History

netfilter: nf_tables: allow to bind table to net_device

This patch adds the internal NFT_AF_NEEDS_DEV flag to indicate that you must attach this table to a net_device. This change is required by the follow up patch that introduces the new netdev table.

Pablo Neira Ayuso committed 11 years ago

Commit ebddf1a1 parent 529985d3 files · +51 −5Browse files

Unified · Split

3 files
  1. include/net/netfilter/nf_tables.h +8 −0
  2. include/uapi/linux/netfilter/nf_tables.h +2 −0
  3. net/netfilter/nf_tables_api.c +41 −5
include/net/netfilter/nf_tables.h+8−0
@@ -819,6 +819,7 @@ unsigned int nft_do_chain(struct nft_pktinfo *pkt, · 818 unmodified lines
819 * @use: number of chain references to this table819 * @use: number of chain references to this table
820 * @flags: table flag (see enum nft_table_flags)820 * @flags: table flag (see enum nft_table_flags)
821 * @name: name of the table821 * @name: name of the table
822 * @dev: this table is bound to this device (if any)
822 */823 */
823struct nft_table {824struct nft_table {
824 struct list_head list;825 struct list_head list;
@@ -828,6 +829,11 @@ struct nft_table { · 3 unmodified lines
828 u32 use;829 u32 use;
829 u16 flags;830 u16 flags;
830 char name[NFT_TABLE_MAXNAMELEN];831 char name[NFT_TABLE_MAXNAMELEN];
832 struct net_device *dev;
833};
834
835enum nft_af_flags {
836 NFT_AF_NEEDS_DEV = (1 << 0),
831};837};
832 838
833/**839/**
@@ -838,6 +844,7 @@ struct nft_table { · 4 unmodified lines
838 * @nhooks: number of hooks in this family844 * @nhooks: number of hooks in this family
839 * @owner: module owner845 * @owner: module owner
840 * @tables: used internally846 * @tables: used internally
847 * @flags: family flags
841 * @nops: number of hook ops in this family848 * @nops: number of hook ops in this family
842 * @hook_ops_init: initialization function for chain hook ops849 * @hook_ops_init: initialization function for chain hook ops
843 * @hooks: hookfn overrides for packet validation850 * @hooks: hookfn overrides for packet validation
@@ -848,6 +855,7 @@ struct nft_af_info { · 4 unmodified lines
848 unsigned int nhooks;855 unsigned int nhooks;
849 struct module *owner;856 struct module *owner;
850 struct list_head tables;857 struct list_head tables;
858 u32 flags;
851 unsigned int nops;859 unsigned int nops;
852 void (*hook_ops_init)(struct nf_hook_ops *,860 void (*hook_ops_init)(struct nf_hook_ops *,
853 unsigned int);861 unsigned int);
include/uapi/linux/netfilter/nf_tables.h+2−0
@@ -146,12 +146,14 @@ enum nft_table_flags { · 145 unmodified lines
146 * @NFTA_TABLE_NAME: name of the table (NLA_STRING)146 * @NFTA_TABLE_NAME: name of the table (NLA_STRING)
147 * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32)147 * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32)
148 * @NFTA_TABLE_USE: number of chains in this table (NLA_U32)148 * @NFTA_TABLE_USE: number of chains in this table (NLA_U32)
149 * @NFTA_TABLE_DEV: net device name (NLA_STRING)
149 */150 */
150enum nft_table_attributes {151enum nft_table_attributes {
151 NFTA_TABLE_UNSPEC,152 NFTA_TABLE_UNSPEC,
152 NFTA_TABLE_NAME,153 NFTA_TABLE_NAME,
153 NFTA_TABLE_FLAGS,154 NFTA_TABLE_FLAGS,
154 NFTA_TABLE_USE,155 NFTA_TABLE_USE,
156 NFTA_TABLE_DEV,
155 __NFTA_TABLE_MAX157 __NFTA_TABLE_MAX
156};158};
157#define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1)159#define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1)
net/netfilter/nf_tables_api.c+41−5
@@ -399,6 +399,8 @@ static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = { · 398 unmodified lines
399 [NFTA_TABLE_NAME] = { .type = NLA_STRING,399 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
400 .len = NFT_TABLE_MAXNAMELEN - 1 },400 .len = NFT_TABLE_MAXNAMELEN - 1 },
401 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },401 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
402 [NFTA_TABLE_DEV] = { .type = NLA_STRING,
403 .len = IFNAMSIZ - 1 },
402};404};
403 405
404static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,406static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
@@ -423,6 +425,10 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, · 18 unmodified lines
