* [PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection
@ 2019-11-23 16:22 Christian Göttsche
2019-11-23 16:22 ` [PATCH nftables v2 2/2] files: add example secmark config Christian Göttsche
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Christian Göttsche @ 2019-11-23 16:22 UTC (permalink / raw)
To: netfilter-devel
Labeling established and related packets requires the secmark to be stored in the connection.
Add the ability to store and retrieve secmarks like:
...
chain input {
...
# label new incoming packets
ct state new meta secmark set tcp dport map @secmapping_in
# add label to connection
ct state new ct secmark set meta secmark
# set label for est/rel packets from connection
ct state established,related meta secmark set ct secmark
...
}
...
chain output {
...
# label new outgoing packets
ct state new meta secmark set tcp dport map @secmapping_out
# add label to connection
ct state new ct secmark set meta secmark
# set label for est/rel packets from connection
ct state established,related meta secmark set ct secmark
...
}
...
This patch also disallow constant value on the right hand side.
# nft add rule x y meta secmark 12
Error: Cannot be used with right hand side constant value
add rule x y meta secmark 12
~~~~~~~~~~~~ ^^
# nft add rule x y ct secmark 12
Error: Cannot be used with right hand side constant value
add rule x y ct secmark 12
~~~~~~~~~~ ^^
# nft add rule x y ct secmark set 12
Error: ct secmark must not be set to constant value
add rule x y ct secmark set 12
^^^^^^^^^^^^^^^^^
This patch improves 3bc84e5c1fdd ("src: add support for setting secmark").
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
v2: - incorporate changes suggested by Pablo Neira Ayuso
- invalidate setting ct secmark to a constant value, like:
ct secmark set 12
Note:
statements setting the meta secmark, like
meta secmark set 12
must accept constant values, cause the secmark object identifier
is a string
meta secmark set "icmp_client"
12 is probably not a used secmark object identifier, so it will
fail:
nft add rule inet filter input meta secmark set 12
Error: Could not process rule: No such file or directory
add rule inet filter input meta secmark set 12
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
src/ct.c | 2 ++
src/evaluate.c | 24 ++++++++++++++++++++++--
src/meta.c | 2 ++
src/parser_bison.y | 14 +++++++++++---
4 files changed, 37 insertions(+), 5 deletions(-)
diff --git a/src/ct.c b/src/ct.c
index ed458e6b..9e6a8351 100644
--- a/src/ct.c
+++ b/src/ct.c
@@ -299,6 +299,8 @@ const struct ct_template ct_templates[__NFT_CT_MAX] = {
BYTEORDER_BIG_ENDIAN, 128),
[NFT_CT_DST_IP6] = CT_TEMPLATE("ip6 daddr", &ip6addr_type,
BYTEORDER_BIG_ENDIAN, 128),
+ [NFT_CT_SECMARK] = CT_TEMPLATE("secmark", &integer_type,
+ BYTEORDER_HOST_ENDIAN, 32),
};
static void ct_print(enum nft_ct_keys key, int8_t dir, uint8_t nfproto,
diff --git a/src/evaluate.c b/src/evaluate.c
index e54eaf1a..a865902c 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1784,6 +1784,18 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr)
left->dtype->desc,
right->dtype->desc);
+ /*
+ * Statements like 'ct secmark 12' are parsed as relational,
+ * disallow constant value on the right hand side.
