* [PATCH nf-next v3 1/3] netfilter: bridge: add nf_afinfo to enable queuing to userspace
@ 2016-02-20 9:07 Stephane Bryant
2016-02-20 9:07 ` [PATCH nf-next v3 2/3] netfilter: bridge: pass L2 header and VLAN as netlink attributes in queues " Stephane Bryant
2016-02-20 9:07 ` [PATCH nf-next v3 3/3] netfilter: bridge: nf queue verdict to use NFQA_VLAN and NFQA_L2HDR Stephane Bryant
0 siblings, 2 replies; 6+ messages in thread
From: Stephane Bryant @ 2016-02-20 9:07 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, stephane
From: stephane <stephane.ml.bryant@gmail.com>
This just adds and registers a nf_afinfo for the ethernet
bridge, which enables queuing to userspace for the AF_BRIDGE
family. No checksum computation is done.
Signed-off-by: Stephane Bryant <stephane.ml.bryant@gmail.com>
---
net/bridge/netfilter/nf_tables_bridge.c | 47 +++++++++++++++++++++++++++++++--
1 file changed, 45 insertions(+), 2 deletions(-)
diff --git a/net/bridge/netfilter/nf_tables_bridge.c b/net/bridge/netfilter/nf_tables_bridge.c
index 7fcdd72..a78c4e2 100644
--- a/net/bridge/netfilter/nf_tables_bridge.c
+++ b/net/bridge/netfilter/nf_tables_bridge.c
@@ -162,15 +162,57 @@ static const struct nf_chain_type filter_bridge = {
(1 << NF_BR_POST_ROUTING),
};
+static void nf_br_saveroute(const struct sk_buff *skb,
+ struct nf_queue_entry *entry)
+{
+}
+
+static int nf_br_reroute(struct net *net, struct sk_buff *skb,
+ const struct nf_queue_entry *entry)
+{
+ return 0;
+}
+
+static __sum16 nf_br_checksum(struct sk_buff *skb, unsigned int hook,
+ unsigned int dataoff, u_int8_t protocol)
+{
+ return 0;
+}
+
+static __sum16 nf_br_checksum_partial(struct sk_buff *skb, unsigned int hook,
+ unsigned int dataoff, unsigned int len,
+ u_int8_t protocol)
+{
+ return 0;
+}
+
+static int nf_br_route(struct net *net, struct dst_entry **dst,
+ struct flowi *fl, bool strict __always_unused)
+{
+ return 0;
+}
+
+static const struct nf_afinfo nf_br_afinfo = {
+ .family = AF_BRIDGE,
+ .checksum = nf_br_checksum,
+ .checksum_partial = nf_br_checksum_partial,
+ .route = nf_br_route,
+ .saveroute = nf_br_saveroute,
+ .reroute = nf_br_reroute,
+ .route_key_size = 0,
+};
+
static int __init nf_tables_bridge_init(void)
{
int ret;
+ nf_register_afinfo(&nf_br_afinfo);
nft_register_chain_type(&filter_bridge);
ret = register_pernet_subsys(&nf_tables_bridge_net_ops);
- if (ret < 0)
+ if (ret < 0) {
nft_unregister_chain_type(&filter_bridge);
-
+ nf_unregister_afinfo(&nf_br_afinfo);
+ }
return ret;
}
@@ -178,6 +220,7 @@ static void __exit nf_tables_bridge_exit(void)
{
unregister_pernet_subsys(&nf_tables_bridge_net_ops);
nft_unregister_chain_type(&filter_bridge);
+ nf_unregister_afinfo(&nf_br_afinfo);
}
module_init(nf_tables_bridge_init);
--
2.1.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH nf-next v3 2/3] netfilter: bridge: pass L2 header and VLAN as netlink attributes in queues to userspace
2016-02-20 9:07 [PATCH nf-next v3 1/3] netfilter: bridge: add nf_afinfo to enable queuing to userspace Stephane Bryant
@ 2016-02-20 9:07 ` Stephane Bryant
2016-02-29 12:40 ` Pablo Neira Ayuso
2016-02-20 9:07 ` [PATCH nf-next v3 3/3] netfilter: bridge: nf queue verdict to use NFQA_VLAN and NFQA_L2HDR Stephane Bryant
1 sibling, 1 reply; 6+ messages in thread
From: Stephane Bryant @ 2016-02-20 9:07 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, stephane
From: stephane <stephane.ml.bryant@gmail.com>
-this creates 2 netlink attribute NLQA_VLAN and NLQA_L2HDR
