1 /* SPDX-License-Identifier: GPL-2.0 */
2 #include <linux/kernel.h>
3 #include <linux/init.h>
4 #include <linux/module.h>
5 #include <linux/seqlock.h>
6 #include <linux/netlink.h>
7 #include <linux/netfilter.h>
8 #include <linux/netfilter/nf_tables.h>
9 #include <net/netfilter/nf_tables.h>
10 #include <net/dst_metadata.h>
11 #include <net/ip_tunnels.h>
12 #include <net/vxlan.h>
13 #include <net/erspan.h>
14
15 struct nft_tunnel {
16 enum nft_tunnel_keys key:8;
17 u8 dreg;
18 enum nft_tunnel_mode mode:8;
19 };
20
nft_tunnel_get_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)21 static void nft_tunnel_get_eval(const struct nft_expr *expr,
22 struct nft_regs *regs,
23 const struct nft_pktinfo *pkt)
24 {
25 const struct nft_tunnel *priv = nft_expr_priv(expr);
26 u32 *dest = ®s->data[priv->dreg];
27 struct ip_tunnel_info *tun_info;
28
29 tun_info = skb_tunnel_info(pkt->skb);
30
31 switch (priv->key) {
32 case NFT_TUNNEL_PATH:
33 if (!tun_info) {
34 nft_reg_store8(dest, false);
35 return;
36 }
37 if (priv->mode == NFT_TUNNEL_MODE_NONE ||
38 (priv->mode == NFT_TUNNEL_MODE_RX &&
39 !(tun_info->mode & IP_TUNNEL_INFO_TX)) ||
40 (priv->mode == NFT_TUNNEL_MODE_TX &&
41 (tun_info->mode & IP_TUNNEL_INFO_TX)))
42 nft_reg_store8(dest, true);
43 else
44 nft_reg_store8(dest, false);
45 break;
46 case NFT_TUNNEL_ID:
47 if (!tun_info) {
48 regs->verdict.code = NFT_BREAK;
49 return;
50 }
51 if (priv->mode == NFT_TUNNEL_MODE_NONE ||
52 (priv->mode == NFT_TUNNEL_MODE_RX &&
53 !(tun_info->mode & IP_TUNNEL_INFO_TX)) ||
54 (priv->mode == NFT_TUNNEL_MODE_TX &&
55 (tun_info->mode & IP_TUNNEL_INFO_TX)))
56 *dest = ntohl(tunnel_id_to_key32(tun_info->key.tun_id));
57 else
58 regs->verdict.code = NFT_BREAK;
59 break;
60 default:
61 WARN_ON(1);
62 regs->verdict.code = NFT_BREAK;
63 }
64 }
65
66 static const struct nla_policy nft_tunnel_policy[NFTA_TUNNEL_MAX + 1] = {
67 [NFTA_TUNNEL_KEY] = { .type = NLA_U32 },
68 [NFTA_TUNNEL_DREG] = { .type = NLA_U32 },
69 [NFTA_TUNNEL_MODE] = { .type = NLA_U32 },
70 };
71
nft_tunnel_get_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])72 static int nft_tunnel_get_init(const struct nft_ctx *ctx,
73 const struct nft_expr *expr,
74 const struct nlattr * const tb[])
75 {
76 struct nft_tunnel *priv = nft_expr_priv(expr);
77 u32 len;
78
79 if (!tb[NFTA_TUNNEL_KEY] ||
80 !tb[NFTA_TUNNEL_DREG])
81 return -EINVAL;
82
83 priv->key = ntohl(nla_get_be32(tb[NFTA_TUNNEL_KEY]));
84 switch (priv->key) {
85 case NFT_TUNNEL_PATH:
86 len = sizeof(u8);
87 break;
88 case NFT_TUNNEL_ID:
89 len = sizeof(u32);
90 break;
91 default:
92 return -EOPNOTSUPP;
93 }
94
95 if (tb[NFTA_TUNNEL_MODE]) {
96 priv->mode = ntohl(nla_get_be32(tb[NFTA_TUNNEL_MODE]));
97 if (priv->mode > NFT_TUNNEL_MODE_MAX)