+ */
+ if (((left->etype == EXPR_META &&
+ left->meta.key == NFT_META_SECMARK) ||
+ (left->etype == EXPR_CT &&
+ left->ct.key == NFT_CT_SECMARK)) &&
+ right->flags & EXPR_F_CONSTANT)
+ return expr_binary_error(ctx->msgs, right, left,
+ "Cannot be used with right hand side constant value");
+
switch (rel->op) {
case OP_EQ:
case OP_IMPLICIT:
@@ -2319,11 +2331,19 @@ static int stmt_evaluate_meta(struct eval_ctx *ctx, struct stmt *stmt)
static int stmt_evaluate_ct(struct eval_ctx *ctx, struct stmt *stmt)
{
- return stmt_evaluate_arg(ctx, stmt,
+ if (stmt_evaluate_arg(ctx, stmt,
stmt->ct.tmpl->dtype,
stmt->ct.tmpl->len,
stmt->ct.tmpl->byteorder,
- &stmt->ct.expr);
+ &stmt->ct.expr) < 0)
+ return -1;
+
+ if (stmt->ct.key == NFT_CT_SECMARK &&
+ expr_is_constant(stmt->ct.expr))
+ return stmt_error(ctx, stmt,
+ "ct secmark must not be set to constant value");
+
+ return 0;
}
static int reject_payload_gen_dependency_tcp(struct eval_ctx *ctx,
diff --git a/src/meta.c b/src/meta.c
index 69a897a9..796d8e94 100644
--- a/src/meta.c
+++ b/src/meta.c
@@ -698,6 +698,8 @@ const struct meta_template meta_templates[] = {
[NFT_META_TIME_HOUR] = META_TEMPLATE("hour", &hour_type,
4 * BITS_PER_BYTE,
BYTEORDER_HOST_ENDIAN),
+ [NFT_META_SECMARK] = META_TEMPLATE("secmark", &integer_type,
+ 32, BYTEORDER_HOST_ENDIAN),
};
static bool meta_key_is_unqualified(enum nft_meta_keys key)
diff --git a/src/parser_bison.y b/src/parser_bison.y
index 631b7d68..707f4671 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -4190,9 +4190,16 @@ meta_stmt : META meta_key SET stmt_expr
{
switch ($2) {
case NFT_META_SECMARK:
- $$ = objref_stmt_alloc(&@$);
- $$->objref.type = NFT_OBJECT_SECMARK;
- $$->objref.expr = $4;
+ switch ($4->etype) {
+ case EXPR_CT:
+ $$ = meta_stmt_alloc(&@$, $2, $4);
+ break;
+ default:
+ $$ = objref_stmt_alloc(&@$);
+ $$->objref.type = NFT_OBJECT_SECMARK;
+ $$->objref.expr = $4;
+ break;
+ }
break;
default:
$$ = meta_stmt_alloc(&@$, $2, $4);
@@ -4388,6 +4395,7 @@ ct_key : L3PROTOCOL { $$ = NFT_CT_L3PROTOCOL; }
| PROTO_DST { $$ = NFT_CT_PROTO_DST; }
| LABEL { $$ = NFT_CT_LABELS; }
| EVENT { $$ = NFT_CT_EVENTMASK; }
+ | SECMARK { $$ = NFT_CT_SECMARK; }
| ct_key_dir_optional
;
--
2.24.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH nftables v2 2/2] files: add example secmark config
2019-11-23 16:22 [PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection Christian Göttsche
@ 2019-11-23 16:22 ` Christian Göttsche
2019-11-25 14:47 ` Pablo Neira Ayuso
2019-11-25 12:10 ` [PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection Pablo Neira Ayuso
2019-11-25 14:46 ` Pablo Neira Ayuso
2 siblings, 1 reply; 6+ messages in thread
From: Christian Göttsche @ 2019-11-23 16:22 UTC (permalink / raw)
To: netfilter-devel
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
v2: add note about SELinux requirements for this example
files/examples/Makefile.am | 1 +
files/examples/secmark.nft | 87 ++++++++++++++++++++++++++++++++++++++
2 files changed, 88 insertions(+)
create mode 100755 files/examples/secmark.nft
diff --git a/files/examples/Makefile.am b/files/examples/Makefile.am
index c40e041e..b29e9f61 100644
--- a/files/examples/Makefile.am
+++ b/files/examples/Makefile.am
@@ -1,4 +1,5 @@
pkgdocdir = ${docdir}/examples
dist_pkgdoc_SCRIPTS = ct_helpers.nft \
load_balancing.nft \
+ secmark.nft \
sets_and_maps.nft
diff --git a/files/examples/secmark.nft b/files/examples/secmark.nft
new file mode 100755
index 00000000..16f9a368
--- /dev/null
+++ b/files/examples/secmark.nft
@@ -0,0 +1,87 @@
+#!/usr/sbin/nft -f
+
+# This example file shows how to use secmark labels with the nftables framework.
