Nftables: Added support for conntrack get Ops.

pkg/abi/linux/nf_tables.go

@@ -420,6 +420,21 @@ const (
 	NFT_BITWISE_RSHIFT        // right-shift operation
 )
 
+// Nf table bitwise expression netlink attributes.
+// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
+const (
+	NFTA_BITWISE_UNSPEC uint16 = iota
+	NFTA_BITWISE_SREG
+	NFTA_BITWISE_DREG
+	NFTA_BITWISE_LEN
+	NFTA_BITWISE_MASK
+	NFTA_BITWISE_XOR
+	NFTA_BITWISE_OP
+	NFTA_BITWISE_DATA
+	__NFTA_BITWISE_MAX
+	NFTA_BITWISE_MAX = __NFTA_BITWISE_MAX - 1
+)
+
 // Nf table route expression keys.
 // Used by the nft route operation to determine the routing data to retrieve.
 // These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
@@ -674,3 +689,117 @@ const (
 	NFTA_LOOKUP_MAX = __NFTA_LOOKUP_MAX - 1
 )
 const NFT_LOOKUP_F_INV = uint32(1 << 0)
+
+// NfTable fib expression netlink attributes.
+// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
+const (
+	NFTA_FIB_UNSPEC uint16 = iota
+	NFTA_FIB_DREG
+	NFTA_FIB_RESULT
+	NFTA_FIB_FLAGS
+	__NFTA_FIB_MAX
+)
+
+const NFTA_FIB_MAX = __NFTA_FIB_MAX - 1
+
+// NfTable fib result types.
+// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
+const (
+	NFT_FIB_RESULT_UNSPEC = iota
+	NFT_FIB_RESULT_OIF
+	NFT_FIB_RESULT_OIFNAME
+	NFT_FIB_RESULT_ADDRTYPE
+	__NFT_FIB_RESULT_MAX
+)
+
+const NFT_FIB_RESULT_MAX = __NFT_FIB_RESULT_MAX - 1
+
+// NfTable fib flags.
+// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
+const (
+	NFTA_FIB_F_SADDR   = 1 << 0
+	NFTA_FIB_F_DADDR   = 1 << 1
+	NFTA_FIB_F_MARK    = 1 << 2
+	NFTA_FIB_F_IIF     = 1 << 3
+	NFTA_FIB_F_OIF     = 1 << 4
+	NFTA_FIB_F_PRESENT = 1 << 5
+)
+
+// Nf table ct expression keys.
+// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
+const (
+	NFT_CT_STATE = iota
+	NFT_CT_DIRECTION
+	NFT_CT_STATUS
+	NFT_CT_MARK
+	NFT_CT_SECMARK
+	NFT_CT_EXPIRATION
+	NFT_CT_HELPER
+	NFT_CT_L3PROTOCOL
+	NFT_CT_SRC
+	NFT_CT_DST
+	NFT_CT_PROTOCOL
+	NFT_CT_PROTO_SRC
+	NFT_CT_PROTO_DST
+	NFT_CT_LABELS
+	NFT_CT_PKTS
+	NFT_CT_BYTES
+	NFT_CT_AVGPKT
+	NFT_CT_ZONE
+	NFT_CT_EVENTMASK
+	NFT_CT_SRC_IP
+	NFT_CT_DST_IP
+	NFT_CT_SRC_IP6
+	NFT_CT_DST_IP6
+	NFT_CT_ID
+	__NFT_CT_MAX
+	NFT_CT_MAX = __NFT_CT_MAX - 1
+)
+
+// Nf table ct expression netlink attributes.
+// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
+const (
+	NFTA_CT_UNSPEC uint16 = iota
+	NFTA_CT_DREG
+	NFTA_CT_KEY
+	NFTA_CT_DIRECTION
+	NFTA_CT_SREG
+	__NFTA_CT_MAX
+	NFTA_CT_MAX = __NFTA_CT_MAX - 1
+)
+
+type ConnTrackStateBit int
+
+const (
+	IP_CT_ESTABLISHED ConnTrackStateBit = iota
+	IP_CT_RELATED
+	IP_CT_NEW
+	IP_CT_IS_REPLY
+	IP_CT_ESTABLISHED_REPLY = IP_CT_ESTABLISHED + IP_CT_IS_REPLY
+	IP_CT_RELATED_REPLY     = IP_CT_RELATED + IP_CT_IS_REPLY
+	IP_CT_NUMBER            = 5
+	IP_CT_NEW_REPLY         = IP_CT_NUMBER
+	IP_CT_UNTRACKED         = 7
+)
+
+// Conntrack states.
+const (
+	NF_CT_STATE_INVALID_BIT   = 1 << 0
+	NF_CT_STATE_UNTRACKED_BIT = 1 << 6
+)
+
+// From include/net/netfilter/nf_conntrack_helper.h:NF_CT_HELPER_NAME_LEN
+const NF_CT_HELPER_NAME_LEN = 16
+
+// From include/net/netfilter/nf_conntrack_labels.h:NF_CT_LABELS_MAX_SIZE
+const NF_CT_LABELS_MAX_SIZE = 16
+
+// ConnTrackDirection corresponds to values in
+// include/uapi/linux/netfilter/nf_conntrack_common.h.
+type ConnTrackDir uint8
+
+const (
+	IP_CT_DIR_ORIGINAL ConnTrackDir = iota
+	IP_CT_DIR_REPLY
+	IP_CT_DIR_MAX
+)

