From 2250296370752e516dc367f1239753b15efbea94 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= Date: Sat, 23 Nov 2019 17:22:39 +0100 Subject: src: add ability to set/get secmarks to/from connection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Labeling established and related packets requires the secmark to be stored in the connection. Add the ability to store and retrieve secmarks like: ... chain input { ... # label new incoming packets ct state new meta secmark set tcp dport map @secmapping_in # add label to connection ct state new ct secmark set meta secmark # set label for est/rel packets from connection ct state established,related meta secmark set ct secmark ... } ... chain output { ... # label new outgoing packets ct state new meta secmark set tcp dport map @secmapping_out # add label to connection ct state new ct secmark set meta secmark # set label for est/rel packets from connection ct state established,related meta secmark set ct secmark ... } ... This patch also disallow constant value on the right hand side. # nft add rule x y meta secmark 12 Error: Cannot be used with right hand side constant value add rule x y meta secmark 12 ~~~~~~~~~~~~ ^^ # nft add rule x y ct secmark 12 Error: Cannot be used with right hand side constant value add rule x y ct secmark 12 ~~~~~~~~~~ ^^ # nft add rule x y ct secmark set 12 Error: ct secmark must not be set to constant value add rule x y ct secmark set 12 ^^^^^^^^^^^^^^^^^ This patch improves 3bc84e5c1fdd ("src: add support for setting secmark"). Signed-off-by: Christian Göttsche Signed-off-by: Pablo Neira Ayuso --- src/evaluate.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) (limited to 'src/evaluate.c') diff --git a/src/evaluate.c b/src/evaluate.c index e54eaf1a..a865902c 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1784,6 +1784,18 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr) left->dtype->desc, right->dtype->desc); + /* + * Statements like 'ct secmark 12' are parsed as relational, + * disallow constant value on the right hand side. + */ + if (((left->etype == EXPR_META && + left->meta.key == NFT_META_SECMARK) || + (left->etype == EXPR_CT && + left->ct.key == NFT_CT_SECMARK)) && + right->flags & EXPR_F_CONSTANT) + return expr_binary_error(ctx->msgs, right, left, + "Cannot be used with right hand side constant value"); + switch (rel->op) { case OP_EQ: case OP_IMPLICIT: @@ -2319,11 +2331,19 @@ static int stmt_evaluate_meta(struct eval_ctx *ctx, struct stmt *stmt) static int stmt_evaluate_ct(struct eval_ctx *ctx, struct stmt *stmt) { - return stmt_evaluate_arg(ctx, stmt, + if (stmt_evaluate_arg(ctx, stmt, stmt->ct.tmpl->dtype, stmt->ct.tmpl->len, stmt->ct.tmpl->byteorder, - &stmt->ct.expr); + &stmt->ct.expr) < 0) + return -1; + + if (stmt->ct.key == NFT_CT_SECMARK && + expr_is_constant(stmt->ct.expr)) + return stmt_error(ctx, stmt, + "ct secmark must not be set to constant value"); + + return 0; } static int reject_payload_gen_dependency_tcp(struct eval_ctx *ctx, -- cgit v1.2.3