[PATCH nft] tests: py: flush log file output before running each command

[PATCH nft] tests: py: flush log file output before running each command

[Pablo Neira Ayuso]

If nft crashes or hits an assertion, the last command run shows in the
/tmp/nftables-test.log file.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 tests/py/nft-test.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/py/nft-test.py b/tests/py/nft-test.py
index df97ed8eefb7..e7b5e01efcb9 100755
--- a/tests/py/nft-test.py
+++ b/tests/py/nft-test.py
@@ -1022,6 +1022,8 @@ def execute_cmd(cmd, filename, lineno, stdout_log=False, debug=False):
     if debug_option:
         print(cmd)
 
+    log_file.flush()
+
     if debug:
         debug_old = nftables.get_debug()
         nftables.set_debug(debug)
-- 
2.20.1

[PATCH nft 1/2] evaluate: remove one indent level in __expr_evaluate_payload()

[Pablo Neira Ayuso]

If there is protocol context for this base, just return from function
to remove one level of indentation. This patch is cleanup.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/evaluate.c | 49 ++++++++++++++++++++++++-------------------------
 1 file changed, 24 insertions(+), 25 deletions(-)

diff --git a/src/evaluate.c b/src/evaluate.c
index 8f133ea8c384..e3fe70624699 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -707,33 +707,32 @@ static int __expr_evaluate_payload(struct eval_ctx *ctx, struct expr *expr)
 			return -1;
 
 		rule_stmt_insert_at(ctx->rule, nstmt, ctx->stmt);
-	} else {
-		/* No conflict: Same payload protocol as context, adjust offset
-		 * if needed.
-		 */
-		if (desc == payload->payload.desc) {
-			payload->payload.offset +=
-				ctx->pctx.protocol[base].offset;
-			return 0;
-		}
-		/* If we already have context and this payload is on the same
-		 * base, try to resolve the protocol conflict.
-		 */
-		if (payload->payload.base == desc->base) {
-			err = resolve_protocol_conflict(ctx, desc, payload);
-			if (err <= 0)
-				return err;
+		return 0;
+	}
 
-			desc = ctx->pctx.protocol[base].desc;
-			if (desc == payload->payload.desc)
-				return 0;
-		}
-		return expr_error(ctx->msgs, payload,
-				  "conflicting protocols specified: %s vs. %s",
-				  ctx->pctx.protocol[base].desc->name,
-				  payload->payload.desc->name);
+	/* No conflict: Same payload protocol as context, adjust offset
+	 * if needed.
+	 */
+	if (desc == payload->payload.desc) {
+		payload->payload.offset += ctx->pctx.protocol[base].offset;
+		return 0;
 	}
-	return 0;
+	/* If we already have context and this payload is on the same
+	 * base, try to resolve the protocol conflict.
+	 */
+	if (payload->payload.base == desc->base) {
+		err = resolve_protocol_conflict(ctx, desc, payload);
+		if (err <= 0)
+			return err;
+
+		desc = ctx->pctx.protocol[base].desc;
+		if (desc == payload->payload.desc)
+			return 0;
+	}
+	return expr_error(ctx->msgs, payload,
+			  "conflicting protocols specified: %s vs. %s",
+			  ctx->pctx.protocol[base].desc->name,
+			  payload->payload.desc->name);
 }
 
 static bool payload_needs_adjustment(const struct expr *expr)
-- 
2.20.1

[PATCH nft 2/2] src: context tracking for multiple transport protocols

[Pablo Neira Ayuso]

This patch extends the protocol context infrastructure to track multiple
transport protocols when they are specified from sets.

This removes errors like:

 "transport protocol mapping is only valid after transport protocol match"

when invoking:

 # nft add rule x z meta l4proto { tcp, udp } dnat to 1.1.1.1:80

This patch also catches conflicts like:

 # nft add rule x z ip protocol { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80
 Error: conflicting protocols specified: udp vs. tcp
 add rule x z ip protocol { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80
                                       ^^^^^^^^^
and:

 # nft add rule x z meta l4proto { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80
 Error: conflicting protocols specified: udp vs. tcp
 add rule x z meta l4proto { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80
                                        ^^^^^^^^^
Note that:

- the singleton protocol context tracker is left in place until the
  existing users are updated to use this new multiprotocol tracker.
  Moving forward, it would be good to consolidate things around this new
  multiprotocol context tracker infrastructure.

