src: tproxy: relax family restrictions

evaluation step currently prohibits

tproxy ip to 1.2.3.4 in ip family, and
tproxy ip6 to dead::1 in ip6.

This seems an arbitrary limitation, just accept this.
The current restriction would make json output support harder than needed,
as the tproxy expression generated from json path would have to
special-case the table its currently in, rather than just using the
family attribute in the json output.

We obviously still reject the family in case it mismatches
the table family (e.g., can't use ip address in ip6 table).

Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/src/evaluate.c b/src/evaluate.c
index 685924dfadd920c8bc0692149399e4cdc11ed430..a3a7874440e85d3d36ec3edef84fa54606ec86c4 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2487,12 +2487,16 @@ static int stmt_evaluate_nat(struct eval_ctx *ctx, struct stmt *stmt)
 
 static int stmt_evaluate_tproxy(struct eval_ctx *ctx, struct stmt *stmt)
 {
+       const struct proto_desc *nproto;
        const struct datatype *dtype;
        int err, len;
 
        switch (ctx->pctx.family) {
        case NFPROTO_IPV4:
-       case NFPROTO_IPV6:
+       case NFPROTO_IPV6: /* fallthrough */
+               if (stmt->tproxy.family == NFPROTO_UNSPEC)
+                       stmt->tproxy.family = ctx->pctx.family;
+               break;
        case NFPROTO_INET:
                break;
        default:
@@ -2507,22 +2511,14 @@ static int stmt_evaluate_tproxy(struct eval_ctx *ctx, struct stmt *stmt)
        if (!stmt->tproxy.addr && !stmt->tproxy.port)
                return stmt_error(ctx, stmt, "Either address or port must be specified!");
 
-       if (ctx->pctx.family != NFPROTO_INET) {
-               if (stmt->tproxy.family != NFPROTO_UNSPEC)
-                       return stmt_error(ctx, stmt, "Family can only be specified in inet tables.");
-               stmt->tproxy.family = ctx->pctx.family;
-       }
-       else {
-               const struct proto_desc *nproto =
-                       ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc;
-               if ((nproto == &proto_ip && stmt->tproxy.family == NFPROTO_IPV6) ||
-                   (nproto == &proto_ip6 && stmt->tproxy.family == NFPROTO_IPV4))
-                       /* this prevents us from rules like
-                        * ip protocol tcp tproxy ip6 to [dead::beef]
-                        */
-                       return stmt_error(ctx, stmt,
-                                         "Conflicting network layer protocols.");
-       }
+       nproto = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc;
+       if ((nproto == &proto_ip && stmt->tproxy.family != NFPROTO_IPV4) ||
+           (nproto == &proto_ip6 && stmt->tproxy.family != NFPROTO_IPV6))
+               /* this prevents us from rules like
+                * ip protocol tcp tproxy ip6 to [dead::beef]
+                */
+               return stmt_error(ctx, stmt,
+                                 "Conflicting network layer protocols.");
 
        if (stmt->tproxy.addr != NULL) {
                if (stmt->tproxy.addr->ops->type == EXPR_RANGE)

diff --git a/tests/py/ip/tproxy.t b/tests/py/ip/tproxy.t
index 6e959f47bff62e784e564e2bb1900051273bc70b..dbd8f5e90a04b7669106ae359e05cb1ec458ceeb 100644 (file)
--- a/tests/py/ip/tproxy.t
+++ b/tests/py/ip/tproxy.t
@@ -9,6 +9,6 @@ tproxy to :50080;fail
 meta l4proto 17 tproxy to 192.0.2.1;ok
 meta l4proto 6 tproxy to 192.0.2.1:50080;ok
 ip protocol 6 tproxy to :50080;ok
-meta l4proto 17 tproxy ip to 192.0.2.1;fail
-meta l4proto 6 tproxy ip to 192.0.2.1:50080;fail
+meta l4proto 17 tproxy ip to 192.0.2.1;ok;meta l4proto 17 tproxy to 192.0.2.1
+meta l4proto 6 tproxy ip to 192.0.2.1:50080;ok;meta l4proto 6 tproxy to 192.0.2.1:50080
 ip protocol 6 tproxy ip to :50080;fail

diff --git a/tests/py/ip/tproxy.t.payload b/tests/py/ip/tproxy.t.payload
index 9a899a8de96670afb3b45c629f73423bdd1e34da..035651f48cb3068962ff8b830b6bff647939e1b1 100644 (file)
--- a/tests/py/ip/tproxy.t.payload
+++ b/tests/py/ip/tproxy.t.payload
@@ -20,3 +20,17 @@ ip x y
   [ immediate reg 1 0x0000a0c3 ]
   [ tproxy ip port reg 1 ]
 
