Re: Seeking help for implementing CT HELPER in nftables

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





Le 23/09/2016 à 16:24, Pablo Neira Ayuso a écrit :
On Fri, Sep 23, 2016 at 12:45:06PM +0200, Christophe Leroy wrote:
Le 20/09/2016 à 17:38, Florian Westphal a écrit :
[...]
nft will need to populate this (or rather, libnftnl will do this on
behalf of nft).

Currently we do this:
nft --debug=netlink add rule filter i ct helper set foo
ip filter i
 [ immediate reg 1 0x006f6f66 0x00000000 0x00000000 0x00000000 ]

Florian, Christophe, sorry for this late jump on this.

If we pass the helper name as string, then helper autoload will not
work as we don't have a way to solve this from the packet path.

That's maybe a stupid idea, but my idea was to do the same as xt_ct_set_helper() from nft_ct_set_init(), hence the need to be able to catch the name in the _init() function.

By doing this, the helper would be autoloaded if needed, wouldn't it ?

Christophe


To solve this, I'm considering a different approach. Basically,
explicit preload the helpers and pass a helper handle through
register instead.

In the ruleset file, this would look like this:

        table ip x {
                helper ftp protocol tcp                 #1

                chain y {
                        ...
                        tcp dport 21 ct helper set ftp  #2
                }
        }

Line #1 makes sure the ftp helper is loaded, we also increment reference
counter. This results in a handle that is dynamically allocated by
nf_tables, that can be retrieve in the same fashion of if_index (ie.
we can look up for the handle from the helper name).

Then from #2, we use the helper handle to refer to the helper.

Good things I see on this:

1) We can still use maps, although we would need a function to lookup
   for the nf_conntrack_helper struct form this handle. We can have a
   small hashtable for this (actually, we have similar approach currently
   to look up for helpers from ports in the deprecated automagic helper
   as signment).
2) We use a u32 instead of string to identify the helper.
3) We solve the module autoload issue.
4) We make sure helper module cannot be removed while there is a
   reference from the ruleset.
5) We can validate that the helper runs from the right layer 4
   protocol, eg. ensure the ftp helper is called for tcp since we can
   do this from nft evaluation phase.

This would need commands like:

        nft add helper ip x name ftp protocol tcp

and to delete this:

        nft delete helper ip x name ftp protocol tcp

Main drawback is that this needs a explicit definition of the helper,
but I think this extra line is ok if it helps resolve other problems.

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux