Skip to content

Commit 1aef2ba

Browse files
zhaofeng0019zhaofeng0019
authored
Fix: add NFTA_RULE_COMPAT attribute (google#207)
xt_matches or xt_targets like xt_tcpudp may have specific compat policy and if not set flush rule will error with EINVAL according to https://elixir.bootlin.com/linux/v3.13/source/net/netfilter/x_tables.c#L563 Signed-off-by: xiaoff <[email protected]>
1 parent 130caa4 commit 1aef2ba

File tree

4 files changed

+298
-0
lines changed

4 files changed

+298
-0
lines changed

‎compat_policy.go

+89
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
package nftables
2+
3+
import (
4+
"fmt"
5+
6+
"github.com/google/nftables/expr"
7+
"golang.org/x/sys/unix"
8+
)
9+
10+
const nft_RULE_COMPAT_F_INV uint32 = (1 << 1)
11+
const nft_RULE_COMPAT_F_MASK uint32 = nft_RULE_COMPAT_F_INV
12+
13+
// Used by xt match or target like xt_tcpudp to set compat policy between xtables and nftables
14+
// https://elixir.bootlin.com/linux/v5.12/source/net/netfilter/nft_compat.c#L187
15+
type compatPolicy struct {
16+
Proto uint32
17+
Flag uint32
18+
}
19+
20+
var xtMatchCompatMap map[string]*compatPolicy = map[string]*compatPolicy{
21+
"tcp": {
22+
Proto: unix.IPPROTO_TCP,
23+
},
24+
"udp": {
25+
Proto: unix.IPPROTO_UDP,
26+
},
27+
"udplite": {
28+
Proto: unix.IPPROTO_UDPLITE,
29+
},
30+
"tcpmss": {
31+
Proto: unix.IPPROTO_TCP,
32+
},
33+
"sctp": {
34+
Proto: unix.IPPROTO_SCTP,
35+
},
36+
"osf": {
37+
Proto: unix.IPPROTO_TCP,
38+
},
39+
"ipcomp": {
40+
Proto: unix.IPPROTO_COMP,
41+
},
42+
"esp": {
43+
Proto: unix.IPPROTO_ESP,
44+
},
45+
}
46+
47+
var xtTargetCompatMap map[string]*compatPolicy = map[string]*compatPolicy{
48+
"TCPOPTSTRIP": {
49+
Proto: unix.IPPROTO_TCP,
50+
},
51+
"TCPMSS": {
52+
Proto: unix.IPPROTO_TCP,
53+
},
54+
}
55+
56+
func getCompatPolicy(exprs []expr.Any) (*compatPolicy, error) {
57+
var exprItem expr.Any
58+
var compat *compatPolicy
59+
60+
for _, iter := range exprs {
61+
var tmpExprItem expr.Any
62+
var tmpCompat *compatPolicy
63+
switch item := iter.(type) {
64+
case *expr.Match:
65+
if compat, ok := xtMatchCompatMap[item.Name]; ok {
66+
tmpCompat = compat
67+
tmpExprItem = item
68+
} else {
69+
continue
70+
}
71+
case *expr.Target:
72+
if compat, ok := xtTargetCompatMap[item.Name]; ok {
73+
tmpCompat = compat
74+
tmpExprItem = item
75+
} else {
76+
continue
77+
}
78+
default:
79+
continue
80+
}
81+
if compat == nil {
82+
compat = tmpCompat
83+
exprItem = tmpExprItem
84+
} else if *compat != *tmpCompat {
85+
return nil, fmt.Errorf("%#v and %#v has conflict compat policy %#v vs %#v", exprItem, tmpExprItem, compat, tmpCompat)
86+
}
87+
}
88+
return compat, nil
89+
}

‎compat_policy_test.go

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
package nftables
2+
3+
import (
4+
"testing"
5+
6+
"github.com/google/nftables/expr"
7+
"github.com/google/nftables/xt"
8+
"golang.org/x/sys/unix"
9+
)
10+
11+
func TestGetCompatPolicy(t *testing.T) {
12+
// -tcp --dport 0:65534 --sport 0:65534
13+
tcpMatch := &expr.Match{
14+
Name: "tcp",
15+
Info: &xt.Tcp{
16+
SrcPorts: [2]uint16{0, 65534},
17+
DstPorts: [2]uint16{0, 65534},
18+
},
19+
}
20+
21+
// -udp --dport 0:65534 --sport 0:65534
22+
udpMatch := &expr.Match{
23+
Name: "udp",
24+
Info: &xt.Udp{
25+
SrcPorts: [2]uint16{0, 65534},
26+
DstPorts: [2]uint16{0, 65534},
27+
},
28+
}
29+
30+
// -j TCPMSS --set-mss 1460
31+
mess := xt.Unknown([]byte{1460 & 0xff, (1460 >> 8) & 0xff})
32+
tcpMessTarget := &expr.Target{
33+
Name: "TCPMESS",
34+
Info: &mess,
35+
}
36+
37+
// -m state --state ESTABLISHED
38+
ctMatch := &expr.Match{
39+
Name: "conntrack",
40+
Rev: 1,
41+
Info: &xt.ConntrackMtinfo1{
42+
ConntrackMtinfoBase: xt.ConntrackMtinfoBase{
43+
MatchFlags: 0x2001,
44+
},
45+
StateMask: 0x02,
46+
},
47+
}
48+
49+
// compatPolicy.Proto should be tcp
50+
if compatPolicy, err := getCompatPolicy([]expr.Any{
51+
tcpMatch,
52+
tcpMessTarget,
53+
ctMatch,
54+
}); err != nil {
55+
t.Fatalf("getCompatPolicy fail %#v", err)
56+
} else if compatPolicy.Proto != unix.IPPROTO_TCP {
57+
t.Fatalf("getCompatPolicy wrong %#v", compatPolicy)
58+
}
59+
60+
// should conflict
61+
if _, err := getCompatPolicy([]expr.Any{
62+
udpMatch,
63+
tcpMatch,
64+
},
65+
); err == nil {
66+
t.Fatalf("getCompatPolicy fail err should not be nil")
67+
}
68+
69+
// compatPolicy should be nil
70+
if compatPolicy, err := getCompatPolicy([]expr.Any{
71+
ctMatch,
72+
}); err != nil {
73+
t.Fatalf("getCompatPolicy fail %#v", err)
74+
} else if compatPolicy != nil {
75+
t.Fatalf("getCompatPolicy fail compat policy of conntrack match should be nil")
76+
}
77+
}

