* Re: [PATCH nft] evaluate: add range specified flag setting (missing NF_NAT_RANGE_PROTO_SPECIFIED)
[not found] <df06055e-784a-9711-2ff5-6ef159e842ee@marinkevich.ru>
@ 2020-03-19 6:33 ` Сергей Маринкевич
2020-03-19 10:00 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Сергей Маринкевич @ 2020-03-19 6:33 UTC (permalink / raw)
To: netfilter-devel; +Cc: pablo
I sorry, my e-mail client goes bananaz.
> Sergey reports:
>
> With nf_tables it is not possible to use port range for masquerading.
> Masquerade statement has option "to [:port-port]" which give no effect
> to translation behavior. But it must change source port of packet to
> one from ":port-port" range.
>
> My network:
>
> +-----------------------------+
> | ROUTER |
> | |
> | Masquerade|
> | 10.0.0.1 1.1.1.1 |
> | +------+ +------+ |
> | | eth1 | | eth2 | |
> +-+--^---+-----------+---^--+-+
> | |
> | |
> +----v------+ +------v----+
> | | | |
> | 10.0.0.2 | | 1.1.1.2 |
> | | | |
> |PC1 | |PC2 |
> +-----------+ +-----------+
>
> For testing i used rule like this:
>
> rule ip nat POSTROUTING oifname eth2 masquerade to :666
>
> Run netcat for 1.1.1.2 667(UDP) and get dump from PC2:
>
> 15:22:25.591567 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f,
ethertype IPv4 (0x0800), length 60: 1.1.1.1.34466 > 1.1.1.2.667: UDP,
length 1
>
> Address translation works fine, but source port are not belongs to
> specified range.
>
> I see in similar source code (i.e. nft_redir.c, nft_nat.c) that
> there is setting NF_NAT_RANGE_PROTO_SPECIFIED flag. After adding this,
> repeat test for kernel with this patch, and get dump:
>
> 16:16:22.324710 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f,
ethertype IPv4 (0x0800), length 60: 1.1.1.1.666 > 1.1.1.2.667: UDP, length 1
>
> Now it is works fine.
>
> Reported-by: Sergey Marinkevich <s@marinkevich.ru>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
> Sergey, could you try this userspace patch instead? Thanks.
I tried this patch with equal environment but another
net(192.168.122.0/24). Router uses vanilla kernel v5.4.19.
Translation is the same.
12:59:11.599887 08:00:27:ec:9c:b3 > 52:54:00:57:d2:7d, ethertype
IPv4 (0x0800), length 60: 192.168.122.38.666 > 192.168.122.1.667: UDP,
length 4
I think i have to add this tag:
Tested-by: Sergey Marinkevich <s@marinkevich.ru>
>
> src/evaluate.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/src/evaluate.c b/src/evaluate.c
> index 4a23b231c74d..d0e712dc02f0 100644
> --- a/src/evaluate.c
> +++ b/src/evaluate.c
> @@ -18,6 +18,7 @@
> #include <linux/netfilter_arp.h>
> #include <linux/netfilter/nf_tables.h>
> #include <linux/netfilter/nf_synproxy.h>
> +#include <linux/netfilter/nf_nat.h>
> #include <linux/netfilter_ipv4.h>
> #include <netinet/ip_icmp.h>
> #include <netinet/icmp6.h>
> @@ -2950,6 +2951,8 @@ static int stmt_evaluate_nat(struct eval_ctx
*ctx, struct stmt *stmt)
> err = nat_evaluate_transport(ctx, stmt, &stmt->nat.proto);
> if (err < 0)
> return err;
> +
> + stmt->nat.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
> }
>
> stmt->flags |= STMT_F_TERMINAL;
> --
> 2.11.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH nft] evaluate: add range specified flag setting (missing NF_NAT_RANGE_PROTO_SPECIFIED)
2020-03-19 6:33 ` [PATCH nft] evaluate: add range specified flag setting (missing NF_NAT_RANGE_PROTO_SPECIFIED) Сергей Маринкевич
@ 2020-03-19 10:00 ` Pablo Neira Ayuso
0 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-19 10:00 UTC (permalink / raw)
To: Сергей
Маринкевич
Cc: netfilter-devel
On Thu, Mar 19, 2020 at 01:33:10PM +0700, Сергей Маринкевич wrote:
> > Sergey, could you try this userspace patch instead? Thanks.
