[PATCH 1/3 -next] netfilter: nft_ct: labels get support

[PATCH 1/3 -next] netfilter: nft_ct: labels get support

[Florian Westphal]

Takes advantage of the fact that the number of labels is currently
restricted to 2**128, ie. the extension area will always fit into
nft register.

Patrick says the kernel registers need to be changed anyway to
deal with concatentations so we will probably not run into issues
when the number of labels increases in a future kernel release.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 include/uapi/linux/netfilter/nf_tables.h |  1 +
 net/netfilter/nft_ct.c                   | 22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 83c985a..c84c452 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -601,6 +601,7 @@ enum nft_ct_keys {
 	NFT_CT_PROTOCOL,
 	NFT_CT_PROTO_SRC,
 	NFT_CT_PROTO_DST,
+	NFT_CT_LABELS,
 };
 
 /**
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 917052e..cb0ffd2 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -19,6 +19,7 @@
 #include <net/netfilter/nf_conntrack_tuple.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
+#include <net/netfilter/nf_conntrack_labels.h>
 
 struct nft_ct {
 	enum nft_ct_keys	key:8;
@@ -97,6 +98,24 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
 			goto err;
 		strncpy((char *)dest->data, helper->name, sizeof(dest->data));
 		return;
+#ifdef CONFIG_NF_CONNTRACK_LABELS
+	case NFT_CT_LABELS: {
+		struct nf_conn_labels *labels = nf_ct_labels_find(ct);
+		unsigned int size;
+
+		if (!labels)
+			goto err;
+		size = labels->words * sizeof(long);
+		if (size > sizeof(dest->data))
+			goto err;
+		memcpy(dest->data, labels->bits, size);
+
+		if (size < sizeof(dest->data))
+			memset(((char *) dest->data) + size, 0,
+			       sizeof(dest->data) - size);
+		return;
+	}
+#endif
 	}
 
 	tuple = &ct->tuplehash[priv->dir].tuple;
@@ -221,6 +240,9 @@ static int nft_ct_init_validate_get(const struct nft_expr *expr,
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 	case NFT_CT_SECMARK:
 #endif
+#ifdef CONFIG_NF_CONNTRACK_LABELS
+	case NFT_CT_LABELS:
+#endif
 	case NFT_CT_EXPIRATION:
 	case NFT_CT_HELPER:
 		if (tb[NFTA_CT_DIRECTION] != NULL)
-- 
1.8.1.5

[PATCH 2/3 libnftnl] expr: add conntrack label match support

[Florian Westphal]

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 include/linux/netfilter/nf_tables.h | 2 ++
 src/expr/ct.c                       | 5 +++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index 31ddd06..5bb7b72 100644
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -585,6 +585,7 @@ enum nft_meta_attributes {
  * @NFT_CT_PROTOCOL: conntrack layer 4 protocol
  * @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
  * @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
+ * @NFT_CT_LABEL: conntrack label
  */
 enum nft_ct_keys {
 	NFT_CT_STATE,
@@ -600,6 +601,7 @@ enum nft_ct_keys {
 	NFT_CT_PROTOCOL,
 	NFT_CT_PROTO_SRC,
 	NFT_CT_PROTO_DST,
+	NFT_CT_LABEL,
 };
 
 /**
diff --git a/src/expr/ct.c b/src/expr/ct.c
index 2df761c..4c18dde 100644
--- a/src/expr/ct.c
+++ b/src/expr/ct.c
@@ -33,7 +33,7 @@ struct nft_expr_ct {
 #define IP_CT_DIR_REPLY		1
 
 #ifndef NFT_CT_MAX
-#define NFT_CT_MAX (NFT_CT_PROTO_DST + 1)
+#define NFT_CT_MAX (NFT_CT_LABEL + 1)
 #endif
 
 static int
@@ -170,7 +170,8 @@ const char *ctkey2str_array[NFT_CT_MAX] = {
 	[NFT_CT_SRC]		= "src",
 	[NFT_CT_DST]		= "dst",
 	[NFT_CT_PROTO_SRC]	= "proto_src",
-	[NFT_CT_PROTO_DST]	= "proto_dst"
+	[NFT_CT_PROTO_DST]	= "proto_dst",
+	[NFT_CT_LABEL]		= "label",
 };
 
 static const char *ctkey2str(uint32_t ctkey)
-- 
1.8.1.5

[PATCH 3/3 nft] ct: connlabel matching support

[Florian Westphal]

Takes advantage of the fact that the current maximum label storage area
is 128 bits, i.e. the dynamically allocated extension area in the
kernel will always fit into a nft register.

