From 8a4b6cbf58e965d67b0337ba1736bd3691a49890 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Mon, 12 Jul 2021 17:44:08 +0200 Subject: [PATCH] tcpopt: allow to check for presence of any tcp option Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1979334 Upstream Status: nftables commit 24d8da3083422 commit 24d8da3083422da8336eeed2ee23b2ccf598ba5a Author: Florian Westphal Date: Wed Oct 21 23:54:17 2020 +0200 tcpopt: allow to check for presence of any tcp option nft currently doesn't allow to check for presence of arbitrary tcp options. Only known options where nft provides a template can be tested for. This allows to test for presence of raw protocol values as well. Example: tcp option 42 exists Signed-off-by: Florian Westphal --- include/expression.h | 3 +- src/exthdr.c | 12 ++++++++ src/ipopt.c | 1 + src/netlink_linearize.c | 2 +- src/parser_bison.y | 7 +++++ src/tcpopt.c | 42 +++++++++++++++++++++++---- tests/py/any/tcpopt.t | 2 ++ tests/py/any/tcpopt.t.payload | 53 +++-------------------------------- 8 files changed, 65 insertions(+), 57 deletions(-) diff --git a/include/expression.h b/include/expression.h index 2e41aa0..b50183d 100644 --- a/include/expression.h +++ b/include/expression.h @@ -299,7 +299,8 @@ struct expr { /* EXPR_EXTHDR */ const struct exthdr_desc *desc; const struct proto_hdr_template *tmpl; - unsigned int offset; + uint16_t offset; + uint8_t raw_type; enum nft_exthdr_op op; unsigned int flags; } exthdr; diff --git a/src/exthdr.c b/src/exthdr.c index c28213f..68d5aa5 100644 --- a/src/exthdr.c +++ b/src/exthdr.c @@ -32,6 +32,13 @@ static void exthdr_expr_print(const struct expr *expr, struct output_ctx *octx) */ unsigned int offset = expr->exthdr.offset / 64; + if (expr->exthdr.desc == NULL && + expr->exthdr.offset == 0 && + expr->exthdr.flags & NFT_EXTHDR_F_PRESENT) { + nft_print(octx, "tcp option %d", expr->exthdr.raw_type); + return; + } + nft_print(octx, "tcp option %s", expr->exthdr.desc->name); if (expr->exthdr.flags & NFT_EXTHDR_F_PRESENT) return; @@ -59,6 +66,7 @@ static bool exthdr_expr_cmp(const struct expr *e1, const struct expr *e2) return e1->exthdr.desc == e2->exthdr.desc && e1->exthdr.tmpl == e2->exthdr.tmpl && e1->exthdr.op == e2->exthdr.op && + e1->exthdr.raw_type == e2->exthdr.raw_type && e1->exthdr.flags == e2->exthdr.flags; } @@ -69,6 +77,7 @@ static void exthdr_expr_clone(struct expr *new, const struct expr *expr) new->exthdr.offset = expr->exthdr.offset; new->exthdr.op = expr->exthdr.op; new->exthdr.flags = expr->exthdr.flags; + new->exthdr.raw_type = expr->exthdr.raw_type; } const struct expr_ops exthdr_expr_ops = { @@ -98,6 +107,7 @@ struct expr *exthdr_expr_alloc(const struct location *loc, expr = expr_alloc(loc, EXPR_EXTHDR, tmpl->dtype, BYTEORDER_BIG_ENDIAN, tmpl->len); expr->exthdr.desc = desc; + expr->exthdr.raw_type = desc ? desc->type : 0; expr->exthdr.tmpl = tmpl; expr->exthdr.offset = tmpl->offset; return expr; @@ -176,6 +186,8 @@ void exthdr_init_raw(struct expr *expr, uint8_t type, unsigned int i; assert(expr->etype == EXPR_EXTHDR); + expr->exthdr.raw_type = type; + if (op == NFT_EXTHDR_OP_TCPOPT) return tcpopt_init_raw(expr, type, offset, len, flags); if (op == NFT_EXTHDR_OP_IPV4) diff --git a/src/ipopt.c b/src/ipopt.c index 7ecb8b9..5f9f908 100644 --- a/src/ipopt.c +++ b/src/ipopt.c @@ -103,6 +103,7 @@ struct expr *ipopt_expr_alloc(const struct location *loc, uint8_t type, expr->exthdr.tmpl = tmpl; expr->exthdr.op = NFT_EXTHDR_OP_IPV4; expr->exthdr.offset = tmpl->offset + calc_offset(desc, tmpl, ptr); + expr->exthdr.raw_type = desc->type; return expr; } diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c index 9d1a064..28b0e6a 100644 --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -174,7 +174,7 @@ static void netlink_gen_exthdr(struct netlink_linearize_ctx *ctx, nle = alloc_nft_expr("exthdr"); netlink_put_register(nle, NFTNL_EXPR_EXTHDR_DREG, dreg); nftnl_expr_set_u8(nle, NFTNL_EXPR_EXTHDR_TYPE, - expr->exthdr.desc->type); + expr->exthdr.raw_type); nftnl_expr_set_u32(nle, NFTNL_EXPR_EXTHDR_OFFSET, offset / BITS_PER_BYTE); nftnl_expr_set_u32(nle, NFTNL_EXPR_EXTHDR_LEN, div_round_up(expr->len, BITS_PER_BYTE)); diff --git a/src/parser_bison.y b/src/parser_bison.y index 114b289..4ea9364 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -4744,6 +4744,13 @@ tcp_hdr_option_type : EOL { $$ = TCPOPT_KIND_EOL; } | SACK3 { $$ = TCPOPT_KIND_SACK3; } | ECHO { $$ = TCPOPT_KIND_ECHO; } | TIMESTAMP { $$ = TCPOPT_KIND_TIMESTAMP; } + | NUM { + if ($1 > 255) { + erec_queue(error(&@1, "value too large"), state->msgs); + YYERROR; + } + $$ = $1; + } ; tcp_hdr_option_field : KIND { $$ = TCPOPT_COMMON_KIND; } diff --git a/src/tcpopt.c b/src/tcpopt.c index d1dd13b..1cf97a5 100644 --- a/src/tcpopt.c +++ b/src/tcpopt.c @@ -103,6 +103,19 @@ const struct exthdr_desc *tcpopt_protocols[] = { [TCPOPT_KIND_TIMESTAMP] = &tcpopt_timestamp, }; +/** + * tcpopt_expr_alloc - allocate tcp option extension expression + * + * @loc: location from parser + * @kind: raw tcp option value to find in packet + * @field: highlevel field to find in the option if @kind is present in packet + * + * Allocate a new tcp option expression. + * @kind is the raw option value to find in the packet. + * Exception: SACK may use extra OOB data that is mangled here. + * + * @field is the optional field to extract from the @type option. + */ struct expr *tcpopt_expr_alloc(const struct location *loc, unsigned int kind, unsigned int field) @@ -138,8 +151,22 @@ struct expr *tcpopt_expr_alloc(const struct location *loc, if (kind < array_size(tcpopt_protocols)) desc = tcpopt_protocols[kind]; - if (!desc) - return NULL; + if (!desc) { + if (field != TCPOPT_COMMON_KIND || kind > 255) + return NULL; + + expr = expr_alloc(loc, EXPR_EXTHDR, &integer_type, + BYTEORDER_BIG_ENDIAN, 8); + + desc = tcpopt_protocols[TCPOPT_NOP]; + tmpl = &desc->templates[field]; + expr->exthdr.desc = desc; + expr->exthdr.tmpl = tmpl; + expr->exthdr.op = NFT_EXTHDR_OP_TCPOPT; + expr->exthdr.raw_type = kind; + return expr; + } + tmpl = &desc->templates[field]; if (!tmpl) return NULL; @@ -149,6 +176,7 @@ struct expr *tcpopt_expr_alloc(const struct location *loc, expr->exthdr.desc = desc; expr->exthdr.tmpl = tmpl; expr->exthdr.op = NFT_EXTHDR_OP_TCPOPT; + expr->exthdr.raw_type = desc->type; expr->exthdr.offset = tmpl->offset; return expr; @@ -165,6 +193,10 @@ void tcpopt_init_raw(struct expr *expr, uint8_t type, unsigned int off, expr->len = len; expr->exthdr.flags = flags; expr->exthdr.offset = off; + expr->exthdr.op = NFT_EXTHDR_OP_TCPOPT; + + if (flags & NFT_EXTHDR_F_PRESENT) + datatype_set(expr, &boolean_type); if (type >= array_size(tcpopt_protocols)) return; @@ -178,12 +210,10 @@ void tcpopt_init_raw(struct expr *expr, uint8_t type, unsigned int off, if (tmpl->offset != off || tmpl->len != len) continue; - if (flags & NFT_EXTHDR_F_PRESENT) - datatype_set(expr, &boolean_type); - else + if ((flags & NFT_EXTHDR_F_PRESENT) == 0) datatype_set(expr, tmpl->dtype); + expr->exthdr.tmpl = tmpl; - expr->exthdr.op = NFT_EXTHDR_OP_TCPOPT; break; } } diff --git a/tests/py/any/tcpopt.t b/tests/py/any/tcpopt.t index 1d42de8..7b17014 100644 --- a/tests/py/any/tcpopt.t +++ b/tests/py/any/tcpopt.t @@ -30,6 +30,7 @@ tcp option timestamp kind 1;ok tcp option timestamp length 1;ok tcp option timestamp tsval 1;ok tcp option timestamp tsecr 1;ok +tcp option 255 missing;ok tcp option foobar;fail tcp option foo bar;fail @@ -38,6 +39,7 @@ tcp option eol left 1;fail tcp option eol left 1;fail tcp option sack window;fail tcp option sack window 1;fail +tcp option 256 exists;fail tcp option window exists;ok tcp option window missing;ok diff --git a/tests/py/any/tcpopt.t.payload b/tests/py/any/tcpopt.t.payload index 9c480c8..34f8e26 100644 --- a/tests/py/any/tcpopt.t.payload +++ b/tests/py/any/tcpopt.t.payload @@ -509,20 +509,6 @@ inet [ exthdr load tcpopt 4b @ 8 + 2 => reg 1 ] [ cmp eq reg 1 0x01000000 ] -# tcp option timestamp tsecr 1 -ip - [ meta load l4proto => reg 1 ] - [ cmp eq reg 1 0x00000006 ] - [ exthdr load tcpopt 4b @ 8 + 6 => reg 1 ] - [ cmp eq reg 1 0x01000000 ] - -# tcp option timestamp tsecr 1 -ip6 - [ meta load l4proto => reg 1 ] - [ cmp eq reg 1 0x00000006 ] - [ exthdr load tcpopt 4b @ 8 + 6 => reg 1 ] - [ cmp eq reg 1 0x01000000 ] - # tcp option timestamp tsecr 1 inet [ meta load l4proto => reg 1 ] @@ -530,19 +516,12 @@ inet [ exthdr load tcpopt 4b @ 8 + 6 => reg 1 ] [ cmp eq reg 1 0x01000000 ] -# tcp option window exists -ip - [ meta load l4proto => reg 1 ] - [ cmp eq reg 1 0x00000006 ] - [ exthdr load tcpopt 1b @ 3 + 0 present => reg 1 ] - [ cmp eq reg 1 0x00000001 ] - -# tcp option window exists -ip6 +# tcp option 255 missing +inet [ meta load l4proto => reg 1 ] [ cmp eq reg 1 0x00000006 ] - [ exthdr load tcpopt 1b @ 3 + 0 present => reg 1 ] - [ cmp eq reg 1 0x00000001 ] + [ exthdr load tcpopt 1b @ 255 + 0 present => reg 1 ] + [ cmp eq reg 1 0x00000000 ] # tcp option window exists inet @@ -551,20 +530,6 @@ inet [ exthdr load tcpopt 1b @ 3 + 0 present => reg 1 ] [ cmp eq reg 1 0x00000001 ] -# tcp option window missing -ip - [ meta load l4proto => reg 1 ] - [ cmp eq reg 1 0x00000006 ] - [ exthdr load tcpopt 1b @ 3 + 0 present => reg 1 ] - [ cmp eq reg 1 0x00000000 ] - -# tcp option window missing -ip6 - [ meta load l4proto => reg 1 ] - [ cmp eq reg 1 0x00000006 ] - [ exthdr load tcpopt 1b @ 3 + 0 present => reg 1 ] - [ cmp eq reg 1 0x00000000 ] - # tcp option window missing inet [ meta load l4proto => reg 1 ] @@ -572,16 +537,6 @@ inet [ exthdr load tcpopt 1b @ 3 + 0 present => reg 1 ] [ cmp eq reg 1 0x00000000 ] -# tcp option maxseg size set 1360 -ip - [ immediate reg 1 0x00005005 ] - [ exthdr write tcpopt reg 1 => 2b @ 2 + 2 ] - -# tcp option maxseg size set 1360 -ip6 - [ immediate reg 1 0x00005005 ] - [ exthdr write tcpopt reg 1 => 2b @ 2 + 2 ] - # tcp option maxseg size set 1360 inet [ immediate reg 1 0x00005005 ] -- 2.31.1