From 7f742d0a9071f932836b4f8525a6d3f7261ae083 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 21 Jun 2019 10:28:37 +0200 Subject: ct: support for NFT_CT_{SRC,DST}_{IP,IP6} These keys are available since kernel >= 4.17. You can still use NFT_CT_{SRC,DST}, however, you need to specify 'meta protocol' in first place to provide layer 3 context. Note that NFT_CT_{SRC,DST} are broken with set, maps and concatenations. This patch is implicitly fixing these cases. If your kernel is < 4.17, you can still use address matching via explicit meta nfproto: meta nfproto ipv4 ct original saddr 1.2.3.4 Signed-off-by: Pablo Neira Ayuso --- tests/py/any/ct.t | 4 ++-- tests/py/inet/ct.t.json | 3 +-- tests/py/inet/ct.t.json.output | 1 - tests/py/inet/ct.t.payload | 5 ++--- tests/py/ip/ct.t.json | 24 ++++++++---------------- tests/py/ip/ct.t.payload | 16 ++++++++-------- 6 files changed, 21 insertions(+), 32 deletions(-) (limited to 'tests') diff --git a/tests/py/any/ct.t b/tests/py/any/ct.t index 81d937d9..267eca1a 100644 --- a/tests/py/any/ct.t +++ b/tests/py/any/ct.t @@ -97,10 +97,10 @@ ct both bytes gt 1;fail ct bytes original reply;fail # missing direction -ct saddr 1.2.3.4;fail +ct ip saddr 1.2.3.4;fail # wrong base (ip6 but ipv4 address given) -meta nfproto ipv6 ct original saddr 1.2.3.4;fail +meta nfproto ipv6 ct original ip saddr 1.2.3.4;fail # direction, but must be used without ct original mark 42;fail diff --git a/tests/py/inet/ct.t.json b/tests/py/inet/ct.t.json index 02bb2d27..d0c26aef 100644 --- a/tests/py/inet/ct.t.json +++ b/tests/py/inet/ct.t.json @@ -30,8 +30,7 @@ "left": { "ct": { "dir": "original", - "family": "ip6", - "key": "saddr" + "key": "ip6 saddr" } }, "op": "==", diff --git a/tests/py/inet/ct.t.json.output b/tests/py/inet/ct.t.json.output index 8b71519e..74c436a3 100644 --- a/tests/py/inet/ct.t.json.output +++ b/tests/py/inet/ct.t.json.output @@ -5,7 +5,6 @@ "left": { "ct": { "dir": "original", - "family": "ip", "key": "saddr" } }, diff --git a/tests/py/inet/ct.t.payload b/tests/py/inet/ct.t.payload index 97128ecc..83146869 100644 --- a/tests/py/inet/ct.t.payload +++ b/tests/py/inet/ct.t.payload @@ -7,7 +7,6 @@ ip test-ip4 output # ct original ip6 saddr ::1 inet test-inet input - [ ct load l3protocol => reg 1 , dir original ] - [ cmp eq reg 1 0x0000000a ] - [ ct load src => reg 1 , dir original ] + [ ct load src_ip6 => reg 1 , dir original ] [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x01000000 ] + diff --git a/tests/py/ip/ct.t.json b/tests/py/ip/ct.t.json index cc3ab692..881cd4c9 100644 --- a/tests/py/ip/ct.t.json +++ b/tests/py/ip/ct.t.json @@ -5,8 +5,7 @@ "left": { "ct": { "dir": "original", - "family": "ip", - "key": "saddr" + "key": "ip saddr" } }, "op": "==", @@ -22,8 +21,7 @@ "left": { "ct": { "dir": "reply", - "family": "ip", - "key": "saddr" + "key": "ip saddr" } }, "op": "==", @@ -39,8 +37,7 @@ "left": { "ct": { "dir": "original", - "family": "ip", - "key": "daddr" + "key": "ip daddr" } }, "op": "==", @@ -56,8 +53,7 @@ "left": { "ct": { "dir": "reply", - "family": "ip", - "key": "daddr" + "key": "ip daddr" } }, "op": "==", @@ -73,8 +69,7 @@ "left": { "ct": { "dir": "original", - "family": "ip", - "key": "saddr" + "key": "ip saddr" } }, "op": "==", @@ -95,8 +90,7 @@ "left": { "ct": { "dir": "reply", - "family": "ip", - "key": "saddr" + "key": "ip saddr" } }, "op": "==", @@ -117,8 +111,7 @@ "left": { "ct": { "dir": "original", - "family": "ip", - "key": "daddr" + "key": "ip daddr" } }, "op": "==", @@ -139,8 +132,7 @@ "left": { "ct": { "dir": "reply", - "family": "ip", - "key": "daddr" + "key": "ip daddr" } }, "op": "==", diff --git a/tests/py/ip/ct.t.payload b/tests/py/ip/ct.t.payload index b7cd130d..d5faed4c 100644 --- a/tests/py/ip/ct.t.payload +++ b/tests/py/ip/ct.t.payload @@ -1,44 +1,44 @@ # ct original ip saddr 192.168.0.1 ip test-ip4 output - [ ct load src => reg 1 , dir original ] + [ ct load src_ip => reg 1 , dir original ] [ cmp eq reg 1 0x0100a8c0 ] # ct reply ip saddr 192.168.0.1 ip test-ip4 output - [ ct load src => reg 1 , dir reply ] + [ ct load src_ip => reg 1 , dir reply ] [ cmp eq reg 1 0x0100a8c0 ] # ct original ip daddr 192.168.0.1 ip test-ip4 output - [ ct load dst => reg 1 , dir original ] + [ ct load dst_ip => reg 1 , dir original ] [ cmp eq reg 1 0x0100a8c0 ] # ct reply ip daddr 192.168.0.1 ip test-ip4 output - [ ct load dst => reg 1 , dir reply ] + [ ct load dst_ip => reg 1 , dir reply ] [ cmp eq reg 1 0x0100a8c0 ] # ct original ip saddr 192.168.1.0/24 ip test-ip4 output - [ ct load src => reg 1 , dir original ] + [ ct load src_ip => reg 1 , dir original ] [ bitwise reg 1 = (reg=1 & 0x00ffffff ) ^ 0x00000000 ] [ cmp eq reg 1 0x0001a8c0 ] # ct reply ip saddr 192.168.1.0/24 ip test-ip4 output - [ ct load src => reg 1 , dir reply ] + [ ct load src_ip => reg 1 , dir reply ] [ bitwise reg 1 = (reg=1 & 0x00ffffff ) ^ 0x00000000 ] [ cmp eq reg 1 0x0001a8c0 ] # ct original ip daddr 192.168.1.0/24 ip test-ip4 output - [ ct load dst => reg 1 , dir original ] + [ ct load dst_ip => reg 1 , dir original ] [ bitwise reg 1 = (reg=1 & 0x00ffffff ) ^ 0x00000000 ] [ cmp eq reg 1 0x0001a8c0 ] # ct reply ip daddr 192.168.1.0/24 ip test-ip4 output - [ ct load dst => reg 1 , dir reply ] + [ ct load dst_ip => reg 1 , dir reply ] [ bitwise reg 1 = (reg=1 & 0x00ffffff ) ^ 0x00000000 ] [ cmp eq reg 1 0x0001a8c0 ] -- cgit v1.2.3