1 /*
2 * (C) 2012-2014 by Pablo Neira Ayuso <pablo@netfilter.org>
3 * (C) 2013 by Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
9 *
10 * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
11 */
12
13 #include <string.h>
14 #include <stdio.h>
15
16 #include <sys/types.h>
17 #include <sys/socket.h>
18 #include <arpa/inet.h>
19 #include <netinet/ip6.h>
20 #include <netdb.h>
21
22 #include <xtables.h>
23
24 #include <linux/netfilter/nf_tables.h>
25 #include "nft.h"
26 #include "nft-shared.h"
27
nft_ipv6_add(struct nft_handle * h,struct nftnl_rule * r,void * data)28 static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
29 {
30 struct iptables_command_state *cs = data;
31 struct xtables_rule_match *matchp;
32 uint32_t op;
33 int ret;
34
35 if (cs->fw6.ipv6.iniface[0] != '\0') {
36 op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_IN);
37 add_iniface(r, cs->fw6.ipv6.iniface, op);
38 }
39
40 if (cs->fw6.ipv6.outiface[0] != '\0') {
41 op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_OUT);
42 add_outiface(r, cs->fw6.ipv6.outiface, op);
43 }
44
45 if (cs->fw6.ipv6.proto != 0) {
46 op = nft_invflags2cmp(cs->fw6.ipv6.invflags, XT_INV_PROTO);
47 add_l4proto(r, cs->fw6.ipv6.proto, op);
48 }
49
50 if (!IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.src) ||
51 !IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.smsk) ||
52 (cs->fw6.ipv6.invflags & IPT_INV_SRCIP)) {
53 op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_SRCIP);
54 add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
55 offsetof(struct ip6_hdr, ip6_src),
56 &cs->fw6.ipv6.src, &cs->fw6.ipv6.smsk,
57 sizeof(struct in6_addr), op);
58 }
59 if (!IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.dst) ||
60 !IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.dmsk) ||
61 (cs->fw6.ipv6.invflags & IPT_INV_DSTIP)) {
62 op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_DSTIP);
63 add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
64 offsetof(struct ip6_hdr, ip6_dst),
65 &cs->fw6.ipv6.dst, &cs->fw6.ipv6.dmsk,
66 sizeof(struct in6_addr), op);
67 }
68 add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags & XT_INV_PROTO);
69
70 for (matchp = cs->matches; matchp; matchp = matchp->next) {
71 ret = add_match(h, r, matchp->match->m);
72 if (ret < 0)
73 return ret;
74 }
75
76 /* Counters need to me added before the target, otherwise they are
77 * increased for each rule because of the way nf_tables works.
78 */
79 if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0)
80 return -1;
81
82 return add_action(r, cs, !!(cs->fw6.ipv6.flags & IP6T_F_GOTO));
83 }
84
nft_ipv6_is_same(const void * data_a,const void * data_b)85 static bool nft_ipv6_is_same(const void *data_a,
86 const void *data_b)
87 {
88 const struct iptables_command_state *a = data_a;
89 const struct iptables_command_state *b = data_b;
90
91 if (memcmp(a->fw6.ipv6.src.s6_addr, b->fw6.ipv6.src.s6_addr,
92 sizeof(struct in6_addr)) != 0
93 || memcmp(a->fw6.ipv6.dst.s6_addr, b->fw6.ipv6.dst.s6_addr,
94 sizeof(struct in6_addr)) != 0
95 || a->fw6.ipv6.proto != b->fw6.ipv6.proto
96 || a->fw6.ipv6.flags != b->fw6.ipv6.flags
97 || a->fw6.ipv6.invflags != b->fw6.ipv6.invflags) {
98 DEBUGP("different src/dst/proto/flags/invflags\n");
