netdev - Re: [PATCH 2/2 nf-next] netfilter: nft_meta: Add NFT_META_BRI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 19 Jun 2019 19:06:43 +0200
From:   Pablo Neira Ayuso <pablo@...filter.org>
To:     wenxu@...oud.cn
Cc:     fw@...len.de, netfilter-devel@...r.kernel.org,
        netdev@...r.kernel.org
Subject: Re: [PATCH 2/2 nf-next] netfilter: nft_meta: Add NFT_META_BRI_VLAN
 support

On Wed, Jun 19, 2019 at 03:16:25PM +0800, wenxu@...oud.cn wrote:
> From: wenxu <wenxu@...oud.cn>
> 
> nft add table bridge firewall
> nft add chain bridge firewall zones { type filter hook prerouting priority - 300 \; }
> nft add rule bridge firewall zones counter ct zone set vlan id map { 100 : 1, 200 : 2 }
> 
> As above set the bridge port with pvid, the received packet don't contain
> the vlan tag which means the packet should belong to vlan 200 through pvid.
> With this pacth user can set the pvid in the prerouting hook before set zone
> id and conntrack: "meta brvlan set meta brpvid"

A real ruleset explaining how you use this would help in the commit
message would help. I also would like to see the patch for nftables.

> Signed-off-by: wenxu <wenxu@...oud.cn>
> ---
>  include/uapi/linux/netfilter/nf_tables.h |  2 ++
>  net/netfilter/nft_meta.c                 | 20 ++++++++++++++++++++
>  2 files changed, 22 insertions(+)
> 
> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> index 4a16124..7be0307 100644
> --- a/include/uapi/linux/netfilter/nf_tables.h
> +++ b/include/uapi/linux/netfilter/nf_tables.h
> @@ -794,6 +794,7 @@ enum nft_exthdr_attributes {
>   * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
>   * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
>   * @NFT_META_BRI_PVID: packet input bridge port pvid
> + * @NFT_META_BRI_VLAN: set vlan tag on packet
>   */
>  enum nft_meta_keys {
>  	NFT_META_LEN,
> @@ -825,6 +826,7 @@ enum nft_meta_keys {
>  	NFT_META_IIFKIND,
>  	NFT_META_OIFKIND,
>  	NFT_META_BRI_PVID,
> +	NFT_META_BRI_VLAN,
>  };
>  
>  /**
> diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
> index 1fdb565..5c3817b 100644
> --- a/net/netfilter/nft_meta.c
> +++ b/net/netfilter/nft_meta.c
> @@ -282,8 +282,13 @@ static void nft_meta_set_eval(const struct nft_expr *expr,
>  {
>  	const struct nft_meta *meta = nft_expr_priv(expr);
>  	struct sk_buff *skb = pkt->skb;
> +	const struct net_device *in = nft_in(pkt);
>  	u32 *sreg = &regs->data[meta->sreg];
> +#ifdef CONFIG_NF_TABLES_BRIDGE
> +	const struct net_bridge_port *p;
> +#endif
>  	u32 value = *sreg;
> +	u16 value16;
>  	u8 value8;
>  
>  	switch (meta->key) {
> @@ -306,6 +311,14 @@ static void nft_meta_set_eval(const struct nft_expr *expr,
>  
>  		skb->nf_trace = !!value8;
>  		break;
> +#ifdef CONFIG_NF_TABLES_BRIDGE
> +	case NFT_META_BRI_VLAN:
> +		value16 = nft_reg_load16(sreg);
> +		if (in && (p = br_port_get_rtnl_rcu(in)) &&
> +		    !skb_vlan_tag_present(skb))

Why does this skip if there is a vlan tag?

I guess it should be possible to update an existing vlan tag?

Thanks.