From patchwork Tue Apr 28 15:41:12 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1278562 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=netfilter.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 49BQqS3ZPDz9sTG for ; Wed, 29 Apr 2020 01:41:40 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728400AbgD1Plf (ORCPT ); Tue, 28 Apr 2020 11:41:35 -0400 Received: from correo.us.es ([193.147.175.20]:49356 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728327AbgD1Ple (ORCPT ); Tue, 28 Apr 2020 11:41:34 -0400 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id C3ADB1F0CE8 for ; Tue, 28 Apr 2020 17:41:27 +0200 (CEST) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id ADB86BAAA3 for ; Tue, 28 Apr 2020 17:41:27 +0200 (CEST) Received: by antivirus1-rhel7.int (Postfix, from userid 99) id A3518BAAB4; Tue, 28 Apr 2020 17:41:27 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on antivirus1-rhel7.int X-Spam-Level: X-Spam-Status: No, score=-108.2 required=7.5 tests=ALL_TRUSTED,BAYES_50, SMTPAUTH_US2,URIBL_BLOCKED,USER_IN_WHITELIST autolearn=disabled version=3.4.1 Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 47CA0BAAA3 for ; Tue, 28 Apr 2020 17:41:25 +0200 (CEST) Received: from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int (F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); Tue, 28 Apr 2020 17:41:25 +0200 (CEST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int) Received: from localhost.localdomain (unknown [90.77.255.23]) (Authenticated sender: pneira@us.es) by entrada.int (Postfix) with ESMTPA id 343BF42EF4E0 for ; Tue, 28 Apr 2020 17:41:25 +0200 (CEST) X-SMTPAUTHUS: auth mail.us.es From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v3 1/9] src: NAT support for intervals in maps Date: Tue, 28 Apr 2020 17:41:12 +0200 Message-Id: <20200428154120.20061-2-pablo@netfilter.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200428154120.20061-1-pablo@netfilter.org> References: <20200428154120.20061-1-pablo@netfilter.org> MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org This patch allows you to specify an interval of IP address in maps. table ip x { chain y { type nat hook postrouting priority srcnat; policy accept; snat ip interval to ip saddr map { 10.141.11.4 : 192.168.2.2-192.168.2.4 } } } The example above performs SNAT to packets that comes from 10.141.11.4 to an interval of IP addresses from 192.168.2.2 to 192.168.2.4 (both included). You can also combine this with dynamic maps: table ip x { map y { type ipv4_addr : interval ipv4_addr flags interval elements = { 10.141.10.0/24 : 192.168.2.2-192.168.2.4 } } chain y { type nat hook postrouting priority srcnat; policy accept; snat ip interval to ip saddr map @y } } Signed-off-by: Pablo Neira Ayuso --- include/expression.h | 2 + include/statement.h | 5 ++ src/evaluate.c | 45 +++++++++++++++- src/mnl.c | 5 +- src/netlink.c | 111 +++++++++++++++++++++++++++++++++++++- src/netlink_delinearize.c | 39 ++++++++++++++ src/netlink_linearize.c | 8 +++ src/parser_bison.y | 34 ++++++++++++ src/rule.c | 3 ++ src/statement.c | 2 + 10 files changed, 250 insertions(+), 4 deletions(-) diff --git a/include/expression.h b/include/expression.h index 87c39e5de08a..359348275a04 100644 --- a/include/expression.h +++ b/include/expression.h @@ -184,6 +184,7 @@ const struct expr_ops *expr_ops_by_type(enum expr_types etype); * @EXPR_F_PROTOCOL: expressions describes upper layer protocol * @EXPR_F_INTERVAL_END: set member ends an open interval * @EXPR_F_BOOLEAN: expression is boolean (set by relational expr on LHS) + * @EXPR_F_INTERVAL: expression describes a interval */ enum expr_flags { EXPR_F_CONSTANT = 0x1, @@ -191,6 +192,7 @@ enum expr_flags { EXPR_F_PROTOCOL = 0x4, EXPR_F_INTERVAL_END = 0x8, EXPR_F_BOOLEAN = 0x10, + EXPR_F_INTERVAL = 0x20, }; #include diff --git a/include/statement.h b/include/statement.h index 8fb459ca1cd4..8427f47e4071 100644 --- a/include/statement.h +++ b/include/statement.h @@ -119,6 +119,10 @@ enum nft_nat_etypes { extern const char *nat_etype2str(enum nft_nat_etypes type); +enum { + STMT_NAT_F_INTERVAL = (1 << 0), +}; + struct nat_stmt { enum nft_nat_etypes type; struct expr *addr; @@ -126,6 +130,7 @@ struct nat_stmt { uint32_t flags; uint8_t family; bool ipportmap; + uint32_t type_flags; }; extern struct stmt *nat_stmt_alloc(const struct location *loc, diff --git a/src/evaluate.c b/src/evaluate.c index 759b17366f68..a116f7b66e07 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1446,6 +1446,9 @@ static int expr_evaluate_map(struct eval_ctx *ctx, struct expr **expr) if (binop_transfer(ctx, expr) < 0) return -1; + if (ctx->set->data->flags & EXPR_F_INTERVAL) + ctx->set->data->len *= 2; + ctx->set->key->len = ctx->ectx.len; ctx->set = NULL; map = *expr; @@ -1486,6 +1489,7 @@ static int expr_evaluate_mapping(struct eval_ctx *ctx, struct expr **expr) { struct expr *mapping = *expr; struct set *set = ctx->set; + uint32_t datalen; if (set == NULL) return expr_error(ctx->msgs, mapping, @@ -1502,7 +1506,13 @@ static int expr_evaluate_mapping(struct eval_ctx *ctx, struct expr **expr) mapping->flags |= mapping->left->flags & EXPR_F_SINGLETON; if (set->data) { - expr_set_context(&ctx->ectx, set->data->dtype, set->data->len); + if (!set_is_anonymous(set->flags) && + set->data->flags & EXPR_F_INTERVAL) + datalen = set->data->len / 2; + else + datalen = set->data->len; + + expr_set_context(&ctx->ectx, set->data->dtype, datalen); } else { assert((set->flags & NFT_SET_MAP) == 0); } @@ -1512,7 +1522,14 @@ static int expr_evaluate_mapping(struct eval_ctx *ctx, struct expr **expr) if (!expr_is_constant(mapping->right)) return expr_error(ctx->msgs, mapping->right, "Value must be a constant"); - if (!expr_is_singleton(mapping->right)) + + if (set_is_anonymous(set->flags) && + (mapping->right->etype == EXPR_RANGE || + mapping->right->etype == EXPR_PREFIX)) + set->data->flags |= EXPR_F_INTERVAL; + + if (!