1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * Copyright (c) 2014 Intel Corporation
5 * Author: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
6 *
7 * Development of this code funded by Astaro AG (http://www.astaro.com/)
8 */
9
10 #include <linux/kernel.h>
11 #include <linux/netlink.h>
12 #include <linux/netfilter.h>
13 #include <linux/netfilter/nf_tables.h>
14 #include <linux/in.h>
15 #include <linux/ip.h>
16 #include <linux/ipv6.h>
17 #include <linux/random.h>
18 #include <linux/smp.h>
19 #include <linux/static_key.h>
20 #include <net/dst.h>
21 #include <net/ip.h>
22 #include <net/sock.h>
23 #include <net/tcp_states.h> /* for TCP_TIME_WAIT */
24 #include <net/netfilter/nf_tables.h>
25 #include <net/netfilter/nf_tables_core.h>
26 #include <net/netfilter/nft_meta.h>
27 #include <net/netfilter/nf_tables_offload.h>
28
29 #include <uapi/linux/netfilter_bridge.h> /* NF_BR_PRE_ROUTING */
30
31 #define NFT_META_SECS_PER_MINUTE 60
32 #define NFT_META_SECS_PER_HOUR 3600
33 #define NFT_META_SECS_PER_DAY 86400
34 #define NFT_META_DAYS_PER_WEEK 7
35
nft_meta_weekday(void)36 static u8 nft_meta_weekday(void)
37 {
38 time64_t secs = ktime_get_real_seconds();
39 unsigned int dse;
40 u8 wday;
41
42 secs -= NFT_META_SECS_PER_MINUTE * sys_tz.tz_minuteswest;
43 dse = div_u64(secs, NFT_META_SECS_PER_DAY);
44 wday = (4 + dse) % NFT_META_DAYS_PER_WEEK;
45
46 return wday;
47 }
48
nft_meta_hour(time64_t secs)49 static u32 nft_meta_hour(time64_t secs)
50 {
51 struct tm tm;
52
53 time64_to_tm(secs, 0, &tm);
54
55 return tm.tm_hour * NFT_META_SECS_PER_HOUR
56 + tm.tm_min * NFT_META_SECS_PER_MINUTE
57 + tm.tm_sec;
58 }
59
60 static noinline_for_stack void
nft_meta_get_eval_time(enum nft_meta_keys key,u32 * dest)61 nft_meta_get_eval_time(enum nft_meta_keys key,
62 u32 *dest)
63 {
64 switch (key) {
65 case NFT_META_TIME_NS:
66 nft_reg_store64((u64 *)dest, ktime_get_real_ns());
67 break;
68 case NFT_META_TIME_DAY:
69 nft_reg_store8(dest, nft_meta_weekday());
70 break;
71 case NFT_META_TIME_HOUR:
72 *dest = nft_meta_hour(ktime_get_real_seconds());
73 break;
74 default:
75 break;
76 }
77 }
78
79 static noinline bool
nft_meta_get_eval_pkttype_lo(const struct nft_pktinfo * pkt,u32 * dest)80 nft_meta_get_eval_pkttype_lo(const struct nft_pktinfo *pkt,
81 u32 *dest)
82 {
83 const struct sk_buff *skb = pkt->skb;
84
85 switch (nft_pf(pkt)) {
86 case NFPROTO_IPV4:
87 if (ipv4_is_multicast(ip_hdr(skb)->daddr))
88 nft_reg_store8(dest, PACKET_MULTICAST);
89 else
90 nft_reg_store8(dest, PACKET_BROADCAST);
91 break;
92 case NFPROTO_IPV6:
93 nft_reg_store8(dest, PACKET_MULTICAST);
94 break;
95 case NFPROTO_NETDEV:
96 switch (skb->protocol) {
97 case htons(ETH_P_IP): {
98 int noff = skb_network_offset(skb);
99 struct iphdr *iph, _iph;
100
101 iph = skb_header_pointer(skb, noff,
102 sizeof(_iph), &_iph);
103 if (!iph)
104 return false;
105
106 if (ipv4_is_multicast(iph->daddr))
107 nft_reg_store8(dest, PACKET_MULTICAST);
108 else
109 nft_reg_store8(dest, PACKET_BROADCAST);
110
111 break;
112 }
113 case htons(ETH_P_IPV6):
