On 27.4.2022 0.07, Pablo Neira Ayuso wrote:
On Tue, Apr 26, 2022 at 11:05:09PM +0200, Pablo Neira Ayuso wrote:
On Thu, Apr 21, 2022 at 07:35:06PM +0300, Topi Miettinen wrote:
On 21.4.2022 0.15, Jan Engelhardt wrote:
On Wednesday 2022-04-20 20:54, Topi Miettinen wrote:
Add socket expressions for checking GID or UID of the originating
socket. These work also on input side, unlike meta skuid/skgid.
Why exactly is it that meta skuid does not work?
Because of the skb_to_full_sk() call in nft_meta_get_eval_skugid()?
I don't know the details, but early demux isn't reliable and filters aren't
run after final demux. In my case, something like "ct state new meta skuid <
1000 drop" as part of input filter doesn't do anything. Making "meta skuid"
100% reliable would be of course preferable to adding a new expression.
Could you give a try to this kernel patch?
This patch adds a new socket hook for inet layer 4 protocols, it is
coming after the NF_LOCAL_IN hook, where the socket information is
available for all cases.
You also need a small patch for userspace nft.
Quickly tested it with:
table inet x {
chain y {
type filter hook socket priority 0; policy accept;
counter
}
}
Thanks. Assuming that this makes the 'meta skuid' and 'meta cgroupv2'
always usable, I'd prefer this approach to new 'socket uid'.
I changed the hook of my input and output filters to 'socket' but then
there are lots of errors:
/etc/nftables.conf:411:3-67: Error: Could not process rule: Operation
not supported
ct state new socket cgroupv2 level 1 vmap
@dict_cgroup_level_1_in
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:412:3-79: Error: Could not process rule: Operation
not supported
ct state new meta skuid < 1000 meta l4proto vmap { tcp
: jump tcp_input_sys }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:413:3-108: Error: Could not process rule: Operation
not supported
ct state new meta skuid >= 1000 meta l4proto vmap { tcp
: jump tcp_input_user, udp : jump udp_input_user }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:417:3-36: Error: Could not process rule: Operation
not supported
icmpv6 type 144-147 counter accept
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:418:3-56: Error: Could not process rule: Operation
not supported
meta l4proto { icmp, icmpv6 } counter jump icmp_common
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:423:3-51: Error: Could not process rule: Operation
not supported
counter log prefix "[inet-input] " flags all drop
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:429:3-53: Error: Could not process rule: Operation
not supported
counter log prefix "[inet-forward] " flags all drop
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:435:3-100: Error: Could not process rule: Operation
not supported
rt type 0 counter log prefix "[inet-output-rt] " flags
all reject with icmpx type admin-prohibited
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:436:3-122: Error: Could not process rule: Operation
not supported
meta protocol != { ip, ip6 } counter log prefix
"[inet-output-proto] " flags all reject with icmpx type admin-prohibited
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:437:3-78: Error: Could not process rule: Operation
not supported
meta l4proto != { icmp, icmpv6, tcp, udp } counter jump
log_bad_proto_output
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:438:3-50: Error: Could not process rule: Operation
not supported
ct state { established, related } counter accept
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:441:3-68: Error: Could not process rule: Operation
not supported
ct state new socket cgroupv2 level 1 vmap
@dict_cgroup_level_1_out
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:443:3-56: Error: Could not process rule: Operation
not supported
meta l4proto { icmp, icmpv6 } counter jump icmp_common
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:448:3-87: Error: Could not process rule: Operation
not supported
counter log prefix "[inet-output] " flags all reject
with icmpx type admin-prohibited
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-Topi
