1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
4 *
5 * Development of this code funded by Astaro AG (http://www.astaro.com/)
6 */
7
8 #include <asm/unaligned.h>
9 #include <linux/kernel.h>
10 #include <linux/netlink.h>
11 #include <linux/netfilter.h>
12 #include <linux/netfilter/nf_tables.h>
13 #include <net/netfilter/nf_tables_core.h>
14 #include <net/netfilter/nf_tables.h>
15 #include <net/tcp.h>
16
17 struct nft_exthdr {
18 u8 type;
19 u8 offset;
20 u8 len;
21 u8 op;
22 enum nft_registers dreg:8;
23 enum nft_registers sreg:8;
24 u8 flags;
25 };
26
optlen(const u8 * opt,unsigned int offset)27 static unsigned int optlen(const u8 *opt, unsigned int offset)
28 {
29 /* Beware zero-length options: make finite progress */
30 if (opt[offset] <= TCPOPT_NOP || opt[offset + 1] == 0)
31 return 1;
32 else
33 return opt[offset + 1];
34 }
35
nft_exthdr_ipv6_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)36 static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
37 struct nft_regs *regs,
38 const struct nft_pktinfo *pkt)
39 {
40 struct nft_exthdr *priv = nft_expr_priv(expr);
41 u32 *dest = ®s->data[priv->dreg];
42 unsigned int offset = 0;
43 int err;
44
45 err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
46 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
47 *dest = (err >= 0);
48 return;
49 } else if (err < 0) {
50 goto err;
51 }
52 offset += priv->offset;
53
54 dest[priv->len / NFT_REG32_SIZE] = 0;
55 if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
56 goto err;
57 return;
58 err:
59 regs->verdict.code = NFT_BREAK;
60 }
61
62 /* find the offset to specified option.
63 *
64 * If target header is found, its offset is set in *offset and return option
65 * number. Otherwise, return negative error.
66 *
67 * If the first fragment doesn't contain the End of Options it is considered
68 * invalid.
69 */
ipv4_find_option(struct net * net,struct sk_buff * skb,unsigned int * offset,int target)70 static int ipv4_find_option(struct net *net, struct sk_buff *skb,
71 unsigned int *offset, int target)
72 {
73 unsigned char optbuf[sizeof(struct ip_options) + 40];
74 struct ip_options *opt = (struct ip_options *)optbuf;
75 struct iphdr *iph, _iph;
76 unsigned int start;
77 bool found = false;
78 __be32 info;
79 int optlen;
80
81 iph = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
82 if (!iph)
83 return -EBADMSG;
84 start = sizeof(struct iphdr);
85
86 optlen = iph->ihl * 4 - (int)sizeof(struct iphdr);
87 if (optlen <= 0)
88 return -ENOENT;
89
90 memset(opt, 0, sizeof(struct ip_options));
91 /* Copy the options since __ip_options_compile() modifies
92 * the options.
93 */
94 if (skb_copy_bits(skb, start, opt->__data, optlen))
95 return -EBADMSG;
96 opt->optlen = optlen;
97
98 if (__ip_options_compile(net, opt, NULL, &info))
99 return -EBADMSG;
100
101 switch (target) {
102 case IPOPT_SSRR:
103 case IPOPT_LSRR:
104 if (!opt->srr)
105 break;
106 found = target == IPOPT_SSRR ? opt->is_strictroute :
107 !opt->is_strictroute;
108 if (found)
109 *offset = opt->srr + start;
110 break;
111 case IPOPT_RR:
112 if (!opt->rr)
113 break;
114 *offset = opt->rr + start;
115 found = true;
116 break;
117 case IPOPT_RA:
118 if (!opt->router_alert)
119 break;
120 *offset = opt->router_alert + start;
121 found = true;
122 break;
123 default:
124 return -EOPNOTSUPP;
125 }
126 return found ? target : -ENOENT;
127 }
128
nft_exthdr_ipv4_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)129 static void nft_exthdr_ipv4_eval(const struct nft_expr *expr,
130 struct nft_regs *regs,
131 const struct nft_pktinfo *pkt)
132 {
133 struct nft_exthdr *priv = nft_expr_priv(expr);
134 u32 *dest = ®s->data[priv->dreg];
135 struct sk_buff *skb = pkt->skb;
136 unsigned int offset;
137 int err;
138
139 if (skb->protocol != htons(ETH_P_IP))