98 return -EOPNOTSUPP;
99 } else {
100 priv->mode = NFT_TUNNEL_MODE_NONE;
101 }
102
103 return nft_parse_register_store(ctx, tb[NFTA_TUNNEL_DREG], &priv->dreg,
104 NULL, NFT_DATA_VALUE, len);
105 }
106
nft_tunnel_get_dump(struct sk_buff * skb,const struct nft_expr * expr)107 static int nft_tunnel_get_dump(struct sk_buff *skb,
108 const struct nft_expr *expr)
109 {
110 const struct nft_tunnel *priv = nft_expr_priv(expr);
111
112 if (nla_put_be32(skb, NFTA_TUNNEL_KEY, htonl(priv->key)))
113 goto nla_put_failure;
114 if (nft_dump_register(skb, NFTA_TUNNEL_DREG, priv->dreg))
115 goto nla_put_failure;
116 if (nla_put_be32(skb, NFTA_TUNNEL_MODE, htonl(priv->mode)))
117 goto nla_put_failure;
118 return 0;
119
120 nla_put_failure:
121 return -1;
122 }
123
124 static struct nft_expr_type nft_tunnel_type;
125 static const struct nft_expr_ops nft_tunnel_get_ops = {
126 .type = &nft_tunnel_type,
127 .size = NFT_EXPR_SIZE(sizeof(struct nft_tunnel)),
128 .eval = nft_tunnel_get_eval,
129 .init = nft_tunnel_get_init,
130 .dump = nft_tunnel_get_dump,
131 };
132
133 static struct nft_expr_type nft_tunnel_type __read_mostly = {
134 .name = "tunnel",
135 .family = NFPROTO_NETDEV,
136 .ops = &nft_tunnel_get_ops,
137 .policy = nft_tunnel_policy,
138 .maxattr = NFTA_TUNNEL_MAX,
139 .owner = THIS_MODULE,
140 };
141
142 struct nft_tunnel_opts {
143 union {
144 struct vxlan_metadata vxlan;
145 struct erspan_metadata erspan;
146 } u;
147 u32 len;
148 __be16 flags;
149 };
150
151 struct nft_tunnel_obj {
152 struct metadata_dst *md;
153 struct nft_tunnel_opts opts;
154 };
155
156 static const struct nla_policy nft_tunnel_ip_policy[NFTA_TUNNEL_KEY_IP_MAX + 1] = {
157 [NFTA_TUNNEL_KEY_IP_SRC] = { .type = NLA_U32 },
158 [NFTA_TUNNEL_KEY_IP_DST] = { .type = NLA_U32 },
159 };
160
nft_tunnel_obj_ip_init(const struct nft_ctx * ctx,const struct nlattr * attr,struct ip_tunnel_info * info)161 static int nft_tunnel_obj_ip_init(const struct nft_ctx *ctx,
162 const struct nlattr *attr,
163 struct ip_tunnel_info *info)
164 {
165 struct nlattr *tb[NFTA_TUNNEL_KEY_IP_MAX + 1];
166 int err;
167
168 err = nla_parse_nested_deprecated(tb, NFTA_TUNNEL_KEY_IP_MAX, attr,
169 nft_tunnel_ip_policy, NULL);
170 if (err < 0)
171 return err;
172
173 if (!tb[NFTA_TUNNEL_KEY_IP_DST])
174 return -EINVAL;
175
176 if (tb[NFTA_TUNNEL_KEY_IP_SRC])
177 info->key.u.ipv4.src = nla_get_be32(tb[NFTA_TUNNEL_KEY_IP_SRC]);
178 if (tb[NFTA_TUNNEL_KEY_IP_DST])
179 info->key.u.ipv4.dst = nla_get_be32(tb[NFTA_TUNNEL_KEY_IP_DST]);
180
181 return 0;
182 }
183
184 static const struct nla_policy nft_tunnel_ip6_policy[NFTA_TUNNEL_KEY_IP6_MAX + 1] = {
185 [NFTA_TUNNEL_KEY_IP6_SRC] = { .len = sizeof(struct in6_addr), },
