netfilter: nft_meta: add l4proto support

For L3-proto independant rules we need to get at the L4 protocol value
directly. Add it to the nft_pktinfo struct and use the meta expression
to retrieve it.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index f066f252e5e5f462013d253c0051de40184883c7..5d2b703efe1cf185ec3095449e5ab33b71bd8621 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -16,6 +16,7 @@ struct nft_pktinfo {
        const struct nf_hook_ops        *ops;
        u8                              nhoff;
        u8                              thoff;
+       u8                              tprot;
        /* for x_tables compatibility */
        struct xt_action_param          xt;
 };

diff --git a/include/net/netfilter/nf_tables_ipv4.h b/include/net/netfilter/nf_tables_ipv4.h
index f7b3a669aad30b440ef7657a3b3f7e9ddd4fe067..cba143fbd2e4fca9f5d0280dda035215ebd922fb 100644 (file)
--- a/include/net/netfilter/nf_tables_ipv4.h
+++ b/include/net/netfilter/nf_tables_ipv4.h
@@ -15,8 +15,9 @@ nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
 
        nft_set_pktinfo(pkt, ops, skb, in, out);
 
-       pkt->xt.thoff = ip_hdrlen(pkt->skb);
        ip = ip_hdr(pkt->skb);
+       pkt->tprot = ip->protocol;
+       pkt->xt.thoff = ip_hdrlen(pkt->skb);
        pkt->xt.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
 }
 

diff --git a/include/net/netfilter/nf_tables_ipv6.h b/include/net/netfilter/nf_tables_ipv6.h
index 3d8ae489be0dd00afd87bb4b1097ffb48efe6252..74d97613765801512e523bab6e40b6e2767d982d 100644 (file)
--- a/include/net/netfilter/nf_tables_ipv6.h
+++ b/include/net/netfilter/nf_tables_ipv6.h
@@ -21,6 +21,7 @@ nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
        if (protohdr < 0)
                return -1;
 
+       pkt->tprot = protohdr;
        pkt->xt.thoff = thoff;
        pkt->xt.fragoff = frag_off;
 

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 10afbfc0e66ad8ab230fdf90b4648accbccff03f..448593c071201f8025ab3d266d9c99901a9390b0 100644 (file)
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -532,6 +532,7 @@ enum nft_exthdr_attributes {
  * @NFT_META_RTCLASSID: realm value of packet's route (skb->dst->tclassid)
  * @NFT_META_SECMARK: packet secmark (skb->secmark)
  * @NFT_META_NFPROTO: netfilter protocol
+ * @NFT_META_L4PROTO: layer 4 protocol number
  */
 enum nft_meta_keys {
        NFT_META_LEN,
@@ -550,6 +551,7 @@ enum nft_meta_keys {
        NFT_META_RTCLASSID,
        NFT_META_SECMARK,
        NFT_META_NFPROTO,
+       NFT_META_L4PROTO,
 };
 
 /**

diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 999d04688433540541e22b6706c2ce39effb1a1c..b43975a43309597d23c9a5301b5c9e9fa2dd419f 100644 (file)
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -46,6 +46,9 @@ static void nft_meta_get_eval(const struct nft_expr *expr,
        case NFT_META_NFPROTO:
                dest->data[0] = pkt->ops->pf;
                break;
+       case NFT_META_L4PROTO:
+               dest->data[0] = pkt->tprot;
+               break;
        case NFT_META_PRIORITY:
                dest->data[0] = skb->priority;
                break;
@@ -185,6 +188,7 @@ static int nft_meta_init_validate_get(uint32_t key)
        case NFT_META_LEN:
        case NFT_META_PROTOCOL:
        case NFT_META_NFPROTO:
+       case NFT_META_L4PROTO:
        case NFT_META_PRIORITY:
        case NFT_META_MARK:
        case NFT_META_IIF: