Pablo Neira Ayuso says: ==================== Netfilter updates for net-next 1) Move struct nft_payload_set definition to .c file where it is only used. 2) Shrink transport and inner header offset fields in the nft_pktinfo structure to 16-bits, from Florian Westphal. 3) Get rid of nft_objref Kbuild toggle, make it built-in into nf_tables. This expression is used to instantiate conntrack helpers in nftables. After removing the conntrack helper auto-assignment toggle it this feature became more important so move it to the nf_tables core module. Also from Florian. 4) Extend the existing function to calculate payload inner header offset to deal with the GRE and IPIP transport protocols. 6) Add inner expression support for nf_tables. This new expression provides a packet parser for tunneled packets which uses a userspace description of the expected inner headers. The inner expression invokes the payload expression (via direct call) to match on the inner header protocol fields using the inner link, network and transport header offsets. An example of the bytecode generated from userspace to match on IP source encapsulated in a VxLAN packet: # nft --debug=netlink add rule netdev x y udp dport 4789 vxlan ip saddr 1.2.3.4 netdev x y [ meta load l4proto => reg 1 ] [ cmp eq reg 1 0x00000011 ] [ payload load 2b @ transport header + 2 => reg 1 ] [ cmp eq reg 1 0x0000b512 ] [ inner type vxlan hdrsize 8 flags f [ meta load protocol => reg 1 ] ] [ cmp eq reg 1 0x00000008 ] [ inner type vxlan hdrsize 8 flags f [ payload load 4b @ network header + 12 => reg 1 ] ] [ cmp eq reg 1 0x04030201 ] 7) Store inner link, network and transport header offsets in percpu area to parse inner packet header once only. Matching on a different tunnel type invalidates existing offsets in the percpu area and it invokes the inner tunnel parser again. 8) Add support for inner meta matching. This support for NFTA_META_PROTOCOL, which specifies the inner ethertype, and NFT_META_L4PROTO, which specifies the inner transport protocol. 9) Extend nft_inner to parse GENEVE optional fields to calculate the link layer offset. 10) Update inner expression so tunnel offset points to GRE header to normalize tunnel header handling. This also allows to perform different interpretations of the GRE header from userspace. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nft_inner: set tunnel offset to GRE header offset netfilter: nft_inner: add geneve support netfilter: nft_meta: add inner match support netfilter: nft_inner: add percpu inner context netfilter: nft_inner: support for inner tunnel header matching netfilter: nft_payload: access ipip payload for inner offset netfilter: nft_payload: access GRE payload via inner offset netfilter: nft_objref: make it builtin netfilter: nf_tables: reduce nft_pktinfo by 8 bytes netfilter: nft_payload: move struct nft_payload_set definition where it belongs ====================
Showing the changes to include/uapi (1 of 14 files). Show all
Unified · Split
| @@ -760,6 +760,7 @@ enum nft_payload_bases { · 759 unmodified lines | |||
| 760 | NFT_PAYLOAD_NETWORK_HEADER, | 760 | NFT_PAYLOAD_NETWORK_HEADER, |
| 761 | NFT_PAYLOAD_TRANSPORT_HEADER, | 761 | NFT_PAYLOAD_TRANSPORT_HEADER, |
| 762 | NFT_PAYLOAD_INNER_HEADER, | 762 | NFT_PAYLOAD_INNER_HEADER, |
| 763 | NFT_PAYLOAD_TUN_HEADER, | ||
| 763 | }; | 764 | }; |
| 764 | 765 | ||
| 765 | /** | 766 | /** |
| @@ -779,6 +780,32 @@ enum nft_payload_csum_flags { · 13 unmodified lines | |||
| 779 | NFT_PAYLOAD_L4CSUM_PSEUDOHDR = (1 << 0), | 780 | NFT_PAYLOAD_L4CSUM_PSEUDOHDR = (1 << 0), |
| 780 | }; | 781 | }; |
| 781 | 782 | ||
| 783 | enum nft_inner_type { | ||
| 784 | NFT_INNER_UNSPEC = 0, | ||
| 785 | NFT_INNER_VXLAN, | ||
| 786 | NFT_INNER_GENEVE, | ||
| 787 | }; | ||
| 788 | |||
| 789 | enum nft_inner_flags { | ||
| 790 | NFT_INNER_HDRSIZE = (1 << 0), | ||
| 791 | NFT_INNER_LL = (1 << 1), | ||
| 792 | NFT_INNER_NH = (1 << 2), | ||
| 793 | NFT_INNER_TH = (1 << 3), | ||
| 794 | }; | ||
| 795 | #define NFT_INNER_MASK (NFT_INNER_HDRSIZE | NFT_INNER_LL | \ | ||
| 796 | NFT_INNER_NH | NFT_INNER_TH) | ||
| 797 | |||
| 798 | enum nft_inner_attributes { | ||
| 799 | NFTA_INNER_UNSPEC, | ||
| 800 | NFTA_INNER_NUM, | ||
| 801 | NFTA_INNER_TYPE, | ||
| 802 | NFTA_INNER_FLAGS, | ||
| 803 | NFTA_INNER_HDRSIZE, | ||
| 804 | NFTA_INNER_EXPR, | ||
| 805 | __NFTA_INNER_MAX | ||
| 806 | }; | ||
| 807 | #define NFTA_INNER_MAX (__NFTA_INNER_MAX - 1) | ||
| 808 | |||
| 782 | /** | 809 | /** |
| 783 | * enum nft_payload_attributes - nf_tables payload expression netlink attributes | 810 | * enum nft_payload_attributes - nf_tables payload expression netlink attributes |
| 784 | * | 811 | * |