On Sat, Mar 26, 2016 at 08:42:12AM +0100, Stephane Bryant wrote:
> This makes nf queues use NFQA_VLAN and NFQA_L2HDR in verdict to modify the
> original skb
Applied this too, thanks. Just one minor glitch.
> Signed-off-by: Stephane Bryant <stephane.ml.bryant@xxxxxxxxx>
> ---
> net/netfilter/nfnetlink_queue.c | 45 +++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 45 insertions(+)
>
> diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
> index 6451f5d..a7ad25a 100644
> --- a/net/netfilter/nfnetlink_queue.c
> +++ b/net/netfilter/nfnetlink_queue.c
> @@ -967,12 +967,18 @@ static struct notifier_block nfqnl_rtnl_notifier = {
> .notifier_call = nfqnl_rcv_nl_event,
> };
>
> +static const struct nla_policy nfqa_vlan_policy[NFQA_VLAN_MAX + 1] = {
> + [NFQA_VLAN_TCI] = { .type = NLA_U16},
> + [NFQA_VLAN_PROTO] = { .type = NLA_U16},
> +};
> +
> static const struct nla_policy nfqa_verdict_policy[NFQA_MAX+1] = {
> [NFQA_VERDICT_HDR] = { .len = sizeof(struct nfqnl_msg_verdict_hdr) },
> [NFQA_MARK] = { .type = NLA_U32 },
> [NFQA_PAYLOAD] = { .type = NLA_UNSPEC },
> [NFQA_CT] = { .type = NLA_UNSPEC },
> [NFQA_EXP] = { .type = NLA_UNSPEC },
> + [NFQA_VLAN] = { .type = NLA_NESTED },
> };
>
> static const struct nla_policy nfqa_verdict_batch_policy[NFQA_MAX+1] = {
> @@ -1086,6 +1092,40 @@ static struct nf_conn *nfqnl_ct_parse(struct nfnl_ct_hook *nfnl_ct,
> return ct;
> }
>
> +static int nfqa_parse_bridge(struct nf_queue_entry *entry,
> + const struct nlattr * const nfqa[])
> +{
> + if (nfqa[NFQA_VLAN]) {
> + int err;
> + struct nlattr *tb[NFQA_VLAN_MAX + 1];
> +
> + err = nla_parse_nested(tb, NFQA_VLAN_MAX, nfqa[NFQA_VLAN],
> + nfqa_vlan_policy);
> + if (err < 0)
> + return err;
> +
> + if (!tb[NFQA_VLAN_TCI] || !tb[NFQA_VLAN_PROTO])
> + return -EINVAL;
> +
> + entry->skb->vlan_tci = ntohs(nla_get_be16(tb[NFQA_VLAN_TCI]));
> + entry->skb->vlan_proto = nla_get_be16(tb[NFQA_VLAN_PROTO]);
> + }
> +
> + if (nfqa[NFQA_L2HDR]) {
> + int mac_header_len = entry->skb->network_header -
> + entry->skb->mac_header;
> +
> + if (mac_header_len != nla_len(nfqa[NFQA_L2HDR]))
> + return -EINVAL;
> + else if (mac_header_len > 0)
> + memcpy(skb_mac_header(entry->skb),
> + nla_data(nfqa[NFQA_L2HDR]),
> + mac_header_len);
> + }
> +
> + return 0;
> +}
> +
> static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
> struct sk_buff *skb,
> const struct nlmsghdr *nlh,
> @@ -1127,6 +1167,11 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
> ct = nfqnl_ct_parse(nfnl_ct, nlh, nfqa, entry, &ctinfo);
> }
>
> + if (entry->state.pf == PF_BRIDGE) {
> + if (nfqa_parse_bridge(entry, nfqa) < 0)
> + verdict = NF_DROP;
I have changed this to return -EINVAL instead, so userspace knows that
what it is doing is wrong.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
