netfilter: nft_meta_bridge: introduce NFT_META_BRI_IIFHWADDR support

Expose the input bridge interface ethernet address so it can be used to
redirect the packet to the receiving physical device for processing.

Tested with nft command line tool.

table bridge nat {
	chain PREROUTING {
		type filter hook prerouting priority 0; policy accept;
		ether daddr de:ad:00:00:be:ef meta pkttype set host ether daddr set meta ibrhwdr accept
	}
}

Joint work with Pablo Neira.

Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 8e0eb832bc01ec2541eba004a94a3741c538666e..7c0c915f030688e5b652e8ab66e072c256813c0e 100644 (file)
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -959,6 +959,7 @@ enum nft_exthdr_attributes {
  * @NFT_META_SDIF: slave device interface index
  * @NFT_META_SDIFNAME: slave device interface name
  * @NFT_META_BRI_BROUTE: packet br_netfilter_broute bit
+ * @NFT_META_BRI_IIFHWADDR: packet input bridge interface ethernet address
  */
 enum nft_meta_keys {
        NFT_META_LEN,
@@ -999,6 +1000,7 @@ enum nft_meta_keys {
        NFT_META_SDIFNAME,
        NFT_META_BRI_BROUTE,
        __NFT_META_IIFTYPE,
+       NFT_META_BRI_IIFHWADDR,
 };
 
 /**

diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c
index 5adced1e7d0c7eda5c193609c2da5da6a9d4d0cf..b7af36bbd30664eb1313c5266c0479751674e254 100644 (file)
--- a/net/bridge/netfilter/nft_meta_bridge.c
+++ b/net/bridge/netfilter/nft_meta_bridge.c
@@ -59,6 +59,13 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr,
                nft_reg_store_be16(dest, htons(p_proto));
                return;
        }
+       case NFT_META_BRI_IIFHWADDR:
+               br_dev = nft_meta_get_bridge(in);
+               if (!br_dev)
+                       goto err;
+
+               memcpy(dest, br_dev->dev_addr, ETH_ALEN);
+               return;
        default:
                return nft_meta_get_eval(expr, regs, pkt);
        }
@@ -86,6 +93,9 @@ static int nft_meta_bridge_get_init(const struct nft_ctx *ctx,
        case NFT_META_BRI_IIFVPROTO:
                len = sizeof(u16);
                break;
+       case NFT_META_BRI_IIFHWADDR:
+               len = ETH_ALEN;
+               break;
        default:
                return nft_meta_get_init(ctx, expr, tb);
        }
@@ -175,6 +185,7 @@ static int nft_meta_bridge_set_validate(const struct nft_ctx *ctx,
 
        switch (priv->key) {
        case NFT_META_BRI_BROUTE:
+       case NFT_META_BRI_IIFHWADDR:
                hooks = 1 << NF_BR_PRE_ROUTING;
                break;
        default: