netfilter: nf_tables: add devgroup support in meta expresion

Add devgroup support to let us match device group of a packets incoming or outgoing interface.

Ana Rey committed 12 years ago

Commit 3045d761 parent ce24b722 files · +16 −0Browse files

Unified · Split

2 files

@@ -573,6 +573,8 @@ enum nft_exthdr_attributes { · 572 unmodified lines
573	573	* @NFT_META_BRI_OIFNAME: packet output bridge interface name
574	574	* @NFT_META_PKTTYPE: packet type (skb->pkt_type), special handling for loopback
575	575	* @NFT_META_CPU: cpu id through smp_processor_id()
	576	+ * @NFT_META_IIFGROUP: packet input interface group
	577	+ * @NFT_META_OIFGROUP: packet output interface group
576	578	*/
577	579	enum nft_meta_keys {
578	580	NFT_META_LEN,
@@ -596,6 +598,8 @@ enum nft_meta_keys { · 17 unmodified lines
596	598	NFT_META_BRI_OIFNAME,
597	599	NFT_META_PKTTYPE,
598	600	NFT_META_CPU,
	601	+ NFT_META_IIFGROUP,
	602	+ NFT_META_OIFGROUP,
599	603	};
600	604
601	605	/**

@@ -155,6 +155,16 @@ void nft_meta_get_eval(const struct nft_expr *expr, · 154 unmodified lines
155	155	case NFT_META_CPU:
156	156	dest->data[0] = smp_processor_id();
157	157	break;
	158	+ case NFT_META_IIFGROUP:
	159	+ if (in == NULL)
	160	+ goto err;
	161	+ dest->data[0] = in->group;
	162	+ break;
	163	+ case NFT_META_OIFGROUP:
	164	+ if (out == NULL)
	165	+ goto err;
	166	+ dest->data[0] = out->group;
	167	+ break;
158	168	default:
159	169	WARN_ON(1);
160	170	goto err;
@@ -228,6 +238,8 @@ int nft_meta_get_init(const struct nft_ctx *ctx, · 67 unmodified lines
228	238	#endif
229	239	case NFT_META_PKTTYPE:
230	240	case NFT_META_CPU:
	241	+ case NFT_META_IIFGROUP:
	242	+ case NFT_META_OIFGROUP:
231	243	break;
232	244	default:
233	245	return -EOPNOTSUPP;