src: Add support for cpu in meta expresion

This allows you to match cpu handling with a packet.

This is an example of the syntax for this new attribute:

nft add rule ip test input meta cpu 1 counter
nft add rule ip test input meta cpu 1-3 counter
nft add rule ip test input meta cpu { 1, 3} counter

Signed-off-by: Ana Rey <anarey@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index d31bbcf071278e21e4af7c311055929a71a9a9c4..dbdc4f5b42aa4196afa3497d7b4c4deadf7c4436 100644 (file)
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -536,6 +536,7 @@ enum nft_exthdr_attributes {
  * @NFT_META_BRI_IIFNAME: packet input bridge interface name
  * @NFT_META_BRI_OIFNAME: packet output bridge interface name
  * @NFT_META_PKTTYPE: packet type (skb->pkt_type), special handling for loopback
+ * @NFT_META_CPU: cpu id through smp_processor_id()
  */
 enum nft_meta_keys {
        NFT_META_LEN,
@@ -558,6 +559,7 @@ enum nft_meta_keys {
        NFT_META_BRI_IIFNAME,
        NFT_META_BRI_OIFNAME,
        NFT_META_PKTTYPE,
+       NFT_META_CPU,
 };
 
 /**

diff --git a/src/meta.c b/src/meta.c
index 7b75caf7fbd9968a46d485484ae1c0130109cc94..1f7217f06d3ae377c19ce45363ed8b2f303be302 100644 (file)
--- a/src/meta.c
+++ b/src/meta.c
@@ -393,6 +393,9 @@ static const struct meta_template meta_templates[] = {
        [NFT_META_PKTTYPE]      = META_TEMPLATE("pkttype",  &pkttype_type,
                                                BITS_PER_BYTE,
                                                BYTEORDER_HOST_ENDIAN),
+       [NFT_META_CPU]          = META_TEMPLATE("cpu",  &integer_type,
+                                               BITS_PER_BYTE,
+                                               BYTEORDER_HOST_ENDIAN),
 };
 
 static void meta_expr_print(const struct expr *expr)

diff --git a/src/parser.y b/src/parser.y
index f06a26513cc50bec6787267ba1822432220d804b..d7bc287f495af5115f309d6c668fbf107d1e005e 100644 (file)
--- a/src/parser.y
+++ b/src/parser.y
@@ -326,6 +326,7 @@ static int monitor_lookup_event(const char *event)
 %token IBRIPORT                        "ibriport"
 %token OBRIPORT                        "obriport"
 %token PKTTYPE                 "pkttype"
+%token CPU                     "cpu"
 
 %token CT                      "ct"
 %token DIRECTION               "direction"
@@ -1840,6 +1841,7 @@ meta_key_unqualified      :       MARK            { $$ = NFT_META_MARK; }
                        |       IBRIPORT        { $$ = NFT_META_BRI_IIFNAME; }
                        |       OBRIPORT        { $$ = NFT_META_BRI_OIFNAME; }
                        |       PKTTYPE         { $$ = NFT_META_PKTTYPE; }
+                       |       CPU             { $$ = NFT_META_CPU; }
                        ;
 
 meta_stmt              :       META    meta_key        SET     expr

diff --git a/src/scanner.l b/src/scanner.l
index ca6db6e1625bd0230a57da25342bd72fa706a186..b7a00b4fef1098b53bed7b88bcc24c61bdc77d8f 100644 (file)
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -416,6 +416,7 @@ addrstring  ({macaddr}|{ip4addr}|{ip6addr})
 "ibriport"             { return IBRIPORT; }
 "obriport"             { return OBRIPORT; }
 "pkttype"              { return PKTTYPE; }
+"cpu"                  { return CPU; }
 
 "ct"                   { return CT; }
 "direction"            { return DIRECTION; }