-these are filled up for the PF_BRIDGE family on the way to userspace
Signed-off-by: Stephane Bryant <stephane.ml.bryant@gmail.com>
---
include/uapi/linux/netfilter/nfnetlink_queue.h | 7 ++++
net/netfilter/nfnetlink_queue.c | 53 ++++++++++++++++++++++++++
2 files changed, 60 insertions(+)
diff --git a/include/uapi/linux/netfilter/nfnetlink_queue.h b/include/uapi/linux/netfilter/nfnetlink_queue.h
index b67a853..211fcdc 100644
--- a/include/uapi/linux/netfilter/nfnetlink_queue.h
+++ b/include/uapi/linux/netfilter/nfnetlink_queue.h
@@ -30,6 +30,11 @@ struct nfqnl_msg_packet_timestamp {
__aligned_be64 usec;
};
+struct nfqnl_msg_vlan {
+ __be16 proto;
+ __u16 tci;
+} __attribute__ ((packed));
+
enum nfqnl_attr_type {
NFQA_UNSPEC,
NFQA_PACKET_HDR,
@@ -50,6 +55,8 @@ enum nfqnl_attr_type {
NFQA_UID, /* __u32 sk uid */
NFQA_GID, /* __u32 sk gid */
NFQA_SECCTX, /* security context string */
+ NFQA_VLAN, /* packet vlan info */
+ NFQA_L2HDR, /* full L2 header */
__NFQA_MAX
};
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 1d39365..b40cdb4 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -295,6 +295,54 @@ static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata)
return seclen;
}
+static u32 nfqnl_get_bridge_nla_len(struct nf_queue_entry *entry)
+{
+ u32 nlalen = 0;
+ struct sk_buff *entskb = entry->skb;
+
+ if ((entry->state.pf != PF_BRIDGE) || (!skb_mac_header_was_set(entskb)))
+ return 0;
+
+ if (skb_vlan_tag_present(entskb))
+ nlalen += nla_total_size(sizeof(struct nfqnl_msg_vlan));
+
+ if (entskb->network_header > entskb->mac_header)
+ nlalen += nla_total_size((entskb->network_header -
+ entskb->mac_header));
+
+ return nlalen;
+}
+
+static int nfqnl_put_bridge_nla(struct nf_queue_entry *entry,
+ struct sk_buff *skb)
+{
+ struct sk_buff *entskb = entry->skb;
+
+ if ((entry->state.pf != PF_BRIDGE) || (!skb_mac_header_was_set(entskb)))
+ return 0;
+
+ if (skb_vlan_tag_present(entskb)) {
+ struct nfqnl_msg_vlan pvlan;
+
+ pvlan.tci = entskb->vlan_tci;
+ pvlan.proto = entskb->vlan_proto;
+ if (nla_put(skb, NFQA_VLAN, sizeof(pvlan), &pvlan))
+ goto nla_put_failure;
+ }
+
+ if (entskb->mac_header < entskb->network_header) {
+ int len = (int)(entskb->network_header - entskb->mac_header);
+
+ if (nla_put(skb, NFQA_L2HDR, len, skb_mac_header(entskb)))
+ goto nla_put_failure;
+ }
+
+ return 0;
+
+nla_put_failure:
+ return -1;
+}
+
static struct sk_buff *
nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
struct nf_queue_entry *entry,
@@ -334,6 +382,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
if (entskb->tstamp.tv64)
size += nla_total_size(sizeof(struct nfqnl_msg_packet_timestamp));
+ size += nfqnl_get_bridge_nla_len(entry);
+
if (entry->state.hook <= NF_INET_FORWARD ||
(entry->state.hook == NF_INET_POST_ROUTING && entskb->sk == NULL))
csum_verify = !skb_csum_unnecessary(entskb);
@@ -499,6 +549,9 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
}
}
+ if (nfqnl_put_bridge_nla(entry, skb))
+ goto nla_put_failure;
+
if (entskb->tstamp.tv64) {
struct nfqnl_msg_packet_timestamp ts;
struct timespec64 kts = ktime_to_timespec64(skb->tstamp);
--
2.1.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH nf-next v3 3/3] netfilter: bridge: nf queue verdict to use NFQA_VLAN and NFQA_L2HDR
2016-02-20 9:07 [PATCH nf-next v3 1/3] netfilter: bridge: add nf_afinfo to enable queuing to userspace Stephane Bryant
2016-02-20 9:07 ` [PATCH nf-next v3 2/3] netfilter: bridge: pass L2 header and VLAN as netlink attributes in queues " Stephane Bryant
