From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 11/18] netfilter: Support iif matches in POSTROUTING
Date: Mon, 18 Nov 2019 22:49:07 +0100 [thread overview]
Message-ID: <20191118214914.142794-12-pablo@netfilter.org> (raw)
In-Reply-To: <20191118214914.142794-1-pablo@netfilter.org>
From: Phil Sutter <phil@nwl.cc>
Instead of generally passing NULL to NF_HOOK_COND() for input device,
pass skb->dev which contains input device for routed skbs.
Note that iptables (both legacy and nft) reject rules with input
interface match from being added to POSTROUTING chains, but nftables
allows this.
Cc: Eric Garver <eric@garver.life>
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/ipv4/ip_output.c | 4 ++--
net/ipv4/xfrm4_output.c | 2 +-
net/ipv6/ip6_output.c | 4 ++--
net/ipv6/xfrm6_output.c | 2 +-
4 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 3d8baaaf7086..9d83cb320dcb 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -422,7 +422,7 @@ int ip_mc_output(struct net *net, struct sock *sk, struct sk_buff *skb)
int ip_output(struct net *net, struct sock *sk, struct sk_buff *skb)
{
- struct net_device *dev = skb_dst(skb)->dev;
+ struct net_device *dev = skb_dst(skb)->dev, *indev = skb->dev;
IP_UPD_PO_STATS(net, IPSTATS_MIB_OUT, skb->len);
@@ -430,7 +430,7 @@ int ip_output(struct net *net, struct sock *sk, struct sk_buff *skb)
skb->protocol = htons(ETH_P_IP);
return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
- net, sk, skb, NULL, dev,
+ net, sk, skb, indev, dev,
ip_finish_output,
!(IPCB(skb)->flags & IPSKB_REROUTED));
}
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index ecff3fce9807..89ba7c87de5d 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -92,7 +92,7 @@ static int __xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb)
int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb)
{
return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
- net, sk, skb, NULL, skb_dst(skb)->dev,
+ net, sk, skb, skb->dev, skb_dst(skb)->dev,
__xfrm4_output,
!(IPCB(skb)->flags & IPSKB_REROUTED));
}
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 71827b56c006..945508a7cb0f 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -160,7 +160,7 @@ static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *s
int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
{
- struct net_device *dev = skb_dst(skb)->dev;
+ struct net_device *dev = skb_dst(skb)->dev, *indev = skb->dev;
struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
skb->protocol = htons(ETH_P_IPV6);
@@ -173,7 +173,7 @@ int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
}
return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
- net, sk, skb, NULL, dev,
+ net, sk, skb, indev, dev,
ip6_finish_output,
!(IP6CB(skb)->flags & IP6SKB_REROUTED));
}
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index eecac1b7148e..fbe51d40bd7e 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -187,7 +187,7 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
{
return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
- net, sk, skb, NULL, skb_dst(skb)->dev,
+ net, sk, skb, skb->dev, skb_dst(skb)->dev,
__xfrm6_output,
!(IP6CB(skb)->flags & IP6SKB_REROUTED));
}
--
2.11.0
next prev parent reply other threads:[~2019-11-18 21:49 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-18 21:48 [PATCH 00/18] Netfilter updates for net-next Pablo Neira Ayuso
2019-11-18 21:48 ` [PATCH 01/18] netfilter: ipset: Add wildcard support to net,iface Pablo Neira Ayuso
2019-11-18 21:48 ` [PATCH 02/18] netfilter: nft_meta: offload support for interface index Pablo Neira Ayuso
2019-11-18 21:48 ` [PATCH 03/18] netfilter: nft_payload: simplify vlan header handling Pablo Neira Ayuso
2019-11-18 21:49 ` [PATCH 04/18] netfilter: nf_tables: add nft_payload_rebuild_vlan_hdr() Pablo Neira Ayuso
2019-11-18 21:49 ` [PATCH 05/18] netfilter: nf_tables_offload: pass extack to nft_flow_cls_offload_setup() Pablo Neira Ayuso
2019-11-18 21:49 ` [PATCH 06/18] netfilter: nft_payload: add C-VLAN support Pablo Neira Ayuso
2019-11-18 21:49 ` [PATCH 07/18] netfilter: xt_time: use time64_t Pablo Neira Ayuso
2019-11-18 21:49 ` [PATCH 08/18] netfilter: nft_meta: use 64-bit time arithmetic Pablo Neira Ayuso
2019-11-18 21:49 ` [PATCH 09/18] netfilter: nf_flow_table_offload: add flow_action_entry_next() and use it Pablo Neira Ayuso
2019-11-18 21:49 ` [PATCH 10/18] netfilter: nf_flow_table_offload: add IPv6 support Pablo Neira Ayuso
2019-11-18 21:49 ` Pablo Neira Ayuso [this message]
2019-11-18 21:49 ` [PATCH 12/18] netfilter: nf_flow_table_offload: Fix check ndo_setup_tc when setup_block Pablo Neira Ayuso
2019-11-18 21:49 ` [PATCH 13/18] netfilter: nf_flow_table: remove unnecessary parameter in flow_offload_fill_dir Pablo Neira Ayuso
2019-11-18 21:49 ` [PATCH 14/18] netfilter: nf_tables_offload: remove reference to flow rule from deletion path Pablo Neira Ayuso
2019-11-18 21:49 ` [PATCH 15/18] netfilter: nf_tables_offload: release flow_rule on error from commit path Pablo Neira Ayuso
2019-11-18 21:49 ` [PATCH 16/18] netfilter: nf_tables_offload: undo updates if transaction fails Pablo Neira Ayuso
2019-11-18 21:49 ` [PATCH 17/18] netfilter: nf_tables: check if bind callback fails and unbind if hook registration fails Pablo Neira Ayuso
2019-11-18 21:49 ` [PATCH 18/18] netfilter: nf_tables: add nft_unregister_flowtable_hook() Pablo Neira Ayuso
2019-11-19 0:47 ` [PATCH 00/18] Netfilter updates for net-next David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191118214914.142794-12-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).