99 return false;
100 }
101
102 return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface,
103 a->fw6.ipv6.iniface_mask,
104 a->fw6.ipv6.outiface_mask,
105 b->fw6.ipv6.iniface, b->fw6.ipv6.outiface,
106 b->fw6.ipv6.iniface_mask,
107 b->fw6.ipv6.outiface_mask);
108 }
109
nft_ipv6_parse_meta(struct nft_xt_ctx * ctx,struct nftnl_expr * e,void * data)110 static void nft_ipv6_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
111 void *data)
112 {
113 struct iptables_command_state *cs = data;
114
115 switch (ctx->meta.key) {
116 case NFT_META_L4PROTO:
117 cs->fw6.ipv6.proto = nftnl_expr_get_u8(e, NFTNL_EXPR_CMP_DATA);
118 if (nftnl_expr_get_u32(e, NFTNL_EXPR_CMP_OP) == NFT_CMP_NEQ)
119 cs->fw6.ipv6.invflags |= XT_INV_PROTO;
120 return;
121 default:
122 break;
123 }
124
125 parse_meta(e, ctx->meta.key, cs->fw6.ipv6.iniface,
126 cs->fw6.ipv6.iniface_mask, cs->fw6.ipv6.outiface,
127 cs->fw6.ipv6.outiface_mask, &cs->fw6.ipv6.invflags);
128 }
129
parse_mask_ipv6(struct nft_xt_ctx * ctx,struct in6_addr * mask)130 static void parse_mask_ipv6(struct nft_xt_ctx *ctx, struct in6_addr *mask)
131 {
132 memcpy(mask, ctx->bitwise.mask, sizeof(struct in6_addr));
133 }
134
nft_ipv6_parse_payload(struct nft_xt_ctx * ctx,struct nftnl_expr * e,void * data)135 static void nft_ipv6_parse_payload(struct nft_xt_ctx *ctx,
136 struct nftnl_expr *e, void *data)
137 {
138 struct iptables_command_state *cs = data;
139 struct in6_addr addr;
140 uint8_t proto;
141 bool inv;
142
143 switch (ctx->payload.offset) {
144 case offsetof(struct ip6_hdr, ip6_src):
145 get_cmp_data(e, &addr, sizeof(addr), &inv);
146 memcpy(cs->fw6.ipv6.src.s6_addr, &addr, sizeof(addr));
147 if (ctx->flags & NFT_XT_CTX_BITWISE) {
148 parse_mask_ipv6(ctx, &cs->fw6.ipv6.smsk);
149 ctx->flags &= ~NFT_XT_CTX_BITWISE;
150 } else {
151 memset(&cs->fw6.ipv6.smsk, 0xff,
152 min(ctx->payload.len, sizeof(struct in6_addr)));
153 }
154
155 if (inv)
156 cs->fw6.ipv6.invflags |= IP6T_INV_SRCIP;
157 break;
158 case offsetof(struct ip6_hdr, ip6_dst):
159 get_cmp_data(e, &addr, sizeof(addr), &inv);
160 memcpy(cs->fw6.ipv6.dst.s6_addr, &addr, sizeof(addr));
161 if (ctx->flags & NFT_XT_CTX_BITWISE) {
162 parse_mask_ipv6(ctx, &cs->fw6.ipv6.dmsk);
163 ctx->flags &= ~NFT_XT_CTX_BITWISE;
164 } else {
165 memset(&cs->fw6.ipv6.dmsk, 0xff,
166 min(ctx->payload.len, sizeof(struct in6_addr)));
167 }
168
169 if (inv)
170 cs->fw6.ipv6.invflags |= IP6T_INV_DSTIP;
171 break;
172 case offsetof(struct ip6_hdr, ip6_nxt):
173 get_cmp_data(e, &proto, sizeof(proto), &inv);
174 cs->fw6.ipv6.proto = proto;
175 if (inv)
176 cs->fw6.ipv6.invflags |= IP6T_INV_PROTO;
177 default:
178 DEBUGP("unknown payload offset %d\n", ctx->payload.offset);
179 break;
180 }
181 }
182
nft_ipv6_parse_immediate(const char * jumpto,bool nft_goto,void * data)183 static void nft_ipv6_parse_immediate(const char *jumpto, bool nft_goto,
184 void *data)
185 {
186 struct iptables_command_state *cs = data;
187
188 cs->jumpto = jumpto;
189
190 if (nft_goto)
191 cs->fw6.ipv6.flags |= IP6T_F_GOTO;
192 }
193
nft_ipv6_print_rule(struct nft_handle * h,struct nftnl_rule * r,unsigned int num,unsigned int format)194 static void nft_ipv6_print_rule(struct nft_handle *h, struct nftnl_rule *r,