186 [NFTA_TUNNEL_KEY_IP6_DST] = { .len = sizeof(struct in6_addr), },
187 [NFTA_TUNNEL_KEY_IP6_FLOWLABEL] = { .type = NLA_U32, }
188 };
189
nft_tunnel_obj_ip6_init(const struct nft_ctx * ctx,const struct nlattr * attr,struct ip_tunnel_info * info)190 static int nft_tunnel_obj_ip6_init(const struct nft_ctx *ctx,
191 const struct nlattr *attr,
192 struct ip_tunnel_info *info)
193 {
194 struct nlattr *tb[NFTA_TUNNEL_KEY_IP6_MAX + 1];
195 int err;
196
197 err = nla_parse_nested_deprecated(tb, NFTA_TUNNEL_KEY_IP6_MAX, attr,
198 nft_tunnel_ip6_policy, NULL);
199 if (err < 0)
200 return err;
201
202 if (!tb[NFTA_TUNNEL_KEY_IP6_DST])
203 return -EINVAL;
204
205 if (tb[NFTA_TUNNEL_KEY_IP6_SRC]) {
206 memcpy(&info->key.u.ipv6.src,
207 nla_data(tb[NFTA_TUNNEL_KEY_IP6_SRC]),
208 sizeof(struct in6_addr));
209 }
210 if (tb[NFTA_TUNNEL_KEY_IP6_DST]) {
211 memcpy(&info->key.u.ipv6.dst,
212 nla_data(tb[NFTA_TUNNEL_KEY_IP6_DST]),
213 sizeof(struct in6_addr));
214 }
215 if (tb[NFTA_TUNNEL_KEY_IP6_FLOWLABEL])
216 info->key.label = nla_get_be32(tb[NFTA_TUNNEL_KEY_IP6_FLOWLABEL]);
217
218 info->mode |= IP_TUNNEL_INFO_IPV6;
219
220 return 0;
221 }
222
223 static const struct nla_policy nft_tunnel_opts_vxlan_policy[NFTA_TUNNEL_KEY_VXLAN_MAX + 1] = {
224 [NFTA_TUNNEL_KEY_VXLAN_GBP] = { .type = NLA_U32 },
225 };
226
nft_tunnel_obj_vxlan_init(const struct nlattr * attr,struct nft_tunnel_opts * opts)227 static int nft_tunnel_obj_vxlan_init(const struct nlattr *attr,
228 struct nft_tunnel_opts *opts)
229 {
230 struct nlattr *tb[NFTA_TUNNEL_KEY_VXLAN_MAX + 1];
231 int err;
232
233 err = nla_parse_nested_deprecated(tb, NFTA_TUNNEL_KEY_VXLAN_MAX, attr,
234 nft_tunnel_opts_vxlan_policy, NULL);
235 if (err < 0)
236 return err;
237
238 if (!tb[NFTA_TUNNEL_KEY_VXLAN_GBP])
239 return -EINVAL;
240
241 opts->u.vxlan.gbp = ntohl(nla_get_be32(tb[NFTA_TUNNEL_KEY_VXLAN_GBP]));
242
243 opts->len = sizeof(struct vxlan_metadata);
244 opts->flags = TUNNEL_VXLAN_OPT;
245
246 return 0;
247 }
248
249 static const struct nla_policy nft_tunnel_opts_erspan_policy[NFTA_TUNNEL_KEY_ERSPAN_MAX + 1] = {
250 [NFTA_TUNNEL_KEY_ERSPAN_VERSION] = { .type = NLA_U32 },
251 [NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX] = { .type = NLA_U32 },
252 [NFTA_TUNNEL_KEY_ERSPAN_V2_DIR] = { .type = NLA_U8 },
253 [NFTA_TUNNEL_KEY_ERSPAN_V2_HWID] = { .type = NLA_U8 },
254 };
255
nft_tunnel_obj_erspan_init(const struct nlattr * attr,struct nft_tunnel_opts * opts)256 static int nft_tunnel_obj_erspan_init(const struct nlattr *attr,
257 struct nft_tunnel_opts *opts)
258 {
259 struct nlattr *tb[NFTA_TUNNEL_KEY_ERSPAN_MAX + 1];
260 uint8_t hwid, dir;
261 int err, version;
262
263 err = nla_parse_nested_deprecated(tb, NFTA_TUNNEL_KEY_ERSPAN_MAX,
