net/netfilter/nft_meta.c

   1 /*
   2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
   9  */
  10
  11 #include <linux/kernel.h>
  12 #include <linux/init.h>
  13 #include <linux/module.h>
  14 #include <linux/netlink.h>
  15 #include <linux/netfilter.h>
  16 #include <linux/netfilter/nf_tables.h>
  17 #include <linux/in.h>
  18 #include <linux/ip.h>
  19 #include <linux/ipv6.h>
  20 #include <linux/smp.h>
  21 #include <linux/static_key.h>
  22 #include <net/dst.h>
  23 #include <net/sock.h>
  24 #include <net/tcp_states.h> /* for TCP_TIME_WAIT */
  25 #include <net/netfilter/nf_tables.h>
  26 #include <net/netfilter/nf_tables_core.h>
  27 #include <net/netfilter/nft_meta.h>
  28
  29 #include <uapi/linux/netfilter_bridge.h> /* NF_BR_PRE_ROUTING */
  30
  31 static DEFINE_PER_CPU(struct rnd_state, nft_prandom_state);
  32
  33 void nft_meta_get_eval(const struct nft_expr *expr,
  34                        struct nft_regs *regs,
  35                        const struct nft_pktinfo *pkt)
  36 {
  37         const struct nft_meta *priv = nft_expr_priv(expr);
  38         const struct sk_buff *skb = pkt->skb;
  39         const struct net_device *in = nft_in(pkt), *out = nft_out(pkt);
  40         struct sock *sk;
  41         u32 *dest = &regs->data[priv->dreg];
  42
  43         switch (priv->key) {
  44         case NFT_META_LEN:
  45                 *dest = skb->len;
  46                 break;
  47         case NFT_META_PROTOCOL:
  48                 nft_reg_store16(dest, (__force u16)skb->protocol);
  49                 break;
  50         case NFT_META_NFPROTO:
  51                 nft_reg_store8(dest, nft_pf(pkt));
  52                 break;
  53         case NFT_META_L4PROTO:
  54                 if (!pkt->tprot_set)
  55                         goto err;
  56                 nft_reg_store8(dest, pkt->tprot);
  57                 break;
  58         case NFT_META_PRIORITY:
  59                 *dest = skb->priority;
  60                 break;
  61         case NFT_META_MARK:
  62                 *dest = skb->mark;
  63                 break;
  64         case NFT_META_IIF:
  65                 if (in == NULL)
  66                         goto err;
  67                 *dest = in->ifindex;
  68                 break;
  69         case NFT_META_OIF:
  70                 if (out == NULL)
  71                         goto err;
  72                 *dest = out->ifindex;
  73                 break;
  74         case NFT_META_IIFNAME:
  75                 if (in == NULL)
  76                         goto err;
  77                 strncpy((char *)dest, in->name, IFNAMSIZ);
  78                 break;
  79         case NFT_META_OIFNAME:
  80                 if (out == NULL)
  81                         goto err;
  82                 strncpy((char *)dest, out->name, IFNAMSIZ);
  83                 break;
  84         case NFT_META_IIFTYPE:
  85                 if (in == NULL)
  86                         goto err;
  87                 nft_reg_store16(dest, in->type);
  88                 break;
  89         case NFT_META_OIFTYPE:
  90                 if (out == NULL)
  91                         goto err;
  92                 nft_reg_store16(dest, out->type);
  93                 break;
  94         case NFT_META_SKUID:
  95                 sk = skb_to_full_sk(skb);
  96                 if (!sk || !sk_fullsock(sk))
  97                         goto err;
  98
  99                 read_lock_bh(&sk->sk_callback_lock);
 100                 if (sk->sk_socket == NULL ||
 101                     sk->sk_socket->file == NULL) {
 102                         read_unlock_bh(&sk->sk_callback_lock);
 103                         goto err;
 104                 }
 105
 106                 *dest = from_kuid_munged(&init_user_ns,
 107                                 sk->sk_socket->file->f_cred->fsuid);
 108                 read_unlock_bh(&sk->sk_callback_lock);
 109                 break;
 110         case NFT_META_SKGID:
 111                 sk = skb_to_full_sk(skb);
 112                 if (!sk || !sk_fullsock(sk))
 113                         goto err;
 114
 115                 read_lock_bh(&sk->sk_callback_lock);
 116                 if (sk->sk_socket == NULL ||
 117                     sk->sk_socket->file == NULL) {
 118                         read_unlock_bh(&sk->sk_callback_lock);
 119                         goto err;
 120                 }
 121                 *dest = from_kgid_munged(&init_user_ns,
 122                                  sk->sk_socket->file->f_cred->fsgid);
 123                 read_unlock_bh(&sk->sk_callback_lock);
 124                 break;
 125 #ifdef CONFIG_IP_ROUTE_CLASSID
 126         case NFT_META_RTCLASSID: {
 127                 const struct dst_entry *dst = skb_dst(skb);
 128
 129                 if (dst == NULL)
 130                         goto err;
 131                 *dest = dst->tclassid;
 132                 break;
 133         }
 134 #endif
 135 #ifdef CONFIG_NETWORK_SECMARK
 136         case NFT_META_SECMARK:
 137                 *dest = skb->secmark;
 138                 break;
 139 #endif
 140         case NFT_META_PKTTYPE:
