Hi, This patchset add connection tracking support for the bridge family. Patches from 1 to 6 split the existing refragmentation codebase into smaller functions that allows us to build specific refragmentation routine for the bridge, motivations for this are: * ip_do_fragment() assumes the skbuff is called from IP stack, hence the control buffer area is assumed to have an IP_CB layout, this forces to save and restore this area. * ip_do_fragment() assumes that a dst entry is attached to the skbuff which is not the case from the bridge codebase. This would force us to emulate a dst object. * ip_do_fragment() alters fragmentation geometry to make it fit into the mtu. From the bridge, it is desiderable to leave geometry untouched, simply drop packets if the maximum fragment size is larger than the mtu. There are a few exceptions in this patchset though, such as linearized skbuff (coming from conntrack helpers doing so) where geometry is lost for us, and for cloned skbuffs, either due to port flood or passed up for tap delivery. For both cases, it should be possible with a more code and the cost of introducing more complexity. These initial patches extract code from the existing refragmentation infrastructure that can be re-used to build a custom refragmentation routine that deals with the bridge specificities. This batch is composed of the following patches: * Patches 1/10 and 2/10 add the fraglist iterator. This infrastructure extracts the code from ip_do_fragment() to split a fraglist into fragments, then call the output callback for each fragmented skbuff. The API consists of ip_fraglist_init() to start the iterator internal state, then ip_fraglist_prepare() to restore restore the IPv4 header in the fragment and, finally, ip_fraglist_next() to obtain the fragmented skbuff from the fraglist. Similar API is introduced for IPv6. * Patches 3/10 and 4/10 add the fragment transformer. This infrastructure extracts the code from ip_do_fragment() to split a linearized skbuff into fragmented skbuffs. This is also useful for the skbuff clone case, needed in case of floods to multiple bridge ports or when passing packets to the tap (ie. tcpdump), so this transformer can also deal with fraglists. The API consists of ip6_frag_init() to start the internal state of the transformer and ip6_frag_next() to build and fetch a fragment. * Patches 5/10 and 6/10 move the IPCB specific code away from these two new APIs, so it can be used from the bridge without saving and restoring the control buffer area. After preparation patches, this batch adds the conntrack support for the bridge family: * Patch 7/10 adds infrastructure to register and to unregister the nf_conntrack_bridge module via nf_ct_bridge_register() and nf_ct_bridge_unregister(). This allows us to transparently reuse the ct extension to match on the ct state without changes. * Patch 8/10 adds IPv4 conntrack support for bridge. This add the nf_conntrack_bridge module which registers two hooks, one at bridge prerouting and another at bridge postrouting. For traffic that is being forwarded, a conntrack entry is created at bridge prerouting and confirmed at bridge postrouting. ARP packets are explicitly untracked. We also follow the "do not drop packets from conntrack", as invalid packets can be just dropped via policy. * Patch 9/10 adds IPv6 support for conntrack bridge. * Patch 10/10 enables classic IPv4/IPv6 conntrack to deal with local traffic, ie. when the bridge interface has an IP address, hence packets are passed up to the IP stack for local handling are confirmed by the classic IPv4/IPv6 conntrack hooks. This allows users to define stateful filtering policies from the bridge prerouting chain. For outgoing traffic, the recommended solution is to define the stateful policy from the classic IPv4/IPv6 output hooks. Users can map different vlans to conntrack zones to avoid conflicts with overlapping conntrack entries via ruleset policy. Please, apply, thanks! Pablo Neira Ayuso (10): net: ipv4: add skbuff fraglist split iterator net: ipv6: add skbuff fraglist split iterator net: ipv4: split skbuff into fragments transformer net: ipv6: split skbuff into fragments transformer net: ipv4: place cb handling away from fraglist iterator net: ipv4: place cb handling away from fragment transformer netfilter: nf_conntrack: allow to register bridge support netfilter: bridge: add support for conntrack support netfilter: nf_conntrack_bridge: add support for IPv6 netfilter: nf_conntrack_bridge: register inet conntrack for bridge include/linux/netfilter_ipv6.h | 50 ++++ include/net/ip.h | 39 +++ include/net/ipv6.h | 44 +++ include/net/netfilter/nf_conntrack.h | 1 + include/net/netfilter/nf_conntrack_bridge.h | 20 ++ include/net/netfilter/nf_conntrack_core.h | 3 + net/bridge/br_device.c | 1 + net/bridge/br_private.h | 1 + net/bridge/netfilter/Kconfig | 14 + net/bridge/netfilter/Makefile | 3 + net/bridge/netfilter/nf_conntrack_bridge.c | 433 ++++++++++++++++++++++++++++ net/ipv4/ip_output.c | 309 ++++++++++++-------- net/ipv6/ip6_output.c | 315 +++++++++++--------- net/ipv6/netfilter.c | 123 ++++++++ net/netfilter/nf_conntrack_proto.c | 126 ++++++-- 15 files changed, 1206 insertions(+), 276 deletions(-) create mode 100644 include/net/netfilter/nf_conntrack_bridge.h create mode 100644 net/bridge/netfilter/nf_conntrack_bridge.c -- 2.11.0