114 nft_reg_store8(dest, PACKET_MULTICAST);
115 break;
116 default:
117 WARN_ON_ONCE(1);
118 return false;
119 }
120 break;
121 default:
122 WARN_ON_ONCE(1);
123 return false;
124 }
125
126 return true;
127 }
128
129 static noinline bool
nft_meta_get_eval_skugid(enum nft_meta_keys key,u32 * dest,const struct nft_pktinfo * pkt)130 nft_meta_get_eval_skugid(enum nft_meta_keys key,
131 u32 *dest,
132 const struct nft_pktinfo *pkt)
133 {
134 struct sock *sk = skb_to_full_sk(pkt->skb);
135 struct socket *sock;
136
137 if (!sk || !sk_fullsock(sk) || !net_eq(nft_net(pkt), sock_net(sk)))
138 return false;
139
140 read_lock_bh(&sk->sk_callback_lock);
141 sock = sk->sk_socket;
142 if (!sock || !sock->file) {
143 read_unlock_bh(&sk->sk_callback_lock);
144 return false;
145 }
146
147 switch (key) {
148 case NFT_META_SKUID:
149 *dest = from_kuid_munged(sock_net(sk)->user_ns,
150 sock->file->f_cred->fsuid);
151 break;
152 case NFT_META_SKGID:
153 *dest = from_kgid_munged(sock_net(sk)->user_ns,
154 sock->file->f_cred->fsgid);
155 break;
156 default:
157 break;
158 }
159
160 read_unlock_bh(&sk->sk_callback_lock);
161 return true;
162 }
163
164 #ifdef CONFIG_CGROUP_NET_CLASSID
165 static noinline bool
nft_meta_get_eval_cgroup(u32 * dest,const struct nft_pktinfo * pkt)166 nft_meta_get_eval_cgroup(u32 *dest, const struct nft_pktinfo *pkt)
167 {
168 struct sock *sk = skb_to_full_sk(pkt->skb);
169
170 if (!sk || !sk_fullsock(sk) || !net_eq(nft_net(pkt), sock_net(sk)))
171 return false;
172
173 *dest = sock_cgroup_classid(&sk->sk_cgrp_data);
174 return true;
175 }
176 #endif
177
nft_meta_get_eval_kind(enum nft_meta_keys key,u32 * dest,const struct nft_pktinfo * pkt)178 static noinline bool nft_meta_get_eval_kind(enum nft_meta_keys key,
179 u32 *dest,
180 const struct nft_pktinfo *pkt)
181 {
182 const struct net_device *in = nft_in(pkt), *out = nft_out(pkt);
183
184 switch (key) {
185 case NFT_META_IIFKIND:
186 if (!in || !in->rtnl_link_ops)
187 return false;
188 strncpy((char *)dest, in->rtnl_link_ops->kind, IFNAMSIZ);
189 break;
190 case NFT_META_OIFKIND:
191 if (!out || !out->rtnl_link_ops)
192 return false;
193 strncpy((char *)dest, out->rtnl_link_ops->kind, IFNAMSIZ);
194 break;
195 default:
196 return false;
197 }
198
199 return true;
200 }
201
nft_meta_store_ifindex(u32 * dest,const struct net_device * dev)202 static void nft_meta_store_ifindex(u32 *dest, const struct net_device *dev)
203 {
204 *dest = dev ? dev->ifindex : 0;
205 }
206
nft_meta_store_ifname(u32 * dest,const struct net_device * dev)207 static void nft_meta_store_ifname(u32 *dest, const struct net_device *dev)
208 {
209 strncpy((char *)dest, dev ? dev->name : "", IFNAMSIZ);
210 }
211
nft_meta_store_iftype(u32 * dest,const struct net_device * dev)212 static bool nft_meta_store_iftype(u32 *dest, const struct net_device *dev)
213 {
214 if (!dev)
215 return false;
216
217 nft_reg_store16(dest, dev->type);
218 return true;
219 }
220
nft_meta_store_ifgroup(u32 * dest,const struct net_device * dev)221 static bool nft_meta_store_ifgroup(u32 *dest, const struct net_device *dev)
