| Message ID | 20191120174357.26112-2-cgzones@googlemail.com |
|---|---|
| State | Changes Requested |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | [RFC,1/4] statement: make secmark statements idempotent | expand |
On Wed, Nov 20, 2019 at 06:43:55PM +0100, Christian Göttsche wrote: > Labeling established and related packets requires the secmark to be stored in the connection. > Add the ability to store and retrieve secmarks like: > > ... > chain input { > ... > > # label new incoming packets > ct state new meta secmark set tcp dport map @secmapping_in > > # add label to connection > ct state new ct secmark set meta secmark > > # set label for est/rel packets from connection > ct state established,related meta secmark set ct secmark > > ... > } > ... > chain output { > ... > > # label new outgoing packets > ct state new meta secmark set tcp dport map @secmapping_out > > # add label to connection > ct state new ct secmark set meta secmark > > # set label for est/rel packets from connection > ct state established,related meta secmark set ct secmark > > ... > } > ... I have applied this with minor changes on the evaluation side. Just follow up with another patch in case you find any issue. Thanks.
On Thu, Nov 21, 2019 at 02:06:34PM +0100, Pablo Neira Ayuso wrote: > On Wed, Nov 20, 2019 at 06:43:55PM +0100, Christian Göttsche wrote: > > Labeling established and related packets requires the secmark to be stored in the connection. > > Add the ability to store and retrieve secmarks like: > > > > ... > > chain input { > > ... > > > > # label new incoming packets > > ct state new meta secmark set tcp dport map @secmapping_in > > > > # add label to connection > > ct state new ct secmark set meta secmark > > > > # set label for est/rel packets from connection > > ct state established,related meta secmark set ct secmark > > > > ... > > } > > ... > > chain output { > > ... > > > > # label new outgoing packets > > ct state new meta secmark set tcp dport map @secmapping_out > > > > # add label to connection > > ct state new ct secmark set meta secmark > > > > # set label for est/rel packets from connection > > ct state established,related meta secmark set ct secmark > > > > ... > > } > > ... > > I have applied this with minor changes on the evaluation side. Just > follow up with another patch in case you find any issue. Actually, I'm keeping back 2/4. I'm attaching the update I made. I think it's good to disallow this: ct secmark 12 meta secmark 12 but you also have to check from the evaluation phase that ct and meta statements do not allow setting a constant value, ie. ct secmark set 12 meta secmark set 12 From the objref statement evaluation step, you can check if this expression is a constant through flags. Thanks.
diff --git a/src/ct.c b/src/ct.c index ed458e6b..9e6a8351 100644 --- a/src/ct.c +++ b/src/ct.c @@ -299,6 +299,8 @@ const struct ct_template ct_templates[__NFT_CT_MAX] = { BYTEORDER_BIG_ENDIAN, 128), [NFT_CT_DST_IP6] = CT_TEMPLATE("ip6 daddr", &ip6addr_type, BYTEORDER_BIG_ENDIAN, 128), + [NFT_CT_SECMARK] = CT_TEMPLATE("secmark", &integer_type, + BYTEORDER_HOST_ENDIAN, 32), }; static void ct_print(enum nft_ct_keys key, int8_t dir, uint8_t nfproto, diff --git a/src/evaluate.c b/src/evaluate.c index e54eaf1a..740d3c30 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1794,6 +1794,16 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr) if (expr_is_singleton(right)) relational_expr_pctx_update(&ctx->pctx, rel); + /* + * Statements like 'ct secmark 12 counter' are parsed as + * relational expression with implicit operator. + * Make them invalid. + */ + if ((left->etype == EXPR_META && left->meta.key == NFT_META_SECMARK) + || (left->etype == EXPR_CT && left->ct.key == NFT_CT_SECMARK)) + return expr_error(ctx->msgs, *expr, + "secmark is invalid with hardcoded ids"); + /* fall through */ case OP_NEQ: switch (right->etype) { diff --git a/src/meta.c b/src/meta.c index 69a897a9..796d8e94 100644 --- a/src/meta.c +++ b/src/meta.c @@ -698,6 +698,8 @@ const struct meta_template meta_templates[] = { [NFT_META_TIME_HOUR] = META_TEMPLATE("hour", &hour_type, 4 * BITS_PER_BYTE, BYTEORDER_HOST_ENDIAN), + [NFT_META_SECMARK] = META_TEMPLATE("secmark", &integer_type, + 32, BYTEORDER_HOST_ENDIAN), }; static bool meta_key_is_unqualified(enum nft_meta_keys key) diff --git a/src/parser_bison.y b/src/parser_bison.y index 631b7d68..707f4671 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -4190,9 +4190,16 @@ meta_stmt : META meta_key SET stmt_expr { switch ($2) { case NFT_META_SECMARK: - $$ = objref_stmt_alloc(&@$); - $$->objref.type = NFT_OBJECT_SECMARK; - $$->objref.expr = $4; + switch ($4->etype) { + case EXPR_CT: + $$ = meta_stmt_alloc(&@$, $2, $4); + break; + default: + $$ = objref_stmt_alloc(&@$); + $$->objref.type = NFT_OBJECT_SECMARK; + $$->objref.expr = $4; + break; + } break; default: $$ = meta_stmt_alloc(&@$, $2, $4); @@ -4388,6 +4395,7 @@ ct_key : L3PROTOCOL { $$ = NFT_CT_L3PROTOCOL; } | PROTO_DST { $$ = NFT_CT_PROTO_DST; } | LABEL { $$ = NFT_CT_LABELS; } | EVENT { $$ = NFT_CT_EVENTMASK; } + | SECMARK { $$ = NFT_CT_SECMARK; } | ct_key_dir_optional ;
Labeling established and related packets requires the secmark to be stored in the connection. Add the ability to store and retrieve secmarks like: ... chain input { ... # label new incoming packets ct state new meta secmark set tcp dport map @secmapping_in # add label to connection ct state new ct secmark set meta secmark # set label for est/rel packets from connection ct state established,related meta secmark set ct secmark ... } ... chain output { ... # label new outgoing packets ct state new meta secmark set tcp dport map @secmapping_out # add label to connection ct state new ct secmark set meta secmark # set label for est/rel packets from connection ct state established,related meta secmark set ct secmark ... } ... improves: 3bc84e5c1fdd1ff011af9788fe174e0514c2c9ea Signed-off-by: Christian Göttsche <cgzones@googlemail.com> --- src/ct.c | 2 ++ src/evaluate.c | 10 ++++++++++ src/meta.c | 2 ++ src/parser_bison.y | 14 +++++++++++--- 4 files changed, 25 insertions(+), 3 deletions(-)