423 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)))425 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)))
424 goto nla_put_failure;426 goto nla_put_failure;
425 427
428 if (table->dev &&
429 nla_put_string(skb, NFTA_TABLE_DEV, table->dev->name))
430 goto nla_put_failure;
431
426 nlmsg_end(skb, nlh);432 nlmsg_end(skb, nlh);
427 return 0;433 return 0;
428 434
@@ -608,6 +614,11 @@ static int nf_tables_updtable(struct nft_ctx *ctx) · 179 unmodified lines
608 if (flags == ctx->table->flags)614 if (flags == ctx->table->flags)
609 return 0;615 return 0;
610 616
617 if ((ctx->afi->flags & NFT_AF_NEEDS_DEV) &&
618 ctx->nla[NFTA_TABLE_DEV] &&
619 nla_strcmp(ctx->nla[NFTA_TABLE_DEV], ctx->table->dev->name))
620 return -EOPNOTSUPP;
621
611 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,622 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
612 sizeof(struct nft_trans_table));623 sizeof(struct nft_trans_table));
613 if (trans == NULL)624 if (trans == NULL)
@@ -645,6 +656,7 @@ static int nf_tables_newtable(struct sock *nlsk, struct sk_buff *skb, · 31 unmodified lines
645 struct nft_table *table;656 struct nft_table *table;
646 struct net *net = sock_net(skb->sk);657 struct net *net = sock_net(skb->sk);
647 int family = nfmsg->nfgen_family;658 int family = nfmsg->nfgen_family;
659 struct net_device *dev = NULL;
648 u32 flags = 0;660 u32 flags = 0;
649 struct nft_ctx ctx;661 struct nft_ctx ctx;
650 int err;662 int err;
@@ -679,30 +691,50 @@ static int nf_tables_newtable(struct sock *nlsk, struct sk_buff *skb, · 28 unmodified lines
679 return -EINVAL;691 return -EINVAL;
680 }692 }
681 693
694 if (afi->flags & NFT_AF_NEEDS_DEV) {
695 char ifname[IFNAMSIZ];
696
697 if (!nla[NFTA_TABLE_DEV])
698 return -EOPNOTSUPP;
699
700 nla_strlcpy(ifname, nla[NFTA_TABLE_DEV], IFNAMSIZ);
701 dev = dev_get_by_name(net, ifname);
702 if (!dev)
703 return -ENOENT;
704 } else if (nla[NFTA_TABLE_DEV]) {
705 return -EOPNOTSUPP;
706 }
707
708 err = -EAFNOSUPPORT;
682 if (!try_module_get(afi->owner))709 if (!try_module_get(afi->owner))
683 return -EAFNOSUPPORT;710 goto err1;
684 711
685 err = -ENOMEM;712 err = -ENOMEM;
686 table = kzalloc(sizeof(*table), GFP_KERNEL);713 table = kzalloc(sizeof(*table), GFP_KERNEL);
687 if (table == NULL)714 if (table == NULL)
688 goto err1;715 goto err2;
689 716
690 nla_strlcpy(table->name, name, NFT_TABLE_MAXNAMELEN);717 nla_strlcpy(table->name, name, NFT_TABLE_MAXNAMELEN);
691 INIT_LIST_HEAD(&table->chains);718 INIT_LIST_HEAD(&table->chains);
692 INIT_LIST_HEAD(&table->sets);719 INIT_LIST_HEAD(&table->sets);
693 table->flags = flags;720 table->flags = flags;
721 table->dev = dev;
694 722
695 nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla);723 nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla);
696 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);724 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
697 if (err < 0)725 if (err < 0)
698 goto err2;726 goto err3;
699 727
700 list_add_tail_rcu(&table->list, &afi->tables);728 list_add_tail_rcu(&table->list, &afi->tables);
701 return 0;729 return 0;
702err2:730err3:
703 kfree(table);731 kfree(table);
704err1:732err2:
705 module_put(afi->owner);733 module_put(afi->owner);
734err1:
735 if (dev != NULL)
736 dev_put(dev);
737
706 return err;738 return err;
707}739}
708 740
@@ -806,6 +838,9 @@ static void nf_tables_table_destroy(struct nft_ctx *ctx) · 97 unmodified lines
806{838{
807 BUG_ON(ctx->table->use > 0);839 BUG_ON(ctx->table->use > 0);
808 840
841 if (ctx->table->dev)
842 dev_put(ctx->table->dev);
843
809 kfree(ctx->table);844 kfree(ctx->table);
810 module_put(ctx->afi->owner);845 module_put(ctx->afi->owner);
811}846}
@@ -1361,6 +1396,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb, · 549 unmodified lines
1361 ops->priority = priority;1396 ops->priority = priority;
1362 ops->priv = chain;1397 ops->priv = chain;
1363 ops->hook = afi->hooks[ops->hooknum];1398 ops->hook = afi->hooks[ops->hooknum];
1399 ops->dev = table->dev;
1364 if (hookfn)1400 if (hookfn)
1365 ops->hook = hookfn;1401 ops->hook = hookfn;
1366 if (afi->hook_ops_init)1402 if (afi->hook_ops_init)

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t