interesting
/
nftables
mirror of https://github.com/google/nftables.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Compare commits

base: interesting:632b415f9d8c3c32158d05cec4001d0456bc33d3
Branches Tags
interesting:main
interesting:v0.3.0
interesting:v0.2.0
interesting:v0.1.0
..
compare: interesting:aa30b93857dddb0be257a5808db2ef2af6133f55
Branches Tags
interesting:main
interesting:v0.3.0
interesting:v0.2.0
interesting:v0.1.0

1 Commits
632b415f9d ... aa30b93857

Author SHA1 Message Date
Paul Greenberg aa30b93857
Merge dae73eaa9c into 9a9f2ce6b3 2024-09-03 11:39:30 +02:00
5 changed files with 5 additions and 272 deletions
Show Stats Expand all files Collapse all files

71
expr/ct.go
View File

@ -194,74 +194,3 @@ func (c *CtHelper) unmarshal(fam byte, data []byte) error {
}
return ad.Err()
}
// From https://git.netfilter.org/libnftnl/tree/include/linux/netfilter/nf_tables.h?id=be0bae0ad31b0adb506f96de083f52a2bd0d4fbf#n1601
// Currently not available in sys/unix
const (
NFTA_CT_EXPECT_L3PROTO = 0x01
NFTA_CT_EXPECT_L4PROTO = 0x02
NFTA_CT_EXPECT_DPORT = 0x03
NFTA_CT_EXPECT_TIMEOUT = 0x04
NFTA_CT_EXPECT_SIZE = 0x05
)
type CtExpect struct {
L3Proto uint16
L4Proto uint8
DPort uint16
Timeout uint32
Size uint8
}
func (c *CtExpect) marshal(fam byte) ([]byte, error) {
exprData, err := c.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("ctexpect\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: exprData},
})
}
func (c *CtExpect) marshalData(fam byte) ([]byte, error) {
// all elements except l3proto must be defined
// per https://git.netfilter.org/nftables/tree/doc/stateful-objects.txt?id=db70959a5ccf2952b218f51c3d529e186a5a43bb#n119
// from man page: l3proto is derived from the table family by default
exprData := []netlink.Attribute{
{Type: NFTA_CT_EXPECT_L4PROTO, Data: []byte{c.L4Proto}},
{Type: NFTA_CT_EXPECT_DPORT, Data: binaryutil.BigEndian.PutUint16(c.DPort)},
{Type: NFTA_CT_EXPECT_TIMEOUT, Data: binaryutil.BigEndian.PutUint32(c.Timeout)},
{Type: NFTA_CT_EXPECT_SIZE, Data: []byte{c.Size}},
}
if c.L3Proto != 0 {
attr := netlink.Attribute{Type: NFTA_CT_EXPECT_L3PROTO, Data: binaryutil.BigEndian.PutUint16(c.L3Proto)}
exprData = append(exprData, attr)
}
return netlink.MarshalAttributes(exprData)
}
func (c *CtExpect) unmarshal(fam byte, data []byte) error {
ad, err := netlink.NewAttributeDecoder(data)
if err != nil {
return err
}
ad.ByteOrder = binary.BigEndian
for ad.Next() {
switch ad.Type() {
case NFTA_CT_EXPECT_L3PROTO:
c.L3Proto = ad.Uint16()
case NFTA_CT_EXPECT_L4PROTO:
c.L4Proto = ad.Uint8()
case NFTA_CT_EXPECT_DPORT:
c.DPort = ad.Uint16()
case NFTA_CT_EXPECT_TIMEOUT:
c.Timeout = ad.Uint32()
case NFTA_CT_EXPECT_SIZE:
c.Size = ad.Uint8()
}
}
return ad.Err()
}

4
expr/expr.go
View File

@ -201,10 +201,6 @@ func exprFromName(name string) Any {
e = &CtHelper{}
case "synproxy":
e = &SynProxy{}
case "ctexpect":
e = &CtExpect{}
case "secmark":
e = &SecMark{}
}
return e
}

64
expr/secmark.go
View File

@ -1,64 +0,0 @@
// Copyright 2024 Google LLC. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package expr
import (
"encoding/binary"
"github.com/mdlayher/netlink"
"golang.org/x/sys/unix"
)
// From https://git.netfilter.org/libnftnl/tree/include/linux/netfilter/nf_tables.h?id=be0bae0ad31b0adb506f96de083f52a2bd0d4fbf#n1338
const (
NFTA_SECMARK_CTX = 0x01
)
type SecMark struct {
Ctx string
}
func (e *SecMark) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("secmark\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *SecMark) marshalData(fam byte) ([]byte, error) {
attrs := []netlink.Attribute{
{Type: NFTA_SECMARK_CTX, Data: []byte(e.Ctx)},
}
return netlink.MarshalAttributes(attrs)
}
func (e *SecMark) unmarshal(fam byte, data []byte) error {
ad, err := netlink.NewAttributeDecoder(data)
if err != nil {
return err
}
ad.ByteOrder = binary.BigEndian
for ad.Next() {
switch ad.Type() {
case NFTA_SECMARK_CTX:
e.Ctx = ad.String()
}
}
return ad.Err()
}

