From 02a383156adbec12c5c95213fc92c94ab345c012 Mon Sep 17 00:00:00 2001 From: Flavio Crisciani Date: Thu, 26 Jul 2018 14:05:25 -0700 Subject: [PATCH] Adjust conntrack filters Today the filter implementation implements only ip matching for src,dst,reply src,reply dst. Updating the comments on the filter to reflect that more clearly and deprecate confusing constants Signed-off-by: Flavio Crisciani --- conntrack_linux.go | 23 +++++++++++++---------- conntrack_test.go | 12 ++++++------ 2 files changed, 19 insertions(+), 16 deletions(-) diff --git a/conntrack_linux.go b/conntrack_linux.go index f75381b..5300d38 100644 --- a/conntrack_linux.go +++ b/conntrack_linux.go @@ -309,7 +309,7 @@ func parseRawData(data []byte) *ConntrackFlow { // Common parameters and options: // -s, --src, --orig-src ip Source address from original direction // -d, --dst, --orig-dst ip Destination address from original direction -// -r, --reply-src ip Source addres from reply direction +// -r, --reply-src ip Source address from reply direction // -q, --reply-dst ip Destination address from reply direction // -p, --protonum proto Layer 4 Protocol, eg. 'tcp' // -f, --family proto Layer 3 Protocol, eg. 'ipv6' @@ -326,11 +326,14 @@ func parseRawData(data []byte) *ConntrackFlow { type ConntrackFilterType uint8 const ( - ConntrackOrigSrcIP = iota // -orig-src ip Source address from original direction - ConntrackOrigDstIP // -orig-dst ip Destination address from original direction - ConntrackNatSrcIP // -src-nat ip Source NAT ip - ConntrackNatDstIP // -dst-nat ip Destination NAT ip - ConntrackNatAnyIP // -any-nat ip Source or destination NAT ip + ConntrackOrigSrcIP = iota // -orig-src ip Source address from original direction + ConntrackOrigDstIP // -orig-dst ip Destination address from original direction + ConntrackReplySrcIP // --reply-src ip Reply Source IP + ConntrackReplyDstIP // --reply-dst ip Reply Destination IP + ConntrackReplyAnyIP // Match source or destination reply IP + ConntrackNatSrcIP = ConntrackReplySrcIP // deprecated use instead ConntrackReplySrcIP + ConntrackNatDstIP = ConntrackReplyDstIP // deprecated use instead ConntrackReplyDstIP + ConntrackNatAnyIP = ConntrackReplyAnyIP // deprecated use instaed ConntrackReplyAnyIP ) type CustomConntrackFilter interface { @@ -375,17 +378,17 @@ func (f *ConntrackFilter) MatchConntrackFlow(flow *ConntrackFlow) bool { } // -src-nat ip Source NAT ip - if elem, found := f.ipFilter[ConntrackNatSrcIP]; match && found { + if elem, found := f.ipFilter[ConntrackReplySrcIP]; match && found { match = match && elem.Equal(flow.Reverse.SrcIP) } // -dst-nat ip Destination NAT ip - if elem, found := f.ipFilter[ConntrackNatDstIP]; match && found { + if elem, found := f.ipFilter[ConntrackReplyDstIP]; match && found { match = match && elem.Equal(flow.Reverse.DstIP) } - // -any-nat ip Source or destination NAT ip - if elem, found := f.ipFilter[ConntrackNatAnyIP]; match && found { + // Match source or destination reply IP + if elem, found := f.ipFilter[ConntrackReplyAnyIP]; match && found { match = match && (elem.Equal(flow.Reverse.SrcIP) || elem.Equal(flow.Reverse.DstIP)) } diff --git a/conntrack_test.go b/conntrack_test.go index 556dd66..edc9f5b 100644 --- a/conntrack_test.go +++ b/conntrack_test.go @@ -371,10 +371,10 @@ func TestConntrackFilter(t *testing.T) { // SrcIP for NAT filterV4 = &ConntrackFilter{} - filterV4.AddIP(ConntrackNatSrcIP, net.ParseIP("20.0.0.1")) + filterV4.AddIP(ConntrackReplySrcIP, net.ParseIP("20.0.0.1")) filterV6 = &ConntrackFilter{} - filterV6.AddIP(ConntrackNatSrcIP, net.ParseIP("dddd:dddd:dddd:dddd:dddd:dddd:dddd:dddd")) + filterV6.AddIP(ConntrackReplySrcIP, net.ParseIP("dddd:dddd:dddd:dddd:dddd:dddd:dddd:dddd")) v4Match, v6Match = applyFilter(flowList, filterV4, filterV6) if v4Match != 1 || v6Match != 1 { @@ -383,10 +383,10 @@ func TestConntrackFilter(t *testing.T) { // DstIP for NAT filterV4 = &ConntrackFilter{} - filterV4.AddIP(ConntrackNatDstIP, net.ParseIP("192.168.1.1")) + filterV4.AddIP(ConntrackReplyDstIP, net.ParseIP("192.168.1.1")) filterV6 = &ConntrackFilter{} - filterV6.AddIP(ConntrackNatDstIP, net.ParseIP("dddd:dddd:dddd:dddd:dddd:dddd:dddd:dddd")) + filterV6.AddIP(ConntrackReplyDstIP, net.ParseIP("dddd:dddd:dddd:dddd:dddd:dddd:dddd:dddd")) v4Match, v6Match = applyFilter(flowList, filterV4, filterV6) if v4Match != 2 || v6Match != 0 { @@ -395,10 +395,10 @@ func TestConntrackFilter(t *testing.T) { // AnyIp for Nat filterV4 = &ConntrackFilter{} - filterV4.AddIP(ConntrackNatAnyIP, net.ParseIP("192.168.1.1")) + filterV4.AddIP(ConntrackReplyAnyIP, net.ParseIP("192.168.1.1")) filterV6 = &ConntrackFilter{} - filterV6.AddIP(ConntrackNatAnyIP, net.ParseIP("eeee:eeee:eeee:eeee:eeee:eeee:eeee:eeee")) + filterV6.AddIP(ConntrackReplyAnyIP, net.ParseIP("eeee:eeee:eeee:eeee:eeee:eeee:eeee:eeee")) v4Match, v6Match = applyFilter(flowList, filterV4, filterV6) if v4Match != 2 || v6Match != 1 {