netfilter: nft_meta: add NFT_META_IFTYPE

Generalize NFT_META_IIFTYPE to NFT_META_IFTYPE which allows you to match
on the interface type of the skb->dev field. This field is used by the
netdev family to add an implicit dependency to skip non-ethernet packets
when matching on layer 3 and 4 TCP/IP header fields.

For backward compatibility, add the NFT_META_IIFTYPE alias to
NFT_META_IFTYPE.

Add __NFT_META_IIFTYPE, to be used by userspace in the future to match
specifically on the iiftype.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index e94d1fa554cb224da089742468739b7f36f38395..08db4ee06ab6fccf42535927d479b9e06e0c37b4 100644 (file)
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -896,7 +896,8 @@ enum nft_meta_keys {
        NFT_META_OIF,
        NFT_META_IIFNAME,
        NFT_META_OIFNAME,
-       NFT_META_IIFTYPE,
+       NFT_META_IFTYPE,
+#define NFT_META_IIFTYPE       NFT_META_IFTYPE
        NFT_META_OIFTYPE,
        NFT_META_SKUID,
        NFT_META_SKGID,
@@ -923,6 +924,7 @@ enum nft_meta_keys {
        NFT_META_TIME_HOUR,
        NFT_META_SDIF,
        NFT_META_SDIFNAME,
+       __NFT_META_IIFTYPE,
 };
 
 /**

diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index a7e01e9952f17132140892f84799cd2effc2c48f..516e74635bae1dcad7276a5fa484639a9ff96a66 100644 (file)
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -244,7 +244,11 @@ static bool nft_meta_get_eval_ifname(enum nft_meta_keys key, u32 *dest,
        case NFT_META_OIF:
                nft_meta_store_ifindex(dest, nft_out(pkt));
                break;
-       case NFT_META_IIFTYPE:
+       case NFT_META_IFTYPE:
+               if (!nft_meta_store_iftype(dest, pkt->skb->dev))
+                       return false;
+               break;
+       case __NFT_META_IIFTYPE:
                if (!nft_meta_store_iftype(dest, nft_in(pkt)))
                        return false;
                break;