195 unsigned int num, unsigned int format)
196 {
197 struct iptables_command_state cs = {};
198
199 nft_rule_to_iptables_command_state(h, r, &cs);
200
201 print_rule_details(&cs, cs.jumpto, cs.fw6.ipv6.flags,
202 cs.fw6.ipv6.invflags, cs.fw6.ipv6.proto,
203 num, format);
204 if (format & FMT_OPTIONS) {
205 if (format & FMT_NOTABLE)
206 fputs("opt ", stdout);
207 fputs(" ", stdout);
208 }
209 print_ifaces(cs.fw6.ipv6.iniface, cs.fw6.ipv6.outiface,
210 cs.fw6.ipv6.invflags, format);
211 print_ipv6_addresses(&cs.fw6, format);
212
213 if (format & FMT_NOTABLE)
214 fputs(" ", stdout);
215
216 if (cs.fw6.ipv6.flags & IP6T_F_GOTO)
217 printf("[goto] ");
218
219 print_matches_and_target(&cs, format);
220
221 if (!(format & FMT_NONEWLINE))
222 fputc('\n', stdout);
223
224 nft_clear_iptables_command_state(&cs);
225 }
226
save_ipv6_addr(char letter,const struct in6_addr * addr,const struct in6_addr * mask,int invert)227 static void save_ipv6_addr(char letter, const struct in6_addr *addr,
228 const struct in6_addr *mask,
229 int invert)
230 {
231 char addr_str[INET6_ADDRSTRLEN];
232 int l = xtables_ip6mask_to_cidr(mask);
233
234 if (!invert && l == 0)
235 return;
236
237 printf("%s-%c %s",
238 invert ? "! " : "", letter,
239 inet_ntop(AF_INET6, addr, addr_str, sizeof(addr_str)));
240
241 if (l == -1)
242 printf("/%s ", inet_ntop(AF_INET6, mask, addr_str, sizeof(addr_str)));
243 else
244 printf("/%d ", l);
245 }
246
nft_ipv6_save_rule(const void * data,unsigned int format)247 static void nft_ipv6_save_rule(const void *data, unsigned int format)
248 {
249 const struct iptables_command_state *cs = data;
250
251 save_ipv6_addr('s', &cs->fw6.ipv6.src, &cs->fw6.ipv6.smsk,
252 cs->fw6.ipv6.invflags & IP6T_INV_SRCIP);
253 save_ipv6_addr('d', &cs->fw6.ipv6.dst, &cs->fw6.ipv6.dmsk,
254 cs->fw6.ipv6.invflags & IP6T_INV_DSTIP);
255
256 save_rule_details(cs, cs->fw6.ipv6.invflags, cs->fw6.ipv6.proto,
257 cs->fw6.ipv6.iniface, cs->fw6.ipv6.iniface_mask,
258 cs->fw6.ipv6.outiface, cs->fw6.ipv6.outiface_mask);
259
260 save_matches_and_target(cs, cs->fw6.ipv6.flags & IP6T_F_GOTO,
261 &cs->fw6, format);
262 }
263
264 /* These are invalid numbers as upper layer protocol */
is_exthdr(uint16_t proto)265 static int is_exthdr(uint16_t proto)
266 {
267 return (proto == IPPROTO_ROUTING ||
268 proto == IPPROTO_FRAGMENT ||
269 proto == IPPROTO_AH ||
270 proto == IPPROTO_DSTOPTS);
271 }
272
nft_ipv6_proto_parse(struct iptables_command_state * cs,struct xtables_args * args)273 static void nft_ipv6_proto_parse(struct iptables_command_state *cs,
274 struct xtables_args *args)
275 {
276 cs->fw6.ipv6.proto = args->proto;
277 cs->fw6.ipv6.invflags = args->invflags;
278
279 if (is_exthdr(cs->fw6.ipv6.proto)
280 && (cs->fw6.ipv6.invflags & XT_INV_PROTO) == 0)
281 fprintf(stderr,
282 "Warning: never matched protocol: %s. "
283 "use extension match instead.\n",
284 cs->protocol);
285 }
286
nft_ipv6_post_parse(int command,struct iptables_command_state * cs,struct xtables_args * args)287 static void nft_ipv6_post_parse(int command, struct iptables_command_state *cs,
288 struct xtables_args *args)
289 {
290 cs->fw6.ipv6.flags = args->flags;
291 /* We already set invflags in proto_parse, but we need to refresh it
292 * to include new parsed options.
