netfilter: helper set support

PATCH In review Florian Westphal 2 participants 5 messages Mar 8, 2017 – Mar 13, 2017

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Florian Westphal

author maintainer

2017-03-08 16:18 UTC #0 lore raw

cover netfilter: helper set support

This adds support to set the conntrack helper from nftables, using nft set ct helper "foo" syntax.

Helpers are defined through the objref infrastructure.

Open question: should NFT_MSG_GETOBJ_RESET get rejected for this new type?

A future patch could extend the attributes so we can also handle module specific settings, such as ftp loose mode, or configure the number of allowed expectations.

 include/net/netfilter/nf_tables.h        |    3 ++-
 include/net/netfilter/nf_tables.h        |    3 
 include/uapi/linux/netfilter/nf_tables.h |   12 +-
 net/netfilter/nf_tables_api.c            |    7 -
 net/netfilter/nft_counter.c              |    3 
 net/netfilter/nft_ct.c                   |  171 +++++++++++++++++++++++++++++++
 net/netfilter/nft_quota.c                |    3 
 6 files changed, 192 insertions(+), 7 deletions(-)

Florian Westphal

author maintainer

2017-03-08 16:17 UTC #1 lore raw

PATCH 1/2 netfilter: provide nft_ctxc in object init function

this is needed by the upcoming ct helper object type -- we'd like to be able use the table family (ip, ip6, inet) to figure out which helper has to be requested.

Signed-off-by Florian Westphal <[email protected]>

---
 include/net/netfilter/nf_tables.h | 3 ++-
 net/netfilter/nf_tables_api.c     | 7 ++++---
 net/netfilter/nft_counter.c       | 3 ++-
 net/netfilter/nft_quota.c         | 3 ++-
 4 files changed, 10 insertions(+), 6 deletions(-)

include/net/netfilter/nf_tables.h +2 -1

index ac84686aaafb..9fdb6f560995 100644
@@ -1016,7 +1016,8 @@ struct nft_object_type {
 	unsigned int			maxattr;
 	struct module			*owner;
 	const struct nla_policy		*policy;
-	int				(*init)(const struct nlattr * const tb[],
+	int				(*init)(const struct nft_ctx *ctx,
+						const struct nlattr *const tb[],
 						struct nft_object *obj);
 	void				(*destroy)(struct nft_object *obj);
 	int				(*dump)(struct sk_buff *skb,

net/netfilter/nf_tables_api.c +4 -3

index ff7304ae58ac..2a34de1e2103 100644
@@ -4084,7 +4084,8 @@ static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
 	[NFTA_OBJ_DATA]		= { .type = NLA_NESTED },
 };
 
-static struct nft_object *nft_obj_init(const struct nft_object_type *type,
+static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
+				       const struct nft_object_type *type,
 				       const struct nlattr *attr)
 {
 	struct nlattr *tb[type->maxattr + 1];

@@ -4104,7 +4105,7 @@ static struct nft_object *nft_obj_init(const struct nft_object_type *type,
 	if (obj == NULL)
 		goto err1;
 
-	err = type->init((const struct nlattr * const *)tb, obj);
+	err = type->init(ctx, (const struct nlattr * const *)tb, obj);
 	if (err < 0)
 		goto err2;

@@ -4212,7 +4213,7 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
 	if (IS_ERR(type))
 		return PTR_ERR(type);
 
-	obj = nft_obj_init(type, nla[NFTA_OBJ_DATA]);
+	obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
 	if (IS_ERR(obj)) {
 		err = PTR_ERR(obj);
 		goto err1;

net/netfilter/nft_counter.c +2 -1

index 7f8422213341..67a710ebde09 100644
@@ -82,7 +82,8 @@ static int nft_counter_do_init(const struct nlattr * const tb[],
 	return 0;
 }
 
