TCP flags filtering#92
Merged
Merged
Conversation
Until now, user had no control over the matcher operator used in a matcher, BF_MATCHER_EQ was used, unless `!` was supported, in which case BF_MATCHER_NE was used. New matchers (e.g. tcp.flags) will require more complex operators, and relying on a prefix to the payload won't be sufficient. Hence, the matcher operator are now matched similarly to the matcher type and the payload. The lexer defines the matchers allowed for a given matcher type, and the parser forward it to the matcher object.
Allow the following rule:
rule:
ip.proto not icmp
to match every IPv4 packet with the protocol being anything but ICMP.
The generator code assume iphdr.protocol field is 2 bytes (uint16_t), when it's actually 1 byte. This lead to BPF verification failure and other instabilities. Update every usage of iphdr.protocol to use 1 byte only.
Create new matcher for TCP flags. It's only possible to test for equality for now, other operators will be added later.
Add two new matcher operators aimed to be used to match TCP flags (but
are not limited to it):
- any: match any of the subset values
tcp.flags any SYN,ACK -> matches SYN, SYN/ACK, ACK packets
- all: match all of the subset values
tcp.flags all SYN,ACK -> matches SYN/ACK packets
Add bytecode generation of tcp.flags filtering with 'not', 'any', and 'all' operators.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Introduce support for TCP flags filtering in
bpfilter:bfclirule (ip.saddr eq 192.168.1.1,ip.saddr not 192.168.1.1).anyandall(see commit for details).tcp.flagsmatcher: match a rule based on the packet's TCP flags.Extra changes:
notoperator inip.proto:ip.proto not icmp.iphdr.protocolsize: uses 1 byte instead of 2 bytes. This change resolves a verifier complain.