- link and network layers are not updated to use this infrastructure
  yet. The code that deals with vlan conflicts relies on forcing
  protocol context updates to the singleton protocol base.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/expression.h |  4 +++-
 include/proto.h      | 11 +++++++++
 src/ct.c             |  8 ++++---
 src/evaluate.c       | 14 +++++++++--
 src/expression.c     | 16 ++++++++++---
 src/meta.c           | 13 +++++-----
 src/payload.c        |  7 +++---
 src/proto.c          | 57 ++++++++++++++++++++++++++++++++++++++++++++
 8 files changed, 112 insertions(+), 18 deletions(-)

diff --git a/include/expression.h b/include/expression.h
index 130912a89e04..b039882cf1d1 100644
--- a/include/expression.h
+++ b/include/expression.h
@@ -167,7 +167,9 @@ struct expr_ops {
 	bool			(*cmp)(const struct expr *e1,
 				       const struct expr *e2);
 	void			(*pctx_update)(struct proto_ctx *ctx,
-					       const struct expr *expr);
+					       const struct location *loc,
+					       const struct expr *left,
+					       const struct expr *right);
 	int			(*build_udata)(struct nftnl_udata_buf *udbuf,
 					       const struct expr *expr);
 	struct expr *		(*parse_udata)(const struct nftnl_udata *ud);
diff --git a/include/proto.h b/include/proto.h
index 1771ba8e8d8c..304b048e4e60 100644
--- a/include/proto.h
+++ b/include/proto.h
@@ -152,6 +152,8 @@ struct dev_proto_desc {
 extern int proto_dev_type(const struct proto_desc *desc, uint16_t *res);
 extern const struct proto_desc *proto_dev_desc(uint16_t type);
 
+#define PROTO_CTX_NUM_PROTOS	16
+
 /**
  * struct proto_ctx - protocol context
  *
@@ -172,6 +174,11 @@ struct proto_ctx {
 		struct location			location;
 		const struct proto_desc		*desc;
 		unsigned int			offset;
+		struct {
+			struct location		location;
+			const struct proto_desc	*desc;
+		} protos[PROTO_CTX_NUM_PROTOS];
+		unsigned int			num_protos;
 	} protocol[PROTO_BASE_MAX + 1];
 };
 
@@ -180,6 +187,10 @@ extern void proto_ctx_init(struct proto_ctx *ctx, unsigned int family,
 extern void proto_ctx_update(struct proto_ctx *ctx, enum proto_bases base,
 			     const struct location *loc,
 			     const struct proto_desc *desc);
+bool proto_ctx_is_ambiguous(struct proto_ctx *ctx, enum proto_bases bases);
+const struct proto_desc *proto_ctx_find_conflict(struct proto_ctx *ctx,
+						 enum proto_bases base,
+						 const struct proto_desc *desc);
 extern const struct proto_desc *proto_find_upper(const struct proto_desc *base,
 						 unsigned int num);
 extern int proto_find_num(const struct proto_desc *base,
diff --git a/src/ct.c b/src/ct.c
index 0842c838b913..2218ecc7a684 100644
--- a/src/ct.c
+++ b/src/ct.c
@@ -351,9 +351,11 @@ static void ct_expr_clone(struct expr *new, const struct expr *expr)
 	new->ct = expr->ct;
 }
 
-static void ct_expr_pctx_update(struct proto_ctx *ctx, const struct expr *expr)
+static void ct_expr_pctx_update(struct proto_ctx *ctx,
+				const struct location *loc,
+				const struct expr *left,
+				const struct expr *right)
 {
-	const struct expr *left = expr->left, *right = expr->right;
 	const struct proto_desc *base = NULL, *desc;
 	uint32_t nhproto;
 
@@ -366,7 +368,7 @@ static void ct_expr_pctx_update(struct proto_ctx *ctx, const struct expr *expr)
 	if (!desc)
 		return;
 
-	proto_ctx_update(ctx, left->ct.base + 1, &expr->location, desc);
+	proto_ctx_update(ctx, left->ct.base + 1, loc, desc);
 }
 
 #define NFTNL_UDATA_CT_KEY 0
diff --git a/src/evaluate.c b/src/evaluate.c
index e3fe70624699..c8045e5ded72 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -710,6 +710,17 @@ static int __expr_evaluate_payload(struct eval_ctx *ctx, struct expr *expr)
 		return 0;
 	}
 