222 {
223 if (!dev)
224 return false;
225
226 *dest = dev->group;
227 return true;
228 }
229
nft_meta_get_eval_ifname(enum nft_meta_keys key,u32 * dest,const struct nft_pktinfo * pkt)230 static bool nft_meta_get_eval_ifname(enum nft_meta_keys key, u32 *dest,
231 const struct nft_pktinfo *pkt)
232 {
233 switch (key) {
234 case NFT_META_IIFNAME:
235 nft_meta_store_ifname(dest, nft_in(pkt));
236 break;
237 case NFT_META_OIFNAME:
238 nft_meta_store_ifname(dest, nft_out(pkt));
239 break;
240 case NFT_META_IIF:
241 nft_meta_store_ifindex(dest, nft_in(pkt));
242 break;
243 case NFT_META_OIF:
244 nft_meta_store_ifindex(dest, nft_out(pkt));
245 break;
246 case NFT_META_IIFTYPE:
247 if (!nft_meta_store_iftype(dest, nft_in(pkt)))
248 return false;
249 break;
250 case NFT_META_OIFTYPE:
251 if (!nft_meta_store_iftype(dest, nft_out(pkt)))
252 return false;
253 break;
254 case NFT_META_IIFGROUP:
255 if (!nft_meta_store_ifgroup(dest, nft_in(pkt)))
256 return false;
257 break;
258 case NFT_META_OIFGROUP:
259 if (!nft_meta_store_ifgroup(dest, nft_out(pkt)))
260 return false;
261 break;
262 default:
263 return false;
264 }
265
266 return true;
267 }
268
269 #ifdef CONFIG_IP_ROUTE_CLASSID
270 static noinline bool
nft_meta_get_eval_rtclassid(const struct sk_buff * skb,u32 * dest)271 nft_meta_get_eval_rtclassid(const struct sk_buff *skb, u32 *dest)
272 {
273 const struct dst_entry *dst = skb_dst(skb);
274
275 if (!dst)
276 return false;
277
278 *dest = dst->tclassid;
279 return true;
280 }
281 #endif
282
nft_meta_get_eval_sdif(const struct nft_pktinfo * pkt)283 static noinline u32 nft_meta_get_eval_sdif(const struct nft_pktinfo *pkt)
284 {
285 switch (nft_pf(pkt)) {
286 case NFPROTO_IPV4:
287 return inet_sdif(pkt->skb);
288 case NFPROTO_IPV6:
289 return inet6_sdif(pkt->skb);
290 }
291
292 return 0;
293 }
294
295 static noinline void
nft_meta_get_eval_sdifname(u32 * dest,const struct nft_pktinfo * pkt)296 nft_meta_get_eval_sdifname(u32 *dest, const struct nft_pktinfo *pkt)
297 {
298 u32 sdif = nft_meta_get_eval_sdif(pkt);
299 const struct net_device *dev;
300
301 dev = sdif ? dev_get_by_index_rcu(nft_net(pkt), sdif) : NULL;
302 nft_meta_store_ifname(dest, dev);
303 }
304
nft_meta_get_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)305 void nft_meta_get_eval(const struct nft_expr *expr,
306 struct nft_regs *regs,
307 const struct nft_pktinfo *pkt)
308 {
309 const struct nft_meta *priv = nft_expr_priv(expr);
310 const struct sk_buff *skb = pkt->skb;
311 u32 *dest = ®s->data[priv->dreg];
312
313 switch (priv->key) {
314 case NFT_META_LEN:
315 *dest = skb->len;
316 break;
317 case NFT_META_PROTOCOL:
318 nft_reg_store16(dest, (__force u16)skb->protocol);
319 break;
320 case NFT_META_NFPROTO:
321 nft_reg_store8(dest, nft_pf(pkt));
322 break;
323 case NFT_META_L4PROTO:
324 if (!pkt->tprot_set)
325 goto err;
326 nft_reg_store8(dest, pkt->tprot);
327 break;
328 case NFT_META_PRIORITY:
329 *dest = skb->priority;
330 break;
331 case NFT_META_MARK:
332 *dest = skb->mark;
333 break;
334 case NFT_META_IIF:
335 case NFT_META_OIF:
