diff options
author | Christian Göttsche <cgzones@googlemail.com> | 2019-11-23 17:22:39 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-11-25 15:44:00 +0100 |
commit | 2250296370752e516dc367f1239753b15efbea94 (patch) | |
tree | db51d55ea3f2fec79477ab35614994fb726d5fee /src/evaluate.c | |
parent | 3ecea86f855dd964c95b0481c9010ae200e90560 (diff) |
src: add ability to set/get secmarks to/from connection
Labeling established and related packets requires the secmark to be stored in the connection.
Add the ability to store and retrieve secmarks like:
...
chain input {
...
# label new incoming packets
ct state new meta secmark set tcp dport map @secmapping_in
# add label to connection
ct state new ct secmark set meta secmark
# set label for est/rel packets from connection
ct state established,related meta secmark set ct secmark
...
}
...
chain output {
...
# label new outgoing packets
ct state new meta secmark set tcp dport map @secmapping_out
# add label to connection
ct state new ct secmark set meta secmark
# set label for est/rel packets from connection
ct state established,related meta secmark set ct secmark
...
}
...
This patch also disallow constant value on the right hand side.
# nft add rule x y meta secmark 12
Error: Cannot be used with right hand side constant value
add rule x y meta secmark 12
~~~~~~~~~~~~ ^^
# nft add rule x y ct secmark 12
Error: Cannot be used with right hand side constant value
add rule x y ct secmark 12
~~~~~~~~~~ ^^
# nft add rule x y ct secmark set 12
Error: ct secmark must not be set to constant value
add rule x y ct secmark set 12
^^^^^^^^^^^^^^^^^
This patch improves 3bc84e5c1fdd ("src: add support for setting secmark").
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/evaluate.c')
-rw-r--r-- | src/evaluate.c | 24 |
1 files changed, 22 insertions, 2 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index e54eaf1a..a865902c 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1784,6 +1784,18 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr) left->dtype->desc, right->dtype->desc); + /* + * Statements like 'ct secmark 12' are parsed as relational, + * disallow constant value on the right hand side. + */ + if (((left->etype == EXPR_META && + left->meta.key == NFT_META_SECMARK) || + (left->etype == EXPR_CT && + left->ct.key == NFT_CT_SECMARK)) && + right->flags & EXPR_F_CONSTANT) + return expr_binary_error(ctx->msgs, right, left, + "Cannot be used with right hand side constant value"); + switch (rel->op) { case OP_EQ: case OP_IMPLICIT: @@ -2319,11 +2331,19 @@ static int stmt_evaluate_meta(struct eval_ctx *ctx, struct stmt *stmt) static int stmt_evaluate_ct(struct eval_ctx *ctx, struct stmt *stmt) { - return stmt_evaluate_arg(ctx, stmt, + if (stmt_evaluate_arg(ctx, stmt, stmt->ct.tmpl->dtype, stmt->ct.tmpl->len, stmt->ct.tmpl->byteorder, - &stmt->ct.expr); + &stmt->ct.expr) < 0) + return -1; + + if (stmt->ct.key == NFT_CT_SECMARK && + expr_is_constant(stmt->ct.expr)) + return stmt_error(ctx, stmt, + "ct secmark must not be set to constant value"); + + return 0; } static int reject_payload_gen_dependency_tcp(struct eval_ctx *ctx, |