPU + 1)
 #endif
 
 struct nft_expr_meta {
@@ -153,7 +153,8 @@ static const char *meta_key2str_array[NFT_META_MAX] = {
 	[NFT_META_SECMARK]	= "secmark",
 	[NFT_META_BRI_IIFNAME]	= "bri_iifname",
 	[NFT_META_BRI_OIFNAME]	= "bri_oifname",
-	[NFT_META_PKTTYPE]	= "pkttype"
+	[NFT_META_PKTTYPE]	= "pkttype",
+	[NFT_META_CPU]		= "cpu",
 };
 
 static const char *meta_key2str(uint8_t key)
-- 
1.7.10.4

[PATCH] netfilter: nf_tables: Add cpu attribute support to meta expresion.

[Ana Rey]

Add cpu support to meta expresion.

This allows you to match packets with cpu number.

Signed-off-by: Ana Rey <anarey@gmail.com>
---
 include/uapi/linux/netfilter/nf_tables.h |    2 ++
 net/netfilter/nft_meta.c                 |    5 +++++
 2 files changed, 7 insertions(+)

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 72ad208..67218f3 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -572,6 +572,7 @@ enum nft_exthdr_attributes {
  * @NFT_META_BRI_IIFNAME: packet input bridge interface name
  * @NFT_META_BRI_OIFNAME: packet output bridge interface name
  * @NFT_META_PKTTYPE: Packet type
+ * @NFT_META_CPU: Packet cpu
  */
 enum nft_meta_keys {
 	NFT_META_LEN,
@@ -594,6 +595,7 @@ enum nft_meta_keys {
 	NFT_META_BRI_IIFNAME,
 	NFT_META_BRI_OIFNAME,
 	NFT_META_PKTTYPE,
+	NFT_META_CPU,
 };
 
 /**
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index dbf7fe1..34a587e 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -17,6 +17,7 @@
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
+#include <linux/smp.h>
 #include <net/dst.h>
 #include <net/sock.h>
 #include <net/tcp_states.h> /* for TCP_TIME_WAIT */
@@ -150,6 +151,9 @@ void nft_meta_get_eval(const struct nft_expr *expr,
 			goto err;
 		}
 		break;
+	case NFT_META_CPU:
+		dest->data[0] = smp_processor_id();
+		break;
 	default:
 		WARN_ON(1);
 		goto err;
@@ -222,6 +226,7 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
 	case NFT_META_SECMARK:
 #endif
 	case NFT_META_PKTTYPE:
+	case NFT_META_CPU:
 		break;
 	default:
 		return -EOPNOTSUPP;
-- 
1.7.10.4

[PATCH] [nft] src: Add support for cpu in meta expresion

[Ana Rey]

This allows you to match cpu handling with a packet.

This is an example of the syntax for this new attribute:

nft add rule ip test input meta cpu 1 counter
nft add rule ip test input meta cpu 1-3 counter
nft add rule ip test input meta cpu { 1, 3} counter

Signed-off-by: Ana Rey <anarey@gmail.com>
---
 include/linux/netfilter/nf_tables.h |    2 ++
 src/meta.c                          |    3 +++
 src/parser.y                        |    2 ++
 src/scanner.l                       |    1 +
 4 files changed, 8 insertions(+)

diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index fbc7904..9e67c14 100644
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -536,6 +536,7 @@ enum nft_exthdr_attributes {
  * @NFT_META_BRI_IIFNAME: packet input bridge interface name
  * @NFT_META_BRI_OIFNAME: packet output bridge interface name
  * @NFT_META_PKTTYPE: packet type
+ * @NFT_META_CPU: packet cpu
  */
 enum nft_meta_keys {
 	NFT_META_LEN,
@@ -558,6 +559,7 @@ enum nft_meta_keys {
 	NFT_META_BRI_IIFNAME,
 	NFT_META_BRI_OIFNAME,
 	NFT_META_PKTTYPE,
+	NFT_META_CPU,
 };
 