+# This script is meant to be loaded with `nft -f <file>`
+# You require linux kernel >= 4.20 and nft >= 0.9.3
+# This example is SELinux based, for the secmark objects you require
+# SELinux enabled and a SELinux policy defining the stated contexts
+# For up-to-date information please visit https://wiki.nftables.org
+
+
+flush ruleset
+
+table inet filter {
+ secmark ssh_server {
+ "system_u:object_r:ssh_server_packet_t:s0"
+ }
+
+ secmark dns_client {
+ "system_u:object_r:dns_client_packet_t:s0"
+ }
+
+ secmark http_client {
+ "system_u:object_r:http_client_packet_t:s0"
+ }
+
+ secmark https_client {
+ "system_u:object_r:http_client_packet_t:s0"
+ }
+
+ secmark ntp_client {
+ "system_u:object_r:ntp_client_packet_t:s0"
+ }
+
+ secmark icmp_client {
+ "system_u:object_r:icmp_client_packet_t:s0"
+ }
+
+ secmark icmp_server {
+ "system_u:object_r:icmp_server_packet_t:s0"
+ }
+
+ secmark ssh_client {
+ "system_u:object_r:ssh_client_packet_t:s0"
+ }
+
+ secmark git_client {
+ "system_u:object_r:git_client_packet_t:s0"
+ }
+
+ map secmapping_in {
+ type inet_service : secmark
+ elements = { 22 : "ssh_server" }
+ }
+
+ map secmapping_out {
+ type inet_service : secmark
+ elements = { 22 : "ssh_client", 53 : "dns_client", 80 : "http_client", 123 : "ntp_client", 443 : "http_client", 9418 : "git_client" }
+ }
+
+ chain input {
+ type filter hook input priority 0;
+
+ # label new incoming packets and add to connection
+ ct state new meta secmark set tcp dport map @secmapping_in
+ ct state new meta secmark set udp dport map @secmapping_in
+ ct state new ip protocol icmp meta secmark set "icmp_server"
+ ct state new ip6 nexthdr icmpv6 meta secmark set "icmp_server"
+ ct state new ct secmark set meta secmark
+
+ # set label for est/rel packets from connection
+ ct state established,related meta secmark set ct secmark
+ }
+
+ chain output {
+ type filter hook output priority 0;
+
+ # label new outgoing packets and add to connection
+ ct state new meta secmark set tcp dport map @secmapping_out
+ ct state new meta secmark set udp dport map @secmapping_out
+ ct state new ip protocol icmp meta secmark set "icmp_client"
+ ct state new ip6 nexthdr icmpv6 meta secmark set "icmp_client"
+ ct state new ct secmark set meta secmark
+
+ # set label for est/rel packets from connection
+ ct state established,related meta secmark set ct secmark
+ }
+}
--
2.24.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection
2019-11-23 16:22 [PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection Christian Göttsche
2019-11-23 16:22 ` [PATCH nftables v2 2/2] files: add example secmark config Christian Göttsche
@ 2019-11-25 12:10 ` Pablo Neira Ayuso
2019-11-25 12:20 ` Pablo Neira Ayuso
2019-11-25 14:46 ` Pablo Neira Ayuso
2 siblings, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2019-11-25 12:10 UTC (permalink / raw)
To: Christian Göttsche; +Cc: netfilter-devel
Hi Christian,
On Sat, Nov 23, 2019 at 05:22:39PM +0100, Christian Göttsche wrote:
[...]
> v2: - incorporate changes suggested by Pablo Neira Ayuso
> - invalidate setting ct secmark to a constant value, like:
> ct secmark set 12
> Note:
> statements setting the meta secmark, like
> meta secmark set 12
> must accept constant values, cause the secmark object identifier
> is a string
> meta secmark set "icmp_client"
This is represented as a object reference statement from the parser.
It should be safe to do the same check from stmt_evaluate_meta() that
this patch does for stmt_evaluate_ct().
