| Message ID | 20191120174357.26112-3-cgzones@googlemail.com |
|---|---|
| State | Changes Requested |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | [RFC,1/4] statement: make secmark statements idempotent | expand |
This patch does not apply here to current git HEAD for some reason. On Wed, Nov 20, 2019 at 06:43:56PM +0100, Christian Göttsche wrote: > Signed-off-by: Christian Göttsche <cgzones@googlemail.com> > --- > files/examples/Makefile.am | 1 + > files/examples/secmark.nft | 85 ++++++++++++++++++++++++++++++++++++++ > 2 files changed, 86 insertions(+) > create mode 100755 files/examples/secmark.nft > > diff --git a/files/examples/Makefile.am b/files/examples/Makefile.am > index c40e041e..b29e9f61 100644 > --- a/files/examples/Makefile.am > +++ b/files/examples/Makefile.am > @@ -1,4 +1,5 @@ > pkgdocdir = ${docdir}/examples > dist_pkgdoc_SCRIPTS = ct_helpers.nft \ > load_balancing.nft \ > + secmark.nft \ > sets_and_maps.nft > diff --git a/files/examples/secmark.nft b/files/examples/secmark.nft > new file mode 100755 > index 00000000..0e010056 > --- /dev/null > +++ b/files/examples/secmark.nft > @@ -0,0 +1,85 @@ > +#!/usr/sbin/nft -f > + > +# This example file shows how to use secmark labels with the nftables framework. > +# This script is meant to be loaded with `nft -f <file>` > +# You require linux kernel >= 4.20 and nft >= 0.9.3 > +# For up-to-date information please visit https://wiki.nftables.org > + > + > +flush ruleset > + > +table inet filter { > + secmark ssh_server { > + "system_u:object_r:ssh_server_packet_t:s0" > + } > + > + secmark dns_client { > + "system_u:object_r:dns_client_packet_t:s0" > + } > + > + secmark http_client { > + "system_u:object_r:http_client_packet_t:s0" > + } > + > + secmark https_client { > + "system_u:object_r:http_client_packet_t:s0" > + } > + > + secmark ntp_client { > + "system_u:object_r:ntp_client_packet_t:s0" > + } > + > + secmark icmp_client { > + "system_u:object_r:icmp_client_packet_t:s0" > + } > + > + secmark icmp_server { > + "system_u:object_r:icmp_server_packet_t:s0" > + } > + > + secmark ssh_client { > + "system_u:object_r:ssh_client_packet_t:s0" > + } > + > + secmark git_client { > + "system_u:object_r:git_client_packet_t:s0" > + } > + > + map secmapping_in { > + type inet_service : secmark > + elements = { 22 : "ssh_server" } > + } > + > + map secmapping_out { > + type inet_service : secmark > + elements = { 22 : "ssh_client", 53 : "dns_client", 80 : "http_client", 123 : "ntp_client", 443 : "http_client", 9418 : "git_client" } > + } > + > + chain input { > + type filter hook input priority 0; > + > + # label new incoming packets and add to connection > + ct state new meta secmark set tcp dport map @secmapping_in > + ct state new meta secmark set udp dport map @secmapping_in > + ct state new ip protocol icmp meta secmark set "icmp_server" > + ct state new ip6 nexthdr icmpv6 meta secmark set "icmp_server" > + ct state new ct secmark set meta secmark > + > + # set label for est/rel packets from connection > + ct state established,related meta secmark set ct secmark > + } > + > + chain output { > + type filter hook output priority 0; > + > + # label new outgoing packets and add to connection > + ct state new meta secmark set tcp dport map @secmapping_out > + ct state new meta secmark set udp dport map @secmapping_out > + ct state new ip protocol icmp meta secmark set "icmp_client" > + ct state new ip6 nexthdr icmpv6 meta secmark set "icmp_client" > + ct state new ct secmark set meta secmark > + > + # set label for est/rel packets from connection > + ct state established,related meta secmark set ct secmark > + } > +} > -- > 2.24.0 >
diff --git a/files/examples/Makefile.am b/files/examples/Makefile.am index c40e041e..b29e9f61 100644 --- a/files/examples/Makefile.am +++ b/files/examples/Makefile.am @@ -1,4 +1,5 @@ pkgdocdir = ${docdir}/examples dist_pkgdoc_SCRIPTS = ct_helpers.nft \ load_balancing.nft \ + secmark.nft \ sets_and_maps.nft diff --git a/files/examples/secmark.nft b/files/examples/secmark.nft new file mode 100755 index 00000000..0e010056 --- /dev/null +++ b/files/examples/secmark.nft @@ -0,0 +1,85 @@ +#!/usr/sbin/nft -f + +# This example file shows how to use secmark labels with the nftables framework. +# This script is meant to be loaded with `nft -f <file>` +# You require linux kernel >= 4.20 and nft >= 0.9.3 +# For up-to-date information please visit https://wiki.nftables.org + + +flush ruleset + +table inet filter { + secmark ssh_server { + "system_u:object_r:ssh_server_packet_t:s0" + } + + secmark dns_client { + "system_u:object_r:dns_client_packet_t:s0" + } + + secmark http_client { + "system_u:object_r:http_client_packet_t:s0" + } + + secmark https_client { + "system_u:object_r:http_client_packet_t:s0" + } + + secmark ntp_client { + "system_u:object_r:ntp_client_packet_t:s0" + } + + secmark icmp_client { + "system_u:object_r:icmp_client_packet_t:s0" + } + + secmark icmp_server { + "system_u:object_r:icmp_server_packet_t:s0" + } + + secmark ssh_client { + "system_u:object_r:ssh_client_packet_t:s0" + } + + secmark git_client { + "system_u:object_r:git_client_packet_t:s0" + } + + map secmapping_in { + type inet_service : secmark + elements = { 22 : "ssh_server" } + } + + map secmapping_out { + type inet_service : secmark + elements = { 22 : "ssh_client", 53 : "dns_client", 80 : "http_client", 123 : "ntp_client", 443 : "http_client", 9418 : "git_client" } + } + + chain input { + type filter hook input priority 0; + + # label new incoming packets and add to connection + ct state new meta secmark set tcp dport map @secmapping_in + ct state new meta secmark set udp dport map @secmapping_in + ct state new ip protocol icmp meta secmark set "icmp_server" + ct state new ip6 nexthdr icmpv6 meta secmark set "icmp_server" + ct state new ct secmark set meta secmark + + # set label for est/rel packets from connection + ct state established,related meta secmark set ct secmark + } + + chain output { + type filter hook output priority 0; + + # label new outgoing packets and add to connection + ct state new meta secmark set tcp dport map @secmapping_out + ct state new meta secmark set udp dport map @secmapping_out + ct state new ip protocol icmp meta secmark set "icmp_client" + ct state new ip6 nexthdr icmpv6 meta secmark set "icmp_client" + ct state new ct secmark set meta secmark + + # set label for est/rel packets from connection + ct state established,related meta secmark set ct secmark + } +}
Signed-off-by: Christian Göttsche <cgzones@googlemail.com> --- files/examples/Makefile.am | 1 + files/examples/secmark.nft | 85 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 86 insertions(+) create mode 100755 files/examples/secmark.nft