(set->data->flags & EXPR_F_INTERVAL) && + !expr_is_singleton(mapping->right)) return expr_error(ctx->msgs, mapping->right, "Value must be a singleton"); @@ -2970,6 +2987,27 @@ static int stmt_evaluate_nat(struct eval_ctx *ctx, struct stmt *stmt) if (err < 0) return err; } + + if (stmt->nat.type_flags & STMT_NAT_F_INTERVAL) { + switch (stmt->nat.addr->etype) { + case EXPR_MAP: + if (!(stmt->nat.addr->mappings->set->data->flags & EXPR_F_INTERVAL)) + return expr_error(ctx->msgs, stmt->nat.addr, + "map is not defined as interval"); + break; + case EXPR_RANGE: + case EXPR_PREFIX: + break; + default: + return expr_error(ctx->msgs, stmt->nat.addr, + "neither prefix, range nor map expression"); + } + + stmt->flags |= STMT_F_TERMINAL; + + return 0; + } + if (stmt->nat.proto != NULL) { err = nat_evaluate_transport(ctx, stmt, &stmt->nat.proto); if (err < 0) @@ -3477,6 +3515,9 @@ static int set_evaluate(struct eval_ctx *ctx, struct set *set) return set_error(ctx, set, "map definition does not " "specify mapping data type"); + if (set->data->flags & EXPR_F_INTERVAL) + set->data->len *= 2; + if (set->data->etype == EXPR_CONCAT && expr_evaluate_concat(ctx, &set->data, false) < 0) return -1; diff --git a/src/mnl.c b/src/mnl.c index 3c009fab6dcf..fb34ecb3dece 100644 --- a/src/mnl.c +++ b/src/mnl.c @@ -1012,8 +1012,11 @@ int mnl_nft_set_add(struct netlink_ctx *ctx, struct cmd *cmd, memory_allocation_error(); set_key_expression(ctx, set->key, set->flags, udbuf, NFTNL_UDATA_SET_KEY_TYPEOF); - if (set->data) + if (set->data) { set_key_expression(ctx, set->data, set->flags, udbuf, NFTNL_UDATA_SET_DATA_TYPEOF); + nftnl_udata_put_u32(udbuf, NFTNL_UDATA_SET_DATA_INTERVAL, + !!(set->data->flags & EXPR_F_INTERVAL)); + } if (set->desc.field_len[0]) { nftnl_set_set_data(nls, NFTNL_SET_DESC_CONCAT, diff --git a/src/netlink.c b/src/netlink.c index 7b7ef39e7807..10964720f5d4 100644 --- a/src/netlink.c +++ b/src/netlink.c @@ -176,6 +176,8 @@ static struct nftnl_set_elem *alloc_nftnl_setelem(const struct expr *set, assert(nld.len > 0); /* fallthrough */ case EXPR_VALUE: + case EXPR_RANGE: + case EXPR_PREFIX: nftnl_set_elem_set(nlse, NFTNL_SET_ELEM_DATA, nld.value, nld.len); break; @@ -296,6 +298,38 @@ static void netlink_gen_verdict(const struct expr *expr, } } +static void netlink_gen_range(const struct expr *expr, + struct nft_data_linearize *nld) +{ + unsigned int len = div_round_up(expr->left->len, BITS_PER_BYTE) * 2; + unsigned char data[len]; + unsigned int offset = 0; + + memset(data, 0, len); + offset = netlink_export_pad(data, expr->left->value, expr->left); + netlink_export_pad(data + offset, expr->right->value, expr->right); + memcpy(nld->value, data, len); + nld->len = len; +} + +static void netlink_gen_prefix(const struct expr *expr, + struct nft_data_linearize *nld) +{ + unsigned int len = div_round_up(expr->len, BITS_PER_BYTE) * 2; + unsigned char data[len]; + int offset; + mpz_t v; + + offset = netlink_export_pad(data, expr->prefix->value, expr); + mpz_init_bitmask(v, expr->len - expr->prefix_len); + mpz_add(v, expr->prefix->value, v); + netlink_export_pad(data + offset, v, expr->prefix); + mpz_clear(v); + + memcpy(nld->value, data, len); + nld->len = len; +} + void netlink_gen_data(const struct expr *expr, struct nft_data_linearize *data) { switch (expr->etype) { @@ -305,6 +339,10 @@ void netlink_gen_data(const struct expr *expr, struct nft_data_linearize *data) return netlink_gen_concat_data(expr, data); case EXPR_VERDICT: return netlink_gen_verdict(expr, data); + case EXPR_RANGE: + return netlink_gen_range(expr, data); + case EXPR_PREFIX: + return netlink_gen_prefix(expr, data); default: BUG("invalid data expression type %s\n", expr_name(expr)); } @@ -618,6 +656,7 @@ static int set_parse_udata_cb(const struct nftnl_udata *attr, void *data) case NFTNL_UDATA_SET_KEYBYTEORDER: case NFTNL_UDATA_SET_DATABYTEORDER: case NFTNL_UDATA_SET_MERGE_ELEMENTS: + case NFTNL_UDATA_SET_DATA_INTERVAL: if (len != sizeof(uint32_t)) return -1; break; @@ -701,6 +740,7 @@ struct set *netlink_delinearize_set(struct netlink_ctx *ctx, struct expr *typeof_expr_key, *typeof_expr_data; uint32_t flags, key, objtype = 0; const struct datatype *dtype; + uint32_t data_interval = 0; bool automerge = false; const char *udata; struct set *set; @@ -724,6 +764,7 @@ struct set *netlink_delinearize_set(struct netlink_ctx *ctx, GET_U32_UDATA(keybyteorder, NFTNL_UDATA_SET_KEYBYTEORDER); GET_U32_UDATA(databyteorder, NFTNL_UDATA_SET_DATABYTEORDER); GET_U32_UDATA(automerge, NFTNL_UDATA_SET_MERGE_ELEMENTS); + GET_U32_UDATA(data_interval, NFTNL_UDATA_SET_DATA_INTERVAL); #undef GET_U32_UDATA typeof_expr_key = set_make_key(ud[NFTNL_UDATA_SET_KEY_TYPEOF]); @@ -792,6 +833,9 @@ struct set *netlink_delinearize_set(struct netlink_ctx *ctx, typeof_expr_key = NULL; } + if (data_interval) + set->data->flags |= EXPR_F_INTERVAL; + if (dtype != datatype) datatype_free(datatype); } @@ -885,6 +929,69 @@ void alloc_setelem_cache(const struct expr *set, struct nftnl_set *nls) } } +static bool mpz_bitmask_is_prefix(mpz_t bitmask, uint32_t len) +{ + unsigned long n1, n2; + + n1 = mpz_scan0(bitmask, 0); + if (n1 == ULONG_MAX) + return false; + + n2 = mpz_scan1(bitmask, n1 + 1); + if (n2 < len) + return false; + + return true; +} + +static uint32_t mpz_bitmask_to_prefix(mpz_t bitmask, uint32_t len) +{ + return len - mpz_scan0(bitmask, 0); +} + +static struct expr *expr_range_to_prefix(struct expr *range) +{ + struct expr *left = range->left, *right = range->right, *prefix; + uint32_t len = left->len, prefix_len; + mpz_t bitmask; + + mpz_init2(bitmask, len); + mpz_xor(bitmask, left->value, right->value); + + if (mpz_bitmask_is_prefix(bitmask, len)) { + prefix_len = mpz_bitmask_to_prefix(bitmask, len); + prefix = prefix_expr_alloc(&range->location, expr_get(left), + prefix_len); + mpz_clear(bitmask); + expr_free(range); + + return prefix; + } + mpz_clear(bitmask); + + return range; +} + +static struct expr *netlink_parse_interval_elem(const struct datatype *dtype, + struct expr *expr) +{ + unsigned int len = div_round_up(expr->len, BITS_PER_BYTE); + struct expr *range, *left, *right; + char data[len]; + + mpz_export_data(data, expr->value, dtype->byteorder, len); + left = constant_expr_alloc(&internal_location, dtype, + dtype->byteorder, + (len / 