nft_meta_bridge.c 4.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158
  1. // SPDX-License-Identifier: GPL-2.0
  2. #include <linux/kernel.h>
  3. #include <linux/init.h>
  4. #include <linux/module.h>
  5. #include <linux/netlink.h>
  6. #include <linux/netfilter.h>
  7. #include <linux/netfilter/nf_tables.h>
  8. #include <net/netfilter/nf_tables.h>
  9. #include <net/netfilter/nft_meta.h>
  10. #include <linux/if_bridge.h>
  11. static const struct net_device *
  12. nft_meta_get_bridge(const struct net_device *dev)
  13. {
  14. if (dev && netif_is_bridge_port(dev))
  15. return netdev_master_upper_dev_get_rcu((struct net_device *)dev);
  16. return NULL;
  17. }
  18. static void nft_meta_bridge_get_eval(const struct nft_expr *expr,
  19. struct nft_regs *regs,
  20. const struct nft_pktinfo *pkt)
  21. {
  22. const struct nft_meta *priv = nft_expr_priv(expr);
  23. const struct net_device *in = nft_in(pkt), *out = nft_out(pkt);
  24. u32 *dest = &regs->data[priv->dreg];
  25. const struct net_device *br_dev;
  26. switch (priv->key) {
  27. case NFT_META_BRI_IIFNAME:
  28. br_dev = nft_meta_get_bridge(in);
  29. break;
  30. case NFT_META_BRI_OIFNAME:
  31. br_dev = nft_meta_get_bridge(out);
  32. break;
  33. case NFT_META_BRI_IIFPVID: {
  34. u16 p_pvid;
  35. br_dev = nft_meta_get_bridge(in);
  36. if (!br_dev || !br_vlan_enabled(br_dev))
  37. goto err;
  38. br_vlan_get_pvid_rcu(in, &p_pvid);
  39. nft_reg_store16(dest, p_pvid);
  40. return;
  41. }
  42. case NFT_META_BRI_IIFVPROTO: {
  43. u16 p_proto;
  44. br_dev = nft_meta_get_bridge(in);
  45. if (!br_dev || !br_vlan_enabled(br_dev))
  46. goto err;
  47. br_vlan_get_proto(br_dev, &p_proto);
  48. nft_reg_store16(dest, htons(p_proto));
  49. return;
  50. }
  51. default:
  52. return nft_meta_get_eval(expr, regs, pkt);
  53. }
  54. strncpy((char *)dest, br_dev ? br_dev->name : "", IFNAMSIZ);
  55. return;
  56. err:
  57. regs->verdict.code = NFT_BREAK;
  58. }
  59. static int nft_meta_bridge_get_init(const struct nft_ctx *ctx,
  60. const struct nft_expr *expr,
  61. const struct nlattr * const tb[])
  62. {
  63. struct nft_meta *priv = nft_expr_priv(expr);
  64. unsigned int len;
  65. priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
  66. switch (priv->key) {
  67. case NFT_META_BRI_IIFNAME:
  68. case NFT_META_BRI_OIFNAME:
  69. len = IFNAMSIZ;
  70. break;
  71. case NFT_META_BRI_IIFPVID:
  72. case NFT_META_BRI_IIFVPROTO:
  73. len = sizeof(u16);
  74. break;
  75. default:
  76. return nft_meta_get_init(ctx, expr, tb);
  77. }
  78. priv->dreg = nft_parse_register(tb[NFTA_META_DREG]);
  79. return nft_validate_register_store(ctx, priv->dreg, NULL,
  80. NFT_DATA_VALUE, len);
  81. }
  82. static struct nft_expr_type nft_meta_bridge_type;
  83. static const struct nft_expr_ops nft_meta_bridge_get_ops = {
  84. .type = &nft_meta_bridge_type,
  85. .size = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
  86. .eval = nft_meta_bridge_get_eval,
  87. .init = nft_meta_bridge_get_init,
  88. .dump = nft_meta_get_dump,
  89. };
  90. static const struct nft_expr_ops nft_meta_bridge_set_ops = {
  91. .type = &nft_meta_bridge_type,
  92. .size = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
  93. .eval = nft_meta_set_eval,
  94. .init = nft_meta_set_init,
  95. .destroy = nft_meta_set_destroy,
  96. .dump = nft_meta_set_dump,
  97. .validate = nft_meta_set_validate,
  98. };
  99. static const struct nft_expr_ops *
  100. nft_meta_bridge_select_ops(const struct nft_ctx *ctx,
  101. const struct nlattr * const tb[])
  102. {
  103. if (tb[NFTA_META_KEY] == NULL)
  104. return ERR_PTR(-EINVAL);
  105. if (tb[NFTA_META_DREG] && tb[NFTA_META_SREG])
  106. return ERR_PTR(-EINVAL);
  107. if (tb[NFTA_META_DREG])
  108. return &nft_meta_bridge_get_ops;
  109. if (tb[NFTA_META_SREG])
  110. return &nft_meta_bridge_set_ops;
  111. return ERR_PTR(-EINVAL);
  112. }
  113. static struct nft_expr_type nft_meta_bridge_type __read_mostly = {
  114. .family = NFPROTO_BRIDGE,
  115. .name = "meta",
  116. .select_ops = nft_meta_bridge_select_ops,
  117. .policy = nft_meta_policy,
  118. .maxattr = NFTA_META_MAX,
  119. .owner = THIS_MODULE,
  120. };
  121. static int __init nft_meta_bridge_module_init(void)
  122. {
  123. return nft_register_expr(&nft_meta_bridge_type);
  124. }
  125. static void __exit nft_meta_bridge_module_exit(void)
  126. {
  127. nft_unregister_expr(&nft_meta_bridge_type);
  128. }
  129. module_init(nft_meta_bridge_module_init);
  130. module_exit(nft_meta_bridge_module_exit);
  131. MODULE_LICENSE("GPL");
  132. MODULE_AUTHOR("wenxu <wenxu@ucloud.cn>");
  133. MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "meta");
  134. MODULE_DESCRIPTION("Support for bridge dedicated meta key");