336 case NFT_META_IIFNAME:
337 case NFT_META_OIFNAME:
338 case NFT_META_IIFTYPE:
339 case NFT_META_OIFTYPE:
340 case NFT_META_IIFGROUP:
341 case NFT_META_OIFGROUP:
342 if (!nft_meta_get_eval_ifname(priv->key, dest, pkt))
343 goto err;
344 break;
345 case NFT_META_SKUID:
346 case NFT_META_SKGID:
347 if (!nft_meta_get_eval_skugid(priv->key, dest, pkt))
348 goto err;
349 break;
350 #ifdef CONFIG_IP_ROUTE_CLASSID
351 case NFT_META_RTCLASSID:
352 if (!nft_meta_get_eval_rtclassid(skb, dest))
353 goto err;
354 break;
355 #endif
356 #ifdef CONFIG_NETWORK_SECMARK
357 case NFT_META_SECMARK:
358 *dest = skb->secmark;
359 break;
360 #endif
361 case NFT_META_PKTTYPE:
362 if (skb->pkt_type != PACKET_LOOPBACK) {
363 nft_reg_store8(dest, skb->pkt_type);
364 break;
365 }
366
367 if (!nft_meta_get_eval_pkttype_lo(pkt, dest))
368 goto err;
369 break;
370 case NFT_META_CPU:
371 *dest = raw_smp_processor_id();
372 break;
373 #ifdef CONFIG_CGROUP_NET_CLASSID
374 case NFT_META_CGROUP:
375 if (!nft_meta_get_eval_cgroup(dest, pkt))
376 goto err;
377 break;
378 #endif
379 case NFT_META_PRANDOM:
380 *dest = get_random_u32();
381 break;
382 #ifdef CONFIG_XFRM
383 case NFT_META_SECPATH:
384 nft_reg_store8(dest, secpath_exists(skb));
385 break;
386 #endif
387 case NFT_META_IIFKIND:
388 case NFT_META_OIFKIND:
389 if (!nft_meta_get_eval_kind(priv->key, dest, pkt))
390 goto err;
391 break;
392 case NFT_META_TIME_NS:
393 case NFT_META_TIME_DAY:
394 case NFT_META_TIME_HOUR:
395 nft_meta_get_eval_time(priv->key, dest);
396 break;
397 case NFT_META_SDIF:
398 *dest = nft_meta_get_eval_sdif(pkt);
399 break;
400 case NFT_META_SDIFNAME:
401 nft_meta_get_eval_sdifname(dest, pkt);
402 break;
403 default:
404 WARN_ON(1);
405 goto err;
406 }
407 return;
408
409 err:
410 regs->verdict.code = NFT_BREAK;
411 }
412 EXPORT_SYMBOL_GPL(nft_meta_get_eval);
413
nft_meta_set_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)414 void nft_meta_set_eval(const struct nft_expr *expr,
415 struct nft_regs *regs,
416 const struct nft_pktinfo *pkt)
417 {
418 const struct nft_meta *meta = nft_expr_priv(expr);
419 struct sk_buff *skb = pkt->skb;
420 u32 *sreg = ®s->data[meta->sreg];
421 u32 value = *sreg;
422 u8 value8;
423
424 switch (meta->key) {
425 case NFT_META_MARK:
426 skb->mark = value;
427 break;
428 case NFT_META_PRIORITY:
429 skb->priority = value;
430 break;
431 case NFT_META_PKTTYPE:
432 value8 = nft_reg_load8(sreg);
433
434 if (skb->pkt_type != value8 &&
435 skb_pkt_type_ok(value8) &&
436 skb_pkt_type_ok(skb->pkt_type))
437 skb->pkt_type = value8;
438 break;
439 case NFT_META_NFTRACE:
440 value8 = nft_reg_load8(sreg);
441
442 skb->nf_trace = !!value8;
443 break;
444 #ifdef CONFIG_NETWORK_SECMARK
445 case NFT_META_SECMARK:
446 skb->secmark = value;
447 break;
448 #endif
449 default:
450 WARN_ON(1);
451 }
452 }
453 EXPORT_SYMBOL_GPL(nft_meta_set_eval);
454
455 const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = {
456 [NFTA_META_DREG] = { .type = NLA_U32 },
457 [NFTA_META_KEY] = { .type = NLA_U32 },
458 [NFTA_META_SREG] = { .type = NLA_U32 },