2) * BITS_PER_BYTE, &data[0]); + right = constant_expr_alloc(&internal_location, dtype, + dtype->byteorder, + (len / 2) * BITS_PER_BYTE, &data[len / 2]); + range = range_expr_alloc(&expr->location, left, right); + expr_free(expr); + + return expr_range_to_prefix(range); +} + static struct expr *netlink_parse_concat_elem(const struct datatype *dtype, struct expr *data) { @@ -1021,7 +1128,9 @@ key_end: datatype_set(data, set->data->dtype); data->byteorder = set->data->byteorder; - if (set->data->dtype->subtypes) + if (set->data->flags & EXPR_F_INTERVAL) + data = netlink_parse_interval_elem(set->data->dtype, data); + else if (set->data->dtype->subtypes) data = netlink_parse_concat_elem(set->data->dtype, data); if (data->byteorder == BYTEORDER_HOST_ENDIAN) diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index 79efda123c14..f41223a8e24a 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -979,6 +979,38 @@ static void netlink_parse_reject(struct netlink_parse_ctx *ctx, ctx->stmt = stmt; } +static bool is_nat_addr_map(const struct expr *addr, uint8_t family) +{ + const struct expr *mappings, *data; + const struct set *set; + + if (!addr || + expr_ops(addr)->type != EXPR_MAP) + return false; + + mappings = addr->right; + if (expr_ops(mappings)->type != EXPR_SET_REF) + return false; + + set = mappings->set; + data = set->data; + + if (!(data->flags & EXPR_F_INTERVAL)) + return false; + + /* if we're dealing with an address:address map, + * the length will be bit_sizeof(addr) + 32 (one register). + */ + switch (family) { + case NFPROTO_IPV4: + return data->len == 32 + 32; + case NFPROTO_IPV6: + return data->len == 128 + 128; + } + + return false; +} + static bool is_nat_proto_map(const struct expr *addr, uint8_t family) { const struct expr *mappings, *data; @@ -1046,6 +1078,13 @@ static void netlink_parse_nat(struct netlink_parse_ctx *ctx, stmt->nat.addr = addr; } + if (is_nat_addr_map(addr, family)) { + stmt->nat.family = family; + stmt->nat.type_flags |= STMT_NAT_F_INTERVAL; + ctx->stmt = stmt; + return; + } + reg2 = netlink_parse_register(nle, NFTNL_EXPR_NAT_REG_ADDR_MAX); if (reg2 && reg2 != reg1) { addr = netlink_get_register(ctx, loc, reg2); diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c index e70e63b336cd..944fcdae4ee9 100644 --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -1117,6 +1117,14 @@ static void netlink_gen_nat_stmt(struct netlink_linearize_ctx *ctx, netlink_gen_expr(ctx, stmt->nat.addr, amin_reg); netlink_put_register(nle, NFTNL_EXPR_NAT_REG_ADDR_MIN, amin_reg); + if (stmt->nat.addr->etype == EXPR_MAP && + stmt->nat.addr->mappings->set->data->flags & EXPR_F_INTERVAL) { + amax_reg = get_register(ctx, NULL); + registers++; + amin_reg += netlink_register_space(nat_addrlen(family)); + netlink_put_register(nle, NFTNL_EXPR_NAT_REG_ADDR_MAX, + amin_reg); + } } if (stmt->nat.ipportmap) { diff --git a/src/parser_bison.y b/src/parser_bison.y index 0e04a0e4fcf0..731a5b3ecdf4 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -1792,6 +1792,17 @@ map_block : /* empty */ { $$ = $-1; } $1->flags |= NFT_SET_MAP; $$ = $1; } + | map_block TYPE + data_type_expr COLON INTERVAL data_type_expr + stmt_separator + { + $1->key = $3; + $1->data = $6; + $1->data->flags |= EXPR_F_INTERVAL; + + $1->flags |= NFT_SET_MAP; + $$ = $1; + } | map_block TYPEOF typeof_expr COLON typeof_expr stmt_separator @@ -1803,6 +1814,18 @@ map_block : /* empty */ { $$ = $-1; } $1->flags |= NFT_SET_MAP; $$ = $1; } + | map_block TYPEOF + typeof_expr COLON INTERVAL typeof_expr + stmt_separator + { + $1->key = $3; + datatype_set($1->key, $3->dtype); + $1->data = $6; + $1->data->flags |= EXPR_F_INTERVAL; + + $1->flags |= NFT_SET_MAP; + $$ = $1; + } | map_block TYPE data_type_expr COLON COUNTER stmt_separator @@ -3171,6 +3194,17 @@ nat_stmt_args : stmt_expr $0->nat.addr = $6; $0->nat.ipportmap = true; } + | nf_key_proto INTERVAL TO stmt_expr + { + $0->nat.family = $1; + $0->nat.addr = $4; + $0->nat.type_flags = STMT_NAT_F_INTERVAL; + } + | INTERVAL TO stmt_expr + { + $0->nat.addr = $3; + $0->nat.type_flags = STMT_NAT_F_INTERVAL; + } ; masq_stmt : masq_stmt_alloc masq_stmt_args diff --git a/src/rule.c b/src/rule.c index a312693f4edc..633ca13639ad 100644 --- a/src/rule.c +++ b/src/rule.c @@ -462,6 +462,9 @@ static void set_print_key_and_data(const struct set *set, struct output_ctx *oct if (set_is_datamap(set->flags)) { nft_print(octx, " : "); + if (set->data->flags & EXPR_F_INTERVAL) + nft_print(octx, "interval "); + if (use_typeof) expr_print(set->data, octx); else diff --git a/src/statement.c b/src/statement.c index 182edac8f2ec..5bbc054055bc 100644 --- a/src/statement.c +++ b/src/statement.c @@ -609,6 +609,8 @@ static void nat_stmt_print(const struct stmt *stmt, struct output_ctx *octx) if (stmt->nat.ipportmap) nft_print(octx, " addr . port"); + else if (stmt->nat.type_flags & STMT_NAT_F_INTERVAL) + nft_print(octx, " interval"); nft_print(octx, " to"); } From patchwork Tue Apr 28 15:41:13 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1278554 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=netfilter.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 49BQqH5w86z9sTG for ; Wed, 29 Apr 2020 01:41:31 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728359AbgD1Pla (ORCPT ); Tue, 28 Apr 2020 11:41:30 -0400 Received: from correo.us.es ([193.147.175.20]:49358 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728341AbgD1Pl3 (ORCPT ); Tue, 28 Apr 2020 11:41:29 -0400 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id CEB711F0CEA for ; Tue, 28 Apr 2020 17:41:27 +0200 (CEST) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id C009BBAABD for ; Tue, 28 Apr 2020 17:41:27 +0200 (CEST) Received: by antivirus1-rhel7.int (Postfix, from userid 99) id B5BB0BAAB8; Tue, 28 Apr 2020 17:41:27 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on antivirus1-rhel7.int X-Spam-Level: X-Spam-Status: No, score=-108.2 required=7.5 tests=ALL_TRUSTED,BAYES_50, SMTPAUTH_US2,URIBL_BLOCKED,USER_IN_WHITELIST autolearn=disabled version=3.4.1 Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id BDD0CDA7B2 for ; Tue, 28 Apr 2020 17:41:25 +0200 (CEST) Received: from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int (F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); Tue, 28 Apr 2020 17:41:25 +0200 (CEST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int) Received: from localhost.localdomain (unknown [90.77.255.23]) (Authenticated sender: pneira@us.es) by entrada.int (Postfix) with ESMTPA id AAF4342EF4E0 for ; Tue, 28 Apr 2020 17:41:25 +0200 (CEST) X-SMTPAUTHUS: auth mail.us.es From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v3 2/9] include: resync nf_nat.h kernel header Date: Tue, 28 Apr 2020 17:41:13 +0200 Message-Id: <20200428154120.20061-3-pablo@netfilter.