264 attr, nft_tunnel_opts_erspan_policy,
265 NULL);
266 if (err < 0)
267 return err;
268
269 if (!tb[NFTA_TUNNEL_KEY_ERSPAN_VERSION])
270 return -EINVAL;
271
272 version = ntohl(nla_get_be32(tb[NFTA_TUNNEL_KEY_ERSPAN_VERSION]));
273 switch (version) {
274 case ERSPAN_VERSION:
275 if (!tb[NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX])
276 return -EINVAL;
277
278 opts->u.erspan.u.index =
279 nla_get_be32(tb[NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX]);
280 break;
281 case ERSPAN_VERSION2:
282 if (!tb[NFTA_TUNNEL_KEY_ERSPAN_V2_DIR] ||
283 !tb[NFTA_TUNNEL_KEY_ERSPAN_V2_HWID])
284 return -EINVAL;
285
286 hwid = nla_get_u8(tb[NFTA_TUNNEL_KEY_ERSPAN_V2_HWID]);
287 dir = nla_get_u8(tb[NFTA_TUNNEL_KEY_ERSPAN_V2_DIR]);
288
289 set_hwid(&opts->u.erspan.u.md2, hwid);
290 opts->u.erspan.u.md2.dir = dir;
291 break;
292 default:
293 return -EOPNOTSUPP;
294 }
295 opts->u.erspan.version = version;
296
297 opts->len = sizeof(struct erspan_metadata);
298 opts->flags = TUNNEL_ERSPAN_OPT;
299
300 return 0;
301 }
302
303 static const struct nla_policy nft_tunnel_opts_policy[NFTA_TUNNEL_KEY_OPTS_MAX + 1] = {
304 [NFTA_TUNNEL_KEY_OPTS_VXLAN] = { .type = NLA_NESTED, },
305 [NFTA_TUNNEL_KEY_OPTS_ERSPAN] = { .type = NLA_NESTED, },
306 };
307
nft_tunnel_obj_opts_init(const struct nft_ctx * ctx,const struct nlattr * attr,struct ip_tunnel_info * info,struct nft_tunnel_opts * opts)308 static int nft_tunnel_obj_opts_init(const struct nft_ctx *ctx,
309 const struct nlattr *attr,
310 struct ip_tunnel_info *info,
311 struct nft_tunnel_opts *opts)
312 {
313 struct nlattr *tb[NFTA_TUNNEL_KEY_OPTS_MAX + 1];
314 int err;
315
316 err = nla_parse_nested_deprecated(tb, NFTA_TUNNEL_KEY_OPTS_MAX, attr,
317 nft_tunnel_opts_policy, NULL);
318 if (err < 0)
319 return err;
320
321 if (tb[NFTA_TUNNEL_KEY_OPTS_VXLAN]) {
322 err = nft_tunnel_obj_vxlan_init(tb[NFTA_TUNNEL_KEY_OPTS_VXLAN],
323 opts);
324 } else if (tb[NFTA_TUNNEL_KEY_OPTS_ERSPAN]) {
325 err = nft_tunnel_obj_erspan_init(tb[NFTA_TUNNEL_KEY_OPTS_ERSPAN],
326 opts);
327 } else {
328 return -EOPNOTSUPP;
329 }
330
331 return err;
332 }
333
334 static const struct nla_policy nft_tunnel_key_policy[NFTA_TUNNEL_KEY_MAX + 1] = {
335 [NFTA_TUNNEL_KEY_IP] = { .type = NLA_NESTED, },
336 [NFTA_TUNNEL_KEY_IP6] = { .type = NLA_NESTED, },
337 [NFTA_TUNNEL_KEY_ID] = { .type = NLA_U32, },
338 [NFTA_TUNNEL_KEY_FLAGS] = { .type = NLA_U32, },
339 [NFTA_TUNNEL_KEY_TOS] = { .type = NLA_U8, },
340 [NFTA_TUNNEL_KEY_TTL] = { .type = NLA_U8, },
341 [NFTA_TUNNEL_KEY_SPORT] = { .type = NLA_U16, },
342 [NFTA_TUNNEL_KEY_DPORT] = { .type = NLA_U16, },
343 [NFTA_TUNNEL_KEY_OPTS] = { .type = NLA_NESTED, },
344 };
345