459 };
460 EXPORT_SYMBOL_GPL(nft_meta_policy);
461
nft_meta_get_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])462 int nft_meta_get_init(const struct nft_ctx *ctx,
463 const struct nft_expr *expr,
464 const struct nlattr * const tb[])
465 {
466 struct nft_meta *priv = nft_expr_priv(expr);
467 unsigned int len;
468
469 priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
470 switch (priv->key) {
471 case NFT_META_PROTOCOL:
472 case NFT_META_IIFTYPE:
473 case NFT_META_OIFTYPE:
474 len = sizeof(u16);
475 break;
476 case NFT_META_NFPROTO:
477 case NFT_META_L4PROTO:
478 case NFT_META_LEN:
479 case NFT_META_PRIORITY:
480 case NFT_META_MARK:
481 case NFT_META_IIF:
482 case NFT_META_OIF:
483 case NFT_META_SDIF:
484 case NFT_META_SKUID:
485 case NFT_META_SKGID:
486 #ifdef CONFIG_IP_ROUTE_CLASSID
487 case NFT_META_RTCLASSID:
488 #endif
489 #ifdef CONFIG_NETWORK_SECMARK
490 case NFT_META_SECMARK:
491 #endif
492 case NFT_META_PKTTYPE:
493 case NFT_META_CPU:
494 case NFT_META_IIFGROUP:
495 case NFT_META_OIFGROUP:
496 #ifdef CONFIG_CGROUP_NET_CLASSID
497 case NFT_META_CGROUP:
498 #endif
499 len = sizeof(u32);
500 break;
501 case NFT_META_IIFNAME:
502 case NFT_META_OIFNAME:
503 case NFT_META_IIFKIND:
504 case NFT_META_OIFKIND:
505 case NFT_META_SDIFNAME:
506 len = IFNAMSIZ;
507 break;
508 case NFT_META_PRANDOM:
509 len = sizeof(u32);
510 break;
511 #ifdef CONFIG_XFRM
512 case NFT_META_SECPATH:
513 len = sizeof(u8);
514 break;
515 #endif
516 case NFT_META_TIME_NS:
517 len = sizeof(u64);
518 break;
519 case NFT_META_TIME_DAY:
520 len = sizeof(u8);
521 break;
522 case NFT_META_TIME_HOUR:
523 len = sizeof(u32);
524 break;
525 default:
526 return -EOPNOTSUPP;
527 }
528
529 return nft_parse_register_store(ctx, tb[NFTA_META_DREG], &priv->dreg,
530 NULL, NFT_DATA_VALUE, len);
531 }
532 EXPORT_SYMBOL_GPL(nft_meta_get_init);
533
nft_meta_get_validate_sdif(const struct nft_ctx * ctx)534 static int nft_meta_get_validate_sdif(const struct nft_ctx *ctx)
535 {
536 unsigned int hooks;
537
538 switch (ctx->family) {
539 case NFPROTO_IPV4:
540 case NFPROTO_IPV6:
541 case NFPROTO_INET:
542 hooks = (1 << NF_INET_LOCAL_IN) |
543 (1 << NF_INET_FORWARD);
544 break;
545 default:
546 return -EOPNOTSUPP;
547 }
548
549 return nft_chain_validate_hooks(ctx->chain, hooks);
550 }
551
nft_meta_get_validate_xfrm(const struct nft_ctx * ctx)552 static int nft_meta_get_validate_xfrm(const struct nft_ctx *ctx)
553 {
554 #ifdef CONFIG_XFRM
555 unsigned int hooks;
556
557 switch (ctx->family) {
558 case NFPROTO_NETDEV:
559 hooks = 1 << NF_NETDEV_INGRESS;
560 break;
561 case NFPROTO_IPV4:
562 case NFPROTO_IPV6:
563 case NFPROTO_INET:
564 hooks = (1 << NF_INET_PRE_ROUTING) |
565 (1 << NF_INET_LOCAL_IN) |
566 (1 << NF_INET_FORWARD);
567 break;
568 default:
569 return -EOPNOTSUPP;
570 }
571
572 return nft_chain_validate_hooks(ctx->chain, hooks);
573 #else
574 return 0;
575 #endif
576 }
577
nft_meta_get_validate(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nft_data ** data)578 static int nft_meta_get_validate(const struct nft_ctx *ctx,