 /**
diff --git a/src/meta.c b/src/meta.c
index 2c61455..75a16ee 100644
--- a/src/meta.c
+++ b/src/meta.c
@@ -393,6 +393,9 @@ static const struct meta_template meta_templates[] = {
 	[NFT_META_PKTTYPE]	= META_TEMPLATE("pkttype",  &pkttype_type,
 						BITS_PER_BYTE,
 						BYTEORDER_HOST_ENDIAN),
+	[NFT_META_CPU]		= META_TEMPLATE("cpu",  &integer_type,
+						BITS_PER_BYTE,
+						BYTEORDER_HOST_ENDIAN),
 };
 
 static void meta_expr_print(const struct expr *expr)
diff --git a/src/parser.y b/src/parser.y
index 6da6e98..bf32c4e 100644
--- a/src/parser.y
+++ b/src/parser.y
@@ -325,6 +325,7 @@ static int monitor_lookup_event(const char *event)
 %token IBRIPORT			"ibriport"
 %token OBRIPORT			"obriport"
 %token PKTTYPE			"pkttype"
+%token CPU			"cpu"
 
 %token CT			"ct"
 %token DIRECTION		"direction"
@@ -1786,6 +1787,7 @@ meta_key_unqualified	:	MARK		{ $$ = NFT_META_MARK; }
 			|	IBRIPORT	{ $$ = NFT_META_BRI_IIFNAME; }
 			|       OBRIPORT	{ $$ = NFT_META_BRI_OIFNAME; }
 			|       PKTTYPE		{ $$ = NFT_META_PKTTYPE; }
+			|       CPU		{ $$ = NFT_META_CPU; }
 			;
 
 meta_stmt		:	META	meta_key	SET	expr
diff --git a/src/scanner.l b/src/scanner.l
index 1d2be76..ad0b58d 100644
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -407,6 +407,7 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})
 "ibriport"		{ return IBRIPORT; }
 "obriport"		{ return OBRIPORT; }
 "pkttype"		{ return PKTTYPE; }
+"cpu"			{ return CPU; }
 
 "ct"			{ return CT; }
 "direction"		{ return DIRECTION; }
-- 
1.7.10.4

[PATCH] [nft] tests: Add tests for cpu attribute of meta expresion.

[Ana Rey]

Add some tests to check the cpu attribute of meta expresion.

Signed-off-by: Ana Rey <anarey@gmail.com>
---
 tests/any/meta.t |    8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tests/any/meta.t b/tests/any/meta.t
index 7361962..7cdf87a 100644
--- a/tests/any/meta.t
+++ b/tests/any/meta.t
@@ -164,3 +164,11 @@ meta pkttype != unicast;ok;pkttype != unicast
 meta pkttype != multicast;ok;pkttype != multicast
 meta pkttype broadcastttt;fail
 -meta pkttype { broadcast, multicast} accept;ok
+
+meta cpu 1;ok;cpu 1
+meta cpu != 1;ok;cpu != 1
+meta cpu 1-3;ok;cpu >= 1 cpu <= 3
+# BUG: there is not matching of packets with this rule.
+meta cpu != 1-2;ok;cpu < 1 cpu > 2
+meta cpu { 2,3};ok;cpu { 2, 3}
+-meta cpu != { 2,3};ok
-- 
1.7.10.4

Re: [PATCH] [nft] src: Add support for cpu in meta expresion

[Pablo Neira Ayuso]

On Thu, Aug 07, 2014 at 09:00:57AM +0200, Ana Rey wrote:
> This allows you to match cpu handling with a packet.
> 
> This is an example of the syntax for this new attribute:
> 
> nft add rule ip test input meta cpu 1 counter
> nft add rule ip test input meta cpu 1-3 counter
> nft add rule ip test input meta cpu { 1, 3} counter

Applied, thanks Ana.

Re: [PATCH] netfilter: nf_tables: Add cpu attribute support to meta expresion.

[Pablo Neira Ayuso]

On Thu, Aug 07, 2014 at 09:00:56AM +0200, Ana Rey wrote:
> Add cpu support to meta expresion.
> 
> This allows you to match packets with cpu number.

Applied, thanks.

Re: [PATCH] [libnftnl] expr: meta: Add cpu support for meta expresion

[Pablo Neira Ayuso]

Applied with minor change in the doc area of nf_tables.h

Thanks.