Netfilter exposes standard hook priorities in case of ipv4, ipv6 and arp but not in case of bridge. This patch exposes the hook priority values of the bridge family (which are different from the formerly mentioned) via uapi so that they can be used by user-space applications just like the others.
Unified · Split
| @@ -5,17 +5,6 @@ · 4 unmodified lines | |||
| 5 | #include <uapi/linux/netfilter_bridge.h> | 5 | #include <uapi/linux/netfilter_bridge.h> |
| 6 | #include <linux/skbuff.h> | 6 | #include <linux/skbuff.h> |
| 7 | 7 | ||
| 8 | enum nf_br_hook_priorities { | ||
| 9 | NF_BR_PRI_FIRST = INT_MIN, | ||
| 10 | NF_BR_PRI_NAT_DST_BRIDGED = -300, | ||
| 11 | NF_BR_PRI_FILTER_BRIDGED = -200, | ||
| 12 | NF_BR_PRI_BRNF = 0, | ||
| 13 | NF_BR_PRI_NAT_DST_OTHER = 100, | ||
| 14 | NF_BR_PRI_FILTER_OTHER = 200, | ||
| 15 | NF_BR_PRI_NAT_SRC = 300, | ||
| 16 | NF_BR_PRI_LAST = INT_MAX, | ||
| 17 | }; | ||
| 18 | |||
| 19 | #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) | 8 | #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) |
| 20 | 9 | ||
| 21 | int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb); | 10 | int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb); |
| @@ -26,4 +26,15 @@ · 25 unmodified lines | |||
| 26 | #define NF_BR_BROUTING 5 | 26 | #define NF_BR_BROUTING 5 |
| 27 | #define NF_BR_NUMHOOKS 6 | 27 | #define NF_BR_NUMHOOKS 6 |
| 28 | 28 | ||
| 29 | enum nf_br_hook_priorities { | ||
| 30 | NF_BR_PRI_FIRST = INT_MIN, | ||
| 31 | NF_BR_PRI_NAT_DST_BRIDGED = -300, | ||
| 32 | NF_BR_PRI_FILTER_BRIDGED = -200, | ||
| 33 | NF_BR_PRI_BRNF = 0, | ||
| 34 | NF_BR_PRI_NAT_DST_OTHER = 100, | ||
| 35 | NF_BR_PRI_FILTER_OTHER = 200, | ||
| 36 | NF_BR_PRI_NAT_SRC = 300, | ||
| 37 | NF_BR_PRI_LAST = INT_MAX, | ||
| 38 | }; | ||
| 39 | |||
| 29 | #endif /* _UAPI__LINUX_BRIDGE_NETFILTER_H */ | 40 | #endif /* _UAPI__LINUX_BRIDGE_NETFILTER_H */ |
| @@ -26,6 +26,7 @@ · 25 unmodified lines | |||
| 26 | #include <linux/if_pppox.h> | 26 | #include <linux/if_pppox.h> |
| 27 | #include <linux/ppp_defs.h> | 27 | #include <linux/ppp_defs.h> |
| 28 | #include <linux/netfilter_bridge.h> | 28 | #include <linux/netfilter_bridge.h> |
| 29 | #include <uapi/linux/netfilter_bridge.h> | ||
| 29 | #include <linux/netfilter_ipv4.h> | 30 | #include <linux/netfilter_ipv4.h> |
| 30 | #include <linux/netfilter_ipv6.h> | 31 | #include <linux/netfilter_ipv6.h> |
| 31 | #include <linux/netfilter_arp.h> | 32 | #include <linux/netfilter_arp.h> |
| @@ -9,6 +9,7 @@ · 8 unmodified lines | |||
| 9 | */ | 9 | */ |
| 10 | 10 | ||
| 11 | #include <linux/netfilter_bridge/ebtables.h> | 11 | #include <linux/netfilter_bridge/ebtables.h> |
| 12 | #include <uapi/linux/netfilter_bridge.h> | ||
| 12 | #include <linux/module.h> | 13 | #include <linux/module.h> |
| 13 | 14 | ||
| 14 | #define FILTER_VALID_HOOKS ((1 << NF_BR_LOCAL_IN) | (1 << NF_BR_FORWARD) | \ | 15 | #define FILTER_VALID_HOOKS ((1 << NF_BR_LOCAL_IN) | (1 << NF_BR_FORWARD) | \ |
| @@ -9,6 +9,7 @@ · 8 unmodified lines | |||
| 9 | */ | 9 | */ |
| 10 | 10 | ||
| 11 | #include <linux/netfilter_bridge/ebtables.h> | 11 | #include <linux/netfilter_bridge/ebtables.h> |
| 12 | #include <uapi/linux/netfilter_bridge.h> | ||
| 12 | #include <linux/module.h> | 13 | #include <linux/module.h> |
| 13 | 14 | ||
| 14 | #define NAT_VALID_HOOKS ((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT) | \ | 15 | #define NAT_VALID_HOOKS ((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT) | \ |