[nftables PATCH] netlink: Allow invert the ranges

[nftables PATCH] netlink: Allow invert the ranges

[Alvaro Neira Ayuso]

From: Álvaro Neira Ayuso <alvaroneay@gmail.com>

This patch fix the bug:

http://bugzilla.netfilter.org/show_bug.cgi?id=924

Before, nftables doesn't permit invert ranges. This patch allows
add rules like this:

nft add rule ip test input ip daddr != 192.168.1.2-192.168.1.55

Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
---
 src/netlink_linearize.c |   43 +++++++++++++++++++++++++++++++++++++------
 1 file changed, 37 insertions(+), 6 deletions(-)

diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
index e3f06af..4b6400a 100644
--- a/src/netlink_linearize.c
+++ b/src/netlink_linearize.c
@@ -182,6 +182,10 @@ static enum nft_cmp_ops netlink_gen_cmp_op(enum ops op)
 	}
 }
 
+static void netlink_gen_range(struct netlink_linearize_ctx *ctx,
+			      const struct expr *expr,
+			      enum nft_registers dreg);
+
 static void netlink_gen_cmp(struct netlink_linearize_ctx *ctx,
 			    const struct expr *expr,
 			    enum nft_registers dreg)
@@ -196,7 +200,8 @@ static void netlink_gen_cmp(struct netlink_linearize_ctx *ctx,
 	sreg = get_register(ctx);
 	netlink_gen_expr(ctx, expr->left, sreg);
 
-	if (expr->right->ops->type == EXPR_PREFIX) {
+	switch (expr->right->ops->type) {
+	case EXPR_PREFIX: {
 		mpz_t mask;
 
 		mpz_init(mask);
@@ -216,7 +221,11 @@ static void netlink_gen_cmp(struct netlink_linearize_ctx *ctx,
 		nft_rule_add_expr(ctx->nlr, nle);
 
 		right = expr->right->prefix;
-	} else {
+		break;
+		}
+	case EXPR_RANGE:
+		return netlink_gen_range(ctx, expr, dreg);
+	default:
 		right = expr->right;
 	}
 
@@ -247,16 +256,38 @@ static void netlink_gen_range(struct netlink_linearize_ctx *ctx,
 
 	nle = alloc_nft_expr("cmp");
 	nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_SREG, sreg);
-	nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP,
-			      netlink_gen_cmp_op(OP_GTE));
+	switch (expr->op) {
+	case OP_EQ:
+		nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP,
+				      netlink_gen_cmp_op(OP_GTE));
+		break;
+	case OP_NEQ:
+		nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP,
+				      netlink_gen_cmp_op(OP_LT));
+		break;
+	default:
+		BUG("invalid comparison operation %u\n", expr->op);
+	}
+
 	netlink_gen_data(range->left, &nld);
 	nft_rule_expr_set(nle, NFT_EXPR_CMP_DATA, nld.value, nld.len);
 	nft_rule_add_expr(ctx->nlr, nle);
 
 	nle = alloc_nft_expr("cmp");
 	nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_SREG, sreg);
-	nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP,
-			      netlink_gen_cmp_op(OP_LTE));
+	switch (expr->op) {
+	case OP_EQ:
+		nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP,
+				      netlink_gen_cmp_op(OP_LTE));
+		break;
+	case OP_NEQ:
+		nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP,
+				      netlink_gen_cmp_op(OP_GT));
+		break;
+	default:
+		BUG("invalid comparison operation %u\n", expr->op);
+	}
+
 	netlink_gen_data(range->right, &nld);
 	nft_rule_expr_set(nle, NFT_EXPR_CMP_DATA, nld.value, nld.len);
 	nft_rule_add_expr(ctx->nlr, nle);
-- 
1.7.10.4

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[nftables PATCH v2] netlink: Allow to invert the ranges

[Alvaro Neira Ayuso]

From: Álvaro Neira Ayuso <alvaroneay@gmail.com>

This patch fix the bug:

http://bugzilla.netfilter.org/show_bug.cgi?id=924

Before, nftables doesn't permit invert ranges. This patch allows
add rules like this:

nft add rule ip test input ip daddr != 192.168.1.2-192.168.1.55
or
nft add rule ip test input ip daddr == 192.168.1.2-192.168.1.55

Also, we still have the option for adding rules like this:

sudo nft add rule ip test output frag id 33-45

Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
---
[changes in v2]
* I have added OP_RANGE in netlink_gen_range. I have supposed that always
  we have a comparison before the range and I have forbidden to add rules
  with ranges without comparison symbol (== or !=).
* I have rewritten the title and the description.

 src/netlink_linearize.c |   45 +++++++++++++++++++++++++++++++++++++++------
 1 file changed, 39 insertions(+), 6 deletions(-)

diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
index e3f06af..19153fd 100644
--- a/src/netlink_linearize.c
+++ b/src/netlink_linearize.c
@@ -182,6 +182,10 @@ static enum nft_cmp_ops netlink_gen_cmp_op(enum ops op)
 	}
 }
 