> 12 is probably not a used secmark object identifier, so it will
> fail:
> nft add rule inet filter input meta secmark set 12
> Error: Could not process rule: No such file or directory
> add rule inet filter input meta secmark set 12
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> src/ct.c | 2 ++
> src/evaluate.c | 24 ++++++++++++++++++++++--
> src/meta.c | 2 ++
> src/parser_bison.y | 14 +++++++++++---
> 4 files changed, 37 insertions(+), 5 deletions(-)
>
> diff --git a/src/ct.c b/src/ct.c
> index ed458e6b..9e6a8351 100644
> --- a/src/ct.c
> +++ b/src/ct.c
> @@ -299,6 +299,8 @@ const struct ct_template ct_templates[__NFT_CT_MAX] = {
> BYTEORDER_BIG_ENDIAN, 128),
> [NFT_CT_DST_IP6] = CT_TEMPLATE("ip6 daddr", &ip6addr_type,
> BYTEORDER_BIG_ENDIAN, 128),
> + [NFT_CT_SECMARK] = CT_TEMPLATE("secmark", &integer_type,
> + BYTEORDER_HOST_ENDIAN, 32),
> };
>
> static void ct_print(enum nft_ct_keys key, int8_t dir, uint8_t nfproto,
> diff --git a/src/evaluate.c b/src/evaluate.c
> index e54eaf1a..a865902c 100644
> --- a/src/evaluate.c
> +++ b/src/evaluate.c
> @@ -1784,6 +1784,18 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr)
> left->dtype->desc,
> right->dtype->desc);
>
> + /*
> + * Statements like 'ct secmark 12' are parsed as relational,
> + * disallow constant value on the right hand side.
> + */
> + if (((left->etype == EXPR_META &&
> + left->meta.key == NFT_META_SECMARK) ||
> + (left->etype == EXPR_CT &&
> + left->ct.key == NFT_CT_SECMARK)) &&
> + right->flags & EXPR_F_CONSTANT)
> + return expr_binary_error(ctx->msgs, right, left,
> + "Cannot be used with right hand side constant value");
> +
> switch (rel->op) {
> case OP_EQ:
> case OP_IMPLICIT:
> @@ -2319,11 +2331,19 @@ static int stmt_evaluate_meta(struct eval_ctx *ctx, struct stmt *stmt)
>
> static int stmt_evaluate_ct(struct eval_ctx *ctx, struct stmt *stmt)
> {
> - return stmt_evaluate_arg(ctx, stmt,
> + if (stmt_evaluate_arg(ctx, stmt,
> stmt->ct.tmpl->dtype,
> stmt->ct.tmpl->len,
> stmt->ct.tmpl->byteorder,
> - &stmt->ct.expr);
> + &stmt->ct.expr) < 0)
> + return -1;
> +
> + if (stmt->ct.key == NFT_CT_SECMARK &&
> + expr_is_constant(stmt->ct.expr))
> + return stmt_error(ctx, stmt,
> + "ct secmark must not be set to constant value");
> +
> + return 0;
> }
>
> static int reject_payload_gen_dependency_tcp(struct eval_ctx *ctx,
> diff --git a/src/meta.c b/src/meta.c
> index 69a897a9..796d8e94 100644
> --- a/src/meta.c
> +++ b/src/meta.c
> @@ -698,6 +698,8 @@ const struct meta_template meta_templates[] = {
> [NFT_META_TIME_HOUR] = META_TEMPLATE("hour", &hour_type,
> 4 * BITS_PER_BYTE,
> BYTEORDER_HOST_ENDIAN),
> + [NFT_META_SECMARK] = META_TEMPLATE("secmark", &integer_type,
> + 32, BYTEORDER_HOST_ENDIAN),
> };
>
> static bool meta_key_is_unqualified(enum nft_meta_keys key)
> diff --git a/src/parser_bison.y b/src/parser_bison.y
> index 631b7d68..707f4671 100644
> --- a/src/parser_bison.y
> +++ b/src/parser_bison.y
> @@ -4190,9 +4190,16 @@ meta_stmt : META meta_key SET stmt_expr
> {
> switch ($2) {
> case NFT_META_SECMARK:
> - $$ = objref_stmt_alloc(&@$);
> - $$->objref.type = NFT_OBJECT_SECMARK;
> - $$->objref.expr = $4;
> + switch ($4->etype) {
> + case EXPR_CT:
> + $$ = meta_stmt_alloc(&@$, $2, $4);
> + break;
> + default:
> + $$ = objref_stmt_alloc(&@$);
> + $$->objref.type = NFT_OBJECT_SECMARK;
> + $$->objref.expr = $4;
> + break;
> + }
> break;
> default:
> $$ = meta_stmt_alloc(&@$, $2, $4);
> @@ -4388,6 +4395,7 @@ ct_key : L3PROTOCOL { $$ = NFT_CT_L3PROTOCOL; }
> | PROTO_DST { $$ = NFT_CT_PROTO_DST; }
> | LABEL { $$ = NFT_CT_LABELS; }
> | EVENT { $$ = NFT_CT_EVENTMASK; }
> + | SECMARK { $$ = NFT_CT_SECMARK; }
> | ct_key_dir_optional
> ;
>
> --
> 2.24.0
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection
2019-11-25 12:10 ` [PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection Pablo Neira Ayuso
@ 2019-11-25 12:20 ` Pablo Neira Ayuso
0 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2019-11-25 12:20 UTC (permalink / raw)
To: Christian Göttsche; +Cc: netfilter-devel
On Mon, Nov 25, 2019 at 01:10:12PM +0100, Pablo Neira Ayuso wrote:
> Hi Christian,
>
> On Sat, Nov 23, 2019 at 05:22:39PM +0100, Christian Göttsche wrote:
> [...]