140 goto err;
141
142 err = ipv4_find_option(nft_net(pkt), skb, &offset, priv->type);
143 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
144 *dest = (err >= 0);
145 return;
146 } else if (err < 0) {
147 goto err;
148 }
149 offset += priv->offset;
150
151 dest[priv->len / NFT_REG32_SIZE] = 0;
152 if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
153 goto err;
154 return;
155 err:
156 regs->verdict.code = NFT_BREAK;
157 }
158
159 static void *
nft_tcp_header_pointer(const struct nft_pktinfo * pkt,unsigned int len,void * buffer,unsigned int * tcphdr_len)160 nft_tcp_header_pointer(const struct nft_pktinfo *pkt,
161 unsigned int len, void *buffer, unsigned int *tcphdr_len)
162 {
163 struct tcphdr *tcph;
164
165 if (!pkt->tprot_set || pkt->tprot != IPPROTO_TCP)
166 return NULL;
167
168 tcph = skb_header_pointer(pkt->skb, pkt->xt.thoff, sizeof(*tcph), buffer);
169 if (!tcph)
170 return NULL;
171
172 *tcphdr_len = __tcp_hdrlen(tcph);
173 if (*tcphdr_len < sizeof(*tcph) || *tcphdr_len > len)
174 return NULL;
175
176 return skb_header_pointer(pkt->skb, pkt->xt.thoff, *tcphdr_len, buffer);
177 }
178
nft_exthdr_tcp_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)179 static void nft_exthdr_tcp_eval(const struct nft_expr *expr,
180 struct nft_regs *regs,
181 const struct nft_pktinfo *pkt)
182 {
183 u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
184 struct nft_exthdr *priv = nft_expr_priv(expr);
185 unsigned int i, optl, tcphdr_len, offset;
186 u32 *dest = ®s->data[priv->dreg];
187 struct tcphdr *tcph;
188 u8 *opt;
189
190 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
191 if (!tcph)
192 goto err;
193
194 opt = (u8 *)tcph;
195 for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
196 optl = optlen(opt, i);
197
198 if (priv->type != opt[i])
199 continue;
200
201 if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
202 goto err;
203
204 offset = i + priv->offset;
205 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
206 *dest = 1;
207 } else {
208 dest[priv->len / NFT_REG32_SIZE] = 0;
209 memcpy(dest, opt + offset, priv->len);
210 }
211
212 return;
213 }
214
215 err:
216 if (priv->flags & NFT_EXTHDR_F_PRESENT)
217 *dest = 0;
218 else
219 regs->verdict.code = NFT_BREAK;
220 }
221
nft_exthdr_tcp_set_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)222 static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr,
223 struct nft_regs *regs,
224 const struct nft_pktinfo *pkt)
225 {
226 u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
227 struct nft_exthdr *priv = nft_expr_priv(expr);
228 unsigned int i, optl, tcphdr_len, offset;
229 struct tcphdr *tcph;
230 u8 *opt;
231 u32 src;
232
233 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
234 if (!tcph)
235 return;
236
237 opt = (u8 *)tcph;
238 for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
239 union {
240 u8 octet;
241 __be16 v16;
242 __be32 v32;
243 } old, new;
244
245 optl = optlen(opt, i);
246
247 if (priv->type != opt[i])
248 continue;
249
250 if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
251 return;
252
253 if (skb_ensure_writable(pkt->skb,
254 pkt->xt.thoff + i + priv->len))
255 return;
256
257 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff,
258 &tcphdr_len);
259 if (!tcph)
260 return;
261
262 src = regs->data[priv->sreg];
263 offset = i + priv->offset;
264
265 switch (priv->len) {
266 case 2:
267 old.v16 = get_unaligned((u16 *)(opt + offset));
268 new.v16 = src;
269
270 switch (priv->type) {
271 case TCPOPT_MSS:
272 /* increase can cause connection to stall */
273 if (ntohs(old.v16) <= ntohs(new.v16))
274 return;
275 break;
276 }
277
278 if (old.v16 == new.v16)
279 return;
280
281 put_unaligned(new.v16, (u16*)(opt + offset));
282 inet_proto_csum_replace2(&tcph->check, pkt->skb,
