netfilter: nf_tables: support for multiple devices per netdev hook

This patch allows you to register one netdev basechain to multiple devices. This adds a new NFTA_HOOK_DEVS netlink attribute to specify the list of netdevices. Basechains store a list of hooks. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
CachyOS · Oct 23, 2019 · d54725c · d54725c
1 parent bbaef95
commit d54725c
Show file tree

Hide file tree

Showing 5 changed files with 293 additions and 98 deletions.
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
@@ -973,21 +973,21 @@ struct nft_hook {
  * struct nft_base_chain - nf_tables base chain
  *
  * @ops: netfilter hook ops
+ * @hook_list: list of netfilter hooks (for NFPROTO_NETDEV family)
  * @type: chain type
  * @policy: default policy
  * @stats: per-cpu chain stats
  * @chain: the chain
- * @dev_name: device name that this base chain is attached to (if any)
  * @flow_block: flow block (for hardware offload)
  */
 struct nft_base_chain {
  struct nf_hook_ops ops;
+ struct list_head hook_list;
  const struct nft_chain_type *type;
  u8 policy;
  u8 flags;
  struct nft_stats __percpu *stats;
  struct nft_chain chain;
- char dev_name[IFNAMSIZ];
  struct flow_block flow_block;
 };
 

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
@@ -144,12 +144,14 @@ enum nft_list_attributes {
  * @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)
  * @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
  * @NFTA_HOOK_DEV: netdevice name (NLA_STRING)
+ * @NFTA_HOOK_DEVS: list of netdevices (NLA_NESTED)
  */
 enum nft_hook_attributes {
  NFTA_HOOK_UNSPEC,
  NFTA_HOOK_HOOKNUM,
  NFTA_HOOK_PRIORITY,
  NFTA_HOOK_DEV,
+ NFTA_HOOK_DEVS,
  __NFTA_HOOK_MAX
 };
 #define NFTA_HOOK_MAX (__NFTA_HOOK_MAX - 1)