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200428154120.20061-1-pablo@netfilter.org> References: <20200428154120.20061-1-pablo@netfilter.org> MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter/nf_nat.h | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/include/linux/netfilter/nf_nat.h b/include/linux/netfilter/nf_nat.h index 0880781ad7b6..4a95c0db14d4 100644 --- a/include/linux/netfilter/nf_nat.h +++ b/include/linux/netfilter/nf_nat.h @@ -1,3 +1,4 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ #ifndef _NETFILTER_NF_NAT_H #define _NETFILTER_NF_NAT_H @@ -9,6 +10,7 @@ #define NF_NAT_RANGE_PROTO_RANDOM (1 << 2) #define NF_NAT_RANGE_PERSISTENT (1 << 3) #define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4) +#define NF_NAT_RANGE_PROTO_OFFSET (1 << 5) #define NF_NAT_RANGE_PROTO_RANDOM_ALL \ (NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY) @@ -16,7 +18,7 @@ #define NF_NAT_RANGE_MASK \ (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED | \ NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT | \ - NF_NAT_RANGE_PROTO_RANDOM_FULLY) + NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET) struct nf_nat_ipv4_range { unsigned int flags; @@ -39,4 +41,13 @@ struct nf_nat_range { union nf_conntrack_man_proto max_proto; }; +struct nf_nat_range2 { + unsigned int flags; + union nf_inet_addr min_addr; + union nf_inet_addr max_addr; + union nf_conntrack_man_proto min_proto; + union nf_conntrack_man_proto max_proto; + union nf_conntrack_man_proto base_proto; +}; + #endif /* _NETFILTER_NF_NAT_H */ From patchwork Tue Apr 28 15:41:14 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1278557 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=netfilter.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 49BQqL106Nz9sTG for ; Wed, 29 Apr 2020 01:41:34 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728372AbgD1Plb (ORCPT ); Tue, 28 Apr 2020 11:41:31 -0400 Received: from correo.us.es ([193.147.175.20]:49362 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728156AbgD1Pla (ORCPT ); Tue, 28 Apr 2020 11:41:30 -0400 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id 38D271F0CE2 for ; Tue, 28 Apr 2020 17:41:28 +0200 (CEST) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 2835FBAAB5 for ; Tue, 28 Apr 2020 17:41:28 +0200 (CEST) Received: by antivirus1-rhel7.int (Postfix, from userid 99) id 1DBC9BAAB4; Tue, 28 Apr 2020 17:41:28 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on antivirus1-rhel7.int X-Spam-Level: X-Spam-Status: No, score=-108.2 required=7.5 tests=ALL_TRUSTED,BAYES_50, SMTPAUTH_US2,URIBL_BLOCKED,USER_IN_WHITELIST autolearn=disabled version=3.4.1 Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 2568366E2 for ; Tue, 28 Apr 2020 17:41:26 +0200 (CEST) Received: from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int (F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); Tue, 28 Apr 2020 17:41:26 +0200 (CEST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int) Received: from localhost.localdomain (unknown [90.77.255.23]) (Authenticated sender: pneira@us.es) by entrada.int (Postfix) with ESMTPA id 11DA842EF4E1 for ; Tue, 28 Apr 2020 17:41:26 +0200 (CEST) X-SMTPAUTHUS: auth mail.us.es From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v3 3/9] src: add netmap support Date: Tue, 28 Apr 2020 17:41:14 +0200 Message-Id: <20200428154120.20061-4-pablo@netfilter.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200428154120.20061-1-pablo@netfilter.org> References: <20200428154120.20061-1-pablo@netfilter.org> MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org This patch allows you to specify an interval of IP address in maps. table ip x { chain y { type nat hook postrouting priority srcnat; policy accept; snat ip prefix to ip saddr map { 10.141.11.0/24 : 192.168.2.0/24 } } } The example above performs SNAT to packets that comes from 10.141.11.0/24 using the prefix 192.168.2.0/24, e.g. 10.141.11.4 is mangled to 192.168.2.4. Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter/nf_nat.h | 4 +++- include/statement.h | 1 + src/netlink_delinearize.c | 4 ++++ src/parser_bison.y | 17 +++++++++++++++++ src/statement.c | 2 ++ 5 files changed, 27 insertions(+), 1 deletion(-) diff --git a/include/linux/netfilter/nf_nat.h b/include/linux/netfilter/nf_nat.h index 4a95c0db14d4..a64586e77b24 100644 --- a/include/linux/netfilter/nf_nat.h +++ b/include/linux/netfilter/nf_nat.h @@ -11,6 +11,7 @@ #define NF_NAT_RANGE_PERSISTENT (1 << 3) #define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4) #define NF_NAT_RANGE_PROTO_OFFSET (1 << 5) +#define NF_NAT_RANGE_NETMAP (1 << 6) #define NF_NAT_RANGE_PROTO_RANDOM_ALL \ (NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY) @@ -18,7 +19,8 @@ #define NF_NAT_RANGE_MASK \ (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED | \ NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT | \ - NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET) + NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET | \ + NF_NAT_RANGE_NETMAP) struct nf_nat_ipv4_range { unsigned int flags; diff --git a/include/statement.h b/include/statement.h index 8427f47e4071..01fe416c415a 100644 --- a/include/statement.h +++ b/include/statement.h @@ -121,6 +121,7 @@ extern const char *nat_etype2str(enum nft_nat_etypes type); enum { STMT_NAT_F_INTERVAL = (1 << 0), + STMT_NAT_F_PREFIX = (1 << 1), }; struct nat_stmt { diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index