Pablo Neira Ayuso | 22 Dec 13:59 2014

[PATCH] netfilter: nf_tables: fix port natting in little endian archs

From: leroy christophe <christophe.leroy <at> c-s.fr>

Make sure this fetches 16-bits port data from the register.
Remove casting to make sparse happy, not needed anymore.

Signed-off-by: leroy christophe <christophe.leroy <at> c-s.fr>
Signed-off-by: Pablo Neira Ayuso <pablo <at> netfilter.org>
---
 <at> Christophe: I have also mangled other spots where this problems will show up
and remove casting (not required anymore to make sparse happy). Please, test
and will submit this to mainstream. I have included you as author, I wanted
to speed up the submission process. Thanks.

 net/ipv4/netfilter/nft_redir_ipv4.c |    8 ++++----
 net/ipv6/netfilter/nft_redir_ipv6.c |    8 ++++----
 net/netfilter/nft_nat.c             |    8 ++++----
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/net/ipv4/netfilter/nft_redir_ipv4.c b/net/ipv4/netfilter/nft_redir_ipv4.c
index ff2d23d..6ecfce6 100644
--- a/net/ipv4/netfilter/nft_redir_ipv4.c
+++ b/net/ipv4/netfilter/nft_redir_ipv4.c
 <at>  <at>  -27,10 +27,10  <at>  <at>  static void nft_redir_ipv4_eval(const struct nft_expr *expr,

 	memset(&mr, 0, sizeof(mr));
 	if (priv->sreg_proto_min) {
-		mr.range[0].min.all = (__force __be16)
-					data[priv->sreg_proto_min].data[0];
-		mr.range[0].max.all = (__force __be16)
-					data[priv->sreg_proto_max].data[0];
(Continue reading)

Pablo Neira Ayuso | 22 Dec 13:45 2014

[PATCH nft 1/2] tests: regression: named sets work

Those tests work already, enable them.

Signed-off-by: Pablo Neira Ayuso <pablo <at> netfilter.org>
---
 tests/regression/ip/sets.t |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/tests/regression/ip/sets.t b/tests/regression/ip/sets.t
index a74d308..c199dbd 100644
--- a/tests/regression/ip/sets.t
+++ b/tests/regression/ip/sets.t
 <at>  <at>  -25,7 +25,6  <at>  <at> 
 ?set2 192.168.3.8 192.168.3.9;ok
 ?set2 192.168.3.10 192.168.3.11;ok

--ip saddr  <at> set1 drop;ok
--ip saddr  <at> set2 drop;ok
--ip saddr  <at> set33 drop;fail
--ip saddr  <at> set21 drop;fail
+ip saddr  <at> set1 drop;ok
+ip saddr  <at> set2 drop;ok
+ip saddr  <at> set33 drop;fail
--

-- 
1.7.10.4

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo <at> vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

(Continue reading)

Pablo Neira Ayuso | 22 Dec 12:31 2014

[PATCH nft] evaluate: fix wrong port natting in little endian

Use a 4-bytes word to store the immediate expression that stores the
port number (instead of 2-bytes). The port netlink attribute is 4-bytes
long, if we use a 2-bytes word the kernel misinterprets the 2-bytes
value in little endian.

Signed-off-by: Pablo Neira Ayuso <pablo <at> netfilter.org>
---
 <at> Christophe: Could you test this patch in you little-endian testbed?
Thanks.

 src/evaluate.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/evaluate.c b/src/evaluate.c
index 8f0acf7..37350b4 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
 <at>  <at>  -1516,7 +1516,7  <at>  <at>  static int stmt_evaluate_nat(struct eval_ctx *ctx, struct stmt *stmt)
 						 "valid after transport protocol match");

 		expr_set_context(&ctx->ectx, &inet_service_type,
-				 2 * BITS_PER_BYTE);
+				 4 * BITS_PER_BYTE);
 		err = expr_evaluate(ctx, &stmt->nat.proto);
 		if (err < 0)
 			return err;
 <at>  <at>  -1578,7 +1578,7  <at>  <at>  static int stmt_evaluate_redir(struct eval_ctx *ctx, struct stmt *stmt)
 						 "missing transport protocol match");

 		expr_set_context(&ctx->ectx, &inet_service_type,
(Continue reading)

Eric B Munson | 19 Dec 16:25 2014

[PATCH] Add element count to hash headers

It would be useful for userspace to query the size of an ipset hash,
however, this data is not exposed to userspace outside of counting the
number of member entries.  This patch uses the attribute
IPSET_ATTR_ELEMENTS to indicate the size in the the header that is
exported to userspace.  This field is then printed by the userspace
tool for hashes.

Because it is only meaningful for hashes to report their size, the
output is conditional on the set type.  To do this checking the
MATCH_TYPENAME macro was moved to utils.h.

