1 /* SPDX-License-Identifier: GPL-2.0 */
2 #include <linux/module.h>
3 #include <linux/netfilter/nf_tables.h>
4 #include <net/netfilter/nf_tables.h>
5 #include <net/netfilter/nf_tables_core.h>
6 #include <net/netfilter/nf_socket.h>
7 #include <net/inet_sock.h>
8 #include <net/tcp.h>
9
10 struct nft_socket {
11 enum nft_socket_keys key:8;
12 union {
13 u8 dreg;
14 };
15 };
16
nft_socket_wildcard(const struct nft_pktinfo * pkt,struct nft_regs * regs,struct sock * sk,u32 * dest)17 static void nft_socket_wildcard(const struct nft_pktinfo *pkt,
18 struct nft_regs *regs, struct sock *sk,
19 u32 *dest)
20 {
21 switch (nft_pf(pkt)) {
22 case NFPROTO_IPV4:
23 nft_reg_store8(dest, inet_sk(sk)->inet_rcv_saddr == 0);
24 break;
25 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
26 case NFPROTO_IPV6:
27 nft_reg_store8(dest, ipv6_addr_any(&sk->sk_v6_rcv_saddr));
28 break;
29 #endif
30 default:
31 regs->verdict.code = NFT_BREAK;
32 return;
33 }
34 }
35
nft_socket_do_lookup(const struct nft_pktinfo * pkt)36 static struct sock *nft_socket_do_lookup(const struct nft_pktinfo *pkt)
37 {
38 const struct net_device *indev = nft_in(pkt);
39 const struct sk_buff *skb = pkt->skb;
40 struct sock *sk = NULL;
41
42 if (!indev)
43 return NULL;
44
45 switch (nft_pf(pkt)) {
46 case NFPROTO_IPV4:
47 sk = nf_sk_lookup_slow_v4(nft_net(pkt), skb, indev);
48 break;
49 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
50 case NFPROTO_IPV6:
51 sk = nf_sk_lookup_slow_v6(nft_net(pkt), skb, indev);
52 break;
53 #endif
54 default:
55 WARN_ON_ONCE(1);
56 break;
57 }
58
59 return sk;
60 }
61
nft_socket_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)62 static void nft_socket_eval(const struct nft_expr *expr,
63 struct nft_regs *regs,
64 const struct nft_pktinfo *pkt)
65 {
66 const struct nft_socket *priv = nft_expr_priv(expr);
67 struct sk_buff *skb = pkt->skb;
68 struct sock *sk = skb->sk;
69 u32 *dest = ®s->data[priv->dreg];
70
71 if (sk && !net_eq(nft_net(pkt), sock_net(sk)))
72 sk = NULL;
73
74 if (!sk)
75 sk = nft_socket_do_lookup(pkt);
76
77 if (!sk) {
78 regs->verdict.code = NFT_BREAK;
79 return;
80 }
81
82 switch(priv->key) {
83 case NFT_SOCKET_TRANSPARENT:
84 nft_reg_store8(dest, inet_sk_transparent(sk));
85 break;
86 case NFT_SOCKET_MARK:
87 if (sk_fullsock(sk)) {
88 *dest = sk->sk_mark;
89 } else {
90 regs->verdict.code = NFT_BREAK;
91 return;
92 }
93 break;
94 case NFT_SOCKET_WILDCARD:
95 if (!sk_fullsock(sk)) {
96 regs->verdict.code = NFT_BREAK;
97 return;
98 }
99 nft_socket_wildcard(pkt, regs, sk, dest);
100 break;
101 default:
102 WARN_ON(1);
103 regs->verdict.code = NFT_BREAK;
104 }
105
106 if (sk != skb->sk)
107 sock_gen_put(sk);
108 }
109
110 static const struct nla_policy nft_socket_policy[NFTA_SOCKET_MAX + 1] = {
111 [NFTA_SOCKET_KEY] = { .type = NLA_U32 },
112 [NFTA_SOCKET_DREG] = { .type = NLA_U32 },
113 };
114
