Netfilter-Devel Archive on lore.kernel.org
 help / color / Atom feed
* Re: [PATCH nft] evaluate: add range specified flag setting (missing NF_NAT_RANGE_PROTO_SPECIFIED)
@ 2020-03-19  6:22 Сергей Маринкевич
  0 siblings, 0 replies; 4+ messages in thread
From: Сергей Маринкевич @ 2020-03-19  6:22 UTC (permalink / raw)
  To: netfilter-devel; +Cc: pablo

> Sergey reports:  > > With nf_tables it is not possible to use port range for 
masquerading. > Masquerade statement has option "to [:port-port]" which 
give no effect > to translation behavior. But it must change source port 
of packet to > one from ":port-port" range. > > My network: > > 
+-----------------------------+ > | ROUTER | > | | > | Masquerade| > | 
10.0.0.1 1.1.1.1 | > | +------+ +------+ | > | | eth1 | | eth2 | | > 
+-+--^---+-----------+---^--+-+ > | | > | | > +----v------+ 
+------v----+ > | | | | > | 10.0.0.2 | | 1.1.1.2 | > | | | | > |PC1 | 
|PC2 | > +-----------+ +-----------+ > > For testing i used rule like 
this: > > rule ip nat POSTROUTING oifname eth2 masquerade to :666 > > 
Run netcat for 1.1.1.2 667(UDP) and get dump from PC2: > > 
15:22:25.591567 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f, ethertype IPv4 
(0x0800), length 60: 1.1.1.1.34466 > 1.1.1.2.667: UDP, length 1 > > 
Address translation works fine, but source port are not belongs to > 
specified range. > > I see in similar source code (i.e. nft_redir.c, 
nft_nat.c) that > there is setting NF_NAT_RANGE_PROTO_SPECIFIED flag. 
After adding this, > repeat test for kernel with this patch, and get 
dump: > > 16:16:22.324710 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f, 
ethertype IPv4 (0x0800), length 60: 1.1.1.1.666 > 1.1.1.2.667: UDP, 
length 1 > > Now it is works fine. > > Reported-by: Sergey Marinkevich 
<s@marinkevich.ru> > Signed-off-by: Pablo Neira Ayuso 
<pablo@netfilter.org> > --- > Sergey, could you try this userspace patch 
instead? Thanks.
I tried this patch with equal environment but another
net(192.168.122.0/24). Router uses vanilla kernel v5.4.19.
Translation is the same.

     12:59:11.599887 08:00:27:ec:9c:b3 > 52:54:00:57:d2:7d, ethertype 
IPv4 (0x0800), length 60: 192.168.122.38.666 > 192.168.122.1.667: UDP, 
length 4

I think i have to add this tag:

Tested-by: Sergey Marinkevich <s@marinkevich.ru>

>  > src/evaluate.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff 
--git a/src/evaluate.c b/src/evaluate.c > index 
4a23b231c74d..d0e712dc02f0 100644 > --- a/src/evaluate.c > +++ 
b/src/evaluate.c > @@ -18,6 +18,7 @@ > #include <linux/netfilter_arp.h> 
 > #include <linux/netfilter/nf_tables.h> > #include 
<linux/netfilter/nf_synproxy.h> > +#include <linux/netfilter/nf_nat.h> > 
#include <linux/netfilter_ipv4.h> > #include <netinet/ip_icmp.h> > 
#include <netinet/icmp6.h> > @@ -2950,6 +2951,8 @@ static int 
stmt_evaluate_nat(struct eval_ctx *ctx, struct stmt *stmt) > err = 
nat_evaluate_transport(ctx, stmt, &stmt->nat.proto); > if (err < 0) > 
return err; > + > + stmt->nat.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; > } 
 > > stmt->flags |= STMT_F_TERMINAL; > -- > 2.11.0

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH nft] evaluate: add range specified flag setting (missing NF_NAT_RANGE_PROTO_SPECIFIED)
  2020-03-19  6:33 ` Сергей Маринкевич
@ 2020-03-19 10:00   ` Pablo Neira Ayuso
  0 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-19 10:00 UTC (permalink / raw)
  To: Сергей
	Маринкевич
  Cc: netfilter-devel