Signed-off-by: Eric B Munson <emunson <at> akamai.com>
Cc: Jozsef Kadlecsik <kadlec <at> blackhole.kfki.hu>
Cc: Josh Hunt <johunt <at> akamai.com>
---
 include/libipset/utils.h                     |  3 +++
 kernel/net/netfilter/ipset/ip_set_hash_gen.h |  3 ++-
 lib/errcode.c                                |  2 --
 lib/session.c                                | 14 ++++++++++++--
 4 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/include/libipset/utils.h b/include/libipset/utils.h
index 3cd29da..ceedd45 100644
--- a/include/libipset/utils.h
+++ b/include/libipset/utils.h
 <at>  <at>  -19,6 +19,9  <at>  <at> 
 #define STRCASEQ(a, b)		(strcasecmp(a, b) == 0)
 #define STRNCASEQ(a, b, n)	(strncasecmp(a, b, n) == 0)

+/* Match set type names */
(Continue reading)

Jörg Thalheim | 19 Dec 14:02 2014

[PATCH] add systemd service file

Signed-off-by: Jörg Thalheim <joerg <at> higgsboson.tk>
---
 configure.ac                   | 34 ++++++++++++++++++++++++++++++++++
 files/Makefile.am              |  3 ++-
 files/nftables/nftables.conf   |  0
 files/systemd/Makefile.am      | 12 ++++++++++++
 files/systemd/nftables-reload  | 16 ++++++++++++++++
 files/systemd/nftables.service | 12 ++++++++++++
 6 files changed, 76 insertions(+), 1 deletion(-)
 create mode 100644 files/nftables/nftables.conf
 create mode 100644 files/systemd/Makefile.am
 create mode 100755 files/systemd/nftables-reload
 create mode 100644 files/systemd/nftables.service

diff --git a/configure.ac b/configure.ac
index 57ea99d..5adb223 100644
--- a/configure.ac
+++ b/configure.ac
 <at>  <at>  -13,6 +13,8  <at>  <at>  AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([-Wall foreign subdir-objects
         tar-pax no-dist-gzip dist-bzip2 1.6])

+AC_PATH_TOOL(PKGCONFIG, pkg-config)
+
 dnl kernel style compile messages
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])

 <at>  <at>  -112,6 +114,36  <at>  <at>  AC_TYPE_UINT16_T
 AC_TYPE_UINT32_T
 AC_TYPE_UINT64_T
(Continue reading)

U.Mutlu | 19 Dec 12:57 2014

Removing a REDIRECT rule not working

I think I found a bug in iptables:

If applying such a rule:

  iptables -t nat -A PREROUTING -p tcp --dport 1234 -j REDIRECT --to-port 5678

then testing it at least once by putting a server-app at port 5678,
and then throwing this rule away by clearing (flushing) alle the tables
doesn't get this rule disappear anymore; it somehow is still active,
because the REDIRection still works even after clearing the tables.

(Haven't checked yet if after a reboot of the system the problem disappears,
but even then this of course wouldn't be a satifactory solution to the problem.)

My system: debian 8 (jessie), iptables from the beforementioned repo, version 
v1.4.21

Another related issue:

The following documentation says that the above rule would be a "transparent 
proxy":
  http://www.tldp.org/HOWTO/TransparentProxy-5.html
But this can't be true, because it's NAT (s.a.); whereas from a
transparent proxy one would expect that the originating IP gets
passed thru to the redirected port, which is not the case here;
only the NATted IP gets passed...

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo <at> vger.kernel.org
(Continue reading)

Kristian Evensen | 19 Dec 11:18 2014
Picon

[PATCH] conntrack: Flush connections with given work

This patch adds support for selective flushing of conntrack mappings. By adding
CTA_MARK and CTA_MARK_MASK to a delete-message, the mark is checked before a
connection is deleted while flushing.

One use-case for this feature is on multihomed systems using policy routing
(based on marks). If say for example the next-hop's internet connection goes
down, it is desirable to be able to "reset" all connections using that
interface. However, since the device might be communicating with other devices
on the local network, it is not desitable to set the interface as down.

An iptables-rules can then be used to match not NEW connections without a mark.
generating for example a TCP RST.

