1 /*
2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11 #include <linux/kernel.h>
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/netlink.h>
15 #include <linux/netfilter.h>
16 #include <linux/netfilter/nf_tables.h>
17 #include <linux/in.h>
18 #include <linux/ip.h>
19 #include <linux/ipv6.h>
20 #include <linux/smp.h>
21 #include <linux/static_key.h>
22 #include <net/dst.h>
23 #include <net/sock.h>
24 #include <net/tcp_states.h> /* for TCP_TIME_WAIT */
25 #include <net/netfilter/nf_tables.h>
26 #include <net/netfilter/nf_tables_core.h>
27 #include <net/netfilter/nft_meta.h>
28
29 #include <uapi/linux/netfilter_bridge.h> /* NF_BR_PRE_ROUTING */
30
31 static DEFINE_PER_CPU(struct rnd_state, nft_prandom_state);
32
nft_meta_get_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)33 void nft_meta_get_eval(const struct nft_expr *expr,
34 struct nft_regs *regs,
35 const struct nft_pktinfo *pkt)
36 {
37 const struct nft_meta *priv = nft_expr_priv(expr);
38 const struct sk_buff *skb = pkt->skb;
39 const struct net_device *in = pkt->in, *out = pkt->out;
40 struct sock *sk;
41 u32 *dest = ®s->data[priv->dreg];
42
43 switch (priv->key) {
44 case NFT_META_LEN:
45 *dest = skb->len;
46 break;
47 case NFT_META_PROTOCOL:
48 *dest = 0;
49 *(__be16 *)dest = skb->protocol;
50 break;
51 case NFT_META_NFPROTO:
52 *dest = pkt->pf;
53 break;
54 case NFT_META_L4PROTO:
55 if (!pkt->tprot_set)
56 goto err;
57 *dest = pkt->tprot;
58 break;
59 case NFT_META_PRIORITY:
60 *dest = skb->priority;
61 break;
62 case NFT_META_MARK:
63 *dest = skb->mark;
64 break;
65 case NFT_META_IIF:
66 if (in == NULL)
67 goto err;
68 *dest = in->ifindex;
69 break;
70 case NFT_META_OIF:
71 if (out == NULL)
72 goto err;
73 *dest = out->ifindex;
74 break;
75 case NFT_META_IIFNAME:
76 if (in == NULL)
77 goto err;
78 strncpy((char *)dest, in->name, IFNAMSIZ);
79 break;
80 case NFT_META_OIFNAME:
81 if (out == NULL)
82 goto err;
83 strncpy((char *)dest, out->name, IFNAMSIZ);
84 break;
85 case NFT_META_IIFTYPE:
86 if (in == NULL)
87 goto err;
88 *dest = 0;
89 *(u16 *)dest = in->type;
90 break;
91 case NFT_META_OIFTYPE:
92 if (out == NULL)
93 goto err;
94 *dest = 0;
95 *(u16 *)dest = out->type;
96 break;
97 case NFT_META_SKUID:
98 sk = skb_to_full_sk(skb);
99 if (!sk || !sk_fullsock(sk))
100 goto err;
101
102 read_lock_bh(&sk->sk_callback_lock);
103 if (sk->sk_socket == NULL ||
104 sk->sk_socket->file == NULL) {
105 read_unlock_bh(&sk->sk_callback_lock);
106 goto err;
107 }
108
109 *dest = from_kuid_munged(&init_user_ns,
110 sk->sk_socket->file->f_cred->fsuid);
111 read_unlock_bh(&sk->sk_callback_lock);
112 break;
113 case NFT_META_SKGID:
114 sk = skb_to_full_sk(skb);
115 if (!sk || !sk_fullsock(sk))
116 goto err;
117
118 read_lock_bh(&sk->sk_callback_lock);
119 if (sk->sk_socket == NULL ||
120 sk->sk_socket->file == NULL) {
121 read_unlock_bh(&sk->sk_callback_lock);
122 goto err;
123 }
124 *dest = from_kgid_munged(&init_user_ns,
125 sk->sk_socket->file->f_cred->fsgid);
126 read_unlock_bh(&sk->sk_callback_lock);
127 break;
128 #ifdef CONFIG_IP_ROUTE_CLASSID
129 case NFT_META_RTCLASSID: {
130 const struct dst_entry *dst = skb_dst(skb);
131