579 const struct nft_expr *expr,
580 const struct nft_data **data)
581 {
582 const struct nft_meta *priv = nft_expr_priv(expr);
583
584 switch (priv->key) {
585 case NFT_META_SECPATH:
586 return nft_meta_get_validate_xfrm(ctx);
587 case NFT_META_SDIF:
588 case NFT_META_SDIFNAME:
589 return nft_meta_get_validate_sdif(ctx);
590 default:
591 break;
592 }
593
594 return 0;
595 }
596
nft_meta_set_validate(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nft_data ** data)597 int nft_meta_set_validate(const struct nft_ctx *ctx,
598 const struct nft_expr *expr,
599 const struct nft_data **data)
600 {
601 struct nft_meta *priv = nft_expr_priv(expr);
602 unsigned int hooks;
603
604 if (priv->key != NFT_META_PKTTYPE)
605 return 0;
606
607 switch (ctx->family) {
608 case NFPROTO_BRIDGE:
609 hooks = 1 << NF_BR_PRE_ROUTING;
610 break;
611 case NFPROTO_NETDEV:
612 hooks = 1 << NF_NETDEV_INGRESS;
613 break;
614 case NFPROTO_IPV4:
615 case NFPROTO_IPV6:
616 case NFPROTO_INET:
617 hooks = 1 << NF_INET_PRE_ROUTING;
618 break;
619 default:
620 return -EOPNOTSUPP;
621 }
622
623 return nft_chain_validate_hooks(ctx->chain, hooks);
624 }
625 EXPORT_SYMBOL_GPL(nft_meta_set_validate);
626
nft_meta_set_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])627 int nft_meta_set_init(const struct nft_ctx *ctx,
628 const struct nft_expr *expr,
629 const struct nlattr * const tb[])
630 {
631 struct nft_meta *priv = nft_expr_priv(expr);
632 unsigned int len;
633 int err;
634
635 priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
636 switch (priv->key) {
637 case NFT_META_MARK:
638 case NFT_META_PRIORITY:
639 #ifdef CONFIG_NETWORK_SECMARK
640 case NFT_META_SECMARK:
641 #endif
642 len = sizeof(u32);
643 break;
644 case NFT_META_NFTRACE:
645 len = sizeof(u8);
646 break;
647 case NFT_META_PKTTYPE:
648 len = sizeof(u8);
649 break;
650 default:
651 return -EOPNOTSUPP;
652 }
653
654 err = nft_parse_register_load(tb[NFTA_META_SREG], &priv->sreg, len);
655 if (err < 0)
656 return err;
657
658 if (priv->key == NFT_META_NFTRACE)
659 static_branch_inc(&nft_trace_enabled);
660
661 return 0;
662 }
663 EXPORT_SYMBOL_GPL(nft_meta_set_init);
664
nft_meta_get_dump(struct sk_buff * skb,const struct nft_expr * expr)665 int nft_meta_get_dump(struct sk_buff *skb,
666 const struct nft_expr *expr)
667 {
668 const struct nft_meta *priv = nft_expr_priv(expr);
669
670 if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key)))
671 goto nla_put_failure;
672 if (nft_dump_register(skb, NFTA_META_DREG, priv->dreg))
673 goto nla_put_failure;
674 return 0;
675
676 nla_put_failure:
677 return -1;
678 }
679 EXPORT_SYMBOL_GPL(nft_meta_get_dump);
680
nft_meta_set_dump(struct sk_buff * skb,const struct nft_expr * expr)681 int nft_meta_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
682 {
683 const struct nft_meta *priv = nft_expr_priv(expr);
684
685 if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key)))
686 goto nla_put_failure;
687 if (nft_dump_register(skb, NFTA_META_SREG, priv->sreg))
688 goto nla_put_failure;
689
690 return 0;
691
