interesting
/
nftables
mirror of https://github.com/google/nftables.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Compare commits

base: interesting:e816228183e4c923ff75681331fa81ae275433c0
Branches Tags
interesting:main
interesting:v0.3.0
interesting:v0.2.0
interesting:v0.1.0
..
compare: interesting:613ce0ba52c3d9643a6609618f44b7469d032458
Branches Tags
interesting:main
interesting:v0.3.0
interesting:v0.2.0
interesting:v0.1.0

1 Commits
e816228183 ... 613ce0ba52

Author SHA1 Message Date
Paul Greenberg 613ce0ba52
Merge dae73eaa9c into 6ddeb7caed 2024-08-15 09:45:08 +02:00
3 changed files with 0 additions and 218 deletions
Show Stats Expand all files Collapse all files

2
expr/expr.go
View File

@ -199,8 +199,6 @@ func exprFromName(name string) Any {
e = &Hash{} e = &Hash{}
case "cthelper": case "cthelper":
e = &CtHelper{} e = &CtHelper{}
case "synproxy":
e = &SynProxy{}
} }
return e return e
} }

118
expr/synproxy.go
View File

@ -1,118 +0,0 @@
// Copyright 2024 Google LLC. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package expr
import (
"encoding/binary"
"github.com/google/nftables/binaryutil"
"github.com/mdlayher/netlink"
"golang.org/x/sys/unix"
)
type SynProxy struct {
Mss uint16
Wscale uint8
Timestamp bool
SackPerm bool
// Probably not expected to be set by users
// https://github.com/torvalds/linux/blob/521b1e7f4cf0b05a47995b103596978224b380a8/net/netfilter/nft_synproxy.c#L30-L31
Ecn bool
// True when Mss is set to a value or if 0 is an intended value of Mss
MssValueSet bool
// True when Wscale is set to a value or if 0 is an intended value of Wscale
WscaleValueSet bool
}
// From https://git.netfilter.org/libnftnl/tree/include/linux/netfilter/nf_tables.h?id=be0bae0ad31b0adb506f96de083f52a2bd0d4fbf#n1723
// Currently not available in golang.org/x/sys/unix
const (
NFTA_SYNPROXY_MSS = 0x01
NFTA_SYNPROXY_WSCALE = 0x02
NFTA_SYNPROXY_FLAGS = 0x03
)
// From https://github.com/torvalds/linux/blob/521b1e7f4cf0b05a47995b103596978224b380a8/include/uapi/linux/netfilter/nf_synproxy.h#L7-L15
// Currently not available in golang.org/x/sys/unix
const (
NF_SYNPROXY_OPT_MSS = 0x01
NF_SYNPROXY_OPT_WSCALE = 0x02
NF_SYNPROXY_OPT_SACK_PERM = 0x04
NF_SYNPROXY_OPT_TIMESTAMP = 0x08
NF_SYNPROXY_OPT_ECN = 0x10
)
func (e *SynProxy) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("synproxy\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *SynProxy) marshalData(fam byte) ([]byte, error) {
var flags uint32
if e.Mss != 0 || e.MssValueSet {
flags |= NF_SYNPROXY_OPT_MSS
}
if e.Wscale != 0 || e.WscaleValueSet {
flags |= NF_SYNPROXY_OPT_WSCALE
}
if e.SackPerm {
flags |= NF_SYNPROXY_OPT_SACK_PERM
}
if e.Timestamp {
flags |= NF_SYNPROXY_OPT_TIMESTAMP
}
if e.Ecn {
flags |= NF_SYNPROXY_OPT_ECN
}
attrs := []netlink.Attribute{
{Type: NFTA_SYNPROXY_MSS, Data: binaryutil.BigEndian.PutUint16(e.Mss)},
{Type: NFTA_SYNPROXY_WSCALE, Data: []byte{e.Wscale}},
{Type: NFTA_SYNPROXY_FLAGS, Data: binaryutil.BigEndian.PutUint32(flags)},
}
return netlink.MarshalAttributes(attrs)
}
func (e *SynProxy) unmarshal(fam byte, data []byte) error {
ad, err := netlink.NewAttributeDecoder(data)
if err != nil {
return err
}
ad.ByteOrder = binary.BigEndian
for ad.Next() {
switch ad.Type() {
case NFTA_SYNPROXY_MSS:
e.Mss = ad.Uint16()
case NFTA_SYNPROXY_WSCALE:
e.Wscale = ad.Uint8()
case NFTA_SYNPROXY_FLAGS:
flags := ad.Uint32()
checkFlag := func(flag uint32) bool {
return (flags & flag) == flag
}
e.MssValueSet = checkFlag(NF_SYNPROXY_OPT_MSS)
e.WscaleValueSet = checkFlag(NF_SYNPROXY_OPT_WSCALE)
e.SackPerm = checkFlag(NF_SYNPROXY_OPT_SACK_PERM)
e.Timestamp = checkFlag(NF_SYNPROXY_OPT_TIMESTAMP)
e.Ecn = checkFlag(NF_SYNPROXY_OPT_ECN)
}
}
return ad.Err()
}