283 old.v16, new.v16, false);
284 break;
285 case 4:
286 new.v32 = src;
287 old.v32 = get_unaligned((u32 *)(opt + offset));
288
289 if (old.v32 == new.v32)
290 return;
291
292 put_unaligned(new.v32, (u32*)(opt + offset));
293 inet_proto_csum_replace4(&tcph->check, pkt->skb,
294 old.v32, new.v32, false);
295 break;
296 default:
297 WARN_ON_ONCE(1);
298 break;
299 }
300
301 return;
302 }
303 }
304
305 static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = {
306 [NFTA_EXTHDR_DREG] = { .type = NLA_U32 },
307 [NFTA_EXTHDR_TYPE] = { .type = NLA_U8 },
308 [NFTA_EXTHDR_OFFSET] = { .type = NLA_U32 },
309 [NFTA_EXTHDR_LEN] = { .type = NLA_U32 },
310 [NFTA_EXTHDR_FLAGS] = { .type = NLA_U32 },
311 [NFTA_EXTHDR_OP] = { .type = NLA_U32 },
312 [NFTA_EXTHDR_SREG] = { .type = NLA_U32 },
313 };
314
nft_exthdr_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])315 static int nft_exthdr_init(const struct nft_ctx *ctx,
316 const struct nft_expr *expr,
317 const struct nlattr * const tb[])
318 {
319 struct nft_exthdr *priv = nft_expr_priv(expr);
320 u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
321 int err;
322
323 if (!tb[NFTA_EXTHDR_DREG] ||
324 !tb[NFTA_EXTHDR_TYPE] ||
325 !tb[NFTA_EXTHDR_OFFSET] ||
326 !tb[NFTA_EXTHDR_LEN])
327 return -EINVAL;
328
329 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
330 if (err < 0)
331 return err;
332
333 err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
334 if (err < 0)
335 return err;
336
337 if (tb[NFTA_EXTHDR_FLAGS]) {
338 err = nft_parse_u32_check(tb[NFTA_EXTHDR_FLAGS], U8_MAX, &flags);
339 if (err < 0)
340 return err;
341
342 if (flags & ~NFT_EXTHDR_F_PRESENT)
343 return -EINVAL;
344 }
345
346 if (tb[NFTA_EXTHDR_OP]) {
347 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
348 if (err < 0)
349 return err;
350 }
351
352 priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
353 priv->offset = offset;
354 priv->len = len;
355 priv->dreg = nft_parse_register(tb[NFTA_EXTHDR_DREG]);
356 priv->flags = flags;
357 priv->op = op;
358
359 return nft_validate_register_store(ctx, priv->dreg, NULL,
360 NFT_DATA_VALUE, priv->len);
361 }
362
nft_exthdr_tcp_set_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])363 static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx,
364 const struct nft_expr *expr,
365 const struct nlattr * const tb[])
366 {
367 struct nft_exthdr *priv = nft_expr_priv(expr);
368 u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
369 int err;
370
371 if (!tb[NFTA_EXTHDR_SREG] ||
372 !tb[NFTA_EXTHDR_TYPE] ||
373 !tb[NFTA_EXTHDR_OFFSET] ||
374 !tb[NFTA_EXTHDR_LEN])
375 return -EINVAL;
376
377 if (tb[NFTA_EXTHDR_DREG] || tb[NFTA_EXTHDR_FLAGS])
378 return -EINVAL;
379
380 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
381 if (err < 0)
382 return err;
383
384 err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
385 if (err < 0)
386 return err;
387
388 if (offset < 2)
389 return -EOPNOTSUPP;
390
391 switch (len) {
392 case 2: break;
393 case 4: break;
394 default:
395 return -EOPNOTSUPP;
396 }
397
398 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
399 if (err < 0)
400 return err;
401
402 priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
403 priv->offset = offset;
404 priv->len = len;
405 priv->sreg = nft_parse_register(tb[NFTA_EXTHDR_SREG]);
406 priv->flags = flags;
407 priv->op = op;
408
409 return nft_validate_register_load(priv->sreg, priv->len);
410 }
411
nft_exthdr_ipv4_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])412 static int nft_exthdr_ipv4_init(const struct nft_ctx *ctx,
413 const struct nft_expr *expr,
414 const struct nlattr * const tb[])
415 {
416 struct nft_exthdr *priv = nft_expr_priv(expr);
417 int err = nft_exthdr_init(ctx, expr, tb);
418
419 if (err < 0)
420 return err;
421