On Thu, Mar 19, 2020 at 01:33:10PM +0700, Сергей Маринкевич wrote:
> > Sergey, could you try this userspace patch instead? Thanks.
>
> I tried this patch with equal environment but another
> 
> net(192.168.122.0/24). Router uses vanilla kernel v5.4.19.
> Translation is the same.
> 
>     12:59:11.599887 08:00:27:ec:9c:b3 > 52:54:00:57:d2:7d, ethertype IPv4
> (0x0800), length 60: 192.168.122.38.666 > 192.168.122.1.667: UDP, length 4
> 
> I think i have to add this tag:
> 
> Tested-by: Sergey Marinkevich <s@marinkevich.ru>

Applied, thanks for testing.

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH nft] evaluate: add range specified flag setting (missing NF_NAT_RANGE_PROTO_SPECIFIED)
       [not found] <df06055e-784a-9711-2ff5-6ef159e842ee@marinkevich.ru>
@ 2020-03-19  6:33 ` Сергей Маринкевич
  2020-03-19 10:00   ` Pablo Neira Ayuso
  0 siblings, 1 reply; 4+ messages in thread
From: Сергей Маринкевич @ 2020-03-19  6:33 UTC (permalink / raw)
  To: netfilter-devel; +Cc: pablo

I sorry, my e-mail client goes bananaz.

 > Sergey reports:
 >
 > With nf_tables it is not possible to use port range for masquerading.
 > Masquerade statement has option "to [:port-port]" which give no effect
 > to translation behavior. But it must change source port of packet to
 > one from ":port-port" range.
 >
 > My network:
 >
 >         +-----------------------------+
 >         |   ROUTER                    |
 >         |                             |
 >         |                   Masquerade|
 >         | 10.0.0.1            1.1.1.1 |
 >         | +------+           +------+ |
 >         | | eth1 |           | eth2 | |
 >         +-+--^---+-----------+---^--+-+
 >              |                   |
 >              |                   |
 >         +----v------+     +------v----+
 >         |           |     |           |
 >         | 10.0.0.2  |     |  1.1.1.2  |
 >         |           |     |           |
 >         |PC1        |     |PC2        |
 >         +-----------+     +-----------+
 >
 > For testing i used rule like this:
 >
 >         rule ip nat POSTROUTING oifname eth2 masquerade to :666
 >
 > Run netcat for 1.1.1.2 667(UDP) and get dump from PC2:
 >
 >         15:22:25.591567 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f, 
ethertype IPv4 (0x0800), length 60: 1.1.1.1.34466 > 1.1.1.2.667: UDP, 
length 1
 >
 > Address translation works fine, but source port are not belongs to
 > specified range.
 >
 > I see in similar source code (i.e. nft_redir.c, nft_nat.c) that
 > there is setting NF_NAT_RANGE_PROTO_SPECIFIED flag. After adding this,
 > repeat test for kernel with this patch, and get dump:
 >
 >         16:16:22.324710 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f, 
ethertype IPv4 (0x0800), length 60: 1.1.1.1.666 > 1.1.1.2.667: UDP, length 1
 >
 > Now it is works fine.
 >
 > Reported-by: Sergey Marinkevich <s@marinkevich.ru>
 > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
 > ---
 > Sergey, could you try this userspace patch instead? Thanks.
I tried this patch with equal environment but another

net(192.168.122.0/24). Router uses vanilla kernel v5.4.19.
Translation is the same.

     12:59:11.599887 08:00:27:ec:9c:b3 > 52:54:00:57:d2:7d, ethertype 
IPv4 (0x0800), length 60: 192.168.122.38.666 > 192.168.122.1.667: UDP, 
length 4

I think i have to add this tag:

