Commit 30e103fe authored by wenxu's avatar wenxu Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_meta: move bridge meta keys into nft_meta_bridge 



Separate bridge meta key from nft_meta to meta_bridge to avoid a
dependency between the bridge module and nft_meta when using the bridge
API available through include/linux/if_bridge.h

Signed-off-by: default avatarwenxu <wenxu@ucloud.cn>
Reviewed-by: default avatarNikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 6aedd14b

include/net/netfilter/nft_meta.h

0 → 100644
+44 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

#ifndef _NFT_META_H_

#define _NFT_META_H_



struct nft_meta {

	enum nft_meta_keys	key:8;

	union {

		enum nft_registers	dreg:8;

		enum nft_registers	sreg:8;

	};

};



extern const struct nla_policy nft_meta_policy[];



int nft_meta_get_init(const struct nft_ctx *ctx,

		      const struct nft_expr *expr,

		      const struct nlattr * const tb[]);



int nft_meta_set_init(const struct nft_ctx *ctx,

		      const struct nft_expr *expr,

		      const struct nlattr * const tb[]);



int nft_meta_get_dump(struct sk_buff *skb,

		      const struct nft_expr *expr);



int nft_meta_set_dump(struct sk_buff *skb,

		      const struct nft_expr *expr);



void nft_meta_get_eval(const struct nft_expr *expr,

		       struct nft_regs *regs,

		       const struct nft_pktinfo *pkt);



void nft_meta_set_eval(const struct nft_expr *expr,

		       struct nft_regs *regs,

		       const struct nft_pktinfo *pkt);



void nft_meta_set_destroy(const struct nft_ctx *ctx,

			  const struct nft_expr *expr);



int nft_meta_set_validate(const struct nft_ctx *ctx,

			  const struct nft_expr *expr,

			  const struct nft_data **data);



#endif

net/bridge/netfilter/Kconfig

+6 −0
Original line number Diff line number Diff line
@@ -9,6 +9,12 @@ menuconfig NF_TABLES_BRIDGE 
	bool "Ethernet Bridge nf_tables support"



if NF_TABLES_BRIDGE



config NFT_BRIDGE_META

	tristate "Netfilter nf_table bridge meta support"

	help

	  Add support for bridge dedicated meta key.



config NFT_BRIDGE_REJECT

	tristate "Netfilter nf_tables bridge reject support"

	depends on NFT_REJECT && NFT_REJECT_IPV4 && NFT_REJECT_IPV6

net/bridge/netfilter/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ 
# Makefile for the netfilter modules for Link Layer filtering on a bridge.

#



obj-$(CONFIG_NFT_BRIDGE_META)  += nft_meta_bridge.o

obj-$(CONFIG_NFT_BRIDGE_REJECT)  += nft_reject_bridge.o



# connection tracking

net/bridge/netfilter/nft_meta_bridge.c

0 → 100644
+127 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

#include <linux/kernel.h>

#include <linux/init.h>

#include <linux/module.h>

#include <linux/netlink.h>

#include <linux/netfilter.h>

#include <linux/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables.h>

#include <net/netfilter/nft_meta.h>



#include "../br_private.h"



static void nft_meta_bridge_get_eval(const struct nft_expr *expr,

				     struct nft_regs *regs,

				     const struct nft_pktinfo *pkt)

{

	const struct nft_meta *priv = nft_expr_priv(expr);

	const struct net_device *in = nft_in(pkt), *out = nft_out(pkt);

	u32 *dest = &regs->data[priv->dreg];

	const struct net_bridge_port *p;



	switch (priv->key) {

	case NFT_META_BRI_IIFNAME:

		if (in == NULL || (p = br_port_get_rcu(in)) == NULL)

			goto err;

		break;

	case NFT_META_BRI_OIFNAME:

		if (out == NULL || (p = br_port_get_rcu(out)) == NULL)

			goto err;

		break;

	default:

		goto out;

	}



	strncpy((char *)dest, p->br->dev->name, IFNAMSIZ);

	return;

out:

	return nft_meta_get_eval(expr, regs, pkt);

err:

	regs->verdict.code = NFT_BREAK;

}



static int nft_meta_bridge_get_init(const struct nft_ctx *ctx,

				    const struct nft_expr *expr,

				    const struct nlattr * const tb[])

{

	struct nft_meta *priv = nft_expr_priv(expr);

	unsigned int len;



	priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));

	switch (priv->key) {

	case NFT_META_BRI_IIFNAME:

	case NFT_META_BRI_OIFNAME:

		len = IFNAMSIZ;

		break;

	default:

		return nft_meta_get_init(ctx, expr, tb);

	}



	priv->dreg = nft_parse_register(tb[NFTA_META_DREG]);

	return nft_validate_register_store(ctx, priv->dreg, NULL,

					   NFT_DATA_VALUE, len);

}



static struct nft_expr_type nft_meta_bridge_type;

static const struct nft_expr_ops nft_meta_bridge_get_ops = {

	.type		= &nft_meta_bridge_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_meta)),

	.eval		= nft_meta_bridge_get_eval,

	.init		= nft_meta_bridge_get_init,

	.dump		= nft_meta_get_dump,

};



static const struct nft_expr_ops nft_meta_bridge_set_ops = {

	.type		= &nft_meta_bridge_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_meta)),

	.eval		= nft_meta_set_eval,

	.init		= nft_meta_set_init,

	.destroy	= nft_meta_set_destroy,

	.dump		= nft_meta_set_dump,

	.validate	= nft_meta_set_validate,

};



static const struct nft_expr_ops *

nft_meta_bridge_select_ops(const struct nft_ctx *ctx,

			   const struct nlattr * const tb[])

{

	if (tb[NFTA_META_KEY] == NULL)

		return ERR_PTR(-EINVAL);



	if (tb[NFTA_META_DREG] && tb[NFTA_META_SREG])

		return ERR_PTR(-EINVAL);



	if (tb[NFTA_META_DREG])

		return &nft_meta_bridge_get_ops;



	if (tb[NFTA_META_SREG])

		return &nft_meta_bridge_set_ops;



	return ERR_PTR(-EINVAL);

}



static struct nft_expr_type nft_meta_bridge_type __read_mostly = {

	.family         = NFPROTO_BRIDGE,

	.name           = "meta",

	.select_ops     = nft_meta_bridge_select_ops,

	.policy         = nft_meta_policy,

	.maxattr        = NFTA_META_MAX,

	.owner          = THIS_MODULE,

};



static int __init nft_meta_bridge_module_init(void)

{

	return nft_register_expr(&nft_meta_bridge_type);

}



static void __exit nft_meta_bridge_module_exit(void)

{

	nft_unregister_expr(&nft_meta_bridge_type);

}



module_init(nft_meta_bridge_module_init);

module_exit(nft_meta_bridge_module_exit);



MODULE_LICENSE("GPL");

MODULE_AUTHOR("wenxu <wenxu@ucloud.cn>");

MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "meta");

net/netfilter/nf_tables_core.c

+1 −0
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ 
#include <net/netfilter/nf_tables_core.h>

#include <net/netfilter/nf_tables.h>

#include <net/netfilter/nf_log.h>

#include <net/netfilter/nft_meta.h>



static noinline void __nft_trace_packet(struct nft_traceinfo *info,

					const struct nft_chain *chain,

CRA Git | Maintained and supported by SUSTech CRA and CCSE