293 */
294 cs->fw6.ipv6.invflags = args->invflags;
295
296 strncpy(cs->fw6.ipv6.iniface, args->iniface, IFNAMSIZ);
297 memcpy(cs->fw6.ipv6.iniface_mask,
298 args->iniface_mask, IFNAMSIZ*sizeof(unsigned char));
299
300 strncpy(cs->fw6.ipv6.outiface, args->outiface, IFNAMSIZ);
301 memcpy(cs->fw6.ipv6.outiface_mask,
302 args->outiface_mask, IFNAMSIZ*sizeof(unsigned char));
303
304 if (args->goto_set)
305 cs->fw6.ipv6.flags |= IP6T_F_GOTO;
306
307 cs->fw6.counters.pcnt = args->pcnt_cnt;
308 cs->fw6.counters.bcnt = args->bcnt_cnt;
309
310 if (command & (CMD_REPLACE | CMD_INSERT |
311 CMD_DELETE | CMD_APPEND | CMD_CHECK)) {
312 if (!(cs->options & OPT_DESTINATION))
313 args->dhostnetworkmask = "::0/0";
314 if (!(cs->options & OPT_SOURCE))
315 args->shostnetworkmask = "::0/0";
316 }
317
318 if (args->shostnetworkmask)
319 xtables_ip6parse_multiple(args->shostnetworkmask,
320 &args->s.addr.v6,
321 &args->s.mask.v6,
322 &args->s.naddrs);
323 if (args->dhostnetworkmask)
324 xtables_ip6parse_multiple(args->dhostnetworkmask,
325 &args->d.addr.v6,
326 &args->d.mask.v6,
327 &args->d.naddrs);
328
329 if ((args->s.naddrs > 1 || args->d.naddrs > 1) &&
330 (cs->fw6.ipv6.invflags & (IP6T_INV_SRCIP | IP6T_INV_DSTIP)))
331 xtables_error(PARAMETER_PROBLEM,
332 "! not allowed with multiple"
333 " source or destination IP addresses");
334 }
335
xlate_ipv6_addr(const char * selector,const struct in6_addr * addr,const struct in6_addr * mask,int invert,struct xt_xlate * xl)336 static void xlate_ipv6_addr(const char *selector, const struct in6_addr *addr,
337 const struct in6_addr *mask,
338 int invert, struct xt_xlate *xl)
339 {
340 char addr_str[INET6_ADDRSTRLEN];
341
342 if (!invert && IN6_IS_ADDR_UNSPECIFIED(addr))
343 return;
344
345 inet_ntop(AF_INET6, addr, addr_str, INET6_ADDRSTRLEN);
346 xt_xlate_add(xl, "%s %s%s%s ", selector, invert ? "!= " : "", addr_str,
347 xtables_ip6mask_to_numeric(mask));
348 }
349
nft_ipv6_xlate(const void * data,struct xt_xlate * xl)350 static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
351 {
352 const struct iptables_command_state *cs = data;
353 const char *comment;
354 int ret;
355
356 xlate_ifname(xl, "iifname", cs->fw6.ipv6.iniface,
357 cs->fw6.ipv6.invflags & IP6T_INV_VIA_IN);
358 xlate_ifname(xl, "oifname", cs->fw6.ipv6.outiface,
359 cs->fw6.ipv6.invflags & IP6T_INV_VIA_OUT);
360
361 if (cs->fw6.ipv6.proto != 0) {
362 const struct protoent *pent =
363 getprotobynumber(cs->fw6.ipv6.proto);
364 char protonum[sizeof("65535")];
365 const char *name = protonum;
366
367 snprintf(protonum, sizeof(protonum), "%u",
368 cs->fw6.ipv6.proto);
369
370 if (!pent || !xlate_find_match(cs, pent->p_name)) {
371 if (pent)
372 name = pent->p_name;
373 xt_xlate_add(xl, "meta l4proto %s%s ",
374 cs->fw6.ipv6.invflags & IP6T_INV_PROTO ?
375 "!= " : "", name);
376 }
377
378 }
379
380 xlate_ipv6_addr("ip6 saddr", &cs->fw6.ipv6.src, &cs->fw6.ipv6.smsk,
381 cs->fw6.ipv6.invflags & IP6T_INV_SRCIP, xl);
382 xlate_ipv6_addr("ip6 daddr", &cs->fw6.ipv6.dst, &cs->fw6.ipv6.dmsk,
383 cs->fw6.ipv6.invflags & IP6T_INV_DSTIP, xl);
384
385 ret = xlate_matches(cs, xl);
386 if (!ret)
387 return ret;
388
389 /* Always add counters per rule, as in iptables */
390 xt_xlate_add(xl, "counter");
391 ret = xlate_action(cs, !!(cs->fw6.ipv6.flags & IP6T_F_GOTO), xl);
392
393 comment = xt_xlate_get_comment(xl);
394 if (comment)
395 xt_xlate_add(xl, " comment %s", comment);
396
397 return ret;
398 }
399
400 struct nft_family_ops nft_family_ops_ipv6 = {
401 .add = nft_ipv6_add,
402 .is_same = nft_ipv6_is_same,
403 .parse_meta = nft_ipv6_parse_meta,
404 .parse_payload = nft_ipv6_parse_payload,
405 .parse_immediate = nft_ipv6_parse_immediate,
406 .print_header = print_header,
407 .print_rule = nft_ipv6_print_rule,
408 .save_rule = nft_ipv6_save_rule,
409 .save_chain = nft_ipv46_save_chain,
410 .proto_parse = nft_ipv6_proto_parse,
411 .post_parse = nft_ipv6_post_parse,
412 .parse_target = nft_ipv46_parse_target,
413 .rule_to_cs = nft_rule_to_iptables_command_state,
414 .clear_cs = nft_clear_iptables_command_state,
415 .xlate = nft_ipv6_xlate,
416 };
417