422 switch (priv->type) {
423 case IPOPT_SSRR:
424 case IPOPT_LSRR:
425 case IPOPT_RR:
426 case IPOPT_RA:
427 break;
428 default:
429 return -EOPNOTSUPP;
430 }
431 return 0;
432 }
433
nft_exthdr_dump_common(struct sk_buff * skb,const struct nft_exthdr * priv)434 static int nft_exthdr_dump_common(struct sk_buff *skb, const struct nft_exthdr *priv)
435 {
436 if (nla_put_u8(skb, NFTA_EXTHDR_TYPE, priv->type))
437 goto nla_put_failure;
438 if (nla_put_be32(skb, NFTA_EXTHDR_OFFSET, htonl(priv->offset)))
439 goto nla_put_failure;
440 if (nla_put_be32(skb, NFTA_EXTHDR_LEN, htonl(priv->len)))
441 goto nla_put_failure;
442 if (nla_put_be32(skb, NFTA_EXTHDR_FLAGS, htonl(priv->flags)))
443 goto nla_put_failure;
444 if (nla_put_be32(skb, NFTA_EXTHDR_OP, htonl(priv->op)))
445 goto nla_put_failure;
446 return 0;
447
448 nla_put_failure:
449 return -1;
450 }
451
nft_exthdr_dump(struct sk_buff * skb,const struct nft_expr * expr)452 static int nft_exthdr_dump(struct sk_buff *skb, const struct nft_expr *expr)
453 {
454 const struct nft_exthdr *priv = nft_expr_priv(expr);
455
456 if (nft_dump_register(skb, NFTA_EXTHDR_DREG, priv->dreg))
457 return -1;
458
459 return nft_exthdr_dump_common(skb, priv);
460 }
461
nft_exthdr_dump_set(struct sk_buff * skb,const struct nft_expr * expr)462 static int nft_exthdr_dump_set(struct sk_buff *skb, const struct nft_expr *expr)
463 {
464 const struct nft_exthdr *priv = nft_expr_priv(expr);
465
466 if (nft_dump_register(skb, NFTA_EXTHDR_SREG, priv->sreg))
467 return -1;
468
469 return nft_exthdr_dump_common(skb, priv);
470 }
471
472 static const struct nft_expr_ops nft_exthdr_ipv6_ops = {
473 .type = &nft_exthdr_type,
474 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
475 .eval = nft_exthdr_ipv6_eval,
476 .init = nft_exthdr_init,
477 .dump = nft_exthdr_dump,
478 };
479
480 static const struct nft_expr_ops nft_exthdr_ipv4_ops = {
481 .type = &nft_exthdr_type,
482 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
483 .eval = nft_exthdr_ipv4_eval,
484 .init = nft_exthdr_ipv4_init,
485 .dump = nft_exthdr_dump,
486 };
487
488 static const struct nft_expr_ops nft_exthdr_tcp_ops = {
489 .type = &nft_exthdr_type,
490 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
491 .eval = nft_exthdr_tcp_eval,
492 .init = nft_exthdr_init,
493 .dump = nft_exthdr_dump,
494 };
495
496 static const struct nft_expr_ops nft_exthdr_tcp_set_ops = {
497 .type = &nft_exthdr_type,
498 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
499 .eval = nft_exthdr_tcp_set_eval,
500 .init = nft_exthdr_tcp_set_init,
501 .dump = nft_exthdr_dump_set,
502 };
503
504 static const struct nft_expr_ops *
nft_exthdr_select_ops(const struct nft_ctx * ctx,const struct nlattr * const tb[])505 nft_exthdr_select_ops(const struct nft_ctx *ctx,
506 const struct nlattr * const tb[])
507 {
508 u32 op;
509
510 if (!tb[NFTA_EXTHDR_OP])
511 return &nft_exthdr_ipv6_ops;
512
513 if (tb[NFTA_EXTHDR_SREG] && tb[NFTA_EXTHDR_DREG])
514 return ERR_PTR(-EOPNOTSUPP);
515
516 op = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OP]));
517 switch (op) {
518 case NFT_EXTHDR_OP_TCPOPT:
519 if (tb[NFTA_EXTHDR_SREG])
520 return &nft_exthdr_tcp_set_ops;
521 if (tb[NFTA_EXTHDR_DREG])
522 return &nft_exthdr_tcp_ops;
523 break;
524 case NFT_EXTHDR_OP_IPV6:
525 if (tb[NFTA_EXTHDR_DREG])
526 return &nft_exthdr_ipv6_ops;
527 break;
528 case NFT_EXTHDR_OP_IPV4:
529 if (ctx->family != NFPROTO_IPV6) {
530 if (tb[NFTA_EXTHDR_DREG])
531 return &nft_exthdr_ipv4_ops;
532 }
533 break;
534 }
535
536 return ERR_PTR(-EOPNOTSUPP);
537 }
538
539 struct nft_expr_type nft_exthdr_type __read_mostly = {
540 .name = "exthdr",
541 .select_ops = nft_exthdr_select_ops,
542 .policy = nft_exthdr_policy,
543 .maxattr = NFTA_EXTHDR_MAX,
544 .owner = THIS_MODULE,
545 };
546