>
> I tried this patch with equal environment but another
>
> net(192.168.122.0/24). Router uses vanilla kernel v5.4.19.
> Translation is the same.
>
> 12:59:11.599887 08:00:27:ec:9c:b3 > 52:54:00:57:d2:7d, ethertype IPv4
> (0x0800), length 60: 192.168.122.38.666 > 192.168.122.1.667: UDP, length 4
>
> I think i have to add this tag:
>
> Tested-by: Sergey Marinkevich <s@marinkevich.ru>
Applied, thanks for testing.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH nft] evaluate: add range specified flag setting (missing NF_NAT_RANGE_PROTO_SPECIFIED)
@ 2020-03-19 6:22 Сергей Маринкевич
0 siblings, 0 replies; 4+ messages in thread
From: Сергей Маринкевич @ 2020-03-19 6:22 UTC (permalink / raw)
To: netfilter-devel; +Cc: pablo
> Sergey reports: > > With nf_tables it is not possible to use port range for
masquerading. > Masquerade statement has option "to [:port-port]" which
give no effect > to translation behavior. But it must change source port
of packet to > one from ":port-port" range. > > My network: > >
+-----------------------------+ > | ROUTER | > | | > | Masquerade| > |
10.0.0.1 1.1.1.1 | > | +------+ +------+ | > | | eth1 | | eth2 | | >
+-+--^---+-----------+---^--+-+ > | | > | | > +----v------+
+------v----+ > | | | | > | 10.0.0.2 | | 1.1.1.2 | > | | | | > |PC1 |
|PC2 | > +-----------+ +-----------+ > > For testing i used rule like
this: > > rule ip nat POSTROUTING oifname eth2 masquerade to :666 > >
Run netcat for 1.1.1.2 667(UDP) and get dump from PC2: > >
15:22:25.591567 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f, ethertype IPv4
(0x0800), length 60: 1.1.1.1.34466 > 1.1.1.2.667: UDP, length 1 > >
Address translation works fine, but source port are not belongs to >
specified range. > > I see in similar source code (i.e. nft_redir.c,
nft_nat.c) that > there is setting NF_NAT_RANGE_PROTO_SPECIFIED flag.
After adding this, > repeat test for kernel with this patch, and get
dump: > > 16:16:22.324710 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f,
ethertype IPv4 (0x0800), length 60: 1.1.1.1.666 > 1.1.1.2.667: UDP,
length 1 > > Now it is works fine. > > Reported-by: Sergey Marinkevich
<s@marinkevich.ru> > Signed-off-by: Pablo Neira Ayuso
<pablo@netfilter.org> > --- > Sergey, could you try this userspace patch
instead? Thanks.
I tried this patch with equal environment but another
net(192.168.122.0/24). Router uses vanilla kernel v5.4.19.
Translation is the same.
