Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9370761c authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: convert built-in tables/chains to chain types 



This patch converts built-in tables/chains to chain types that
allows you to deploy customized table and chain configurations from
userspace.

After this patch, you have to specify the chain type when
creating a new chain:

 add chain ip filter output { type filter hook input priority 0; }
                              ^^^^ ------

The existing chain types after this patch are: filter, route and
nat. Note that tables are just containers of chains with no specific
semantics, which is a significant change with regards to iptables.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent c29b72e0

include/net/netfilter/nf_tables.h

+22 −9
Original line number Diff line number Diff line
@@ -336,7 +336,6 @@ static inline struct nft_expr *nft_expr_last(const struct nft_rule *rule) 


enum nft_chain_flags {

	NFT_BASE_CHAIN			= 0x1,

	NFT_CHAIN_BUILTIN		= 0x2,

};



/**
@@ -362,14 +361,23 @@ struct nft_chain { 
	char				name[NFT_CHAIN_MAXNAMELEN];

};



enum nft_chain_type {

	NFT_CHAIN_T_DEFAULT = 0,

	NFT_CHAIN_T_ROUTE,

	NFT_CHAIN_T_NAT,

	NFT_CHAIN_T_MAX

};



/**

 *	struct nft_base_chain - nf_tables base chain

 *

 *	@ops: netfilter hook ops

 *	@type: chain type

 *	@chain: the chain

 */

struct nft_base_chain {

	struct nf_hook_ops		ops;

	enum nft_chain_type		type;

	struct nft_chain		chain;

};
@@ -384,10 +392,6 @@ extern unsigned int nft_do_chain(const struct nf_hook_ops *ops, 
				 const struct net_device *out,

				 int (*okfn)(struct sk_buff *));



enum nft_table_flags {

	NFT_TABLE_BUILTIN		= 0x1,

};



/**

 *	struct nft_table - nf_tables table

 *
@@ -431,8 +435,17 @@ struct nft_af_info { 
extern int nft_register_afinfo(struct nft_af_info *);

extern void nft_unregister_afinfo(struct nft_af_info *);



extern int nft_register_table(struct nft_table *, int family);

extern void nft_unregister_table(struct nft_table *, int family);

struct nf_chain_type {

	unsigned int		hook_mask;

	const char		*name;

	enum nft_chain_type	type;

	nf_hookfn		*fn[NF_MAX_HOOKS];

	struct module		*me;

	int			family;

};



extern int nft_register_chain_type(struct nf_chain_type *);

extern void nft_unregister_chain_type(struct nf_chain_type *);



extern int nft_register_expr(struct nft_expr_type *);

extern void nft_unregister_expr(struct nft_expr_type *);
@@ -440,8 +453,8 @@ extern void nft_unregister_expr(struct nft_expr_type *); 
#define MODULE_ALIAS_NFT_FAMILY(family)	\

	MODULE_ALIAS("nft-afinfo-" __stringify(family))



#define MODULE_ALIAS_NFT_TABLE(family, name) \

	MODULE_ALIAS("nft-table-" __stringify(family) "-" name)

#define MODULE_ALIAS_NFT_CHAIN(family, name) \

	MODULE_ALIAS("nft-chain-" __stringify(family) "-" name)



#define MODULE_ALIAS_NFT_EXPR(name) \

	MODULE_ALIAS("nft-expr-" name)

include/uapi/linux/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -115,6 +115,7 @@ enum nft_table_attributes { 
 * @NFTA_CHAIN_HANDLE: numeric handle of the chain (NLA_U64)

 * @NFTA_CHAIN_NAME: name of the chain (NLA_STRING)

 * @NFTA_CHAIN_HOOK: hook specification for basechains (NLA_NESTED: nft_hook_attributes)

 * @NFTA_CHAIN_TYPE: type name of the string (NLA_NUL_STRING)

 */

enum nft_chain_attributes {

	NFTA_CHAIN_UNSPEC,
@@ -122,6 +123,7 @@ enum nft_chain_attributes { 
	NFTA_CHAIN_HANDLE,

	NFTA_CHAIN_NAME,

	NFTA_CHAIN_HOOK,

	NFTA_CHAIN_TYPE,

	__NFTA_CHAIN_MAX

};

#define NFTA_CHAIN_MAX		(__NFTA_CHAIN_MAX - 1)

net/ipv4/netfilter/Kconfig

+4 −4
Original line number Diff line number Diff line
@@ -44,13 +44,13 @@ config NFT_REJECT_IPV4 
	depends on NF_TABLES_IPV4

	tristate "nf_tables IPv4 reject support"



config NF_TABLE_ROUTE_IPV4

config NFT_CHAIN_ROUTE_IPV4

	depends on NF_TABLES_IPV4

	tristate "IPv4 nf_tables route table support"

	tristate "IPv4 nf_tables route chain support"



config NF_TABLE_NAT_IPV4

config NFT_CHAIN_NAT_IPV4

	depends on NF_TABLES_IPV4

	tristate "IPv4 nf_tables nat table support"

	tristate "IPv4 nf_tables nat chain support"



config IP_NF_IPTABLES

	tristate "IP tables support (required for filtering/masq/NAT)"

net/ipv4/netfilter/Makefile

+2 −2
Original line number Diff line number Diff line
@@ -29,8 +29,8 @@ obj-$(CONFIG_NF_NAT_PROTO_GRE) += nf_nat_proto_gre.o 


obj-$(CONFIG_NF_TABLES_IPV4) += nf_tables_ipv4.o

obj-$(CONFIG_NFT_REJECT_IPV4) += nft_reject_ipv4.o

obj-$(CONFIG_NF_TABLE_ROUTE_IPV4) += nf_table_route_ipv4.o

obj-$(CONFIG_NF_TABLE_NAT_IPV4) += nf_table_nat_ipv4.o

obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV4) += nft_chain_route_ipv4.o

obj-$(CONFIG_NFT_CHAIN_NAT_IPV4) += nft_chain_nat_ipv4.o



# generic IP tables 

obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o

net/ipv4/netfilter/nf_tables_ipv4.c

+21 −0
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>

 * Copyright (c) 2012-2013 Pablo Neira Ayuso <pablo@netfilter.org>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as
@@ -41,14 +42,34 @@ static struct nft_af_info nft_af_ipv4 __read_mostly = { 
	},

};



static struct nf_chain_type filter_ipv4 = {

	.family		= NFPROTO_IPV4,

	.name		= "filter",

	.type		= NFT_CHAIN_T_DEFAULT,

	.hook_mask	= (1 << NF_INET_LOCAL_IN) |

			  (1 << NF_INET_LOCAL_OUT) |

			  (1 << NF_INET_FORWARD) |

			  (1 << NF_INET_PRE_ROUTING) |

			  (1 << NF_INET_POST_ROUTING),

	.fn		= {

		[NF_INET_LOCAL_IN]	= nft_do_chain,

		[NF_INET_LOCAL_OUT]	= nft_do_chain,

		[NF_INET_FORWARD]	= nft_do_chain,

		[NF_INET_PRE_ROUTING]	= nft_do_chain,

		[NF_INET_POST_ROUTING]	= nft_do_chain,

	},

};



static int __init nf_tables_ipv4_init(void)

{

	nft_register_chain_type(&filter_ipv4);

	return nft_register_afinfo(&nft_af_ipv4);

}



static void __exit nf_tables_ipv4_exit(void)

{

	nft_unregister_afinfo(&nft_af_ipv4);

	nft_unregister_chain_type(&filter_ipv4);

}



module_init(nf_tables_ipv4_init);