f41223a8e24a..b039a1e3c7ac 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -15,6 +15,7 @@ #include #include #include +#include #include #include #include @@ -1060,6 +1061,9 @@ static void netlink_parse_nat(struct netlink_parse_ctx *ctx, if (nftnl_expr_is_set(nle, NFTNL_EXPR_NAT_FLAGS)) stmt->nat.flags = nftnl_expr_get_u32(nle, NFTNL_EXPR_NAT_FLAGS); + if (stmt->nat.flags & NF_NAT_RANGE_NETMAP) + stmt->nat.type_flags |= STMT_NAT_F_PREFIX; + addr = NULL; reg1 = netlink_parse_register(nle, NFTNL_EXPR_NAT_REG_ADDR_MIN); if (reg1) { diff --git a/src/parser_bison.y b/src/parser_bison.y index 731a5b3ecdf4..3b470cc63235 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -3205,6 +3205,23 @@ nat_stmt_args : stmt_expr $0->nat.addr = $3; $0->nat.type_flags = STMT_NAT_F_INTERVAL; } + | nf_key_proto PREFIX TO stmt_expr + { + $0->nat.family = $1; + $0->nat.addr = $4; + $0->nat.type_flags = + STMT_NAT_F_PREFIX | + STMT_NAT_F_INTERVAL; + $0->nat.flags |= NF_NAT_RANGE_NETMAP; + } + | PREFIX TO stmt_expr + { + $0->nat.addr = $3; + $0->nat.type_flags = + STMT_NAT_F_PREFIX | + STMT_NAT_F_INTERVAL; + $0->nat.flags |= NF_NAT_RANGE_NETMAP; + } ; masq_stmt : masq_stmt_alloc masq_stmt_args diff --git a/src/statement.c b/src/statement.c index 5bbc054055bc..8a1cd6e04f61 100644 --- a/src/statement.c +++ b/src/statement.c @@ -609,6 +609,8 @@ static void nat_stmt_print(const struct stmt *stmt, struct output_ctx *octx) if (stmt->nat.ipportmap) nft_print(octx, " addr . port"); + else if (stmt->nat.type_flags & STMT_NAT_F_PREFIX) + nft_print(octx, " prefix"); else if (stmt->nat.type_flags & STMT_NAT_F_INTERVAL) nft_print(octx, " interval"); From patchwork Tue Apr 28 15:41:15 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1278556 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=netfilter.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 49BQqK0RFKz9sTX for ; Wed, 29 Apr 2020 01:41:33 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728381AbgD1Plc (ORCPT ); Tue, 28 Apr 2020 11:41:32 -0400 Received: from correo.us.es ([193.147.175.20]:49366 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728131AbgD1Pla (ORCPT ); Tue, 28 Apr 2020 11:41:30 -0400 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id 89C841F0CE6 for ; Tue, 28 Apr 2020 17:41:28 +0200 (CEST) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 79ADABAAB5 for ; Tue, 28 Apr 2020 17:41:28 +0200 (CEST) Received: by antivirus1-rhel7.int (Postfix, from userid 99) id 6F6C4BAAB4; Tue, 28 Apr 2020 17:41:28 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on antivirus1-rhel7.int X-Spam-Level: X-Spam-Status: No, score=-108.2 required=7.5 tests=ALL_TRUSTED,BAYES_50, SMTPAUTH_US2,URIBL_BLOCKED,USER_IN_WHITELIST autolearn=disabled version=3.4.1 Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 763A120670 for ; Tue, 28 Apr 2020 17:41:26 +0200 (CEST) Received: from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int (F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); Tue, 28 Apr 2020 17:41:26 +0200 (CEST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int) Received: from localhost.localdomain (unknown [90.77.255.23]) (Authenticated sender: pneira@us.es) by entrada.int (Postfix) with ESMTPA id 645E542EF4E1 for ; Tue, 28 Apr 2020 17:41:26 +0200 (CEST) X-SMTPAUTHUS: auth mail.us.es From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v3 4/9] src: add STMT_NAT_F_CONCAT flag and use it Date: Tue, 28 Apr 2020 17:41:15 +0200 Message-Id: <20200428154120.20061-5-pablo@netfilter.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200428154120.20061-1-pablo@netfilter.org> References: <20200428154120.20061-1-pablo@netfilter.org> MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Replace ipportmap boolean field by flags. Signed-off-by: Pablo Neira Ayuso --- include/statement.h | 2 +- src/evaluate.c | 2 +- src/netlink_delinearize. | 0 src/netlink_delinearize.c | 2 +- src/netlink_linearize.c | 6 +++--- src/parser_bison.y | 2 +- src/statement.c | 2 +- 7 files changed, 8 insertions(+), 8 deletions(-) create mode 100644 src/netlink_delinearize. diff --git a/include/statement.h b/include/statement.h index 01fe416c415a..7d96b3947dfc 100644 --- a/include/statement.h +++ b/include/statement.h @@ -122,6 +122,7 @@ extern const char *nat_etype2str(enum nft_nat_etypes type); enum { STMT_NAT_F_INTERVAL = (1 << 0), STMT_NAT_F_PREFIX = (1 << 1), + STMT_NAT_F_CONCAT = (1 << 2), }; struct nat_stmt { @@ -130,7 +131,6 @@ struct nat_stmt { struct expr *proto; uint32_t flags; uint8_t family; - bool ipportmap; uint32_t type_flags; }; diff --git a/src/evaluate.c b/src/evaluate.c index a116f7b66e07..cad65cfb7343 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -2973,7 +2973,7 @@ static int stmt_evaluate_nat(struct eval_ctx *ctx, struct stmt *stmt) if (err < 0) return err; - if (stmt->nat.ipportmap) { + if (stmt->nat.type_flags & STMT_NAT_F_CONCAT) { err = stmt_evaluate_nat_map(ctx, stmt); if (err < 0) return err; diff --git a/src/netlink_delinearize. b/src/netlink_delinearize. new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index b039a1e3c7ac..772559c838f5 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -1110,7 +1110,7 @@ static void netlink_parse_nat(struct netlink_parse_ctx *ctx, if (is_nat_proto_map(addr, family)) { stmt->nat.family = family; - stmt->nat.ipportmap = true; + stmt->nat.type_flags |= STMT_NAT_F_CONCAT; ctx->stmt = stmt; return; } diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c index 944fcdae4ee9..08f7f89f1066 100644 --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -1127,15 +1127,15 @@ static void netlink_gen_nat_stmt(struct netlink_linearize_ctx *ctx, } } - if (stmt->nat.ipportmap) { + if (stmt->nat.type_flags & STMT_NAT_F_CONCAT) { /* nat_stmt evaluation step doesn't allow - * stmt->nat.ipportmap && stmt->nat.proto. + * STMT_NAT_F_CONCAT && stmt->nat.proto. */ assert(stmt->nat.proto == NULL); pmin_reg = amin_reg; - /* if ipportmap is set, the mapped type is a + /* if STMT_NAT_F_CONCAT is set, the mapped type is a * concatenation of 'addr . inet_service'. * The map lookup will then