98
nftables_test.go
View File

@ -1398,104 +1398,6 @@ func TestCt(t *testing.T) {
} }
} }
func TestSynProxyObject(t *testing.T) {
conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
defer nftest.CleanupSystemConn(t, newNS)
conn.FlushRuleset()
defer conn.FlushRuleset()
table := conn.AddTable(&nftables.Table{
Family: nftables.TableFamilyINet,
Name: "filter",
})
syn1 := &nftables.NamedObj{
Table: table,
Name: "https-synproxy",
Type: nftables.ObjTypeSynProxy,
Obj: &expr.SynProxy{
Mss: 1,
Wscale: 2,
Timestamp: true,
SackPerm: true,
// set for equals test below
MssValueSet: true,
WscaleValueSet: true,
},
}
syn2 := &nftables.NamedObj{
Table: table,
Name: "https-synproxy-empty",
Type: nftables.ObjTypeSynProxy,
Obj: &expr.SynProxy{},
}
syn3 := &nftables.NamedObj{
Table: table,
Name: "https-synproxy-zero",
Type: nftables.ObjTypeSynProxy,
Obj: &expr.SynProxy{
Mss: 0,
Wscale: 0,
MssValueSet: true,
WscaleValueSet: true,
},
}
conn.AddObj(syn1)
conn.AddObj(syn2)
conn.AddObj(syn3)
if err := conn.Flush(); err != nil {
t.Fatalf(err.Error())
}
objs, err := conn.GetNamedObjects(table)
if err != nil {
t.Errorf("c.GetObjects(table) failed: %v", err)
}
if got, want := len(objs), 3; got != want {
t.Fatalf("received %d objects, expected %d", got, want)
}
synObjs := []*nftables.NamedObj{syn1, syn2, syn3}
for i := 0; i < len(objs); i++ {
obj := objs[i].(*nftables.NamedObj)
syn := synObjs[i]
if got, want := obj.Name, syn.Name; got != want {
t.Errorf("object %d names are not equal: got %s, want %s", i, got, want)
}
if got, want := obj.Type, syn.Type; got != want {
t.Errorf("object %d types are not equal: got %v, want %v", i, got, want)
}
if got, want := obj.Table.Name, syn.Table.Name; got != want {
t.Errorf("object %d tables are not equal: got %s, want %s", i, got, want)
}
sp1 := obj.Obj.(*expr.SynProxy)
sp2 := syn.Obj.(*expr.SynProxy)
if got, want := sp1.Mss, sp2.Mss; got != want {
t.Errorf("object %d mss' are not equal: got %d, want %d", i, got, want)
}
if got, want := sp1.Wscale, sp2.Wscale; got != want {
t.Errorf("object %d wscales are not equal: got %d, want %d", i, got, want)
}
if got, want := sp1.Timestamp, sp2.Timestamp; got != want {
t.Errorf("object %d timestamp flags are not equal: got %v, want %v", i, got, want)
}
if got, want := sp1.SackPerm, sp2.SackPerm; got != want {
t.Errorf("object %d sack-perm flags are not equal: got %v, want %v", i, got, want)
}
if got, want := sp1.MssValueSet, sp2.MssValueSet; got != want {
t.Errorf("object %d MssValueSet flags are not equal: got %v, want %v", i, got, want)
}
if got, want := sp1.WscaleValueSet, sp2.WscaleValueSet; got != want {
t.Errorf("object %d WscaleValueSet flags are not equal: got %v, want %v", i, got, want)
}
if got, want := sp1.Ecn, sp2.Ecn; got != want {
t.Errorf("object %d Ecn flags are not equal: got %v, want %v", i, got, want)
}
}
}
func TestCtHelper(t *testing.T) { func TestCtHelper(t *testing.T) {
conn, newNS := nftest.OpenSystemConn(t, *enableSysTests) conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
defer nftest.CleanupSystemConn(t, newNS) defer nftest.CleanupSystemConn(t, newNS)