+	if (payload->payload.base == desc->base &&
+	    proto_ctx_is_ambiguous(&ctx->pctx, base)) {
+		desc = proto_ctx_find_conflict(&ctx->pctx, base, payload->payload.desc);
+		assert(desc);
+
+		return expr_error(ctx->msgs, payload,
+				  "conflicting protocols specified: %s vs. %s",
+				  desc->name,
+				  payload->payload.desc->name);
+	}
+
 	/* No conflict: Same payload protocol as context, adjust offset
 	 * if needed.
 	 */
@@ -1874,8 +1885,7 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr)
 		 * Update protocol context for payload and meta iiftype
 		 * equality expressions.
 		 */
-		if (expr_is_singleton(right))
-			relational_expr_pctx_update(&ctx->pctx, rel);
+		relational_expr_pctx_update(&ctx->pctx, rel);
 
 		/* fall through */
 	case OP_NEQ:
diff --git a/src/expression.c b/src/expression.c
index fe529f98de7b..87bd4d01bb72 100644
--- a/src/expression.c
+++ b/src/expression.c
@@ -708,16 +708,26 @@ struct expr *relational_expr_alloc(const struct location *loc, enum ops op,
 void relational_expr_pctx_update(struct proto_ctx *ctx,
 				 const struct expr *expr)
 {
-	const struct expr *left = expr->left;
+	const struct expr *left = expr->left, *right = expr->right;
 	const struct expr_ops *ops;
+	const struct expr *i;
 
 	assert(expr->etype == EXPR_RELATIONAL);
 	assert(expr->op == OP_EQ || expr->op == OP_IMPLICIT);
 
 	ops = expr_ops(left);
 	if (ops->pctx_update &&
-	    (left->flags & EXPR_F_PROTOCOL))
-		ops->pctx_update(ctx, expr);
+	    (left->flags & EXPR_F_PROTOCOL)) {
+		if (expr_is_singleton(right))
+			ops->pctx_update(ctx, &expr->location, left, right);
+		else if (right->etype == EXPR_SET) {
+			list_for_each_entry(i, &right->expressions, list) {
+				if (i->etype == EXPR_SET_ELEM &&
+				    i->key->etype == EXPR_VALUE)
+					ops->pctx_update(ctx, &expr->location, left, i->key);
+			}
+		}
+	}
 }
 
 static void range_expr_print(const struct expr *expr, struct output_ctx *octx)
diff --git a/src/meta.c b/src/meta.c
index d92d0d323b9b..73d58b1f53b5 100644
--- a/src/meta.c
+++ b/src/meta.c
@@ -753,10 +753,11 @@ static void meta_expr_clone(struct expr *new, const struct expr *expr)
  * Update LL protocol context based on IIFTYPE meta match in non-LL hooks.
  */
 static void meta_expr_pctx_update(struct proto_ctx *ctx,
-				  const struct expr *expr)
+				  const struct location *loc,
+				  const struct expr *left,
+				  const struct expr *right)
 {
 	const struct hook_proto_desc *h = &hook_proto_desc[ctx->family];
-	const struct expr *left = expr->left, *right = expr->right;
 	const struct proto_desc *desc;
 	uint8_t protonum;
 
@@ -771,7 +772,7 @@ static void meta_expr_pctx_update(struct proto_ctx *ctx,
 		if (desc == NULL)
 			desc = &proto_unknown;
 
-		proto_ctx_update(ctx, PROTO_BASE_LL_HDR, &expr->location, desc);
+		proto_ctx_update(ctx, PROTO_BASE_LL_HDR, loc, desc);
 		break;
 	case NFT_META_NFPROTO:
 		protonum = mpz_get_uint8(right->value);
@@ -784,7 +785,7 @@ static void meta_expr_pctx_update(struct proto_ctx *ctx,
 				desc = h->desc;
 		}
 
-		proto_ctx_update(ctx, PROTO_BASE_NETWORK_HDR, &expr->location, desc);
+		proto_ctx_update(ctx, PROTO_BASE_NETWORK_HDR, loc, desc);
 		break;
 	case NFT_META_L4PROTO:
 		desc = proto_find_upper(&proto_inet_service,
@@ -792,7 +793,7 @@ static void meta_expr_pctx_update(struct proto_ctx *ctx,
 		if (desc == NULL)
 			desc = &proto_unknown;
 