Tested-by: Sergey Marinkevich <s@marinkevich.ru>

 >
 >  src/evaluate.c | 3 +++
 >  1 file changed, 3 insertions(+)
 >
 > diff --git a/src/evaluate.c b/src/evaluate.c
 > index 4a23b231c74d..d0e712dc02f0 100644
 > --- a/src/evaluate.c
 > +++ b/src/evaluate.c
 > @@ -18,6 +18,7 @@
 >  #include <linux/netfilter_arp.h>
 >  #include <linux/netfilter/nf_tables.h>
 >  #include <linux/netfilter/nf_synproxy.h>
 > +#include <linux/netfilter/nf_nat.h>
 >  #include <linux/netfilter_ipv4.h>
 >  #include <netinet/ip_icmp.h>
 >  #include <netinet/icmp6.h>
 > @@ -2950,6 +2951,8 @@ static int stmt_evaluate_nat(struct eval_ctx 
*ctx, struct stmt *stmt)
 >          err = nat_evaluate_transport(ctx, stmt, &stmt->nat.proto);
 >          if (err < 0)
 >              return err;
 > +
 > +        stmt->nat.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
 >      }
 >
 >      stmt->flags |= STMT_F_TERMINAL;
 > --
 > 2.11.0


^ permalink raw reply	[flat|nested] 4+ messages in thread

* [PATCH nft] evaluate: add range specified flag setting (missing NF_NAT_RANGE_PROTO_SPECIFIED)
@ 2020-03-18 18:54 Pablo Neira Ayuso
  0 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-18 18:54 UTC (permalink / raw)
  To: netfilter-devel

Sergey reports:

With nf_tables it is not possible to use port range for masquerading.
Masquerade statement has option "to [:port-port]" which give no effect
to translation behavior. But it must change source port of packet to
one from ":port-port" range.

My network:

        +-----------------------------+
        |   ROUTER                    |
        |                             |
        |                   Masquerade|
        | 10.0.0.1            1.1.1.1 |
        | +------+           +------+ |
        | | eth1 |           | eth2 | |
        +-+--^---+-----------+---^--+-+
             |                   |
             |                   |
        +----v------+     +------v----+
        |           |     |           |
        | 10.0.0.2  |     |  1.1.1.2  |
        |           |     |           |
        |PC1        |     |PC2        |
        +-----------+     +-----------+

For testing i used rule like this:

        rule ip nat POSTROUTING oifname eth2 masquerade to :666

Run netcat for 1.1.1.2 667(UDP) and get dump from PC2:

        15:22:25.591567 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f, ethertype IPv4 (0x0800), length 60: 1.1.1.1.34466 > 1.1.1.2.667: UDP, length 1

Address translation works fine, but source port are not belongs to
specified range.

I see in similar source code (i.e. nft_redir.c, nft_nat.c) that
there is setting NF_NAT_RANGE_PROTO_SPECIFIED flag. After adding this,
repeat test for kernel with this patch, and get dump:

        16:16:22.324710 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f, ethertype IPv4 (0x0800), length 60: 1.1.1.1.666 > 1.1.1.2.667: UDP, length 1

Now it is works fine.

Reported-by: Sergey Marinkevich <s@marinkevich.ru>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
Sergey, could you try this userspace patch instead? Thanks.

 src/evaluate.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/evaluate.c b/src/evaluate.c
index 4a23b231c74d..d0e712dc02f0 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -18,6 +18,7 @@
 #include <linux/netfilter_arp.h>
 #include <linux/netfilter/nf_tables.h>
 #include <linux/netfilter/nf_synproxy.h>
+#include <linux/netfilter/nf_nat.h>
 #include <linux/netfilter_ipv4.h>
 #include <netinet/ip_icmp.h>
 #include <netinet/icmp6.h>
@@ -2950,6 +2951,8 @@ static int stmt_evaluate_nat(struct eval_ctx *ctx, struct stmt *stmt)
 		err = nat_evaluate_transport(ctx, stmt, &stmt->nat.proto);
 		if (err < 0)
 			return err;
+
+		stmt->nat.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
 	}
 
 	stmt->flags |= STMT_F_TERMINAL;
-- 
2.11.0


^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, back to index

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-19  6:22 [PATCH nft] evaluate: add range specified flag setting (missing NF_NAT_RANGE_PROTO_SPECIFIED) Сергей Маринкевич
     [not found] <df06055e-784a-9711-2ff5-6ef159e842ee@marinkevich.ru>
2020-03-19  6:33 ` Сергей Маринкевич
2020-03-19 10:00   ` Pablo Neira Ayuso
  -- strict thread matches above, loose matches on Subject: below --
2020-03-18 18:54 Pablo Neira Ayuso

Netfilter-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netfilter-devel/0 netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ https://lore.kernel.org/netfilter-devel \
		netfilter-devel@vger.kernel.org
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netfilter-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git