132
nftables_test.go
View File

@ -1398,68 +1398,6 @@ func TestCt(t *testing.T) {
}
}
func TestSecMarkMarshaling(t *testing.T) {
// Testing marshaling since secmark requires live selinux tag otherwise
// errors with conn.Receive: netlink receive: no such file or directory.
// More information available here:
// https://git.netfilter.org/nftables/tree/files/examples/secmark.nft?id=26d9cbefb10e6bc3765df7e9e7a4fc3b951a80f3#n6
want := [][]byte{
// batch begin
[]byte("\x00\x00\x00\x0a"),
// sudo nft add table inet filter
[]byte("\x01\x00\x00\x00\x0b\x00\x01\x00filter\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00"),
// sudo nft add secmark inet filter sshtag '{ ctx "system_u:object_r:ssh_server_packet_t:s0" }'
[]byte("\x01\x00\x00\x00\x0b\x00\x01\x00filter\x00\x00\x0b\x00\x02\x00sshtag\x00\x00\x08\x00\x03\x00\x00\x00\x00\x080\x00\x04\x80,\x00\x01\x00system_u:object_r:ssh_server_packet_t:s0"),
// batch end
[]byte("\x00\x00\x00\x0a"),
}
conn, err := nftables.New(nftables.WithTestDial(
func(req []netlink.Message) ([]netlink.Message, error) {
for idx, msg := range req {
b, err := msg.MarshalBinary()
if err != nil {
t.Fatal(err)
}
if len(b) < 16 {
continue
}
b = b[16:]
if len(want) == 0 {
t.Errorf("no want entry for message %d: %x", idx, b)
continue
}
if got, want := b, want[0]; !bytes.Equal(got, want) {
t.Errorf("message %d: %s", idx, linediff(nfdump(got), nfdump(want)))
}
want = want[1:]
}
return req, nil
}))
if err != nil {
t.Fatal(err)
}
table := conn.AddTable(&nftables.Table{
Family: nftables.TableFamilyINet,
Name: "filter",
})
sec := &nftables.NamedObj{
Table: table,
Name: "sshtag",
Type: nftables.ObjTypeSecMark,
Obj: &expr.SecMark{
Ctx: "system_u:object_r:ssh_server_packet_t:s0",
},
}
conn.AddObj(sec)
if err := conn.Flush(); err != nil {
t.Fatalf(err.Error())
}
}
func TestSynProxyObject(t *testing.T) {
conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
defer nftest.CleanupSystemConn(t, newNS)
@ -1505,6 +1443,7 @@ func TestSynProxyObject(t *testing.T) {
conn.AddObj(syn1)
conn.AddObj(syn2)
conn.AddObj(syn3)
if err := conn.Flush(); err != nil {
t.Fatalf(err.Error())
}
@ -1513,6 +1452,7 @@ func TestSynProxyObject(t *testing.T) {
if err != nil {
t.Errorf("c.GetObjects(table) failed: %v", err)
}
if got, want := len(objs), 3; got != want {
t.Fatalf("received %d objects, expected %d", got, want)
}
@ -1556,74 +1496,6 @@ func TestSynProxyObject(t *testing.T) {
}
}
func TestCtExpect(t *testing.T) {
conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
defer nftest.CleanupSystemConn(t, newNS)
conn.FlushRuleset()
defer conn.FlushRuleset()
table := conn.AddTable(&nftables.Table{
Family: nftables.TableFamilyIPv4,
Name: "filter",
})
cte := &nftables.NamedObj{
Table: table,
Name: "expect",
Type: nftables.ObjTypeCtExpect,
Obj: &expr.CtExpect{
L3Proto: unix.NFPROTO_IPV4,
L4Proto: unix.IPPROTO_TCP,
DPort: 53,
Timeout: 20,
Size: 100,
},
}
conn.AddObj(cte)
if err := conn.Flush(); err != nil {
t.Fatalf(err.Error())
}
objs, err := conn.GetNamedObjects(table)
if err != nil {
t.Errorf("c.GetObjects(table) failed: %v", err)
}
if got, want := len(objs), 1; got != want {
t.Fatalf("received %d objects, expected %d", got, want)
}
obj := objs[0].(*nftables.NamedObj)
if got, want := obj.Name, cte.Name; got != want {
t.Errorf("object names are not equal: got %s, want %s", got, want)
}
if got, want := obj.Type, cte.Type; got != want {
t.Errorf("object types are not equal: got %v, want %v", got, want)
}
if got, want := obj.Table.Name, cte.Table.Name; got != want {
t.Errorf("object tables are not equal: got %s, want %s", got, want)
}
ce1 := obj.Obj.(*expr.CtExpect)
ce2 := cte.Obj.(*expr.CtExpect)
if got, want := ce1.L3Proto, ce2.L3Proto; got != want {
t.Errorf("object l3proto not equal: got %d, want %d", got, want)
}
if got, want := ce1.L4Proto, ce2.L4Proto; got != want {
t.Errorf("object l4proto not equal: got %d, want %d", got, want)
}
if got, want := ce1.DPort, ce2.DPort; got != want {
t.Errorf("object dport not equal: got %d, want %d", got, want)
}
if got, want := ce1.Size, ce2.Size; got != want {
t.Errorf("object Size not equal: got %d, want %d", got, want)
}
if got, want := ce1.Timeout, ce2.Timeout; got != want {
t.Errorf("object timeout not equal: got %d, want %d", got, want)
}
}
func TestCtHelper(t *testing.T) {
conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
defer nftest.CleanupSystemConn(t, newNS)

6
obj.go
View File

@ -54,9 +54,9 @@ var objByObjTypeMagic = map[ObjType]string{
ObjTypeCtHelper: "cthelper",
ObjTypeTunnel: "tunnel", // not implemented in expr
ObjTypeCtTimeout: "cttimeout", // not implemented in expr
ObjTypeSecMark: "secmark",
ObjTypeCtExpect: "ctexpect",
ObjTypeSynProxy: "synproxy",
ObjTypeSecMark: "secmark", // not implemented in expr
ObjTypeCtExpect: "ctexpect", // not implemented in expr
ObjTypeSynProxy: "synproxy", // not implemented in expr
}
// Obj represents a netfilter stateful object. See also