132 if (dst == NULL)
133 goto err;
134 *dest = dst->tclassid;
135 break;
136 }
137 #endif
138 #ifdef CONFIG_NETWORK_SECMARK
139 case NFT_META_SECMARK:
140 *dest = skb->secmark;
141 break;
142 #endif
143 case NFT_META_PKTTYPE:
144 if (skb->pkt_type != PACKET_LOOPBACK) {
145 *dest = skb->pkt_type;
146 break;
147 }
148
149 switch (pkt->pf) {
150 case NFPROTO_IPV4:
151 if (ipv4_is_multicast(ip_hdr(skb)->daddr))
152 *dest = PACKET_MULTICAST;
153 else
154 *dest = PACKET_BROADCAST;
155 break;
156 case NFPROTO_IPV6:
157 if (ipv6_hdr(skb)->daddr.s6_addr[0] == 0xFF)
158 *dest = PACKET_MULTICAST;
159 else
160 *dest = PACKET_BROADCAST;
161 break;
162 case NFPROTO_NETDEV:
163 switch (skb->protocol) {
164 case htons(ETH_P_IP): {
165 int noff = skb_network_offset(skb);
166 struct iphdr *iph, _iph;
167
168 iph = skb_header_pointer(skb, noff,
169 sizeof(_iph), &_iph);
170 if (!iph)
171 goto err;
172
173 if (ipv4_is_multicast(iph->daddr))
174 *dest = PACKET_MULTICAST;
175 else
176 *dest = PACKET_BROADCAST;
177
178 break;
179 }
180 case htons(ETH_P_IPV6):
181 *dest = PACKET_MULTICAST;
182 break;
183 default:
184 WARN_ON_ONCE(1);
185 goto err;
186 }
187 break;
188 default:
189 WARN_ON_ONCE(1);
190 goto err;
191 }
192 break;
193 case NFT_META_CPU:
194 *dest = raw_smp_processor_id();
195 break;
196 case NFT_META_IIFGROUP:
197 if (in == NULL)
198 goto err;
199 *dest = in->group;
200 break;
201 case NFT_META_OIFGROUP:
202 if (out == NULL)
203 goto err;
204 *dest = out->group;
205 break;
206 #ifdef CONFIG_CGROUP_NET_CLASSID
207 case NFT_META_CGROUP:
208 sk = skb_to_full_sk(skb);
209 if (!sk || !sk_fullsock(sk))
210 goto err;
211 *dest = sock_cgroup_classid(&sk->sk_cgrp_data);
212 break;
213 #endif
214 case NFT_META_PRANDOM: {
215 struct rnd_state *state = this_cpu_ptr(&nft_prandom_state);
216 *dest = prandom_u32_state(state);
217 break;
218 }
219 default:
220 WARN_ON(1);
221 goto err;
222 }
223 return;
224
225 err:
226 regs->verdict.code = NFT_BREAK;
227 }
228 EXPORT_SYMBOL_GPL(nft_meta_get_eval);
229
nft_meta_set_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)230 void nft_meta_set_eval(const struct nft_expr *expr,
231 struct nft_regs *regs,
232 const struct nft_pktinfo *pkt)
233 {
234 const struct nft_meta *meta = nft_expr_priv(expr);
235 struct sk_buff *skb = pkt->skb;
236 u32 value = regs->data[meta->sreg];
237
238 switch (meta->key) {
239 case NFT_META_MARK:
240 skb->mark = value;
241 break;
242 case NFT_META_PRIORITY:
243 skb->priority = value;
244 break;
245 case NFT_META_PKTTYPE:
246 if (skb->pkt_type != value &&
247 skb_pkt_type_ok(value) && skb_pkt_type_ok(skb->pkt_type))
248 skb->pkt_type = value;
249 break;
250 case NFT_META_NFTRACE:
251 skb->nf_trace = !!value;
252 break;
253 default:
254 WARN_ON(1);
255 }
256 }
257 EXPORT_SYMBOL_GPL(nft_meta_set_eval);
258
259 const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = {
260 [NFTA_META_DREG] = { .type = NLA_U32 },
261 [NFTA_META_KEY] = { .type = NLA_U32 },
262 [NFTA_META_SREG] = { .type = NLA_U32 },
263 };
264 EXPORT_SYMBOL_GPL(nft_meta_policy);
265
nft_meta_get_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])266 int nft_meta_get_init(const struct nft_ctx *ctx,
