src: Add support for native socket matching

Signed-off-by: Máté Eckl <ecklm94@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/libnftnl/expr.h b/include/libnftnl/expr.h
index 45ff5334f6a0277a5cb902cec4c2ee0e4376fb85..3dcd7dc645e4fa966f26ebe7cf9b42556ef59a3a 100644 (file)
--- a/include/libnftnl/expr.h
+++ b/include/libnftnl/expr.h
@@ -72,6 +72,11 @@ enum {
        NFTNL_EXPR_RT_DREG,
 };
 
+enum {
+       NFTNL_EXPR_SOCKET_KEY   = NFTNL_EXPR_BASE,
+       NFTNL_EXPR_SOCKET_DREG,
+};
+
 enum {
        NFTNL_EXPR_CMP_SREG     = NFTNL_EXPR_BASE,
        NFTNL_EXPR_CMP_OP,

diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index 660168ab924a3b7394578b3968254ded125d3c4e..db80d5318729bcbdf3c8c2446c7e1275ca0009a3 100644 (file)
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -904,6 +904,31 @@ enum nft_rt_attributes {
 };
 #define NFTA_RT_MAX            (__NFTA_RT_MAX - 1)
 
+/**
+ * enum nft_socket_attributes - nf_tables socket expression netlink attributes
+ *
+ * @NFTA_SOCKET_KEY: socket key to match
+ * @NFTA_SOCKET_DREG: destination register
+ */
+enum nft_socket_attributes {
+       NFTA_SOCKET_UNSPEC,
+       NFTA_SOCKET_KEY,
+       NFTA_SOCKET_DREG,
+       __NFTA_SOCKET_MAX
+};
+#define NFTA_SOCKET_MAX                (__NFTA_SOCKET_MAX - 1)
+
+/*
+ * enum nft_socket_keys - nf_tables socket expression keys
+ *
+ * @NFT_SOCKET_TRANSPARENT: Value of the IP(V6)_TRANSPARENT socket option_
+ */
+enum nft_socket_keys {
+       NFT_SOCKET_TRANSPARENT,
+       __NFT_SOCKET_MAX
+};
+#define NFT_SOCKET_MAX (__NFT_SOCKET_MAX - 1)
+
 /**
  * enum nft_ct_keys - nf_tables ct expression keys
  *

diff --git a/src/Makefile.am b/src/Makefile.am
index 578b7d36d8a948aa656951035aba1c91e5ba1d9d..cd063728ec4c079af8f6f212b28e1161f657b552 100644 (file)
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -54,6 +54,7 @@ libnftnl_la_SOURCES = utils.c         \
                      expr/masq.c       \
                      expr/redir.c      \
                      expr/hash.c       \
+                     expr/socket.c     \
                      obj/counter.c     \
                      obj/ct_helper.c   \
                      obj/quota.c       \

