diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-10-13 12:35:47 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-10-13 16:49:07 +0200 |
commit | b4775dec9f80b74c522edec8ebb4af5092e0e82b (patch) | |
tree | 89131c377e3a9b137931b6663847ae06d19bc668 | |
parent | 4eb71b2fe5ca0b65cbe47b4a33cefe4c7862e018 (diff) |
src: ingress inet support
Add support for inet ingress chains.
table inet filter {
chain ingress {
type filter hook ingress device "veth0" priority filter; policy accept;
}
chain input {
type filter hook input priority filter; policy accept;
}
chain forward {
type filter hook forward priority filter; policy accept;
}
}
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r-- | include/linux/netfilter.h | 1 | ||||
-rw-r--r-- | src/evaluate.c | 8 | ||||
-rw-r--r-- | src/rule.c | 2 | ||||
-rwxr-xr-x | tests/shell/testcases/chains/0043chain_ingress_0 | 18 | ||||
-rw-r--r-- | tests/shell/testcases/chains/dumps/0043chain_ingress.nft | 11 |
5 files changed, 38 insertions, 2 deletions
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index 18075f95..feb6287c 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -48,6 +48,7 @@ enum nf_inet_hooks { NF_INET_FORWARD, NF_INET_LOCAL_OUT, NF_INET_POST_ROUTING, + NF_INET_INGRESS, NF_INET_NUMHOOKS }; diff --git a/src/evaluate.c b/src/evaluate.c index 5f17d750..abbf83ae 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -3965,10 +3965,12 @@ static uint32_t str2hooknum(uint32_t family, const char *hook) return NF_INET_NUMHOOKS; switch (family) { + case NFPROTO_INET: + if (!strcmp(hook, "ingress")) + return NF_INET_INGRESS; case NFPROTO_IPV4: case NFPROTO_BRIDGE: case NFPROTO_IPV6: - case NFPROTO_INET: /* These families have overlapping values for each hook */ if (!strcmp(hook, "prerouting")) return NF_INET_PRE_ROUTING; @@ -4042,7 +4044,9 @@ static int chain_evaluate(struct eval_ctx *ctx, struct chain *chain) expr_name(chain->policy)); } - if (chain->handle.family == NFPROTO_NETDEV) { + if (chain->handle.family == NFPROTO_NETDEV || + (chain->handle.family == NFPROTO_INET && + chain->hook.num == NF_INET_INGRESS)) { if (!chain->dev_expr) return __stmt_binary_error(ctx, &chain->loc, NULL, "Missing `device' in this chain definition"); @@ -1019,6 +1019,8 @@ const char *hooknum2str(unsigned int family, unsigned int hooknum) return "postrouting"; case NF_INET_LOCAL_OUT: return "output"; + case NF_INET_INGRESS: + return "ingress"; default: break; }; diff --git a/tests/shell/testcases/chains/0043chain_ingress_0 b/tests/shell/testcases/chains/0043chain_ingress_0 new file mode 100755 index 00000000..86dc075d --- /dev/null +++ b/tests/shell/testcases/chains/0043chain_ingress_0 @@ -0,0 +1,18 @@ +#!/bin/bash + +set -e + +RULESET="table inet filter { + chain ingress { + type filter hook ingress device \"lo\" priority filter; policy accept; + } + chain input { + type filter hook input priority filter; policy accept; + } + chain forward { + type filter hook forward priority filter; policy accept; + } +}" + +$NFT -f - <<< "$RULESET" && exit 0 +exit 1 diff --git a/tests/shell/testcases/chains/dumps/0043chain_ingress.nft b/tests/shell/testcases/chains/dumps/0043chain_ingress.nft new file mode 100644 index 00000000..74670423 --- /dev/null +++ b/tests/shell/testcases/chains/dumps/0043chain_ingress.nft @@ -0,0 +1,11 @@ +table inet filter { + chain ingress { + type filter hook ingress device \"lo\" priority filter; policy accept; + } + chain input { + type filter hook input priority filter; policy accept; + } + chain forward { + type filter hook forward priority filter; policy accept; + } +} |