nft_tunnel_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)346 static int nft_tunnel_obj_init(const struct nft_ctx *ctx,
347 const struct nlattr * const tb[],
348 struct nft_object *obj)
349 {
350 struct nft_tunnel_obj *priv = nft_obj_data(obj);
351 struct ip_tunnel_info info;
352 struct metadata_dst *md;
353 int err;
354
355 if (!tb[NFTA_TUNNEL_KEY_ID])
356 return -EINVAL;
357
358 memset(&info, 0, sizeof(info));
359 info.mode = IP_TUNNEL_INFO_TX;
360 info.key.tun_id = key32_to_tunnel_id(nla_get_be32(tb[NFTA_TUNNEL_KEY_ID]));
361 info.key.tun_flags = TUNNEL_KEY | TUNNEL_CSUM | TUNNEL_NOCACHE;
362
363 if (tb[NFTA_TUNNEL_KEY_IP]) {
364 err = nft_tunnel_obj_ip_init(ctx, tb[NFTA_TUNNEL_KEY_IP], &info);
365 if (err < 0)
366 return err;
367 } else if (tb[NFTA_TUNNEL_KEY_IP6]) {
368 err = nft_tunnel_obj_ip6_init(ctx, tb[NFTA_TUNNEL_KEY_IP6], &info);
369 if (err < 0)
370 return err;
371 } else {
372 return -EINVAL;
373 }
374
375 if (tb[NFTA_TUNNEL_KEY_SPORT]) {
376 info.key.tp_src = nla_get_be16(tb[NFTA_TUNNEL_KEY_SPORT]);
377 }
378 if (tb[NFTA_TUNNEL_KEY_DPORT]) {
379 info.key.tp_dst = nla_get_be16(tb[NFTA_TUNNEL_KEY_DPORT]);
380 }
381
382 if (tb[NFTA_TUNNEL_KEY_FLAGS]) {
383 u32 tun_flags;
384
385 tun_flags = ntohl(nla_get_be32(tb[NFTA_TUNNEL_KEY_FLAGS]));
386 if (tun_flags & ~NFT_TUNNEL_F_MASK)
387 return -EOPNOTSUPP;
388
389 if (tun_flags & NFT_TUNNEL_F_ZERO_CSUM_TX)
390 info.key.tun_flags &= ~TUNNEL_CSUM;
391 if (tun_flags & NFT_TUNNEL_F_DONT_FRAGMENT)
392 info.key.tun_flags |= TUNNEL_DONT_FRAGMENT;
393 if (tun_flags & NFT_TUNNEL_F_SEQ_NUMBER)
394 info.key.tun_flags |= TUNNEL_SEQ;
395 }
396 if (tb[NFTA_TUNNEL_KEY_TOS])
397 info.key.tos = nla_get_u8(tb[NFTA_TUNNEL_KEY_TOS]);
398 if (tb[NFTA_TUNNEL_KEY_TTL])
399 info.key.ttl = nla_get_u8(tb[NFTA_TUNNEL_KEY_TTL]);
400 else
401 info.key.ttl = U8_MAX;
402
403 if (tb[NFTA_TUNNEL_KEY_OPTS]) {
404 err = nft_tunnel_obj_opts_init(ctx, tb[NFTA_TUNNEL_KEY_OPTS],
405 &info, &priv->opts);
406 if (err < 0)
407 return err;
408 }
409
410 md = metadata_dst_alloc(priv->opts.len, METADATA_IP_TUNNEL, GFP_KERNEL);
411 if (!md)
412 return -ENOMEM;
413
414 memcpy(&md->u.tun_info, &info, sizeof(info));
415 #ifdef CONFIG_DST_CACHE
416 err = dst_cache_init(&md->u.tun_info.dst_cache, GFP_KERNEL);
417 if (err < 0) {
418 metadata_dst_free(md);
419 return err;
420 }
421 #endif
422 ip_tunnel_info_opts_set(&md->u.tun_info, &priv->opts.u, priv->opts.len,
423 priv->opts.flags);
424 priv->md = md;
425
426 return 0;
427 }
428
nft_tunnel_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)429 static inline void nft_tunnel_obj_eval(struct nft_object *obj,
430 struct nft_regs *regs,
431 const struct nft_pktinfo *pkt)
432 {
433 struct nft_tunnel_obj *priv = nft_obj_data(obj);
434 struct sk_buff *skb = pkt->skb;
435