return the * concatenated value, so we need to skip diff --git a/src/parser_bison.y b/src/parser_bison.y index 3b470cc63235..b1e869d568a1 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -3192,7 +3192,7 @@ nat_stmt_args : stmt_expr { $0->nat.family = $1; $0->nat.addr = $6; - $0->nat.ipportmap = true; + $0->nat.type_flags = STMT_NAT_F_CONCAT; } | nf_key_proto INTERVAL TO stmt_expr { diff --git a/src/statement.c b/src/statement.c index 8a1cd6e04f61..21a1bc8d40dd 100644 --- a/src/statement.c +++ b/src/statement.c @@ -607,7 +607,7 @@ static void nat_stmt_print(const struct stmt *stmt, struct output_ctx *octx) break; } - if (stmt->nat.ipportmap) + if (stmt->nat.type_flags & STMT_NAT_F_CONCAT) nft_print(octx, " addr . port"); else if (stmt->nat.type_flags & STMT_NAT_F_PREFIX) nft_print(octx, " prefix"); From patchwork Tue Apr 28 15:41:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1278555 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=netfilter.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 49BQqJ46pqz9sTV for ; Wed, 29 Apr 2020 01:41:32 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728370AbgD1Plb (ORCPT ); Tue, 28 Apr 2020 11:41:31 -0400 Received: from correo.us.es ([193.147.175.20]:49368 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728346AbgD1Pl3 (ORCPT ); Tue, 28 Apr 2020 11:41:29 -0400 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id BF5D11F0CED for ; Tue, 28 Apr 2020 17:41:28 +0200 (CEST) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id B0DE0BAAB5 for ; Tue, 28 Apr 2020 17:41:28 +0200 (CEST) Received: by antivirus1-rhel7.int (Postfix, from userid 99) id A6756BAAB4; Tue, 28 Apr 2020 17:41:28 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on antivirus1-rhel7.int X-Spam-Level: X-Spam-Status: No, score=-108.2 required=7.5 tests=ALL_TRUSTED,BAYES_50, SMTPAUTH_US2,URIBL_BLOCKED,USER_IN_WHITELIST autolearn=disabled version=3.4.1 Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id C8848DA736 for ; Tue, 28 Apr 2020 17:41:26 +0200 (CEST) Received: from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int (F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); Tue, 28 Apr 2020 17:41:26 +0200 (CEST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int) Received: from localhost.localdomain (unknown [90.77.255.23]) (Authenticated sender: pneira@us.es) by entrada.int (Postfix) with ESMTPA id ACEC542EF4E0 for ; Tue, 28 Apr 2020 17:41:26 +0200 (CEST) X-SMTPAUTHUS: auth mail.us.es From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v3 5/9] evaluate: fix crash when handling concatenation without map Date: Tue, 28 Apr 2020 17:41:16 +0200 Message-Id: <20200428154120.20061-6-pablo@netfilter.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200428154120.20061-1-pablo@netfilter.org> References: <20200428154120.20061-1-pablo@netfilter.org> MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Fix a crash when map is not specified, e.g. nft add rule x y snat ip addr . port to 1.1.1.1 . 22 Signed-off-by: Pablo Neira Ayuso --- src/evaluate.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/evaluate.c b/src/evaluate.c index cad65cfb7343..8c227eb11402 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -2924,6 +2924,9 @@ static int stmt_evaluate_nat_map(struct eval_ctx *ctx, struct stmt *stmt) if (expr_evaluate(ctx, &stmt->nat.addr)) return -1; + if (stmt->nat.addr->etype != EXPR_MAP) + return 0; + data = stmt->nat.addr->mappings->set->data; datatype_set(data, dtype); From patchwork Tue Apr 28 15:41:17 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1278558 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=netfilter.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 49BQqL6SYxz9sTR for ; Wed, 29 Apr 2020 01:41:34 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728383AbgD1Plc (ORCPT ); Tue, 28 Apr 2020 11:41:32 -0400 Received: from correo.us.es ([193.147.175.20]:49374 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728350AbgD1Plb (ORCPT ); Tue, 28 Apr 2020 11:41:31 -0400 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id 1729F1F0CF6 for ; Tue, 28 Apr 2020 17:41:29 +0200 (CEST) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 07BD22067B for ; Tue, 28 Apr 2020 17:41:29 +0200 (CEST) Received: by antivirus1-rhel7.int (Postfix, from userid 99) id F0FEC20670; Tue, 28 Apr 2020 17:41:28 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on antivirus1-rhel7.int X-Spam-Level: X-Spam-Status: No, score=-108.2 required=7.5 tests=ALL_TRUSTED,BAYES_50, SMTPAUTH_US2,URIBL_BLOCKED,USER_IN_WHITELIST autolearn=disabled version=3.4.1 Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 13A79BAAAF for ; Tue, 28 Apr 2020 17:41:27 +0200 (CEST) Received: from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int (F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); Tue, 28 Apr 2020 17:41:27 +0200 (CEST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int) Received: from localhost.localdomain (unknown [90.77.255.23]) (Authenticated sender: pneira@us.es) by entrada.int (Postfix) with ESMTPA id 020A642EF4E0 for ; Tue, 28 Apr 2020 17:41:26 +0200 (CEST) X-SMTPAUTHUS: auth mail.us.es From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v3 6/9] tests: py: concatenation, netmap and nat mappings Date: Tue, 28 Apr 2020 17:41:17 +0200 Message-Id: <20200428154120.20061-7-pablo@netfilter.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200428154120.20061-1-pablo@netfilter.org> References: <20200428154120.20061-1-pablo@netfilter.org> MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Signed-off-by: Pablo Neira Ayuso --- tests/py/ip/snat.t | 4 ++++ tests/py/ip/snat.t.payload | 27 +++++++++++++++++++++++++++ 2 files changed, 31 insertions(+) diff --git a/tests/py/ip/snat.t b/tests/py/ip/snat.t index 7281bf5fa7e0..c6e8a8e68f9d 100644 --- a/tests/py/ip/snat.t +++ b/tests/py/ip/snat.t @@ -8,3 +8,7 @@ iifname "eth0" tcp dport {80, 90, 23} snat to 192.168.3.2;ok iifname "eth0" tcp dport != {80, 90, 23} snat to 192.168.3.2;ok iifname "eth0" tcp dport != 23-34 snat to 192.168.3.2;ok + +snat ip addr . port to ip saddr map { 10.141.11.4 : 192.168.2.3 . 