+static void netlink_gen_range(struct netlink_linearize_ctx *ctx,
+			      const struct expr *expr,
+			      enum nft_registers dreg);
+
 static void netlink_gen_cmp(struct netlink_linearize_ctx *ctx,
 			    const struct expr *expr,
 			    enum nft_registers dreg)
@@ -196,7 +200,8 @@ static void netlink_gen_cmp(struct netlink_linearize_ctx *ctx,
 	sreg = get_register(ctx);
 	netlink_gen_expr(ctx, expr->left, sreg);
 
-	if (expr->right->ops->type == EXPR_PREFIX) {
+	switch (expr->right->ops->type) {
+	case EXPR_PREFIX: {
 		mpz_t mask;
 
 		mpz_init(mask);
@@ -216,7 +221,11 @@ static void netlink_gen_cmp(struct netlink_linearize_ctx *ctx,
 		nft_rule_add_expr(ctx->nlr, nle);
 
 		right = expr->right->prefix;
-	} else {
+		break;
+		}
+	case EXPR_RANGE:
+		return netlink_gen_range(ctx, expr, dreg);
+	default:
 		right = expr->right;
 	}
 
@@ -247,16 +256,40 @@ static void netlink_gen_range(struct netlink_linearize_ctx *ctx,
 
 	nle = alloc_nft_expr("cmp");
 	nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_SREG, sreg);
-	nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP,
-			      netlink_gen_cmp_op(OP_GTE));
+	switch (expr->op) {
+	case OP_NEQ:
+		nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP,
+				      netlink_gen_cmp_op(OP_LT));
+		break;
+	case OP_RANGE:
+	case OP_EQ:
+		nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP,
+				      netlink_gen_cmp_op(OP_GTE));
+		break;
+	default:
+		BUG("invalid range operation %u\n", expr->op);
+	}
+
 	netlink_gen_data(range->left, &nld);
 	nft_rule_expr_set(nle, NFT_EXPR_CMP_DATA, nld.value, nld.len);
 	nft_rule_add_expr(ctx->nlr, nle);
 
 	nle = alloc_nft_expr("cmp");
 	nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_SREG, sreg);
-	nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP,
-			      netlink_gen_cmp_op(OP_LTE));
+	switch (expr->op) {
+	case OP_NEQ:
+		nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP,
+				      netlink_gen_cmp_op(OP_GT));
+		break;
+	case OP_RANGE:
+	case OP_EQ:
+		nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP,
+				      netlink_gen_cmp_op(OP_LTE));
+		break;
+	default:
+		BUG("invalid range operation %u\n", expr->op);
+	}
+
 	netlink_gen_data(range->right, &nld);
 	nft_rule_expr_set(nle, NFT_EXPR_CMP_DATA, nld.value, nld.len);
 	nft_rule_add_expr(ctx->nlr, nle);
-- 
1.7.10.4

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [nftables PATCH v2] netlink: Allow to invert the ranges

[Patrick McHardy]

On Wed, May 28, 2014 at 12:08:22PM +0200, Alvaro Neira Ayuso wrote:
> From: Álvaro Neira Ayuso <alvaroneay@gmail.com>
> 
> This patch fix the bug:
> 
> http://bugzilla.netfilter.org/show_bug.cgi?id=924
> 
> Before, nftables doesn't permit invert ranges. This patch allows
> add rules like this:
> 
> nft add rule ip test input ip daddr != 192.168.1.2-192.168.1.55
> or
> nft add rule ip test input ip daddr == 192.168.1.2-192.168.1.55
> 
> Also, we still have the option for adding rules like this:
> 
> sudo nft add rule ip test output frag id 33-45
> 
> Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
> ---
> [changes in v2]
> * I have added OP_RANGE in netlink_gen_range. I have supposed that always
>   we have a comparison before the range and I have forbidden to add rules
>   with ranges without comparison symbol (== or !=).

That seems fine. The implicit op for ranges is OP_EQ.

The patch looks fine to me. Minor improvement might be to factor out the common
code from netlink_gen_range(), but might not be worth it.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [nftables PATCH v2] netlink: Allow to invert the ranges

[Pablo Neira Ayuso]

On Sun, Jun 01, 2014 at 09:20:07PM +0100, Patrick McHardy wrote:
> On Wed, May 28, 2014 at 12:08:22PM +0200, Alvaro Neira Ayuso wrote:
> > From: Álvaro Neira Ayuso <alvaroneay@gmail.com>
> > 
> > This patch fix the bug:
> > 
> > http://bugzilla.netfilter.org/show_bug.cgi?id=924
> > 
> > Before, nftables doesn't permit invert ranges. This patch allows
> > add rules like this:
> > 
> > nft add rule ip test input ip daddr != 192.168.1.2-192.168.1.55
> > or
> > nft add rule ip test input ip daddr == 192.168.1.2-192.168.1.55
> > 
> > Also, we still have the option for adding rules like this:
> > 
> > sudo nft add rule ip test output frag id 33-45
> > 
> > Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
> > ---
> > [changes in v2]
> > * I have added OP_RANGE in netlink_gen_range. I have supposed that always
> >   we have a comparison before the range and I have forbidden to add rules
> >   with ranges without comparison symbol (== or !=).
> 
> That seems fine. The implicit op for ranges is OP_EQ.
> 
> The patch looks fine to me. Minor improvement might be to factor out the common
> code from netlink_gen_range(), but might not be worth it.

I have applied this, we can revisit this later. Thanks Alvaro and
Patrick.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html