@ 2016-02-20 9:07 ` Stephane Bryant
2016-02-20 9:56 ` Florian Westphal
1 sibling, 1 reply; 6+ messages in thread
From: Stephane Bryant @ 2016-02-20 9:07 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, Stephane Bryant
This makes nf queues use NFQA_VLAN and NFQA_L2HDR in verdict to modify the
original skb
Signed-off-by: Stephane Bryant <stephane.ml.bryant@gmail.com>
---
net/netfilter/nfnetlink_queue.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index b40cdb4..c6c365a 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1121,6 +1121,25 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
ct = nfqnl_ct_parse(nfnl_ct, nlh, nfqa, entry, &ctinfo);
}
+ if (nfqa[NFQA_VLAN]) {
+ struct nfqnl_msg_vlan *pvlan = nla_data(nfqa[NFQA_VLAN]);
+
+ entry->skb->vlan_tci = pvlan->tci;
+ entry->skb->vlan_proto = pvlan->proto;
+ }
+
+ if (nfqa[NFQA_L2HDR]) {
+ int mac_header_len = entry->skb->network_header -
+ entry->skb->mac_header;
+
+ if (mac_header_len != nla_len(nfqa[NFQA_L2HDR]))
+ verdict = NF_DROP;
+ else if (mac_header_len > 0)
+ memcpy(skb_mac_header(entry->skb),
+ nla_data(nfqa[NFQA_L2HDR]),
+ mac_header_len);
+ }
+
if (nfqa[NFQA_PAYLOAD]) {
u16 payload_len = nla_len(nfqa[NFQA_PAYLOAD]);
int diff = payload_len - entry->skb->len;
--
2.1.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH nf-next v3 3/3] netfilter: bridge: nf queue verdict to use NFQA_VLAN and NFQA_L2HDR
2016-02-20 9:07 ` [PATCH nf-next v3 3/3] netfilter: bridge: nf queue verdict to use NFQA_VLAN and NFQA_L2HDR Stephane Bryant
@ 2016-02-20 9:56 ` Florian Westphal
0 siblings, 0 replies; 6+ messages in thread
From: Florian Westphal @ 2016-02-20 9:56 UTC (permalink / raw)
To: Stephane Bryant; +Cc: pablo, netfilter-devel
Stephane Bryant <stephane.ml.bryant@gmail.com> wrote:
> This makes nf queues use NFQA_VLAN and NFQA_L2HDR in verdict to modify the
> original skb
Looks good to me, thanks for addressing all my comments.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH nf-next v3 2/3] netfilter: bridge: pass L2 header and VLAN as netlink attributes in queues to userspace
2016-02-20 9:07 ` [PATCH nf-next v3 2/3] netfilter: bridge: pass L2 header and VLAN as netlink attributes in queues " Stephane Bryant
@ 2016-02-29 12:40 ` Pablo Neira Ayuso
2016-03-05 18:32 ` stéphane bryant
0 siblings, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2016-02-29 12:40 UTC (permalink / raw)
To: Stephane Bryant; +Cc: netfilter-devel
On Sat, Feb 20, 2016 at 10:07:09AM +0100, Stephane Bryant wrote:
> From: stephane <stephane.ml.bryant@gmail.com>
>
> -this creates 2 netlink attribute NLQA_VLAN and NLQA_L2HDR
> -these are filled up for the PF_BRIDGE family on the way to userspace
>
> Signed-off-by: Stephane Bryant <stephane.ml.bryant@gmail.com>
> ---
> include/uapi/linux/netfilter/nfnetlink_queue.h | 7 ++++
> net/netfilter/nfnetlink_queue.c | 53 ++++++++++++++++++++++++++
> 2 files changed, 60 insertions(+)
>
> diff --git a/include/uapi/linux/netfilter/nfnetlink_queue.h b/include/uapi/linux/netfilter/nfnetlink_queue.h
> index b67a853..211fcdc 100644
> --- a/include/uapi/linux/netfilter/nfnetlink_queue.h
> +++ b/include/uapi/linux/netfilter/nfnetlink_queue.h
> @@ -30,6 +30,11 @@ struct nfqnl_msg_packet_timestamp {
> __aligned_be64 usec;
> };
>
> +struct nfqnl_msg_vlan {
> + __be16 proto;
> + __u16 tci;
> +} __attribute__ ((packed));
Stephane, I'm very looking forward to having this update pushed
mainstream.