80 };ok +snat ip interval to ip saddr map { 10.141.11.4 : 192.168.2.2-192.168.2.4 };ok +snat ip prefix to ip saddr map { 10.141.11.0/24 : 192.168.2.0/24 };ok diff --git a/tests/py/ip/snat.t.payload b/tests/py/ip/snat.t.payload index 789933ffd650..22befe155dde 100644 --- a/tests/py/ip/snat.t.payload +++ b/tests/py/ip/snat.t.payload @@ -60,3 +60,30 @@ ip test-ip4 postrouting [ immediate reg 1 0x0203a8c0 ] [ nat snat ip addr_min reg 1 addr_max reg 0 ] +# snat ip addr . port to ip saddr map { 10.141.11.4 : 192.168.2.3 . 80 } +__map%d test-ip4 b size 1 +__map%d test-ip4 0 + element 040b8d0a : 0302a8c0 00005000 0 [end] +ip + [ payload load 4b @ network header + 12 => reg 1 ] + [ lookup reg 1 set __map%d dreg 1 ] + [ nat snat ip addr_min reg 1 addr_max reg 0 proto_min reg 9 proto_max reg 0 ] + +# snat ip interval to ip saddr map { 10.141.11.4 : 192.168.2.2-192.168.2.4 } +__map%d test-ip4 b size 1 +__map%d test-ip4 0 + element 040b8d0a : 0202a8c0 0402a8c0 0 [end] +ip + [ payload load 4b @ network header + 12 => reg 1 ] + [ lookup reg 1 set __map%d dreg 1 ] + [ nat snat ip addr_min reg 1 addr_max reg 9 ] + +# snat ip prefix to ip saddr map { 10.141.11.0/24 : 192.168.2.0/24 } +__map%d test-ip4 f size 3 +__map%d test-ip4 0 + element 00000000 : 1 [end] element 000b8d0a : 0002a8c0 ff02a8c0 0 [end] element 000c8d0a : 1 [end] +ip + [ payload load 4b @ network header + 12 => reg 1 ] + [ lookup reg 1 set __map%d dreg 1 ] + [ nat snat ip addr_min reg 1 addr_max reg 9 flags 0x40 ] + From patchwork Tue Apr 28 15:41:18 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1278561 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=netfilter.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 49BQqQ0KF2z9sTY for ; Wed, 29 Apr 2020 01:41:37 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728399AbgD1Ple (ORCPT ); Tue, 28 Apr 2020 11:41:34 -0400 Received: from correo.us.es ([193.147.175.20]:49380 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728362AbgD1Plb (ORCPT ); Tue, 28 Apr 2020 11:41:31 -0400 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id 958AE1F0CF9 for ; Tue, 28 Apr 2020 17:41:29 +0200 (CEST) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 86AB3BAAA1 for ; Tue, 28 Apr 2020 17:41:29 +0200 (CEST) Received: by antivirus1-rhel7.int (Postfix, from userid 99) id 7C3C8BAAB5; Tue, 28 Apr 2020 17:41:29 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on antivirus1-rhel7.int X-Spam-Level: X-Spam-Status: No, score=-108.2 required=7.5 tests=ALL_TRUSTED,BAYES_50, SMTPAUTH_US2,URIBL_BLOCKED,USER_IN_WHITELIST autolearn=disabled version=3.4.1 Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 6AD4BBAAA1 for ; Tue, 28 Apr 2020 17:41:27 +0200 (CEST) Received: from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int (F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); Tue, 28 Apr 2020 17:41:27 +0200 (CEST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int) Received: from localhost.localdomain (unknown [90.77.255.23]) (Authenticated sender: pneira@us.es) by entrada.int (Postfix) with ESMTPA id 4F7AE42EF4E0 for ; Tue, 28 Apr 2020 17:41:27 +0200 (CEST) X-SMTPAUTHUS: auth mail.us.es From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v3 7/9] mnl: restore --debug=netlink output with sets Date: Tue, 28 Apr 2020 17:41:18 +0200 Message-Id: <20200428154120.20061-8-pablo@netfilter.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200428154120.20061-1-pablo@netfilter.org> References: <20200428154120.20061-1-pablo@netfilter.org> MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org (null) (null) b size 1 The debugging output displays table and set names as (null). This patch sets the table and name before displaying the netlink debugging, then unset them to not break the extended error support. Fixes: 086ec6f30c96 ("mnl: extended error support for create command") Signed-off-by: Pablo Neira Ayuso --- src/mnl.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/mnl.c b/src/mnl.c index fb34ecb3dece..94e80261afb7 100644 --- a/src/mnl.c +++ b/src/mnl.c @@ -960,6 +960,8 @@ int mnl_nft_set_add(struct netlink_ctx *ctx, struct cmd *cmd, memory_allocation_error(); nftnl_set_set_u32(nls, NFTNL_SET_FAMILY, h->family); + nftnl_set_set_str(nls, NFTNL_SET_TABLE, h->table.name); + nftnl_set_set_str(nls, NFTNL_SET_NAME, h->set.name); nftnl_set_set_u32(nls, NFTNL_SET_ID, h->set_id); nftnl_set_set_u32(nls, NFTNL_SET_FLAGS, set->flags); @@ -1036,6 +1038,9 @@ int mnl_nft_set_add(struct netlink_ctx *ctx, struct cmd *cmd, netlink_dump_set(nls, ctx); + nftnl_set_unset(nls, NFTNL_SET_TABLE); + nftnl_set_unset(nls, NFTNL_SET_NAME); + nlh = nftnl_nlmsg_build_hdr(nftnl_batch_buffer(ctx->batch), NFT_MSG_NEWSET, h->family, From patchwork Tue Apr 28 15:41:19 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1278560 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=netfilter.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 49BQqP0HNwz9sTX for ; Wed, 29 Apr 2020 01:41:37 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728394AbgD1Pld (ORCPT ); Tue, 28 Apr 2020 11:41:33 -0400 Received: from correo.us.es ([193.147.175.20]:49378 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728365AbgD1Plb (ORCPT ); Tue, 28 Apr 2020 11:41:31 -0400 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id B40911F0CEB for ; Tue, 28 Apr 2020 17:41:29 +0200 (CEST) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id A4A2CBAAB4 for ; Tue, 28 Apr 2020 17:41:29 +0200 (CEST) Received: by antivirus1-rhel7.int (Postfix, from userid 99) id 9A446BAAA1; Tue, 28 Apr 2020 17:41:29 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on antivirus1-rhel7.int X-Spam-Level: X-Spam-Status: No, score=-108.2 required=7.5 tests=ALL_TRUSTED,BAYES_50, SMTPAUTH_US2,URIBL_BLOCKED,USER_IN_WHITELIST autolearn=disabled version=3.4.1 Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id B66ACBAABA for ; Tue, 28 Apr 2020 17:41:27 +0200 (CEST) Received: from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int (F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); Tue, 28 Apr 2020 17:41:27 +0200 (CEST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int) Received: from localhost.localdomain (unknown [90.77.255.23]) (Authenticated sender: pneira@us.es) by entrada.int (Postfix) with ESMTPA id 9A7FA42EF4E0 for ; Tue, 28 Apr 2020 17:41:27 +0200 (CEST) X-SMTPAUTHUS: auth mail.us.es From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v3 8/9] tests: py: remove range test with service names Date: Tue, 28 Apr 2020 17:41:19 +0200 Message-Id: <20200428154120.20061-9-pablo@netfilter.