Currently this re-uses rt_symbol_table_init() to read connlabel.conf.
This works since the format is pretty much the same.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 Changes since RFC:
  - print function should only output one single label
  - use singular ('label', not 'labels')
  - use extra __init function to init label symtable

 include/datatype.h                  |  2 ++
 include/linux/netfilter/nf_tables.h |  2 ++
 src/ct.c                            | 72 +++++++++++++++++++++++++++++++++++++
 src/parser.y                        |  2 ++
 src/scanner.l                       |  1 +
 5 files changed, 79 insertions(+)

diff --git a/include/datatype.h b/include/datatype.h
index 9e609cf..2c66e9d 100644
--- a/include/datatype.h
+++ b/include/datatype.h
@@ -34,6 +34,7 @@
  * @TYPE_CT_DIR:	conntrack direction
  * @TYPE_CT_STATUS:	conntrack status (bitmask subtype)
  * @TYPE_ICMP6_TYPE:	ICMPv6 type codes (integer subtype)
+ * @TYPE_CT_LABEL:	Conntrack Label (bitmask subtype)
  */
 enum datatypes {
 	TYPE_INVALID,
@@ -66,6 +67,7 @@ enum datatypes {
 	TYPE_CT_DIR,
 	TYPE_CT_STATUS,
 	TYPE_ICMP6_TYPE,
+	TYPE_CT_LABEL,
 	__TYPE_MAX
 };
 #define TYPE_MAX		(__TYPE_MAX - 1)
diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index 448593c..ff9b0a7 100644
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -586,6 +586,7 @@ enum nft_meta_attributes {
  * @NFT_CT_PROTOCOL: conntrack layer 4 protocol
  * @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
  * @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
+ * @NFT_CT_LABELS: conntrack label bitset (stored in conntrack extension)
  */
 enum nft_ct_keys {
 	NFT_CT_STATE,
@@ -601,6 +602,7 @@ enum nft_ct_keys {
 	NFT_CT_PROTOCOL,
 	NFT_CT_PROTO_SRC,
 	NFT_CT_PROTO_DST,
+	NFT_CT_LABEL,
 };
 
 /**
diff --git a/src/ct.c b/src/ct.c
index 79d4666..08f8e1e 100644
--- a/src/ct.c
+++ b/src/ct.c
@@ -20,8 +20,10 @@
 #include <linux/netfilter/nf_conntrack_common.h>
 #include <linux/netfilter/nf_conntrack_tuple_common.h>
 
+#include <erec.h>
 #include <expression.h>
 #include <datatype.h>
+#include <gmputil.h>
 #include <ct.h>
 #include <gmputil.h>
 #include <utils.h>
@@ -91,6 +93,73 @@ static const struct datatype ct_status_type = {
 	.sym_tbl	= &ct_status_tbl,
 };
 