> > v2: - incorporate changes suggested by Pablo Neira Ayuso
> > - invalidate setting ct secmark to a constant value, like:
> > ct secmark set 12
> > Note:
> > statements setting the meta secmark, like
> > meta secmark set 12
> > must accept constant values, cause the secmark object identifier
> > is a string
> > meta secmark set "icmp_client"
>
> This is represented as a object reference statement from the parser.
>
> It should be safe to do the same check from stmt_evaluate_meta() that
> this patch does for stmt_evaluate_ct().
Oh, now I understand what you describe, your patch looks good indeed.
> > 12 is probably not a used secmark object identifier, so it will
> > fail:
> > nft add rule inet filter input meta secmark set 12
> > Error: Could not process rule: No such file or directory
> > add rule inet filter input meta secmark set 12
> > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > src/ct.c | 2 ++
> > src/evaluate.c | 24 ++++++++++++++++++++++--
> > src/meta.c | 2 ++
> > src/parser_bison.y | 14 +++++++++++---
> > 4 files changed, 37 insertions(+), 5 deletions(-)
> >
> > diff --git a/src/ct.c b/src/ct.c
> > index ed458e6b..9e6a8351 100644
> > --- a/src/ct.c
> > +++ b/src/ct.c
> > @@ -299,6 +299,8 @@ const struct ct_template ct_templates[__NFT_CT_MAX] = {
> > BYTEORDER_BIG_ENDIAN, 128),
> > [NFT_CT_DST_IP6] = CT_TEMPLATE("ip6 daddr", &ip6addr_type,
> > BYTEORDER_BIG_ENDIAN, 128),
> > + [NFT_CT_SECMARK] = CT_TEMPLATE("secmark", &integer_type,
> > + BYTEORDER_HOST_ENDIAN, 32),
> > };
> >
> > static void ct_print(enum nft_ct_keys key, int8_t dir, uint8_t nfproto,
> > diff --git a/src/evaluate.c b/src/evaluate.c
> > index e54eaf1a..a865902c 100644
> > --- a/src/evaluate.c
> > +++ b/src/evaluate.c
> > @@ -1784,6 +1784,18 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr)
> > left->dtype->desc,
> > right->dtype->desc);
> >
> > + /*
> > + * Statements like 'ct secmark 12' are parsed as relational,
> > + * disallow constant value on the right hand side.
