List and reimport Ruleset fails with "Error: transport protocol mapping is only valid after transport protocol match"

List and reimport Ruleset fails with "Error: transport protocol mapping is only valid after transport protocol match"

[Henning Reich]

Hi,

maybe somebody can give me a hint.

I'm using some systemd-nspawn containers with exposed Port.
Systemd creates automatically some masquerading rules and all works fine.
But if I restart nft.service, these rules are gone (obviously). So I
want to store and re-import them.

so this
nft list table ip io.systemd.nat | tee systemd_nat_rules
shows me:

table ip io.systemd.nat {
       set masq_saddr {
               type ipv4_addr
               flags interval
               elements = { 192.168.162.112/28 }
       }

       map map_port_ipport {
               type inet_proto . inet_service : ipv4_addr . inet_service
               elements = { tcp . 8088 : 192.168.162.117 . 80 }
       }

       chain prerouting {
               type nat hook prerouting priority dstnat + 1; policy accept;
               fib daddr type local dnat ip addr . port to meta
l4proto . th dport map @map_port_ipport
       }

       chain output {
               type nat hook output priority -99; policy accept;
               ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to
meta l4proto . th dport map @map_port_ipport
       }

       chain postrouting {
               type nat hook postrouting priority srcnat + 1; policy accept;
               ip saddr @masq_saddr masquerade
       }
}


But trying to import it:

nft -c -f systemd_nat_rules
results in:
ruleset:9:48-59: Error: transport protocol mapping is only valid after
transport protocol match
               type inet_proto . inet_service : ipv4_addr . inet_service



I also tried to store and import the complete ruleset (nft list
ruleset), but with the same error.

Thanks for your help.
Henning

Re: List and reimport Ruleset fails with "Error: transport protocol mapping is only valid after transport protocol match"

[Florian Westphal]

Henning Reich <henning.reich@gmail.com> wrote:
> I'm using some systemd-nspawn containers with exposed Port.
> Systemd creates automatically some masquerading rules and all works fine.
> But if I restart nft.service, these rules are gone (obviously). So I
> want to store and re-import them.
> 
> so this
> nft list table ip io.systemd.nat | tee systemd_nat_rules
> shows me:
> 
> table ip io.systemd.nat {
>        set masq_saddr {
>                type ipv4_addr
>                flags interval
>                elements = { 192.168.162.112/28 }
>        }
> 
>        map map_port_ipport {
>                type inet_proto . inet_service : ipv4_addr . inet_service
>                elements = { tcp . 8088 : 192.168.162.117 . 80 }
>        }
> 
>        chain prerouting {
>                type nat hook prerouting priority dstnat + 1; policy accept;
>                fib daddr type local dnat ip addr . port to meta
> l4proto . th dport map @map_port_ipport

> results in:
> ruleset:9:48-59: Error: transport protocol mapping is only valid after
> transport protocol match
>                type inet_proto . inet_service : ipv4_addr . inet_service

nft is too dumb and doesn't realize the protocol match is in the map
lookup.

I'll take a look.

[PATCH nft] evaluate: check if nat statement map specifies a transport header expr

[Florian Westphal]

Importing the systemd nat table fails:

table ip io.systemd.nat {
 map map_port_ipport {
   type inet_proto . inet_service : ipv4_addr . inet_service
   elements = { tcp . 8088 : 192.168.162.117 . 80 }
 }
 chain prerouting {
   type nat hook prerouting priority dstnat + 1; policy accept;
    fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
 }
}
ruleset:9:48-59: Error: transport protocol mapping is only valid after transport protocol match

To resolve this (no transport header base specified), check if the
map itself contains a network base protocol expression.

This allows nft to import the ruleset.
Import still fails with same error if 'inet_service' is removed
from the map, as it should.

