* [PATCH nft] expression: tolerate named set protocol dependency
@ 2025-03-13 16:39 Florian Westphal
2025-03-20 0:18 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Florian Westphal @ 2025-03-13 16:39 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
Included test will fail with:
/dev/stdin:8:38-52: Error: Transparent proxy support requires transport protocol match
meta l4proto @protos tproxy to :1088
^^^^^^^^^^^^^^^
Tolerate a set reference too. Because the set can be empty (or there
can be removals later), add a fake 0-rhs value.
This will make pctx_update assign proto_unknown as the transport protocol
in use, Thats enough to avoid 'requires transport protocol' error.
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1686
Signed-off-by: Florian Westphal <fw@strlen.de>
---
src/expression.c | 10 +++
.../dumps/named_set_as_protocol_dep.json-nft | 75 +++++++++++++++++++
.../nft-f/dumps/named_set_as_protocol_dep.nft | 11 +++
.../testcases/nft-f/named_set_as_protocol_dep | 5 ++
4 files changed, 101 insertions(+)
create mode 100644 tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.json-nft
create mode 100644 tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.nft
create mode 100755 tests/shell/testcases/nft-f/named_set_as_protocol_dep
diff --git a/src/expression.c b/src/expression.c
index 8a90e09dd1c5..38d3ad6d6a4b 100644
--- a/src/expression.c
+++ b/src/expression.c
@@ -945,6 +945,16 @@ void relational_expr_pctx_update(struct proto_ctx *ctx,
i->key->etype == EXPR_VALUE)
ops->pctx_update(ctx, &expr->location, left, i->key);
}
+ } else if (right->etype == EXPR_SET_REF) {
+ const struct expr *key = right->set->key;
+ struct expr *tmp;
+
+ tmp = constant_expr_alloc(&expr->location, key->dtype,
+ key->byteorder, key->len,
+ NULL);
+
+ ops->pctx_update(ctx, &expr->location, left, tmp);
+ expr_free(tmp);
}
}
}
diff --git a/tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.json-nft b/tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.json-nft
new file mode 100644
index 000000000000..4bc24aa319ab
--- /dev/null
+++ b/tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.json-nft
@@ -0,0 +1,75 @@
+{
+ "nftables": [
+ {
+ "metainfo": {
+ "version": "VERSION",
+ "release_name": "RELEASE_NAME",
+ "json_schema_version": 1
+ }
+ },
+ {
+ "table": {
+ "family": "inet",
+ "name": "test",
+ "handle": 0
+ }
+ },
+ {
+ "chain": {
+ "family": "inet",
+ "table": "test",
+ "name": "prerouting",
+ "handle": 0,
+ "type": "filter",
+ "hook": "prerouting",
+ "prio": -150,
+ "policy": "accept"
+ }
+ },
+ {
+ "set": {
+ "family": "inet",
+ "name": "protos",
+ "table": "test",
+ "type": {
+ "typeof": {
+ "meta": {
+ "key": "l4proto"
+ }
+ }
+ },
+ "handle": 0,
+ "elem": [
+ "tcp",
+ "udp"
+ ]
+ }
+ },
+ {
+ "rule": {
+ "family": "inet",
+ "table": "test",
+ "chain": "prerouting",
+ "handle": 0,
+ "expr": [
+ {
+ "match": {
+ "op": "==",
+ "left": {
+ "meta": {
+ "key": "l4proto"
+ }
+ },
+ "right": "@protos"
+ }
+ },
+ {
+ "tproxy": {
+ "port": 1088
+ }
+ }
+ ]
+ }
+ }
+ ]
+}
diff --git a/tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.nft b/tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.nft
new file mode 100644
index 000000000000..2bc0c2adb38c
--- /dev/null
+++ b/tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.nft
@@ -0,0 +1,11 @@
+table inet test {
+ set protos {
+ typeof meta l4proto
+ elements = { tcp, udp }
+ }
+
+ chain prerouting {
+ type filter hook prerouting priority mangle; policy accept;
+ meta l4proto @protos tproxy to :1088
+ }
+}
diff --git a/tests/shell/testcases/nft-f/named_set_as_protocol_dep b/tests/shell/testcases/nft-f/named_set_as_protocol_dep
new file mode 100755
index 000000000000..5c516e421cd6
--- /dev/null
+++ b/tests/shell/testcases/nft-f/named_set_as_protocol_dep
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+dumpfile=$(dirname $0)/dumps/$(basename $0).nft
+
+$NFT -f "$dumpfile" || exit 1
--
2.45.3
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH nft] expression: tolerate named set protocol dependency
2025-03-13 16:39 [PATCH nft] expression: tolerate named set protocol dependency Florian Westphal
@ 2025-03-20 0:18 ` Pablo Neira Ayuso
2025-03-20 8:30 ` Florian Westphal
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2025-03-20 0:18 UTC (permalink / raw)
To: Florian Westphal; +Cc: netfilter-devel
On Thu, Mar 13, 2025 at 05:39:51PM +0100, Florian Westphal wrote:
> Included test will fail with:
> /dev/stdin:8:38-52: Error: Transparent proxy support requires transport protocol match
> meta l4proto @protos tproxy to :1088
> ^^^^^^^^^^^^^^^
> Tolerate a set reference too. Because the set can be empty (or there
> can be removals later), add a fake 0-rhs value.
>
> This will make pctx_update assign proto_unknown as the transport protocol
this is correct for meta, so...
> in use, Thats enough to avoid 'requires transport protocol' error.