-		proto_ctx_update(ctx, PROTO_BASE_TRANSPORT_HDR, &expr->location, desc);
+		proto_ctx_update(ctx, PROTO_BASE_TRANSPORT_HDR, loc, desc);
 		break;
 	case NFT_META_PROTOCOL:
 		if (h->base != PROTO_BASE_LL_HDR)
@@ -806,7 +807,7 @@ static void meta_expr_pctx_update(struct proto_ctx *ctx,
 		if (desc == NULL)
 			desc = &proto_unknown;
 
-		proto_ctx_update(ctx, PROTO_BASE_NETWORK_HDR, &expr->location, desc);
+		proto_ctx_update(ctx, PROTO_BASE_NETWORK_HDR, loc, desc);
 		break;
 	default:
 		break;
diff --git a/src/payload.c b/src/payload.c
index 29242537237e..ca422d5bcd56 100644
--- a/src/payload.c
+++ b/src/payload.c
@@ -80,9 +80,10 @@ static void payload_expr_clone(struct expr *new, const struct expr *expr)
  * Update protocol context for relational payload expressions.
  */
 static void payload_expr_pctx_update(struct proto_ctx *ctx,
-				     const struct expr *expr)
+				     const struct location *loc,
+				     const struct expr *left,
+				     const struct expr *right)
 {
-	const struct expr *left = expr->left, *right = expr->right;
 	const struct proto_desc *base, *desc;
 	unsigned int proto = 0;
 
@@ -102,7 +103,7 @@ static void payload_expr_pctx_update(struct proto_ctx *ctx,
 		assert(base->length > 0);
 		ctx->protocol[base->base].offset += base->length;
 	}
-	proto_ctx_update(ctx, desc->base, &expr->location, desc);
+	proto_ctx_update(ctx, desc->base, loc, desc);
 }
 
 #define NFTNL_UDATA_SET_KEY_PAYLOAD_DESC 0
diff --git a/src/proto.c b/src/proto.c
index 7d001501d7d2..7de2bbf91ae4 100644
--- a/src/proto.c
+++ b/src/proto.c
@@ -193,12 +193,69 @@ void proto_ctx_update(struct proto_ctx *ctx, enum proto_bases base,
 		      const struct location *loc,
 		      const struct proto_desc *desc)
 {
+	bool found = false;
+	unsigned int i;
+
+	switch (base) {
+	case PROTO_BASE_LL_HDR:
+	case PROTO_BASE_NETWORK_HDR:
+		break;
+	case PROTO_BASE_TRANSPORT_HDR:
+		if (ctx->protocol[base].num_protos >= PROTO_CTX_NUM_PROTOS)
+			break;
+
+		for (i = 0; i < ctx->protocol[base].num_protos; i++) {
+			if (ctx->protocol[base].protos[i].desc == desc) {
+				found = true;
+				break;
+			}
+		}
+		if (!found) {
+			i = ctx->protocol[base].num_protos++;
+			ctx->protocol[base].protos[i].desc = desc;
+			ctx->protocol[base].protos[i].location = *loc;
+		}
+		break;
+	default:
+		BUG("unknown protocol base %d", base);
+	}
+
 	ctx->protocol[base].location	= *loc;
 	ctx->protocol[base].desc	= desc;
 
 	proto_ctx_debug(ctx, base, ctx->debug_mask);
 }
 
+bool proto_ctx_is_ambiguous(struct proto_ctx *ctx, enum proto_bases base)
+{
+	return ctx->protocol[base].num_protos > 1;
+}
+
+const struct proto_desc *proto_ctx_find_conflict(struct proto_ctx *ctx,
+						 enum proto_bases base,
+						 const struct proto_desc *desc)
+{
+	unsigned int i;
+
+	switch (base) {
+	case PROTO_BASE_LL_HDR:
+	case PROTO_BASE_NETWORK_HDR:
+		if (desc != ctx->protocol[base].desc)
+			return ctx->protocol[base].desc;
+		break;
+	case PROTO_BASE_TRANSPORT_HDR:
+		for (i = 0; i < ctx->protocol[base].num_protos; i++) {
+			if (desc != ctx->protocol[base].protos[i].desc)
+				return ctx->protocol[base].protos[i].desc;
+		}
+		break;
+	default:
+		BUG("unknown protocol base %d", base);
+	}
+
+	return NULL;
+}
+
 #define HDR_TEMPLATE(__name, __dtype, __type, __member)			\
 	PROTO_HDR_TEMPLATE(__name, __dtype,				\
 			   BYTEORDER_BIG_ENDIAN,			\
-- 
2.20.1