-static int nft_counter_obj_init(const struct nlattr * const tb[],
+static int nft_counter_obj_init(const struct nft_ctx *ctx,
+				const struct nlattr * const tb[],
 				struct nft_object *obj)
 {
 	struct nft_counter_percpu_priv *priv = nft_obj_data(obj);

net/netfilter/nft_quota.c +2 -1

index 2d6fe3559912..25e33159be57 100644
@@ -99,7 +99,8 @@ static int nft_quota_do_init(const struct nlattr * const tb[],
 	return 0;
 }
 
-static int nft_quota_obj_init(const struct nlattr * const tb[],
+static int nft_quota_obj_init(const struct nft_ctx *ctx,
+			      const struct nlattr * const tb[],
 			      struct nft_object *obj)
 {
 	struct nft_quota *priv = nft_obj_data(obj);

Signature · 1 line

2.10.2

Florian Westphal

author maintainer

2017-03-08 16:18 UTC #2 lore raw

PATCH 2/2 netfilter: nft_ct: add helper set support

In reply to Florian Westphal

this allows to assign connection tracking helpers to connections via nft objref infrastructure.

The idea is to first specifiy a helper object:

 table ip filter {
    ct helper some-name {
      type "ftp"
      protocol tcp
      l3proto ip
    }

}

and then assign it via

nft add ... ct helper set "some-name"

helper assignment works for new conntracks only as we cannot expand the conntrack extension area once it has been committed to the main conntrack table.

ipv4 and ipv6 protocols are tracked stored separately so we can also handle families that observe both ipv4 and ipv6 traffic.

Signed-off-by Florian Westphal <[email protected]>

---
 include/uapi/linux/netfilter/nf_tables.h |  12 ++-
 net/netfilter/nft_ct.c                   | 171 +++++++++++++++++++++++++++++++
 2 files changed, 182 insertions(+), 1 deletion(-)

include/uapi/linux/netfilter/nf_tables.h +11 -1

index 05215d30fe5c..121e79cacc49 100644
@@ -1246,10 +1246,20 @@ enum nft_fib_flags {
 	NFTA_FIB_F_OIF		= 1 << 4,	/* restrict to oif */
 };
 
+enum nft_ct_helper_attributes {
+	NFTA_CT_HELPER_UNSPEC,
+	NFTA_CT_HELPER_NAME,
+	NFTA_CT_HELPER_L3PROTO,
+	NFTA_CT_HELPER_L4PROTO,
+	__NFTA_CT_HELPER_MAX,
+};
+#define NFTA_CT_HELPER_MAX	(__NFTA_CT_HELPER_MAX - 1)
+
 #define NFT_OBJECT_UNSPEC	0
 #define NFT_OBJECT_COUNTER	1
 #define NFT_OBJECT_QUOTA	2
-#define __NFT_OBJECT_MAX	3
+#define NFT_OBJECT_CT_HELPER	3
+#define __NFT_OBJECT_MAX	4
 #define NFT_OBJECT_MAX		(__NFT_OBJECT_MAX - 1)
 
 /**

net/netfilter/nft_ct.c +171 -0

199 lines not on this page · raw message

Signature · 1 line

2.10.2

Pablo Neira Ayuso

maintainer

2017-03-08 16:45 UTC #3 lore raw

In reply to Florian Westphal

Quoted 6 lines · Florian Westphal

This adds support to set the conntrack helper from nftables, using nft set ct helper "foo" syntax.
Helpers are defined through the objref infrastructure.
Open question: should NFT_MSG_GETOBJ_RESET get rejected for this new type?

Yes. This is a stateless object, but that can be done in a follow up patch, no problem.

Thanks Florian.

Pablo Neira Ayuso

maintainer

2017-03-13 12:44 UTC #4 lore raw

In reply to Florian Westphal

Quoted 4 lines · Florian Westphal

This adds support to set the conntrack helper from nftables, using nft set ct helper "foo" syntax.
Helpers are defined through the objref infrastructure.

Series applied, thanks Florian.