+# meta l4proto 17 tproxy ip to 192.0.2.1
+ip x y 
+  [ meta load l4proto => reg 1 ]
+  [ cmp eq reg 1 0x00000011 ]
+  [ immediate reg 1 0x010200c0 ]
+  [ tproxy ip addr reg 1 ]
+
+# meta l4proto 6 tproxy ip to 192.0.2.1:50080
+ip x y 
+  [ meta load l4proto => reg 1 ]
+  [ cmp eq reg 1 0x00000006 ]
+  [ immediate reg 1 0x010200c0 ]
+  [ immediate reg 2 0x0000a0c3 ]
+  [ tproxy ip addr reg 1 port reg 2 ]

diff --git a/tests/py/ip6/tproxy.t b/tests/py/ip6/tproxy.t
index dcd2bd8f580aeaf40d4e28ae2552f2e4a26ce5e7..4e48d81f13cc98f5a8346a23660d13111d48daaa 100644 (file)
--- a/tests/py/ip6/tproxy.t
+++ b/tests/py/ip6/tproxy.t
@@ -9,8 +9,6 @@ tproxy to :50080;fail
 meta l4proto 6 tproxy to [2001:db8::1];ok
 meta l4proto 17 tproxy to [2001:db8::1]:50080;ok
 meta l4proto 6 tproxy to :50080;ok
-meta l4proto 6 tproxy ip6 to [2001:db8::1];fail
-meta l4proto 17 tproxy ip6 to [2001:db8::1]:50080;fail
+meta l4proto 6 tproxy ip6 to [2001:db8::1];ok;meta l4proto 6 tproxy to [2001:db8::1]
+meta l4proto 17 tproxy ip6 to [2001:db8::1]:50080;ok;meta l4proto 17 tproxy to [2001:db8::1]:50080
 meta l4proto 6 tproxy ip6 to :50080;fail
-
-

diff --git a/tests/py/ip6/tproxy.t.payload b/tests/py/ip6/tproxy.t.payload
index d03beee4940d988a9d6af526a83fb2379e913b98..c78c8a1dd20a740b80f4451cf90a7bda3a2f4ec9 100644 (file)
--- a/tests/py/ip6/tproxy.t.payload
+++ b/tests/py/ip6/tproxy.t.payload
@@ -20,14 +20,14 @@ ip6 x y
   [ immediate reg 1 0x0000a0c3 ]
   [ tproxy ip6 port reg 1 ]
 
-# meta l4proto 6 tproxy to [2001:db8::1]
+# meta l4proto 6 tproxy ip6 to [2001:db8::1]
 ip6 x y 
   [ meta load l4proto => reg 1 ]
   [ cmp eq reg 1 0x00000006 ]
   [ immediate reg 1 0xb80d0120 0x00000000 0x00000000 0x01000000 ]
   [ tproxy ip6 addr reg 1 ]
 
-# meta l4proto 17 tproxy to [2001:db8::1]:50080
+# meta l4proto 17 tproxy ip6 to [2001:db8::1]:50080
 ip6 x y 
   [ meta load l4proto => reg 1 ]
   [ cmp eq reg 1 0x00000011 ]
@@ -35,10 +35,3 @@ ip6 x y
   [ immediate reg 2 0x0000a0c3 ]
   [ tproxy ip6 addr reg 1 port reg 2 ]
 
-# meta l4proto 6 tproxy to :50080
-ip6 x y 
-  [ meta load l4proto => reg 1 ]
-  [ cmp eq reg 1 0x00000006 ]
-  [ immediate reg 1 0x0000a0c3 ]
-  [ tproxy ip6 port reg 1 ]
-