12:59:11.599887 08:00:27:ec:9c:b3 > 52:54:00:57:d2:7d, ethertype
IPv4 (0x0800), length 60: 192.168.122.38.666 > 192.168.122.1.667: UDP,
length 4
I think i have to add this tag:
Tested-by: Sergey Marinkevich <s@marinkevich.ru>
> > src/evaluate.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff
--git a/src/evaluate.c b/src/evaluate.c > index
4a23b231c74d..d0e712dc02f0 100644 > --- a/src/evaluate.c > +++
b/src/evaluate.c > @@ -18,6 +18,7 @@ > #include <linux/netfilter_arp.h>
> #include <linux/netfilter/nf_tables.h> > #include
<linux/netfilter/nf_synproxy.h> > +#include <linux/netfilter/nf_nat.h> >
#include <linux/netfilter_ipv4.h> > #include <netinet/ip_icmp.h> >
#include <netinet/icmp6.h> > @@ -2950,6 +2951,8 @@ static int
stmt_evaluate_nat(struct eval_ctx *ctx, struct stmt *stmt) > err =
nat_evaluate_transport(ctx, stmt, &stmt->nat.proto); > if (err < 0) >
return err; > + > + stmt->nat.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; > }
> > stmt->flags |= STMT_F_TERMINAL; > -- > 2.11.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH nft] evaluate: add range specified flag setting (missing NF_NAT_RANGE_PROTO_SPECIFIED)
@ 2020-03-18 18:54 Pablo Neira Ayuso
0 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-18 18:54 UTC (permalink / raw)
To: netfilter-devel
Sergey reports:
With nf_tables it is not possible to use port range for masquerading.
Masquerade statement has option "to [:port-port]" which give no effect
to translation behavior. But it must change source port of packet to
one from ":port-port" range.
My network:
+-----------------------------+
| ROUTER |
| |
| Masquerade|
| 10.0.0.1 1.1.1.1 |
| +------+ +------+ |
| | eth1 | | eth2 | |
+-+--^---+-----------+---^--+-+
| |
| |
+----v------+ +------v----+
| | | |
| 10.0.0.2 | | 1.1.1.2 |
| | | |
|PC1 | |PC2 |
+-----------+ +-----------+
For testing i used rule like this:
rule ip nat POSTROUTING oifname eth2 masquerade to :666
Run netcat for 1.1.1.2 667(UDP) and get dump from PC2:
15:22:25.591567 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f, ethertype IPv4 (0x0800), length 60: 1.1.1.1.34466 > 1.1.1.2.667: UDP, length 1
Address translation works fine, but source port are not belongs to
specified range.
I see in similar source code (i.e. nft_redir.c, nft_nat.c) that
there is setting NF_NAT_RANGE_PROTO_SPECIFIED flag. After adding this,
repeat test for kernel with this patch, and get dump:
16:16:22.324710 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f, ethertype IPv4 (0x0800), length 60: 1.1.1.1.666 > 1.1.1.2.667: UDP, length 1
Now it is works fine.
Reported-by: Sergey Marinkevich <s@marinkevich.ru>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
Sergey, could you try this userspace patch instead? Thanks.
src/evaluate.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/evaluate.c b/src/evaluate.c
index 4a23b231c74d..d0e712dc02f0 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -18,6 +18,7 @@
#include <linux/netfilter_arp.h>
#include <linux/netfilter/nf_tables.h>
#include <linux/netfilter/nf_synproxy.h>
+#include <linux/netfilter/nf_nat.h>
#include <linux/netfilter_ipv4.h>
#include <netinet/ip_icmp.h>
#include <netinet/icmp6.h>
@@ -2950,6 +2951,8 @@ static int stmt_evaluate_nat(struct eval_ctx *ctx, struct stmt *stmt)
err = nat_evaluate_transport(ctx, stmt, &stmt->nat.proto);
if (err < 0)
return err;
+
+ stmt->nat.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
}
stmt->flags |= STMT_F_TERMINAL;
--
2.11.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-03-19 10:00 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <df06055e-784a-9711-2ff5-6ef159e842ee@marinkevich.ru>
2020-03-19 6:33 ` [PATCH nft] evaluate: add range specified flag setting (missing NF_NAT_RANGE_PROTO_SPECIFIED) Сергей Маринкевич
2020-03-19 10:00 ` Pablo Neira Ayuso
2020-03-19 6:22 Сергей Маринкевич
-- strict thread matches above, loose matches on Subject: below --
2020-03-18 18:54 Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.