‎nftables_test.go

+121
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ import (
3131
"github.com/google/nftables/binaryutil"
3232
"github.com/google/nftables/expr"
3333
"github.com/google/nftables/internal/nftest"
34+
"github.com/google/nftables/xt"
3435
"github.com/mdlayher/netlink"
3536
"github.com/vishvananda/netns"
3637
"golang.org/x/sys/unix"
@@ -6039,3 +6040,123 @@ func TestGetRulesQueue(t *testing.T) {
60396040
t.Errorf("queue expr = %+v, wanted %+v", queueExpr, want)
60406041
}
60416042
}
6043+
6044+
func TestNftablesCompat(t *testing.T) {
6045+
// Create a new network namespace to test these operations,
6046+
// and tear down the namespace at test completion.
6047+
c, newNS := openSystemNFTConn(t)
6048+
defer cleanupSystemNFTConn(t, newNS)
6049+
// Clear all rules at the beginning + end of the test.
6050+
c.FlushRuleset()
6051+
defer c.FlushRuleset()
6052+
6053+
filter := c.AddTable(&nftables.Table{
6054+
Family: nftables.TableFamilyIPv4,
6055+
Name: "filter",
6056+
})
6057+
6058+
input := c.AddChain(&nftables.Chain{
6059+
Name: "input",
6060+
Table: filter,
6061+
Type: nftables.ChainTypeFilter,
6062+
Hooknum: nftables.ChainHookInput,
6063+
Priority: nftables.ChainPriorityFilter,
6064+
})
6065+
6066+
// -tcp --dport 0:65534 --sport 0:65534
6067+
tcpMatch := &expr.Match{
6068+
Name: "tcp",
6069+
Info: &xt.Tcp{
6070+
SrcPorts: [2]uint16{0, 65534},
6071+
DstPorts: [2]uint16{0, 65534},
6072+
},
6073+
}
6074+
6075+
// -udp --dport 0:65534 --sport 0:65534
6076+
udpMatch := &expr.Match{
6077+
Name: "udp",
6078+
Info: &xt.Udp{
6079+
SrcPorts: [2]uint16{0, 65534},
6080+
DstPorts: [2]uint16{0, 65534},
6081+
},
6082+
}
6083+
6084+
// - j TCPMSS --set-mss 1460
6085+
mess := xt.Unknown([]byte{1460 & 0xff, (1460 >> 8) & 0xff})
6086+
tcpMessTarget := &expr.Target{
6087+
Name: "TCPMSS",
6088+
Info: &mess,
6089+
}
6090+
6091+
// -m state --state ESTABLISHED
6092+
ctMatch := &expr.Match{
6093+
Name: "conntrack",
6094+
Rev: 1,
6095+
Info: &xt.ConntrackMtinfo1{
6096+
ConntrackMtinfoBase: xt.ConntrackMtinfoBase{
6097+
MatchFlags: 0x2001,
6098+
},
6099+
StateMask: 0x02,
6100+
},
6101+
}
6102+
6103+
// -p tcp --dport --dport 0:65534 --sport 0:65534 -m state --state ESTABLISHED -j TCPMSS --set-mss 1460
6104+
c.AddRule(&nftables.Rule{
6105+
Table: filter,
6106+
Chain: input,
6107+
Exprs: []expr.Any{
6108+
tcpMatch,
6109+
ctMatch,
6110+
tcpMessTarget,
6111+
},
6112+
})
6113+
if err := c.Flush(); err != nil {
6114+
t.Fatalf("add rule fail %#v", err)
6115+
}
6116+
6117+
c.AddRule(&nftables.Rule{
6118+
Table: filter,
6119+
Chain: input,
6120+
Exprs: []expr.Any{
6121+
udpMatch,
6122+
&expr.Verdict{
6123+
Kind: expr.VerdictAccept,
6124+
},
6125+
},
6126+
})
6127+
if err := c.Flush(); err != nil {
6128+
t.Fatalf("add rule %#v fail", err)
6129+
}
6130+
6131+
// -m state --state ESTABLISHED -j ACCEPT
6132+
c.AddRule(&nftables.Rule{
6133+
Table: filter,
6134+
Chain: input,
6135+
Exprs: []expr.Any{
6136+
ctMatch,
6137+
&expr.Verdict{
6138+
Kind: expr.VerdictAccept,
6139+
},
6140+
},
6141+
})
6142+
if err := c.Flush(); err != nil {
6143+
t.Fatalf("add rule %#v fail", err)
6144+
}
6145+
6146+
// -p udp --dport --dport 0:65534 --sport 0:65534 -m state --state ESTABLISHED -j ACCEPT
6147+
c.AddRule(&nftables.Rule{
6148+
Table: filter,
6149+
Chain: input,
6150+
Exprs: []expr.Any{
6151+
tcpMatch,
6152+
udpMatch,
6153+
ctMatch,
6154+
&expr.Verdict{
6155+
Kind: expr.VerdictAccept,
6156+
},
6157+
},
6158+
})
6159+
if err := c.Flush(); err == nil {
6160+
t.Fatalf("compat policy should conflict and err should not be err")
6161+
}
6162+
}

‎rule.go

+11
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,17 @@ func (cc *Conn) newRule(r *Rule, op ruleOperation) *Rule {
133133
{Type: unix.NLA_F_NESTED | unix.NFTA_RULE_EXPRESSIONS, Data: cc.marshalAttr(exprAttrs)},
134134
})...)
135135

136+
if compatPolicy, err := getCompatPolicy(r.Exprs); err != nil {
137+
cc.setErr(err)
138+
} else if compatPolicy != nil {
139+
data = append(data, cc.marshalAttr([]netlink.Attribute{
140+
{Type: unix.NLA_F_NESTED | unix.NFTA_RULE_COMPAT, Data: cc.marshalAttr([]netlink.Attribute{
141+
{Type: unix.NFTA_RULE_COMPAT_PROTO, Data: binaryutil.BigEndian.PutUint32(compatPolicy.Proto)},
142+
{Type: unix.NFTA_RULE_COMPAT_FLAGS, Data: binaryutil.BigEndian.PutUint32(compatPolicy.Flag & nft_RULE_COMPAT_F_MASK)},
143+
})},
144+
})...)
145+
}
146+
136147
msgData := []byte{}
137148

138149
msgData = append(msgData, data...)

0 commit comments

Comments
 (0)