On Wed, Jun 19, 2019 at 03:16:25PM +0800, wenxu@xxxxxxxxx wrote:
> From: wenxu <wenxu@xxxxxxxxx>
>
> nft add table bridge firewall
> nft add chain bridge firewall zones { type filter hook prerouting priority - 300 \; }
> nft add rule bridge firewall zones counter ct zone set vlan id map { 100 : 1, 200 : 2 }
>
> As above set the bridge port with pvid, the received packet don't contain
> the vlan tag which means the packet should belong to vlan 200 through pvid.
> With this pacth user can set the pvid in the prerouting hook before set zone
> id and conntrack: "meta brvlan set meta brpvid"
A real ruleset explaining how you use this would help in the commit
message would help. I also would like to see the patch for nftables.
> Signed-off-by: wenxu <wenxu@xxxxxxxxx>
> ---
> include/uapi/linux/netfilter/nf_tables.h | 2 ++
> net/netfilter/nft_meta.c | 20 ++++++++++++++++++++
> 2 files changed, 22 insertions(+)
>
> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> index 4a16124..7be0307 100644
> --- a/include/uapi/linux/netfilter/nf_tables.h
> +++ b/include/uapi/linux/netfilter/nf_tables.h
> @@ -794,6 +794,7 @@ enum nft_exthdr_attributes {
> * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
> * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
> * @NFT_META_BRI_PVID: packet input bridge port pvid
> + * @NFT_META_BRI_VLAN: set vlan tag on packet
> */
> enum nft_meta_keys {
> NFT_META_LEN,
> @@ -825,6 +826,7 @@ enum nft_meta_keys {
> NFT_META_IIFKIND,
> NFT_META_OIFKIND,
> NFT_META_BRI_PVID,
> + NFT_META_BRI_VLAN,
> };
>
> /**
> diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
> index 1fdb565..5c3817b 100644
> --- a/net/netfilter/nft_meta.c
> +++ b/net/netfilter/nft_meta.c
> @@ -282,8 +282,13 @@ static void nft_meta_set_eval(const struct nft_expr *expr,
> {
> const struct nft_meta *meta = nft_expr_priv(expr);
> struct sk_buff *skb = pkt->skb;
> + const struct net_device *in = nft_in(pkt);
> u32 *sreg = ®s->data[meta->sreg];
> +#ifdef CONFIG_NF_TABLES_BRIDGE
> + const struct net_bridge_port *p;
> +#endif
> u32 value = *sreg;
> + u16 value16;
> u8 value8;
>
> switch (meta->key) {
> @@ -306,6 +311,14 @@ static void nft_meta_set_eval(const struct nft_expr *expr,
>
> skb->nf_trace = !!value8;
> break;
> +#ifdef CONFIG_NF_TABLES_BRIDGE
> + case NFT_META_BRI_VLAN:
> + value16 = nft_reg_load16(sreg);
> + if (in && (p = br_port_get_rtnl_rcu(in)) &&
> + !skb_vlan_tag_present(skb))
Why does this skip if there is a vlan tag?
I guess it should be possible to update an existing vlan tag?
Thanks.