436 skb_dst_drop(skb);
437 dst_hold((struct dst_entry *) priv->md);
438 skb_dst_set(skb, (struct dst_entry *) priv->md);
439 }
440
nft_tunnel_ip_dump(struct sk_buff * skb,struct ip_tunnel_info * info)441 static int nft_tunnel_ip_dump(struct sk_buff *skb, struct ip_tunnel_info *info)
442 {
443 struct nlattr *nest;
444
445 if (info->mode & IP_TUNNEL_INFO_IPV6) {
446 nest = nla_nest_start_noflag(skb, NFTA_TUNNEL_KEY_IP6);
447 if (!nest)
448 return -1;
449
450 if (nla_put_in6_addr(skb, NFTA_TUNNEL_KEY_IP6_SRC, &info->key.u.ipv6.src) < 0 ||
451 nla_put_in6_addr(skb, NFTA_TUNNEL_KEY_IP6_DST, &info->key.u.ipv6.dst) < 0 ||
452 nla_put_be32(skb, NFTA_TUNNEL_KEY_IP6_FLOWLABEL, info->key.label))
453 return -1;
454
455 nla_nest_end(skb, nest);
456 } else {
457 nest = nla_nest_start_noflag(skb, NFTA_TUNNEL_KEY_IP);
458 if (!nest)
459 return -1;
460
461 if (nla_put_in_addr(skb, NFTA_TUNNEL_KEY_IP_SRC, info->key.u.ipv4.src) < 0 ||
462 nla_put_in_addr(skb, NFTA_TUNNEL_KEY_IP_DST, info->key.u.ipv4.dst) < 0)
463 return -1;
464
465 nla_nest_end(skb, nest);
466 }
467
468 return 0;
469 }
470
nft_tunnel_opts_dump(struct sk_buff * skb,struct nft_tunnel_obj * priv)471 static int nft_tunnel_opts_dump(struct sk_buff *skb,
472 struct nft_tunnel_obj *priv)
473 {
474 struct nft_tunnel_opts *opts = &priv->opts;
475 struct nlattr *nest;
476
477 nest = nla_nest_start_noflag(skb, NFTA_TUNNEL_KEY_OPTS);
478 if (!nest)
479 return -1;
480
481 if (opts->flags & TUNNEL_VXLAN_OPT) {
482 if (nla_put_be32(skb, NFTA_TUNNEL_KEY_VXLAN_GBP,
483 htonl(opts->u.vxlan.gbp)))
484 return -1;
485 } else if (opts->flags & TUNNEL_ERSPAN_OPT) {
486 switch (opts->u.erspan.version) {
487 case ERSPAN_VERSION:
488 if (nla_put_be32(skb, NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX,
489 opts->u.erspan.u.index))
490 return -1;
491 break;
492 case ERSPAN_VERSION2:
493 if (nla_put_u8(skb, NFTA_TUNNEL_KEY_ERSPAN_V2_HWID,
494 get_hwid(&opts->u.erspan.u.md2)) ||
495 nla_put_u8(skb, NFTA_TUNNEL_KEY_ERSPAN_V2_DIR,
496 opts->u.erspan.u.md2.dir))
497 return -1;
498 break;
499 }
500 }
501 nla_nest_end(skb, nest);
502
503 return 0;
504 }
505
nft_tunnel_ports_dump(struct sk_buff * skb,struct ip_tunnel_info * info)506 static int nft_tunnel_ports_dump(struct sk_buff *skb,
507 struct ip_tunnel_info *info)
508 {
509 if (nla_put_be16(skb, NFTA_TUNNEL_KEY_SPORT, info->key.tp_src) < 0 ||
510 nla_put_be16(skb, NFTA_TUNNEL_KEY_DPORT, info->key.tp_dst) < 0)
511 return -1;
512
513 return 0;
514 }
515
nft_tunnel_flags_dump(struct sk_buff * skb,struct ip_tunnel_info * info)516 static int nft_tunnel_flags_dump(struct sk_buff *skb,
517 struct ip_tunnel_info *info)
518 {
519 u32 flags = 0;
520
521 if (info->key.tun_flags & TUNNEL_DONT_FRAGMENT)