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200428154120.20061-1-pablo@netfilter.org> References: <20200428154120.20061-1-pablo@netfilter.org> MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Service names printing are not default these days, using service names with ranges is misleading. Signed-off-by: Pablo Neira Ayuso --- tests/py/inet/dccp.t | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/py/inet/dccp.t b/tests/py/inet/dccp.t index f0dd788b8b36..9a81bb2e60f3 100644 --- a/tests/py/inet/dccp.t +++ b/tests/py/inet/dccp.t @@ -12,7 +12,6 @@ dccp sport {23, 24, 25};ok dccp sport != {23, 24, 25};ok dccp sport { 20-50 };ok -dccp sport ftp-data - re-mail-ck;ok;dccp sport 20-50 dccp sport 20-50;ok dccp sport { 20-50};ok dccp sport != { 20-50};ok From patchwork Tue Apr 28 15:41:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1278559 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=netfilter.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 49BQqM4RnSz9sTV for ; Wed, 29 Apr 2020 01:41:35 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728390AbgD1Pld (ORCPT ); Tue, 28 Apr 2020 11:41:33 -0400 Received: from correo.us.es ([193.147.175.20]:49368 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728361AbgD1Plb (ORCPT ); Tue, 28 Apr 2020 11:41:31 -0400 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id 1A2731F0CEA for ; Tue, 28 Apr 2020 17:41:30 +0200 (CEST) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 0A959BAAB5 for ; Tue, 28 Apr 2020 17:41:30 +0200 (CEST) Received: by antivirus1-rhel7.int (Postfix, from userid 99) id 00230BAAB4; Tue, 28 Apr 2020 17:41:29 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on antivirus1-rhel7.int X-Spam-Level: X-Spam-Status: No, score=-108.2 required=7.5 tests=ALL_TRUSTED,BAYES_50, SMTPAUTH_US2,URIBL_BLOCKED,USER_IN_WHITELIST autolearn=disabled version=3.4.1 Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id F33B9BAAB8 for ; Tue, 28 Apr 2020 17:41:27 +0200 (CEST) Received: from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int (F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); Tue, 28 Apr 2020 17:41:27 +0200 (CEST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int) Received: from localhost.localdomain (unknown [90.77.255.23]) (Authenticated sender: pneira@us.es) by entrada.int (Postfix) with ESMTPA id E1BA842EF4E0 for ; Tue, 28 Apr 2020 17:41:27 +0200 (CEST) X-SMTPAUTHUS: auth mail.us.es From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v3 9/9] tests: shell: add NAT mappings tests Date: Tue, 28 Apr 2020 17:41:20 +0200 Message-Id: <20200428154120.20061-10-pablo@netfilter.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200428154120.20061-1-pablo@netfilter.org> References: <20200428154120.20061-1-pablo@netfilter.org> MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Signed-off-by: Pablo Neira Ayuso --- tests/shell/testcases/sets/0046netmap_0 | 14 +++++++++++++ tests/shell/testcases/sets/0047nat_0 | 20 +++++++++++++++++++ .../testcases/sets/dumps/0046netmap_0.nft | 6 ++++++ .../shell/testcases/sets/dumps/0047nat_0.nft | 13 ++++++++++++ 4 files changed, 53 insertions(+) create mode 100755 tests/shell/testcases/sets/0046netmap_0 create mode 100755 tests/shell/testcases/sets/0047nat_0 create mode 100644 tests/shell/testcases/sets/dumps/0046netmap_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0047nat_0.nft diff --git a/tests/shell/testcases/sets/0046netmap_0 b/tests/shell/testcases/sets/0046netmap_0 new file mode 100755 index 000000000000..2804a4a27ede --- /dev/null +++ b/tests/shell/testcases/sets/0046netmap_0 @@ -0,0 +1,14 @@ +#!/bin/bash + +EXPECTED="table ip x { + chain y { + type nat hook postrouting priority srcnat; policy accept; + snat ip prefix to ip saddr map { 10.141.11.0/24 : 192.168.2.0/24, + 10.141.12.0/24 : 192.168.3.0/24, + 10.141.13.0/24 : 192.168.4.0/24 } + } + } +" + +set -e +$NFT -f - <<< $EXPECTED diff --git a/tests/shell/testcases/sets/0047nat_0 b/tests/shell/testcases/sets/0047nat_0 new file mode 100755 index 000000000000..746a6b6d3450 --- /dev/null +++ b/tests/shell/testcases/sets/0047nat_0 @@ -0,0 +1,20 @@ +#!/bin/bash + +EXPECTED="table ip x { + map y { + type ipv4_addr : interval ipv4_addr + flags interval + elements = { 10.141.10.0/24 : 192.168.2.2-192.168.2.4, + 10.141.11.0/24 : 192.168.4.2-192.168.4.3 } + } + + chain y { + type nat hook postrouting priority srcnat; policy accept; + snat ip interval to ip saddr map @y + } + } +" + +set -e +$NFT -f - <<< $EXPECTED +$NFT add element x y { 10.141.12.0/24 : 192.168.5.10-192.168.5.20 } diff --git a/tests/shell/testcases/sets/dumps/0046netmap_0.nft b/tests/shell/testcases/sets/dumps/0046netmap_0.nft new file mode 100644 index 000000000000..e14c33954313 --- /dev/null +++ b/tests/shell/testcases/sets/dumps/0046netmap_0.nft @@ -0,0 +1,6 @@ +table ip x { + chain y { + type nat hook postrouting priority srcnat; policy accept; + snat ip prefix to ip saddr map { 10.141.11.0/24 : 192.168.2.0/24, 10.141.12.0/24 : 192.168.3.0/24, 10.141.13.0/24 : 192.168.4.0/24 } + } +} diff --git a/tests/shell/testcases/sets/dumps/0047nat_0.nft b/tests/shell/testcases/sets/dumps/0047nat_0.nft new file mode 100644 index 000000000000..70730ef3c56f --- /dev/null +++ b/tests/shell/testcases/sets/dumps/0047nat_0.nft @@ -0,0 +1,13 @@ +table ip x { + map y { + type ipv4_addr : interval ipv4_addr + flags interval + elements = { 10.141.10.0/24 : 192.168.2.2-192.168.2.4, 10.141.11.0/24 : 192.168.4.2/31, + 10.141.12.0/24 : 192.168.5.10-192.168.5.20 } + } + + chain y { + type nat hook postrouting priority srcnat; policy accept; + snat ip interval to ip saddr map @y + } +}