+static struct symbol_table *ct_label_tbl;
+
+#define CT_LABEL_BIT_SIZE 128
+
+static void ct_label_type_print(const struct expr *expr)
+{
+	unsigned long bit = mpz_scan1(expr->value, 0);
+	const struct symbolic_constant *s;
+
+	for (s = ct_label_tbl->symbols; s->identifier != NULL; s++) {
+		if (bit != s->value)
+			continue;
+		printf("%s", s->identifier);
+		return;
+	}
+	/* can happen when connlabel.conf is altered after rules were added */
+	gmp_printf("0x%Zx", &expr->value);
+}
+
+static struct error_record *ct_label_type_parse(const struct expr *sym,
+						struct expr **res)
+{
+	const struct symbolic_constant *s;
+	const struct datatype *dtype;
+	uint8_t data[CT_LABEL_BIT_SIZE];
+	mpz_t value;
+
+	for (s = ct_label_tbl->symbols; s->identifier != NULL; s++) {
+		if (!strcmp(sym->identifier, s->identifier))
+			break;
+	}
+
+	dtype = sym->dtype;
+	if (s->identifier == NULL)
+		return error(&sym->location, "Could not parse %s", dtype->desc);
+
+	if (s->value >= CT_LABEL_BIT_SIZE)
+		return error(&sym->location, "%s: out of range (%u max)",
+			     s->identifier, s->value, CT_LABEL_BIT_SIZE);
+
+	mpz_init2(value, dtype->size);
+	mpz_setbit(value, s->value);
+	mpz_export_data(data, value, BYTEORDER_HOST_ENDIAN, sizeof(data));
+
+	*res = constant_expr_alloc(&sym->location, dtype,
+				   dtype->byteorder, sizeof(data),
+				   data);
+	mpz_clear(value);
+	return NULL;
+}
+
+static const struct datatype ct_label_type = {
+	.type		= TYPE_CT_LABEL,
+	.name		= "ct_label",
+	.desc		= "conntrack label",
+	.byteorder	= BYTEORDER_HOST_ENDIAN,
+	.size		= CT_LABEL_BIT_SIZE,
+	.basetype	= &bitmask_type,
+	.print		= ct_label_type_print,
+	.parse		= ct_label_type_parse,
+};
+
+static void __init ct_label_table_init(void)
+{
+	ct_label_tbl = rt_symbol_table_init("/etc/xtables/connlabel.conf");
+}
+
 static const struct ct_template ct_templates[] = {
 	[NFT_CT_STATE]		= CT_TEMPLATE("state",	    &ct_state_type,
 					      BYTEORDER_HOST_ENDIAN,
@@ -125,6 +194,9 @@ static const struct ct_template ct_templates[] = {
 	[NFT_CT_PROTO_DST]	= CT_TEMPLATE("proto-dst",  &invalid_type,
 					      BYTEORDER_BIG_ENDIAN,
 					      2 * BITS_PER_BYTE),
+	[NFT_CT_LABEL]		= CT_TEMPLATE("label", &ct_label_type,
+					      BYTEORDER_HOST_ENDIAN,
+					      CT_LABEL_BIT_SIZE),
 };
 
 static void ct_expr_print(const struct expr *expr)
diff --git a/src/parser.y b/src/parser.y
index 07613e2..b3acc74 100644
--- a/src/parser.y
+++ b/src/parser.y
@@ -314,6 +314,7 @@ static void location_update(struct location *loc, struct location *rhs, int n)
 %token L3PROTOCOL		"l3proto"
 %token PROTO_SRC		"proto-src"
 %token PROTO_DST		"proto-dst"
+%token LABEL			"label"
 
 %token COUNTER			"counter"
 %token PACKETS			"packets"
@@ -1551,6 +1552,7 @@ ct_key			:	STATE		{ $$ = NFT_CT_STATE; }
 			|	PROTOCOL	{ $$ = NFT_CT_PROTOCOL; }
 			|	PROTO_SRC	{ $$ = NFT_CT_PROTO_SRC; }
 			|	PROTO_DST	{ $$ = NFT_CT_PROTO_DST; }
+			|	LABEL		{ $$ = NFT_CT_LABEL; }
 			;
 
 payload_expr		:	payload_raw_expr
diff --git a/src/scanner.l b/src/scanner.l
index e4cb398..45c6476 100644
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -411,6 +411,7 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})
 "l3proto"		{ return L3PROTOCOL; }
 "proto-src"		{ return PROTO_SRC; }
 "proto-dst"		{ return PROTO_DST; }
+"label"			{ return LABEL; }
 
 "xml"			{ return XML; }
 "json"			{ return JSON; }
-- 
1.8.1.5

Re: [PATCH 3/3 nft] ct: connlabel matching support

[Patrick McHardy]

On Tue, Feb 18, 2014 at 10:27:24AM +0100, Florian Westphal wrote:
> Takes advantage of the fact that the current maximum label storage area
> is 128 bits, i.e. the dynamically allocated extension area in the
> kernel will always fit into a nft register.
> 
> Currently this re-uses rt_symbol_table_init() to read connlabel.conf.
> This works since the format is pretty much the same.
> 
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  Changes since RFC:
>   - print function should only output one single label
>   - use singular ('label', not 'labels')
>   - use extra __init function to init label symtable

Looks very good to me.