> > + */
> > + if (((left->etype == EXPR_META &&
> > + left->meta.key == NFT_META_SECMARK) ||
> > + (left->etype == EXPR_CT &&
> > + left->ct.key == NFT_CT_SECMARK)) &&
> > + right->flags & EXPR_F_CONSTANT)
> > + return expr_binary_error(ctx->msgs, right, left,
> > + "Cannot be used with right hand side constant value");
> > +
> > switch (rel->op) {
> > case OP_EQ:
> > case OP_IMPLICIT:
> > @@ -2319,11 +2331,19 @@ static int stmt_evaluate_meta(struct eval_ctx *ctx, struct stmt *stmt)
> >
> > static int stmt_evaluate_ct(struct eval_ctx *ctx, struct stmt *stmt)
> > {
> > - return stmt_evaluate_arg(ctx, stmt,
> > + if (stmt_evaluate_arg(ctx, stmt,
> > stmt->ct.tmpl->dtype,
> > stmt->ct.tmpl->len,
> > stmt->ct.tmpl->byteorder,
> > - &stmt->ct.expr);
> > + &stmt->ct.expr) < 0)
> > + return -1;
> > +
> > + if (stmt->ct.key == NFT_CT_SECMARK &&
> > + expr_is_constant(stmt->ct.expr))
> > + return stmt_error(ctx, stmt,
> > + "ct secmark must not be set to constant value");
> > +
> > + return 0;
> > }
> >
> > static int reject_payload_gen_dependency_tcp(struct eval_ctx *ctx,
> > diff --git a/src/meta.c b/src/meta.c
> > index 69a897a9..796d8e94 100644
> > --- a/src/meta.c
> > +++ b/src/meta.c
> > @@ -698,6 +698,8 @@ const struct meta_template meta_templates[] = {
> > [NFT_META_TIME_HOUR] = META_TEMPLATE("hour", &hour_type,
> > 4 * BITS_PER_BYTE,
> > BYTEORDER_HOST_ENDIAN),
> > + [NFT_META_SECMARK] = META_TEMPLATE("secmark", &integer_type,
> > + 32, BYTEORDER_HOST_ENDIAN),
> > };
> >
> > static bool meta_key_is_unqualified(enum nft_meta_keys key)
> > diff --git a/src/parser_bison.y b/src/parser_bison.y
> > index 631b7d68..707f4671 100644
> > --- a/src/parser_bison.y
> > +++ b/src/parser_bison.y
> > @@ -4190,9 +4190,16 @@ meta_stmt : META meta_key SET stmt_expr
> > {
> > switch ($2) {
> > case NFT_META_SECMARK:
> > - $$ = objref_stmt_alloc(&@$);
> > - $$->objref.type = NFT_OBJECT_SECMARK;
> > - $$->objref.expr = $4;
> > + switch ($4->etype) {
> > + case EXPR_CT:
> > + $$ = meta_stmt_alloc(&@$, $2, $4);
> > + break;
> > + default:
> > + $$ = objref_stmt_alloc(&@$);
> > + $$->objref.type = NFT_OBJECT_SECMARK;
> > + $$->objref.expr = $4;
> > + break;
> > + }
> > break;
> > default:
> > $$ = meta_stmt_alloc(&@$, $2, $4);
> > @@ -4388,6 +4395,7 @@ ct_key : L3PROTOCOL { $$ = NFT_CT_L3PROTOCOL; }
> > | PROTO_DST { $$ = NFT_CT_PROTO_DST; }
> > | LABEL { $$ = NFT_CT_LABELS; }
> > | EVENT { $$ = NFT_CT_EVENTMASK; }
> > + | SECMARK { $$ = NFT_CT_SECMARK; }
> > | ct_key_dir_optional
> > ;
> >
> > --
> > 2.24.0
> >
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection
2019-11-23 16:22 [PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection Christian Göttsche
2019-11-23 16:22 ` [PATCH nftables v2 2/2] files: add example secmark config Christian Göttsche
2019-11-25 12:10 ` [PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection Pablo Neira Ayuso
@ 2019-11-25 14:46 ` Pablo Neira Ayuso
2 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2019-11-25 14:46 UTC (permalink / raw)
To: Christian Göttsche; +Cc: netfilter-devel
On Sat, Nov 23, 2019 at 05:22:39PM +0100, Christian Göttsche wrote:
> Labeling established and related packets requires the secmark to be stored in the connection.
> Add the ability to store and retrieve secmarks like:
[...]
Applied, thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-11-25 14:47 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-23 16:22 [PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection Christian Göttsche
2019-11-23 16:22 ` [PATCH nftables v2 2/2] files: add example secmark config Christian Göttsche
2019-11-25 14:47 ` Pablo Neira Ayuso
2019-11-25 12:10 ` [PATCH nftables v2 1/2] src: add ability to set/get secmarks to/from connection Pablo Neira Ayuso
2019-11-25 12:20 ` Pablo Neira Ayuso
2019-11-25 14:46 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).