267 const struct nft_expr *expr,
268 const struct nlattr * const tb[])
269 {
270 struct nft_meta *priv = nft_expr_priv(expr);
271 unsigned int len;
272
273 priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
274 switch (priv->key) {
275 case NFT_META_PROTOCOL:
276 case NFT_META_IIFTYPE:
277 case NFT_META_OIFTYPE:
278 len = sizeof(u16);
279 break;
280 case NFT_META_NFPROTO:
281 case NFT_META_L4PROTO:
282 case NFT_META_LEN:
283 case NFT_META_PRIORITY:
284 case NFT_META_MARK:
285 case NFT_META_IIF:
286 case NFT_META_OIF:
287 case NFT_META_SKUID:
288 case NFT_META_SKGID:
289 #ifdef CONFIG_IP_ROUTE_CLASSID
290 case NFT_META_RTCLASSID:
291 #endif
292 #ifdef CONFIG_NETWORK_SECMARK
293 case NFT_META_SECMARK:
294 #endif
295 case NFT_META_PKTTYPE:
296 case NFT_META_CPU:
297 case NFT_META_IIFGROUP:
298 case NFT_META_OIFGROUP:
299 #ifdef CONFIG_CGROUP_NET_CLASSID
300 case NFT_META_CGROUP:
301 #endif
302 len = sizeof(u32);
303 break;
304 case NFT_META_IIFNAME:
305 case NFT_META_OIFNAME:
306 len = IFNAMSIZ;
307 break;
308 case NFT_META_PRANDOM:
309 prandom_init_once(&nft_prandom_state);
310 len = sizeof(u32);
311 break;
312 default:
313 return -EOPNOTSUPP;
314 }
315
316 priv->dreg = nft_parse_register(tb[NFTA_META_DREG]);
317 return nft_validate_register_store(ctx, priv->dreg, NULL,
318 NFT_DATA_VALUE, len);
319 }
320 EXPORT_SYMBOL_GPL(nft_meta_get_init);
321
nft_meta_set_validate(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nft_data ** data)322 int nft_meta_set_validate(const struct nft_ctx *ctx,
323 const struct nft_expr *expr,
324 const struct nft_data **data)
325 {
326 struct nft_meta *priv = nft_expr_priv(expr);
327 unsigned int hooks;
328
329 if (priv->key != NFT_META_PKTTYPE)
330 return 0;
331
332 switch (ctx->afi->family) {
333 case NFPROTO_BRIDGE:
334 hooks = 1 << NF_BR_PRE_ROUTING;
335 break;
336 case NFPROTO_NETDEV:
337 hooks = 1 << NF_NETDEV_INGRESS;
338 break;
339 default:
340 return -EOPNOTSUPP;
341 }
342
343 return nft_chain_validate_hooks(ctx->chain, hooks);
344 }
345 EXPORT_SYMBOL_GPL(nft_meta_set_validate);
346
nft_meta_set_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])347 int nft_meta_set_init(const struct nft_ctx *ctx,
348 const struct nft_expr *expr,
349 const struct nlattr * const tb[])
350 {
351 struct nft_meta *priv = nft_expr_priv(expr);
352 unsigned int len;
353 int err;
354
355 priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
356 switch (priv->key) {
357 case NFT_META_MARK:
358 case NFT_META_PRIORITY:
359 len = sizeof(u32);
360 break;
361 case NFT_META_NFTRACE:
362 len = sizeof(u8);
363 break;
364 case NFT_META_PKTTYPE:
365 len = sizeof(u8);
366 break;
367 default:
368 return -EOPNOTSUPP;
369 }
370
371 err = nft_meta_set_validate(ctx, expr, NULL);
372 if (err < 0)
373 return err;
374
375 priv->sreg = nft_parse_register(tb[NFTA_META_SREG]);
376 err = nft_validate_register_load(priv->sreg, len);
377 if (err < 0)
378 return err;
379
380 if (priv->key == NFT_META_NFTRACE)
381 static_branch_inc(&nft_trace_enabled);
382
383 return 0;
384 }
385 EXPORT_SYMBOL_GPL(nft_meta_set_init);
386
nft_meta_get_dump(struct sk_buff * skb,const struct nft_expr * expr)387 int nft_meta_get_dump(struct sk_buff *skb,