Re: [PATCH 1/3 -next] netfilter: nft_ct: labels get support

[Patrick McHardy]

On Tue, Feb 18, 2014 at 10:27:22AM +0100, Florian Westphal wrote:
> Takes advantage of the fact that the number of labels is currently
> restricted to 2**128, ie. the extension area will always fit into
> nft register.
> 
> Patrick says the kernel registers need to be changed anyway to
> deal with concatentations so we will probably not run into issues
> when the number of labels increases in a future kernel release.
> 
> +#ifdef CONFIG_NF_CONNTRACK_LABELS
> +	case NFT_CT_LABELS: {
> +		struct nf_conn_labels *labels = nf_ct_labels_find(ct);
> +		unsigned int size;
> +
> +		if (!labels)
> +			goto err;

Is that really an error? I'd expect it to be equivalent with "no labels set",
which can also be matched on.

> +		size = labels->words * sizeof(long);
> +		if (size > sizeof(dest->data))
> +			goto err;

Can't we check that during ->init() if the number is limited anyway?

> +		memcpy(dest->data, labels->bits, size);
> +
> +		if (size < sizeof(dest->data))
> +			memset(((char *) dest->data) + size, 0,
> +			       sizeof(dest->data) - size);
> +		return;
> +	}
> +#endif

Re: [PATCH 1/3 -next] netfilter: nft_ct: labels get support

[Florian Westphal]

Patrick McHardy <kaber@trash.net> wrote:
> On Tue, Feb 18, 2014 at 10:27:22AM +0100, Florian Westphal wrote:
> > Takes advantage of the fact that the number of labels is currently
> > restricted to 2**128, ie. the extension area will always fit into
> > nft register.
> > 
> > Patrick says the kernel registers need to be changed anyway to
> > deal with concatentations so we will probably not run into issues
> > when the number of labels increases in a future kernel release.
> > 
> > +#ifdef CONFIG_NF_CONNTRACK_LABELS
> > +	case NFT_CT_LABELS: {
> > +		struct nf_conn_labels *labels = nf_ct_labels_find(ct);
> > +		unsigned int size;
> > +
> > +		if (!labels)
> > +			goto err;
> 
> Is that really an error? I'd expect it to be equivalent with "no labels set",
> which can also be matched on.

I think you're right.  I'll change it.

> > +		size = labels->words * sizeof(long);
> > +		if (size > sizeof(dest->data))
> > +			goto err;
> 
> Can't we check that during ->init() if the number is limited anyway?

True.

Thanks Patrick.

I'll wait a bit for more feedback and repost the kernel patch
with  these changes incorporated.

Re: [PATCH 1/3 -next] netfilter: nft_ct: labels get support

[Patrick McHardy]

On Tue, Feb 18, 2014 at 11:13:08AM +0100, Florian Westphal wrote:
> Patrick McHardy <kaber@trash.net> wrote:
> > On Tue, Feb 18, 2014 at 10:27:22AM +0100, Florian Westphal wrote:
> > > Takes advantage of the fact that the number of labels is currently
> > > restricted to 2**128, ie. the extension area will always fit into
> > > nft register.
> > > 
> > > Patrick says the kernel registers need to be changed anyway to
> > > deal with concatentations so we will probably not run into issues
> > > when the number of labels increases in a future kernel release.
> > > 
> > > +#ifdef CONFIG_NF_CONNTRACK_LABELS
> > > +	case NFT_CT_LABELS: {
> > > +		struct nf_conn_labels *labels = nf_ct_labels_find(ct);
> > > +		unsigned int size;
> > > +
> > > +		if (!labels)
> > > +			goto err;
> > 
> > Is that really an error? I'd expect it to be equivalent with "no labels set",
> > which can also be matched on.
> 
> I think you're right.  I'll change it.
> 
> > > +		size = labels->words * sizeof(long);
> > > +		if (size > sizeof(dest->data))
> > > +			goto err;
> > 
> > Can't we check that during ->init() if the number is limited anyway?
> 
> True.

Quick follow up: BUILD_BUG_ON() is probably the best choice. I couldn't
find the limit though.

> Thanks Patrick.
> 
> I'll wait a bit for more feedback and repost the kernel patch
> with  these changes incorporated.