Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 39e6dea2 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: add forward expression to the netdev family 



You can use this to forward packets from ingress to the egress path of
the specified interface. This provides a fast path to bounce packets
from one interface to another specific destination interface.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 502061f8

include/uapi/linux/netfilter/nf_tables.h

+12 −0
Original line number Original line Diff line number Diff line
@@ -983,6 +983,18 @@ enum nft_dup_attributes { 
};

};

#define NFTA_DUP_MAX		(__NFTA_DUP_MAX - 1)

#define NFTA_DUP_MAX		(__NFTA_DUP_MAX - 1)





/**

 * enum nft_fwd_attributes - nf_tables fwd expression netlink attributes

 *

 * @NFTA_FWD_SREG_DEV: source register of output interface (NLA_U32: nft_register)

 */

enum nft_fwd_attributes {

	NFTA_FWD_UNSPEC,

	NFTA_FWD_SREG_DEV,

	__NFTA_FWD_MAX

};

#define NFTA_FWD_MAX	(__NFTA_FWD_MAX - 1)



/**

/**

 * enum nft_gen_attributes - nf_tables ruleset generation attributes

 * enum nft_gen_attributes - nf_tables ruleset generation attributes

 *

 *

net/netfilter/Kconfig

+6 −0
Original line number Original line Diff line number Diff line
@@ -577,6 +577,12 @@ config NFT_DUP_NETDEV 
	help

	help

	  This option enables packet duplication for the "netdev" family.

	  This option enables packet duplication for the "netdev" family.





config NFT_FWD_NETDEV

	tristate "Netfilter nf_tables netdev packet forwarding support"

	select NF_DUP_NETDEV

	help

	  This option enables packet forwarding for the "netdev" family.



endif # NF_TABLES_NETDEV

endif # NF_TABLES_NETDEV





endif # NF_TABLES

endif # NF_TABLES

net/netfilter/Makefile

+1 −0
Original line number Original line Diff line number Diff line
@@ -95,6 +95,7 @@ obj-$(CONFIG_NFT_REDIR) += nft_redir.o 




# nf_tables netdev

# nf_tables netdev

obj-$(CONFIG_NFT_DUP_NETDEV)	+= nft_dup_netdev.o

obj-$(CONFIG_NFT_DUP_NETDEV)	+= nft_dup_netdev.o

obj-$(CONFIG_NFT_FWD_NETDEV)	+= nft_fwd_netdev.o





# generic X tables 

# generic X tables 

obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o

obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o

net/netfilter/nft_fwd_netdev.c

0 → 100644
+98 −0
Original line number Original line Diff line number Diff line 
/*

 * Copyright (c) 2015 Pablo Neira Ayuso <pablo@netfilter.org>

 *

 * This program is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 as published by

 * the Free Software Foundation.

 */



#include <linux/kernel.h>

#include <linux/init.h>

#include <linux/module.h>

#include <linux/netlink.h>

#include <linux/netfilter.h>

#include <linux/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables.h>

#include <net/netfilter/nf_dup_netdev.h>



struct nft_fwd_netdev {

	enum nft_registers	sreg_dev:8;

};



static void nft_fwd_netdev_eval(const struct nft_expr *expr,

				struct nft_regs *regs,

				const struct nft_pktinfo *pkt)

{

	struct nft_fwd_netdev *priv = nft_expr_priv(expr);

	int oif = regs->data[priv->sreg_dev];



	nf_dup_netdev_egress(pkt, oif);

	regs->verdict.code = NF_DROP;

}



static const struct nla_policy nft_fwd_netdev_policy[NFTA_FWD_MAX + 1] = {

	[NFTA_FWD_SREG_DEV]	= { .type = NLA_U32 },

};



static int nft_fwd_netdev_init(const struct nft_ctx *ctx,

			       const struct nft_expr *expr,

			       const struct nlattr * const tb[])

{

	struct nft_fwd_netdev *priv = nft_expr_priv(expr);



	if (tb[NFTA_FWD_SREG_DEV] == NULL)

		return -EINVAL;



	priv->sreg_dev = nft_parse_register(tb[NFTA_FWD_SREG_DEV]);

	return nft_validate_register_load(priv->sreg_dev, sizeof(int));

}



static const struct nft_expr_ops nft_fwd_netdev_ingress_ops;



static int nft_fwd_netdev_dump(struct sk_buff *skb, const struct nft_expr *expr)

{

	struct nft_fwd_netdev *priv = nft_expr_priv(expr);



	if (nft_dump_register(skb, NFTA_FWD_SREG_DEV, priv->sreg_dev))

		goto nla_put_failure;



	return 0;



nla_put_failure:

	return -1;

}



static struct nft_expr_type nft_fwd_netdev_type;

static const struct nft_expr_ops nft_fwd_netdev_ops = {

	.type		= &nft_fwd_netdev_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_fwd_netdev)),

	.eval		= nft_fwd_netdev_eval,

	.init		= nft_fwd_netdev_init,

	.dump		= nft_fwd_netdev_dump,

};



static struct nft_expr_type nft_fwd_netdev_type __read_mostly = {

	.family		= NFPROTO_NETDEV,

	.name		= "fwd",

	.ops		= &nft_fwd_netdev_ops,

	.policy		= nft_fwd_netdev_policy,

	.maxattr	= NFTA_FWD_MAX,

	.owner		= THIS_MODULE,

};



static int __init nft_fwd_netdev_module_init(void)

{

	return nft_register_expr(&nft_fwd_netdev_type);

}



static void __exit nft_fwd_netdev_module_exit(void)

{

	nft_unregister_expr(&nft_fwd_netdev_type);

}



module_init(nft_fwd_netdev_module_init);

module_exit(nft_fwd_netdev_module_exit);



MODULE_LICENSE("GPL");

MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");

MODULE_ALIAS_NFT_AF_EXPR(5, "fwd");