388 const struct nft_expr *expr)
389 {
390 const struct nft_meta *priv = nft_expr_priv(expr);
391
392 if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key)))
393 goto nla_put_failure;
394 if (nft_dump_register(skb, NFTA_META_DREG, priv->dreg))
395 goto nla_put_failure;
396 return 0;
397
398 nla_put_failure:
399 return -1;
400 }
401 EXPORT_SYMBOL_GPL(nft_meta_get_dump);
402
nft_meta_set_dump(struct sk_buff * skb,const struct nft_expr * expr)403 int nft_meta_set_dump(struct sk_buff *skb,
404 const struct nft_expr *expr)
405 {
406 const struct nft_meta *priv = nft_expr_priv(expr);
407
408 if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key)))
409 goto nla_put_failure;
410 if (nft_dump_register(skb, NFTA_META_SREG, priv->sreg))
411 goto nla_put_failure;
412
413 return 0;
414
415 nla_put_failure:
416 return -1;
417 }
418 EXPORT_SYMBOL_GPL(nft_meta_set_dump);
419
nft_meta_set_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)420 void nft_meta_set_destroy(const struct nft_ctx *ctx,
421 const struct nft_expr *expr)
422 {
423 const struct nft_meta *priv = nft_expr_priv(expr);
424
425 if (priv->key == NFT_META_NFTRACE)
426 static_branch_dec(&nft_trace_enabled);
427 }
428 EXPORT_SYMBOL_GPL(nft_meta_set_destroy);
429
430 static struct nft_expr_type nft_meta_type;
431 static const struct nft_expr_ops nft_meta_get_ops = {
432 .type = &nft_meta_type,
433 .size = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
434 .eval = nft_meta_get_eval,
435 .init = nft_meta_get_init,
436 .dump = nft_meta_get_dump,
437 };
438
439 static const struct nft_expr_ops nft_meta_set_ops = {
440 .type = &nft_meta_type,
441 .size = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
442 .eval = nft_meta_set_eval,
443 .init = nft_meta_set_init,
444 .destroy = nft_meta_set_destroy,
445 .dump = nft_meta_set_dump,
446 .validate = nft_meta_set_validate,
447 };
448
449 static const struct nft_expr_ops *
nft_meta_select_ops(const struct nft_ctx * ctx,const struct nlattr * const tb[])450 nft_meta_select_ops(const struct nft_ctx *ctx,
451 const struct nlattr * const tb[])
452 {
453 if (tb[NFTA_META_KEY] == NULL)
454 return ERR_PTR(-EINVAL);
455
456 if (tb[NFTA_META_DREG] && tb[NFTA_META_SREG])
457 return ERR_PTR(-EINVAL);
458
459 if (tb[NFTA_META_DREG])
460 return &nft_meta_get_ops;
461
462 if (tb[NFTA_META_SREG])
463 return &nft_meta_set_ops;
464
465 return ERR_PTR(-EINVAL);
466 }
467
468 static struct nft_expr_type nft_meta_type __read_mostly = {
469 .name = "meta",
470 .select_ops = &nft_meta_select_ops,
471 .policy = nft_meta_policy,
472 .maxattr = NFTA_META_MAX,
473 .owner = THIS_MODULE,
474 };
475
nft_meta_module_init(void)476 static int __init nft_meta_module_init(void)
477 {
478 return nft_register_expr(&nft_meta_type);
479 }
480
nft_meta_module_exit(void)481 static void __exit nft_meta_module_exit(void)
482 {
483 nft_unregister_expr(&nft_meta_type);
484 }
485
486 module_init(nft_meta_module_init);
487 module_exit(nft_meta_module_exit);
488
489 MODULE_LICENSE("GPL");
490 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
491 MODULE_ALIAS_NFT_EXPR("meta");
492