692 nla_put_failure:
693 return -1;
694 }
695 EXPORT_SYMBOL_GPL(nft_meta_set_dump);
696
nft_meta_set_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)697 void nft_meta_set_destroy(const struct nft_ctx *ctx,
698 const struct nft_expr *expr)
699 {
700 const struct nft_meta *priv = nft_expr_priv(expr);
701
702 if (priv->key == NFT_META_NFTRACE)
703 static_branch_dec(&nft_trace_enabled);
704 }
705 EXPORT_SYMBOL_GPL(nft_meta_set_destroy);
706
nft_meta_get_offload(struct nft_offload_ctx * ctx,struct nft_flow_rule * flow,const struct nft_expr * expr)707 static int nft_meta_get_offload(struct nft_offload_ctx *ctx,
708 struct nft_flow_rule *flow,
709 const struct nft_expr *expr)
710 {
711 const struct nft_meta *priv = nft_expr_priv(expr);
712 struct nft_offload_reg *reg = &ctx->regs[priv->dreg];
713
714 switch (priv->key) {
715 case NFT_META_PROTOCOL:
716 NFT_OFFLOAD_MATCH_EXACT(FLOW_DISSECTOR_KEY_BASIC, basic, n_proto,
717 sizeof(__u16), reg);
718 nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_NETWORK);
719 break;
720 case NFT_META_L4PROTO:
721 NFT_OFFLOAD_MATCH_EXACT(FLOW_DISSECTOR_KEY_BASIC, basic, ip_proto,
722 sizeof(__u8), reg);
723 nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_TRANSPORT);
724 break;
725 case NFT_META_IIF:
726 NFT_OFFLOAD_MATCH_EXACT(FLOW_DISSECTOR_KEY_META, meta,
727 ingress_ifindex, sizeof(__u32), reg);
728 break;
729 case NFT_META_IIFTYPE:
730 NFT_OFFLOAD_MATCH_EXACT(FLOW_DISSECTOR_KEY_META, meta,
731 ingress_iftype, sizeof(__u16), reg);
732 break;
733 default:
734 return -EOPNOTSUPP;
735 }
736
737 return 0;
738 }
739
740 static const struct nft_expr_ops nft_meta_get_ops = {
741 .type = &nft_meta_type,
742 .size = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
743 .eval = nft_meta_get_eval,
744 .init = nft_meta_get_init,
745 .dump = nft_meta_get_dump,
746 .validate = nft_meta_get_validate,
747 .offload = nft_meta_get_offload,
748 };
749
750 static const struct nft_expr_ops nft_meta_set_ops = {
751 .type = &nft_meta_type,
752 .size = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
753 .eval = nft_meta_set_eval,
754 .init = nft_meta_set_init,
755 .destroy = nft_meta_set_destroy,
756 .dump = nft_meta_set_dump,
757 .validate = nft_meta_set_validate,
758 };
759
760 static const struct nft_expr_ops *
nft_meta_select_ops(const struct nft_ctx * ctx,const struct nlattr * const tb[])761 nft_meta_select_ops(const struct nft_ctx *ctx,
762 const struct nlattr * const tb[])
763 {
764 if (tb[NFTA_META_KEY] == NULL)
765 return ERR_PTR(-EINVAL);
766
767 if (tb[NFTA_META_DREG] && tb[NFTA_META_SREG])
768 return ERR_PTR(-EINVAL);
769
770 #if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE) && IS_MODULE(CONFIG_NFT_BRIDGE_META)
771 if (ctx->family == NFPROTO_BRIDGE)
772 return ERR_PTR(-EAGAIN);
773 #endif
774 if (tb[NFTA_META_DREG])
775 return &nft_meta_get_ops;
776
777 if (tb[NFTA_META_SREG])
778 return &nft_meta_set_ops;
779
780 return ERR_PTR(-EINVAL);
781 }
782
783 struct nft_expr_type nft_meta_type __read_mostly = {
784 .name = "meta",
785 .select_ops = nft_meta_select_ops,