>
> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1686
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
> src/expression.c | 10 +++
> .../dumps/named_set_as_protocol_dep.json-nft | 75 +++++++++++++++++++
> .../nft-f/dumps/named_set_as_protocol_dep.nft | 11 +++
> .../testcases/nft-f/named_set_as_protocol_dep | 5 ++
> 4 files changed, 101 insertions(+)
> create mode 100644 tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.json-nft
> create mode 100644 tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.nft
> create mode 100755 tests/shell/testcases/nft-f/named_set_as_protocol_dep
>
> diff --git a/src/expression.c b/src/expression.c
> index 8a90e09dd1c5..38d3ad6d6a4b 100644
> --- a/src/expression.c
> +++ b/src/expression.c
> @@ -945,6 +945,16 @@ void relational_expr_pctx_update(struct proto_ctx *ctx,
> i->key->etype == EXPR_VALUE)
> ops->pctx_update(ctx, &expr->location, left, i->key);
> }
> + } else if (right->etype == EXPR_SET_REF) {
> + const struct expr *key = right->set->key;
> + struct expr *tmp;
> +
> + tmp = constant_expr_alloc(&expr->location, key->dtype,
> + key->byteorder, key->len,
> + NULL);
> +
> + ops->pctx_update(ctx, &expr->location, left, tmp);
> + expr_free(tmp);
maybe narrow down this to meta on the lhs? I am not sure of the effect
of this update for payload and ct, they also provide .pctx_update.
If there is a use-case for these two other expression, this can be
revisited.
Thanks.
> }
> }
> }
> diff --git a/tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.json-nft b/tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.json-nft
> new file mode 100644
> index 000000000000..4bc24aa319ab
> --- /dev/null
> +++ b/tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.json-nft
> @@ -0,0 +1,75 @@
> +{
> + "nftables": [
> + {
> + "metainfo": {
> + "version": "VERSION",
> + "release_name": "RELEASE_NAME",
> + "json_schema_version": 1
> + }
> + },
> + {
> + "table": {
> + "family": "inet",
> + "name": "test",
> + "handle": 0
> + }
> + },
> + {
> + "chain": {
> + "family": "inet",
> + "table": "test",
> + "name": "prerouting",
> + "handle": 0,
> + "type": "filter",
> + "hook": "prerouting",
> + "prio": -150,
> + "policy": "accept"
> + }
> + },
> + {
> + "set": {
> + "family": "inet",
> + "name": "protos",
> + "table": "test",
> + "type": {
> + "typeof": {
> + "meta": {
> + "key": "l4proto"
> + }
> + }
> + },
> + "handle": 0,
> + "elem": [
> + "tcp",
> + "udp"
> + ]
> + }
> + },
> + {
> + "rule": {
> + "family": "inet",
> + "table": "test",
> + "chain": "prerouting",
> + "handle": 0,
> + "expr": [
> + {
> + "match": {
> + "op": "==",
> + "left": {
> + "meta": {
> + "key": "l4proto"
> + }
> + },
> + "right": "@protos"
> + }
> + },
> + {
> + "tproxy": {
> + "port": 1088
> + }
> + }
> + ]
> + }
> + }
> + ]
> +}
> diff --git a/tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.nft b/tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.nft
> new file mode 100644
> index 000000000000..2bc0c2adb38c
> --- /dev/null
> +++ b/tests/shell/testcases/nft-f/dumps/named_set_as_protocol_dep.nft
> @@ -0,0 +1,11 @@
> +table inet test {
> + set protos {
> + typeof meta l4proto
> + elements = { tcp, udp }
> + }
> +
> + chain prerouting {
> + type filter hook prerouting priority mangle; policy accept;
> + meta l4proto @protos tproxy to :1088
> + }
> +}
> diff --git a/tests/shell/testcases/nft-f/named_set_as_protocol_dep b/tests/shell/testcases/nft-f/named_set_as_protocol_dep
> new file mode 100755
> index 000000000000..5c516e421cd6
> --- /dev/null
> +++ b/tests/shell/testcases/nft-f/named_set_as_protocol_dep
> @@ -0,0 +1,5 @@
> +#!/bin/bash
> +
> +dumpfile=$(dirname $0)/dumps/$(basename $0).nft
> +
> +$NFT -f "$dumpfile" || exit 1
> --
> 2.45.3
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH nft] expression: tolerate named set protocol dependency
2025-03-20 0:18 ` Pablo Neira Ayuso
@ 2025-03-20 8:30 ` Florian Westphal
0 siblings, 0 replies; 3+ messages in thread
From: Florian Westphal @ 2025-03-20 8:30 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: Florian Westphal, netfilter-devel
Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > + const struct expr *key = right->set->key;
> > + struct expr *tmp;
> > +
> > + tmp = constant_expr_alloc(&expr->location, key->dtype,
> > + key->byteorder, key->len,
> > + NULL);
> > +
> > + ops->pctx_update(ctx, &expr->location, left, tmp);
> > + expr_free(tmp);
>
> maybe narrow down this to meta on the lhs? I am not sure of the effect
> of this update for payload and ct, they also provide .pctx_update.
Sure, I can amend it accordingly.
> If there is a use-case for these two other expression, this can be
> revisited.
Agreed, lets restrict it for meta for now.
Thanks for reviewing.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-03-20 8:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-03-13 16:39 [PATCH nft] expression: tolerate named set protocol dependency Florian Westphal
2025-03-20 0:18 ` Pablo Neira Ayuso
2025-03-20 8:30 ` Florian Westphal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).