Signed-off-by: Kristian Evensen <kristian.evensen <at> gmail.com>
---
 net/netfilter/nf_conntrack_netlink.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 1bd9ed9..9626b8f 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
 <at>  <at>  -1001,6 +1001,18  <at>  <at>  static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {
 				    .len = NF_CT_LABELS_MAX_SIZE },
 };

+#ifdef CONFIG_NF_CONNTRACK_MARK
+static int ctnetlink_filter_mark(struct nf_conn *i, void *data)
+{
+	struct ctnetlink_dump_filter *filter = data;
(Continue reading)

Jörg Thalheim | 18 Dec 21:10 2014

[PATCH] add systemd service file

Signed-off-by: Jörg Thalheim <joerg <at> higgsboson.tk>
---
 configure.ac                   | 34 ++++++++++++++++++++++++++++++++++
 files/Makefile.am              |  3 ++-
 files/nftables/nftables.conf   |  0
 files/systemd/Makefile.am      | 12 ++++++++++++
 files/systemd/nftables-reload  | 15 +++++++++++++++
 files/systemd/nftables.service | 12 ++++++++++++
 6 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 files/nftables/nftables.conf
 create mode 100644 files/systemd/Makefile.am
 create mode 100755 files/systemd/nftables-reload
 create mode 100644 files/systemd/nftables.service

diff --git a/configure.ac b/configure.ac
index 57ea99d..5adb223 100644
--- a/configure.ac
+++ b/configure.ac
 <at>  <at>  -13,6 +13,8  <at>  <at>  AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([-Wall foreign subdir-objects
         tar-pax no-dist-gzip dist-bzip2 1.6])

+AC_PATH_TOOL(PKGCONFIG, pkg-config)
+
 dnl kernel style compile messages
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])

 <at>  <at>  -112,6 +114,36  <at>  <at>  AC_TYPE_UINT16_T
 AC_TYPE_UINT32_T
 AC_TYPE_UINT64_T
(Continue reading)

Jörg Thalheim | 18 Dec 13:47 2014

Re: [PATCH] add systemd service file

I refactor the patch based on your feedback, however:

  $ nft flush ruleset

fails with:

  <cmdline>:1:1-13: Error: Could not process rule: Address family not supported by protocol 
  flush ruleset
  ^^^^^^^^^^^^^

  $ nft --version     
  nftables v0.4 (Support Edward Snowden)

  $ uname -a
  Linux turingmachine 3.17.6-1-ARCH #1 SMP PREEMPT Sun Dec 7 23:43:32 UTC 2014 x86_64 GNU/Linux
Jörg Thalheim | 18 Dec 13:47 2014

[PATCH] add systemd service file

Signed-off-by: Jörg Thalheim <joerg <at> higgsboson.tk>
---
 configure.ac                   | 34 ++++++++++++++++++++++++++++++++++
 files/Makefile.am              | 10 +++++++++-
 files/nftables.conf            |  7 +++++++
 files/nftables/nftables.conf   |  0
 files/systemd/Makefile.am      | 12 ++++++++++++
 files/systemd/nftables-reload  | 15 +++++++++++++++
 files/systemd/nftables.service | 12 ++++++++++++
 7 files changed, 89 insertions(+), 1 deletion(-)
 create mode 100644 files/nftables.conf
 create mode 100644 files/nftables/nftables.conf
 create mode 100644 files/systemd/Makefile.am
 create mode 100755 files/systemd/nftables-reload
 create mode 100644 files/systemd/nftables.service

diff --git a/configure.ac b/configure.ac
index 57ea99d..5adb223 100644
--- a/configure.ac
+++ b/configure.ac
 <at>  <at>  -13,6 +13,8  <at>  <at>  AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([-Wall foreign subdir-objects
         tar-pax no-dist-gzip dist-bzip2 1.6])

+AC_PATH_TOOL(PKGCONFIG, pkg-config)
+
 dnl kernel style compile messages
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])

 <at>  <at>  -112,6 +114,36  <at>  <at>  AC_TYPE_UINT16_T
(Continue reading)

Jörg Thalheim | 17 Dec 20:54 2014

[PATCH] add systemd service file

Signed-off-by: Jörg Thalheim <joerg <at> higgsboson.tk>
---
 .gitignore                |   2 +
 configure.ac              |  35 +++++++++++++
 files/Makefile.am         |   7 +++
 files/nftables.service.in |  12 +++++
 files/nftablesctl.in      | 129 ++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 185 insertions(+)
 create mode 100644 files/nftables.service.in
 create mode 100755 files/nftablesctl.in

diff --git a/.gitignore b/.gitignore
index 63ef1a2..e6f8065 100644
--- a/.gitignore
+++ b/.gitignore
 <at>  <at>  -23,6 +23,8  <at>  <at>  depcomp
 ylwrap
 src/parser_bison.c
 src/parser_bison.h
+files/nftables.service
+files/nftablesctl

 # Debian package build temporary files
 build-stamp
diff --git a/configure.ac b/configure.ac
index 57ea99d..19980d1 100644
--- a/configure.ac
+++ b/configure.ac
 <at>  <at>  -13,6 +13,8  <at>  <at>  AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([-Wall foreign subdir-objects
(Continue reading)


Gmane