pkg/sentry/socket/netlink/netfilter/protocol.go

@@ -846,7 +846,7 @@ func (p *Protocol) newRule(nft *nftables.NFTables, st *stack.Stack, attrs map[ui
 	}
 
 	for _, exprInfo := range exprInfos {
-		err = rule.AddOpFromExprInfo(tab, exprInfo)
+		err = rule.AddOpFromExprInfo(nft, tab, exprInfo)
 		// TODO - b/434244017: Create a copy of nftables structure when modifying the table.
 		// Because we will create a copy of the table, no cleanup is necessary on the error case.
 		// The table will simply be reverted to the original state.

pkg/sentry/socket/netlink/nlmsg/message.go

@@ -519,6 +519,11 @@ func HostToNetU64(v uint64) uint64 {
 	return binary.BigEndian.Uint64(b[:])
 }
 
+// PutU8 returns a uint8 as a marshal.Marshallable.
+func PutU8(val uint8) marshal.Marshallable {
+	return primitive.AllocateUint8(val)
+}
+
 // PutU16 converts a uint16 to network byte order and returns it as a
 // marshal.Marshallable.
 func PutU16(val uint16) marshal.Marshallable {

pkg/tcpip/network/ipv4/ipv4.go

@@ -970,8 +970,10 @@ func (e *endpoint) HandlePacket(pkt *stack.PacketBuffer) {
 			}
 		}
 
+		nicID := e.nic.ID()
 		// Loopback traffic skips the prerouting chain.
-		inNicName := stk.FindNICNameFromID(e.nic.ID())
+		inNicName := stk.FindNICNameFromID(nicID)
+		pkt.InputNICID = nicID
 		if ok := stk.IPTables().CheckPrerouting(pkt, e, inNicName); !ok {
 			// iptables is telling us to drop the packet.
 			stats.IPTablesPreroutingDropped.Increment()

pkg/tcpip/nftables/BUILD

@@ -20,6 +20,8 @@ go_library(
         "nft_byteorder.go",
         "nft_comparison.go",
         "nft_counter.go",
+        "nft_ct.go",
+        "nft_fib.go",
         "nft_immediate.go",
         "nft_last.go",
         "nft_lookup.go",
@@ -56,6 +58,7 @@ go_library(
         "//pkg/tcpip/checksum",
         "//pkg/tcpip/header",
         "//pkg/tcpip/stack",
+        "//pkg/tcpip/transport/tcpconntrack",
     ],
 )