786 .policy = nft_meta_policy,
787 .maxattr = NFTA_META_MAX,
788 .owner = THIS_MODULE,
789 };
790
791 #ifdef CONFIG_NETWORK_SECMARK
792 struct nft_secmark {
793 u32 secid;
794 char *ctx;
795 };
796
797 static const struct nla_policy nft_secmark_policy[NFTA_SECMARK_MAX + 1] = {
798 [NFTA_SECMARK_CTX] = { .type = NLA_STRING, .len = NFT_SECMARK_CTX_MAXLEN },
799 };
800
nft_secmark_compute_secid(struct nft_secmark * priv)801 static int nft_secmark_compute_secid(struct nft_secmark *priv)
802 {
803 u32 tmp_secid = 0;
804 int err;
805
806 err = security_secctx_to_secid(priv->ctx, strlen(priv->ctx), &tmp_secid);
807 if (err)
808 return err;
809
810 if (!tmp_secid)
811 return -ENOENT;
812
813 err = security_secmark_relabel_packet(tmp_secid);
814 if (err)
815 return err;
816
817 priv->secid = tmp_secid;
818 return 0;
819 }
820
nft_secmark_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)821 static void nft_secmark_obj_eval(struct nft_object *obj, struct nft_regs *regs,
822 const struct nft_pktinfo *pkt)
823 {
824 const struct nft_secmark *priv = nft_obj_data(obj);
825 struct sk_buff *skb = pkt->skb;
826
827 skb->secmark = priv->secid;
828 }
829
nft_secmark_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)830 static int nft_secmark_obj_init(const struct nft_ctx *ctx,
831 const struct nlattr * const tb[],
832 struct nft_object *obj)
833 {
834 struct nft_secmark *priv = nft_obj_data(obj);
835 int err;
836
837 if (tb[NFTA_SECMARK_CTX] == NULL)
838 return -EINVAL;
839
840 priv->ctx = nla_strdup(tb[NFTA_SECMARK_CTX], GFP_KERNEL);
841 if (!priv->ctx)
842 return -ENOMEM;
843
844 err = nft_secmark_compute_secid(priv);
845 if (err) {
846 kfree(priv->ctx);
847 return err;
848 }
849
850 security_secmark_refcount_inc();
851
852 return 0;
853 }
854
nft_secmark_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)855 static int nft_secmark_obj_dump(struct sk_buff *skb, struct nft_object *obj,
856 bool reset)
857 {
858 struct nft_secmark *priv = nft_obj_data(obj);
859 int err;
860
861 if (nla_put_string(skb, NFTA_SECMARK_CTX, priv->ctx))
862 return -1;
863
864 if (reset) {
865 err = nft_secmark_compute_secid(priv);
866 if (err)
867 return err;
868 }
869
870 return 0;
871 }
872
nft_secmark_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)873 static void nft_secmark_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
874 {
875 struct nft_secmark *priv = nft_obj_data(obj);
876
877 security_secmark_refcount_dec();
878
879 kfree(priv->ctx);
880 }
881
882 static const struct nft_object_ops nft_secmark_obj_ops = {
883 .type = &nft_secmark_obj_type,
884 .size = sizeof(struct nft_secmark),
885 .init = nft_secmark_obj_init,
886 .eval = nft_secmark_obj_eval,
887 .dump = nft_secmark_obj_dump,
888 .destroy = nft_secmark_obj_destroy,
889 };
890 struct nft_object_type nft_secmark_obj_type __read_mostly = {
891 .type = NFT_OBJECT_SECMARK,
892 .ops = &nft_secmark_obj_ops,
893 .maxattr = NFTA_SECMARK_MAX,
894 .policy = nft_secmark_policy,
895 .owner = THIS_MODULE,
896 };
897 #endif /* CONFIG_NETWORK_SECMARK */
898