Re: [PATCH nf-next v5 3/3] netfilter: bridge: nf queue verdict to use NFQA_VLAN and NFQA_L2HDR

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Stephane,

We're almost there, a bit more changes for this please.

On Sun, Mar 20, 2016 at 09:06:46AM +0100, Stephane Bryant wrote:
> This makes nf queues use NFQA_VLAN and NFQA_L2HDR in verdict to modify the
> original skb
> 
> Signed-off-by: Stephane Bryant <stephane.ml.bryant@gmail.com>
> ---
>  net/netfilter/nfnetlink_queue.c | 25 +++++++++++++++++++++++++
>  1 file changed, 25 insertions(+)
> 
> diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
> index 0da0276..aa526f0 100644
> --- a/net/netfilter/nfnetlink_queue.c
> +++ b/net/netfilter/nfnetlink_queue.c
> @@ -1126,6 +1126,31 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
>  			ct = nfqnl_ct_parse(nfnl_ct, nlh, nfqa, entry, &ctinfo);
>  	}
>  
> +	if (nfqa[NFQA_VLAN]) {
> +		struct nlattr *vlan_tci =
> +			nla_find_nested(nfqa[NFQA_VLAN], NFQA_VLAN_TCI);
> +		struct nlattr *vlan_proto =
> +			nla_find_nested(nfqa[NFQA_VLAN], NFQA_VLAN_PROTO);
> +
> +		if (vlan_tci)
> +			entry->skb->vlan_tci = ntohs(nla_get_be16(vlan_tci));
> +
> +		if (vlan_proto)
> +			entry->skb->vlan_proto = nla_get_be16(vlan_proto);
> +	}

Could you replace this chunk above by something like...

        if (entry->state.pf == PF_BRIDGE) {
                err = nfqa_parse_bridge(nfqa);
                if (err < 0)
                        return err;
        }

Then, this nfqa_parse_bridge() should look like;

        if (nfqa[NFQA_VLAN]) {
                struct nlattr *tb[NFQA_VLAN_MAX + 1];

                err = nla_parse_nested(tb, NFQA_VLAN_MAX, nfqa[NFQA_VLAN],
                                       nfqa_vlan_policy);
                if (err < 0)
                        return err;

                if (!tb[NFQA_VLAN_TCI] ||
                    !tb[NFTA_VLAN_PROTO])
                        return -EINVAL;

                if (tb[NFQA_VLAN_TCI])
			entry->skb->vlan_tci =
                                ntohs(nla_get_be16(tb[NFQA_VLAN_TCI]));
                if (tb[NFAQ_VLAN_PROTO])
                        entry->skb->vlan_proto =
                                nla_get_be16(tb[NFQA_VLAN_PROTO]);
        }

        if (nfqa[NFQA_L2HDR]) {
                ...
        }

You will need the policy structure BTW:

static const struct nla_policy nfqa_verdict_policy[NFQA_VLAN_MAX + 1] = {
        [NFQA_VLAN_TCI]         = { .type = NLA_U16 },
        [NFQA_VLAN_PROTO]       = { .type = NLA_U16 },
};

And don't forget to update nfqa_verdict_policy to add the NFQA_VLAN
nested attribute there as:

        .type   = NLA_NESTED.

Thanks !