diff --git a/src/expr/socket.c b/src/expr/socket.c
new file mode 100644 (file)
index 0000000..db160a1
--- /dev/null
+++ b/src/expr/socket.c
@@ -0,0 +1,208 @@
+/*
+ * Copyright (c) 2018 Máté Eckl <ecklm94@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_socket {
+       enum nft_socket_keys    key;
+       enum nft_registers      dreg;
+};
+
+static int
+nftnl_expr_socket_set(struct nftnl_expr *e, uint16_t type,
+                      const void *data, uint32_t data_len)
+{
+       struct nftnl_expr_socket *socket = nftnl_expr_data(e);
+
+       switch (type) {
+       case NFTNL_EXPR_SOCKET_KEY:
+               socket->key = *((uint32_t *)data);
+               break;
+       case NFTNL_EXPR_SOCKET_DREG:
+               socket->dreg = *((uint32_t *)data);
+               break;
+       default:
+               return -1;
+       }
+       return 0;
+}
+
+static const void *
+nftnl_expr_socket_get(const struct nftnl_expr *e, uint16_t type,
+                      uint32_t *data_len)
+{
+       struct nftnl_expr_socket *socket = nftnl_expr_data(e);
+
+       switch (type) {
+       case NFTNL_EXPR_SOCKET_KEY:
+               *data_len = sizeof(socket->key);
+               return &socket->key;
+       case NFTNL_EXPR_SOCKET_DREG:
+               *data_len = sizeof(socket->dreg);
+               return &socket->dreg;
+       }
+       return NULL;
+}
+
+static int nftnl_expr_socket_cb(const struct nlattr *attr, void *data)
+{
+       const struct nlattr **tb = data;
+       int type = mnl_attr_get_type(attr);
+
+       if (mnl_attr_type_valid(attr, NFTA_SOCKET_MAX) < 0)
+               return MNL_CB_OK;
+
+       switch (type) {
+       case NFTA_SOCKET_KEY:
+       case NFTA_SOCKET_DREG:
+               if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+                       abi_breakage();
+               break;
+       }
+
+       tb[type] = attr;
+       return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_socket_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+       struct nftnl_expr_socket *socket = nftnl_expr_data(e);
+
+       if (e->flags & (1 << NFTNL_EXPR_SOCKET_KEY))
+               mnl_attr_put_u32(nlh, NFTA_SOCKET_KEY, htonl(socket->key));
+       if (e->flags & (1 << NFTNL_EXPR_SOCKET_DREG))
+               mnl_attr_put_u32(nlh, NFTA_SOCKET_DREG, htonl(socket->dreg));
+}
+
+static int
+nftnl_expr_socket_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+       struct nftnl_expr_socket *socket = nftnl_expr_data(e);
+       struct nlattr *tb[NFTA_SOCKET_MAX+1] = {};
+
+       if (mnl_attr_parse_nested(attr, nftnl_expr_socket_cb, tb) < 0)
+               return -1;
+
+       if (tb[NFTA_SOCKET_KEY]) {
+               socket->key = ntohl(mnl_attr_get_u32(tb[NFTA_SOCKET_KEY]));
+               e->flags |= (1 << NFTNL_EXPR_SOCKET_KEY);
+       }
+       if (tb[NFTA_SOCKET_DREG]) {
+               socket->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_SOCKET_DREG]));
+               e->flags |= (1 << NFTNL_EXPR_SOCKET_DREG);
+       }
+
+       return 0;
+}
+
+static const char *socket_key2str_array[NFT_SOCKET_MAX + 1] = {
+       [NFT_SOCKET_TRANSPARENT] = "transparent",
+};
+
+static const char *socket_key2str(uint8_t key)
+{
+       if (key < NFT_SOCKET_MAX + 1)
+               return socket_key2str_array[key];
+
+       return "unknown";
+}
+
+static inline int str2socket_key(const char *str)
+{
+       int i;
+
+       for (i = 0; i < NFT_SOCKET_MAX + 1; i++) {
+               if (strcmp(str, socket_key2str_array[i]) == 0)
+                       return i;
+       }
+
+       errno = EINVAL;
+       return -1;
+}
+
+static int
+nftnl_expr_socket_snprintf_default(char *buf, size_t len,
+                              const struct nftnl_expr *e)
+{
+       struct nftnl_expr_socket *socket = nftnl_expr_data(e);
+
+       if (e->flags & (1 << NFTNL_EXPR_SOCKET_DREG)) {
+               return snprintf(buf, len, "load %s => reg %u ",
+                               socket_key2str(socket->key), socket->dreg);
+       }
+       return 0;
+}
+
+static int nftnl_expr_socket_export(char *buf, size_t size,
+                                 const struct nftnl_expr *e, int type)
+{
+       struct nftnl_expr_socket *socket = nftnl_expr_data(e);
+       NFTNL_BUF_INIT(b, buf, size);
+
+       if (e->flags & (1 << NFTNL_EXPR_SOCKET_DREG))
+               nftnl_buf_u32(&b, type, socket->dreg, DREG);
+       if (e->flags & (1 << NFTNL_EXPR_SOCKET_KEY))
+               nftnl_buf_str(&b, type, socket_key2str(socket->key), KEY);
+
+       return nftnl_buf_done(&b);
+}
+
+static int
+nftnl_expr_socket_snprintf(char *buf, size_t len, uint32_t type,
+                      uint32_t flags, const struct nftnl_expr *e)
+{
+       switch (type) {
+       case NFTNL_OUTPUT_DEFAULT:
+               return nftnl_expr_socket_snprintf_default(buf, len, e);
+       case NFTNL_OUTPUT_XML:
+       case NFTNL_OUTPUT_JSON:
+               return nftnl_expr_socket_export(buf, len, e, type);
+       default:
+               break;
+       }
+       return -1;
+}
+
+static bool nftnl_expr_socket_cmp(const struct nftnl_expr *e1,
+                             const struct nftnl_expr *e2)
+{
+       struct nftnl_expr_socket *r1 = nftnl_expr_data(e1);
+       struct nftnl_expr_socket *r2 = nftnl_expr_data(e2);
+       bool eq = true;
+
+       if (e1->flags & (1 << NFTNL_EXPR_SOCKET_KEY))
+               eq &= (r1->key == r2->key);
+       if (e1->flags & (1 << NFTNL_EXPR_SOCKET_DREG))
+               eq &= (r1->dreg == r2->dreg);
+
+       return eq;
+}
+
+struct expr_ops expr_ops_socket = {
+       .name           = "socket",
+       .alloc_len      = sizeof(struct nftnl_expr_socket),
+       .max_attr       = NFTA_SOCKET_MAX,
+       .cmp            = nftnl_expr_socket_cmp,
+       .set            = nftnl_expr_socket_set,
+       .get            = nftnl_expr_socket_get,
+       .parse          = nftnl_expr_socket_parse,
+       .build          = nftnl_expr_socket_build,
+       .snprintf       = nftnl_expr_socket_snprintf,
+};

diff --git a/src/expr_ops.c b/src/expr_ops.c
index 041bd357d370e4f48f35126d3cde63d033bd26a3..9df55fd4f3776d04dd37e9bb0c068034b5852b5b 100644 (file)
--- a/src/expr_ops.c
+++ b/src/expr_ops.c
@@ -34,6 +34,7 @@ extern struct expr_ops expr_ops_dynset;
 extern struct expr_ops expr_ops_hash;
 extern struct expr_ops expr_ops_fib;
 extern struct expr_ops expr_ops_flow;
+extern struct expr_ops expr_ops_socket;
 
 static struct expr_ops expr_ops_notrack = {
        .name   = "notrack",
@@ -71,6 +72,7 @@ static struct expr_ops *expr_ops[] = {
        &expr_ops_fib,
        &expr_ops_objref,
        &expr_ops_flow,
+       &expr_ops_socket,
        NULL,
 };