However, this I think it would be good if you can translate this to
use nested attributes.
See nla_nest_start() and nla_nest_end(). Then, add a new vlan
attributes for this:
enum nfqnl_vlan_attr {
NFQA_VLAN_UNSPEC,
NFQA_VLAN_PROTO,
NFQA_VLAN_TCI,
__NFQA_VLAN_MAX,
};
#define NFQA_VLAN_MAX (__NFQA_VLAN_MAX + 1)
Using structure to encapsulate netlink data is highly discouraged. I
know we're doing this already in old attribute but that we cannot
change since it's part of the ABI. But I would like that we start
doing this the right way for new attributes.
Let me know,
Thanks!
> +
> enum nfqnl_attr_type {
> NFQA_UNSPEC,
> NFQA_PACKET_HDR,
> @@ -50,6 +55,8 @@ enum nfqnl_attr_type {
> NFQA_UID, /* __u32 sk uid */
> NFQA_GID, /* __u32 sk gid */
> NFQA_SECCTX, /* security context string */
> + NFQA_VLAN, /* packet vlan info */
> + NFQA_L2HDR, /* full L2 header */
>
> __NFQA_MAX
> };
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH nf-next v3 2/3] netfilter: bridge: pass L2 header and VLAN as netlink attributes in queues to userspace
2016-02-29 12:40 ` Pablo Neira Ayuso
@ 2016-03-05 18:32 ` stéphane bryant
0 siblings, 0 replies; 6+ messages in thread
From: stéphane bryant @ 2016-03-05 18:32 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
>
> Stephane, I'm very looking forward to having this update pushed
> mainstream.
>
> However, this I think it would be good if you can translate this to
> use nested attributes.
>
> See nla_nest_start() and nla_nest_end(). Then, add a new vlan
> attributes for this:
>
> enum nfqnl_vlan_attr {
> NFQA_VLAN_UNSPEC,
> NFQA_VLAN_PROTO,
> NFQA_VLAN_TCI,
> __NFQA_VLAN_MAX,
> };
> #define NFQA_VLAN_MAX (__NFQA_VLAN_MAX + 1)
>
> Using structure to encapsulate netlink data is highly discouraged. I
> know we're doing this already in old attribute but that we cannot
> change since it's part of the ABI. But I would like that we start
> doing this the right way for new attributes.
Apologies for the delay -- i missed the email. I will try to get this
done within 3 weeks.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-03-05 18:32 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-02-20 9:07 [PATCH nf-next v3 1/3] netfilter: bridge: add nf_afinfo to enable queuing to userspace Stephane Bryant
2016-02-20 9:07 ` [PATCH nf-next v3 2/3] netfilter: bridge: pass L2 header and VLAN as netlink attributes in queues " Stephane Bryant
2016-02-29 12:40 ` Pablo Neira Ayuso
2016-03-05 18:32 ` stéphane bryant
2016-02-20 9:07 ` [PATCH nf-next v3 3/3] netfilter: bridge: nf queue verdict to use NFQA_VLAN and NFQA_L2HDR Stephane Bryant
2016-02-20 9:56 ` Florian Westphal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).