522 flags |= NFT_TUNNEL_F_DONT_FRAGMENT;
523 if (!(info->key.tun_flags & TUNNEL_CSUM))
524 flags |= NFT_TUNNEL_F_ZERO_CSUM_TX;
525 if (info->key.tun_flags & TUNNEL_SEQ)
526 flags |= NFT_TUNNEL_F_SEQ_NUMBER;
527
528 if (nla_put_be32(skb, NFTA_TUNNEL_KEY_FLAGS, htonl(flags)) < 0)
529 return -1;
530
531 return 0;
532 }
533
nft_tunnel_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)534 static int nft_tunnel_obj_dump(struct sk_buff *skb,
535 struct nft_object *obj, bool reset)
536 {
537 struct nft_tunnel_obj *priv = nft_obj_data(obj);
538 struct ip_tunnel_info *info = &priv->md->u.tun_info;
539
540 if (nla_put_be32(skb, NFTA_TUNNEL_KEY_ID,
541 tunnel_id_to_key32(info->key.tun_id)) ||
542 nft_tunnel_ip_dump(skb, info) < 0 ||
543 nft_tunnel_ports_dump(skb, info) < 0 ||
544 nft_tunnel_flags_dump(skb, info) < 0 ||
545 nla_put_u8(skb, NFTA_TUNNEL_KEY_TOS, info->key.tos) ||
546 nla_put_u8(skb, NFTA_TUNNEL_KEY_TTL, info->key.ttl) ||
547 nft_tunnel_opts_dump(skb, priv) < 0)
548 goto nla_put_failure;
549
550 return 0;
551
552 nla_put_failure:
553 return -1;
554 }
555
nft_tunnel_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)556 static void nft_tunnel_obj_destroy(const struct nft_ctx *ctx,
557 struct nft_object *obj)
558 {
559 struct nft_tunnel_obj *priv = nft_obj_data(obj);
560
561 metadata_dst_free(priv->md);
562 }
563
564 static struct nft_object_type nft_tunnel_obj_type;
565 static const struct nft_object_ops nft_tunnel_obj_ops = {
566 .type = &nft_tunnel_obj_type,
567 .size = sizeof(struct nft_tunnel_obj),
568 .eval = nft_tunnel_obj_eval,
569 .init = nft_tunnel_obj_init,
570 .destroy = nft_tunnel_obj_destroy,
571 .dump = nft_tunnel_obj_dump,
572 };
573
574 static struct nft_object_type nft_tunnel_obj_type __read_mostly = {
575 .type = NFT_OBJECT_TUNNEL,
576 .ops = &nft_tunnel_obj_ops,
577 .maxattr = NFTA_TUNNEL_KEY_MAX,
578 .policy = nft_tunnel_key_policy,
579 .owner = THIS_MODULE,
580 };
581
nft_tunnel_module_init(void)582 static int __init nft_tunnel_module_init(void)
583 {
584 int err;
585
586 err = nft_register_expr(&nft_tunnel_type);
587 if (err < 0)
588 return err;
589
590 err = nft_register_obj(&nft_tunnel_obj_type);
591 if (err < 0)
592 nft_unregister_expr(&nft_tunnel_type);
593
594 return err;
595 }
596
nft_tunnel_module_exit(void)597 static void __exit nft_tunnel_module_exit(void)
598 {
599 nft_unregister_obj(&nft_tunnel_obj_type);
600 nft_unregister_expr(&nft_tunnel_type);
601 }
602
603 module_init(nft_tunnel_module_init);
604 module_exit(nft_tunnel_module_exit);
605
606 MODULE_LICENSE("GPL");
607 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
608 MODULE_ALIAS_NFT_EXPR("tunnel");
609 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_TUNNEL);
610