nft_socket_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])115 static int nft_socket_init(const struct nft_ctx *ctx,
116 const struct nft_expr *expr,
117 const struct nlattr * const tb[])
118 {
119 struct nft_socket *priv = nft_expr_priv(expr);
120 unsigned int len;
121
122 if (!tb[NFTA_SOCKET_DREG] || !tb[NFTA_SOCKET_KEY])
123 return -EINVAL;
124
125 switch(ctx->family) {
126 case NFPROTO_IPV4:
127 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
128 case NFPROTO_IPV6:
129 #endif
130 case NFPROTO_INET:
131 break;
132 default:
133 return -EOPNOTSUPP;
134 }
135
136 priv->key = ntohl(nla_get_u32(tb[NFTA_SOCKET_KEY]));
137 switch(priv->key) {
138 case NFT_SOCKET_TRANSPARENT:
139 case NFT_SOCKET_WILDCARD:
140 len = sizeof(u8);
141 break;
142 case NFT_SOCKET_MARK:
143 len = sizeof(u32);
144 break;
145 default:
146 return -EOPNOTSUPP;
147 }
148
149 return nft_parse_register_store(ctx, tb[NFTA_SOCKET_DREG], &priv->dreg,
150 NULL, NFT_DATA_VALUE, len);
151 }
152
nft_socket_dump(struct sk_buff * skb,const struct nft_expr * expr)153 static int nft_socket_dump(struct sk_buff *skb,
154 const struct nft_expr *expr)
155 {
156 const struct nft_socket *priv = nft_expr_priv(expr);
157
158 if (nla_put_u32(skb, NFTA_SOCKET_KEY, htonl(priv->key)))
159 return -1;
160 if (nft_dump_register(skb, NFTA_SOCKET_DREG, priv->dreg))
161 return -1;
162 return 0;
163 }
164
nft_socket_validate(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nft_data ** data)165 static int nft_socket_validate(const struct nft_ctx *ctx,
166 const struct nft_expr *expr,
167 const struct nft_data **data)
168 {
169 if (ctx->family != NFPROTO_IPV4 &&
170 ctx->family != NFPROTO_IPV6 &&
171 ctx->family != NFPROTO_INET)
172 return -EOPNOTSUPP;
173
174 return nft_chain_validate_hooks(ctx->chain,
175 (1 << NF_INET_PRE_ROUTING) |
176 (1 << NF_INET_LOCAL_IN) |
177 (1 << NF_INET_LOCAL_OUT));
178 }
179
180 static struct nft_expr_type nft_socket_type;
181 static const struct nft_expr_ops nft_socket_ops = {
182 .type = &nft_socket_type,
183 .size = NFT_EXPR_SIZE(sizeof(struct nft_socket)),
184 .eval = nft_socket_eval,
185 .init = nft_socket_init,
186 .dump = nft_socket_dump,
187 .validate = nft_socket_validate,
188 };
189
190 static struct nft_expr_type nft_socket_type __read_mostly = {
191 .name = "socket",
192 .ops = &nft_socket_ops,
193 .policy = nft_socket_policy,
194 .maxattr = NFTA_SOCKET_MAX,
195 .owner = THIS_MODULE,
196 };
197
nft_socket_module_init(void)198 static int __init nft_socket_module_init(void)
199 {
200 return nft_register_expr(&nft_socket_type);
201 }
202
nft_socket_module_exit(void)203 static void __exit nft_socket_module_exit(void)
204 {
205 nft_unregister_expr(&nft_socket_type);
206 }
207
208 module_init(nft_socket_module_init);
209 module_exit(nft_socket_module_exit);
210
211 MODULE_LICENSE("GPL");
212 MODULE_AUTHOR("Máté Eckl");
213 MODULE_DESCRIPTION("nf_tables socket match module");
214 MODULE_ALIAS_NFT_EXPR("socket");
215