Reported-by: Henning Reich <henning.reich@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 src/evaluate.c | 38 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/src/evaluate.c b/src/evaluate.c
index 85cf9e05b641..a6bb1792c58a 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2971,12 +2971,48 @@ static int evaluate_addr(struct eval_ctx *ctx, struct stmt *stmt,
 				 expr);
 }
 
+static bool nat_evaluate_addr_has_th_expr(const struct expr *map)
+{
+	const struct expr *i, *concat;
+
+	if (!map || map->etype != EXPR_MAP)
+		return false;
+
+	concat = map->map;
+	if (concat ->etype != EXPR_CONCAT)
+		return false;
+
+	list_for_each_entry(i, &concat->expressions, list) {
+		enum proto_bases base;
+
+		if ((i->flags & EXPR_F_PROTOCOL) == 0)
+			continue;
+
+		switch (i->etype) {
+		case EXPR_META:
+			base = i->meta.base;
+			break;
+		case EXPR_PAYLOAD:
+			base = i->payload.base;
+			break;
+		default:
+			return false;
+		}
+
+		if (base == PROTO_BASE_NETWORK_HDR)
+			return true;
+	}
+
+	return false;
+}
+
 static int nat_evaluate_transport(struct eval_ctx *ctx, struct stmt *stmt,
 				  struct expr **expr)
 {
 	struct proto_ctx *pctx = &ctx->pctx;
 
-	if (pctx->protocol[PROTO_BASE_TRANSPORT_HDR].desc == NULL)
+	if (pctx->protocol[PROTO_BASE_TRANSPORT_HDR].desc == NULL &&
+	    !nat_evaluate_addr_has_th_expr(stmt->nat.addr))
 		return stmt_binary_error(ctx, *expr, stmt,
 					 "transport protocol mapping is only "
 					 "valid after transport protocol match");
-- 
2.26.3

[PATCH nft] evaluate: check if nat statement map specifies a transport header expr

[Florian Westphal]

Importing the systemd nat table fails:

table ip io.systemd.nat {
 map map_port_ipport {
   type inet_proto . inet_service : ipv4_addr . inet_service
   elements = { tcp . 8088 : 192.168.162.117 . 80 }
 }
 chain prerouting {
   type nat hook prerouting priority dstnat + 1; policy accept;
    fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
 }
}
ruleset:9:48-59: Error: transport protocol mapping is only valid after transport protocol match

To resolve this (no transport header base specified), check if the
map itself contains a network base protocol expression.

This allows nft to import the ruleset.
Import still fails with same error if 'inet_service' is removed
from the map, as it should.

Reported-by: Henning Reich <henning.reich@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 src/evaluate.c | 38 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/src/evaluate.c b/src/evaluate.c
index 85cf9e05b641..a6bb1792c58a 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2971,12 +2971,48 @@ static int evaluate_addr(struct eval_ctx *ctx, struct stmt *stmt,
 				 expr);
 }
 
+static bool nat_evaluate_addr_has_th_expr(const struct expr *map)
+{
+	const struct expr *i, *concat;
+
+	if (!map || map->etype != EXPR_MAP)
+		return false;
+
+	concat = map->map;
+	if (concat ->etype != EXPR_CONCAT)
+		return false;
+
+	list_for_each_entry(i, &concat->expressions, list) {
+		enum proto_bases base;
+
+		if ((i->flags & EXPR_F_PROTOCOL) == 0)
+			continue;
+
+		switch (i->etype) {
+		case EXPR_META:
+			base = i->meta.base;
+			break;
+		case EXPR_PAYLOAD:
+			base = i->payload.base;
+			break;
+		default:
+			return false;
+		}
+
+		if (base == PROTO_BASE_NETWORK_HDR)
+			return true;
+	}
+
+	return false;
+}
+
 static int nat_evaluate_transport(struct eval_ctx *ctx, struct stmt *stmt,
 				  struct expr **expr)
 {
 	struct proto_ctx *pctx = &ctx->pctx;
 
-	if (pctx->protocol[PROTO_BASE_TRANSPORT_HDR].desc == NULL)
+	if (pctx->protocol[PROTO_BASE_TRANSPORT_HDR].desc == NULL &&
+	    !nat_evaluate_addr_has_th_expr(stmt->nat.addr))
 		return stmt_binary_error(ctx, *expr, stmt,
 					 "transport protocol mapping is only "
 					 "valid after transport protocol match");
-- 
2.26.3