// SPDX-License-Identifier: GPL-2.0-or-later
/* seitan - Syscall Expressive Interpreter, Transformer and Notifier
*
* demo/nft.hjson - Example for nft(8): fetch ruleset, add/delete set elements
*
* Copyright (c) 2024 Red Hat GmbH
* Author: Stefano Brivio <sbrivio@redhat.com>
*
* Example of stand-alone usage. Prepare a table and a set for testing, first:
*
* nft add table ip test_t
* nft add set ip test_t test_s '{ type ipv4_addr ; }'
*
* Now add the set element:
*
* ./seitan-cooker \
* -i demo/nft.hjson -g demo/nft.gluten -f demo/nft.bpf
* ./seitan-eater \
* -i demo/nft.bpf -- /sbin/nft add element ip test_t test_s { 1.2.3.4 }
* # blocks
*
* ./seitan -p $(pgrep seitan-eater) -i demo/nft.gluten
* # as root or with CAP_NET_ADMIN: add element on behalf of caller
*
* nft list ruleset # Check that the new element is there
*
* ./seitan-eater \
* -i demo/nft.bpf -- /sbin/nft delete element ip test_t test_s { 1.2.3.4 }
* # blocks
*
* ./seitan -p $(pgrep seitan-eater) -i demo/nft.gluten
* # as root or with CAP_NET_ADMIN: deletes element on behalf of caller
*
*/
[
/* Open netlink socket on behalf of the caller, owned by us, and replace in
* the caller.
*
* For netlink operations, there's always a double permission check:
* both opener of the socket and sender of the messages need to have matching
* capabilities, see netlink_ns_capable() in net/netlink/af_netlink.c.
*
* This block takes care of the first part.
*/
{
"match": {
"socket": {
"family" : "netlink",
"type" : "raw",
"protocol" : "nl_netfilter"
}
/* socket(2) doesn't point to memory, so we can safely let any unrelated
* system calls proceed, directly in the caller, without replaying it
* ourselves.
*/
},
"call": {
"socket": {
"family" : "netlink",
"type" : "raw",
"flags" : 0,
"protocol" : "nl_netfilter"
},
"ret": "fd"
},
"fd": {
"src": { "get": "fd" },
"close_on_exec": true,
"return": true
}
},
/* Second part: send messages on behalf of the target process.
*
* First, the ones to fetch tables, chains, sets, flow tables, and objects,
* including their generation (version) identifier.
*
* These are simple messages, without batches, using sendto().
*/
{
"match": {
"sendto": {
"fd": {
"set": "fd"
},
"buf": {
"set": "buf",
"value": {
"netlink": {
"type": {
"in": [
"nf_getgen",
"nf_gettable",
"nf_getchain",
"nf_getobj",
"nf_getflowtable",
"nf_getset"
]
}
}
}
},
"len" : { "set": "len" },
"addr": { "set": "addr" }
}
},
"call": {
"sendto": {
"fd": { "get": "fd" },
"buf": { "get": "buf" },
"len": { "get": "len" },
"addr": { "get": "addr" },
"flags": 0
},
"ret": "rc"
},
"return": { "value": "rc", "error": "rc" }
},
/* sendto(2) points to memory, so we need to match on any unrelated sendto()
* call and replay it ourselves, but pretending we're the original process
* (see "context" below). Otherwise, a thread of the target process can fool
* us into sending other messages with our capability set.
*/
{
"match": {
"sendto": {
"fd": { "set": "fd" },
"buf": { "set": "buf" },
"len": { "set": "len" },
"addr": { "set": "addr" },
"flags": { "set": "flags" }
}
},
"call": {
"sendto": {
"fd": { "get": "fd" },
"buf": { "get": "buf" },
"len": { "get": "len" },
"addr": { "get": "addr" },
"flags": { "get": "flags" }
},
"context": { "uid": "caller", "gid": "caller" }
}
},
/* Now deal with the actual element insertion or deletion: those are batched
* messages, using sendmsg(). Replay the message and relay return code and any
* error back.
*/
{
"match": {
"sendmsg": {
"fd": { "set": "fd" },
"msg": {
"iov": {
"set": "buf",
"value": {
"netlink": {
"type": { "in": [ "nf_newsetelem", "nf_delsetelem" ] }
}
}
}
}
}
},
"call": {
"sendmsg": {
"fd": { "get": "fd" },
"msg": {
"name": {
"family": "netlink",
"pid": 0,
"groups": 0
},
"iovlen": 1,
"iov": { "get": "buf" }
},
"flags": 0
},
"ret": "rc"
},
"return": { "value": "rc", "error": "rc" }
},
/* Same as sendto(2): sendmsg(2) points to memory. Replay any unrelated system
* call with the credentials from the target process.
*/
{
"match": {
"sendmsg": {
"fd": { "set": "fd" },
"msg": {
"name": { "set": "name" },
"namelen": { "set": "namelen" },
"iov": { "set": "buf" },
"control": { "set": "control" },
"controllen": { "set": "controllen" }
},
"flags": { "set": "flags" }
}
},
"call": {
"sendmsg": {
"fd": { "get": "fd" },
"msg": {
"name": { "get": "name" },
"namelen": { "get": "namelen" },
"iov": { "get": "buf" },
"iovlen": 1,
"control": { "get": "control" },
"controllen": { "get": "controllen" }
},
"flags": { "get": "flags" }
},
"context": { "uid": "caller", "gid": "caller" }
}
}
]