 141                 if (skb->pkt_type != PACKET_LOOPBACK) {
 142                         nft_reg_store8(dest, skb->pkt_type);
 143                         break;
 144                 }
 145
 146                 switch (nft_pf(pkt)) {
 147                 case NFPROTO_IPV4:
 148                         if (ipv4_is_multicast(ip_hdr(skb)->daddr))
 149                                 nft_reg_store8(dest, PACKET_MULTICAST);
 150                         else
 151                                 nft_reg_store8(dest, PACKET_BROADCAST);
 152                         break;
 153                 case NFPROTO_IPV6:
 154                         nft_reg_store8(dest, PACKET_MULTICAST);
 155                         break;
 156                 case NFPROTO_NETDEV:
 157                         switch (skb->protocol) {
 158                         case htons(ETH_P_IP): {
 159                                 int noff = skb_network_offset(skb);
 160                                 struct iphdr *iph, _iph;
 161
 162                                 iph = skb_header_pointer(skb, noff,
 163                                                          sizeof(_iph), &_iph);
 164                                 if (!iph)
 165                                         goto err;
 166
 167                                 if (ipv4_is_multicast(iph->daddr))
 168                                         nft_reg_store8(dest, PACKET_MULTICAST);
 169                                 else
 170                                         nft_reg_store8(dest, PACKET_BROADCAST);
 171
 172                                 break;
 173                         }
 174                         case htons(ETH_P_IPV6):
 175                                 nft_reg_store8(dest, PACKET_MULTICAST);
 176                                 break;
 177                         default:
 178                                 WARN_ON_ONCE(1);
 179                                 goto err;
 180                         }
 181                         break;
 182                 default:
 183                         WARN_ON_ONCE(1);
 184                         goto err;
 185                 }
 186                 break;
 187         case NFT_META_CPU:
 188                 *dest = raw_smp_processor_id();
 189                 break;
 190         case NFT_META_IIFGROUP:
 191                 if (in == NULL)
 192                         goto err;
 193                 *dest = in->group;
 194                 break;
 195         case NFT_META_OIFGROUP:
 196                 if (out == NULL)
 197                         goto err;
 198                 *dest = out->group;
 199                 break;
 200 #ifdef CONFIG_CGROUP_NET_CLASSID
 201         case NFT_META_CGROUP:
 202                 sk = skb_to_full_sk(skb);
 203                 if (!sk || !sk_fullsock(sk))
 204                         goto err;
 205                 *dest = sock_cgroup_classid(&sk->sk_cgrp_data);
 206                 break;
 207 #endif
 208         case NFT_META_PRANDOM: {
 209                 struct rnd_state *state = this_cpu_ptr(&nft_prandom_state);
 210                 *dest = prandom_u32_state(state);
 211                 break;
 212         }
 213 #ifdef CONFIG_XFRM
 214         case NFT_META_SECPATH:
 215                 nft_reg_store8(dest, !!skb->sp);
 216                 break;
 217 #endif
 218         default:
 219                 WARN_ON(1);
 220                 goto err;
 221         }
 222         return;
 223
 224 err:
 225         regs->verdict.code = NFT_BREAK;
 226 }
 227 EXPORT_SYMBOL_GPL(nft_meta_get_eval);
 228
 229 void nft_meta_set_eval(const struct nft_expr *expr,
 230                        struct nft_regs *regs,
 231                        const struct nft_pktinfo *pkt)
 232 {
 233         const struct nft_meta *meta = nft_expr_priv(expr);
 234         struct sk_buff *skb = pkt->skb;
 235         u32 *sreg = &regs->data[meta->sreg];
 236         u32 value = *sreg;
 237         u8 pkt_type;
 238
 239         switch (meta->key) {
 240         case NFT_META_MARK:
 241                 skb->mark = value;
 242                 break;
 243         case NFT_META_PRIORITY:
 244                 skb->priority = value;
 245                 break;
 246         case NFT_META_PKTTYPE:
 247                 pkt_type = nft_reg_load8(sreg);
 248
 249                 if (skb->pkt_type != pkt_type &&
 250                     skb_pkt_type_ok(pkt_type) &&
 251                     skb_pkt_type_ok(skb->pkt_type))
 252                         skb->pkt_type = pkt_type;
 253                 break;
 254         case NFT_META_NFTRACE:
 255                 skb->nf_trace = !!value;
 256                 break;
 257         default:
 258                 WARN_ON(1);
 259         }
 260 }
 261 EXPORT_SYMBOL_GPL(nft_meta_set_eval);
 262
 263 const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = {
 264         [NFTA_META_DREG]        = { .type = NLA_U32 },
 265         [NFTA_META_KEY]         = { .type = NLA_U32 },
 266         [NFTA_META_SREG]        = { .type = NLA_U32 },
 267 };
 268 EXPORT_SYMBOL_GPL(nft_meta_policy);
 269
 270 int nft_meta_get_init(const struct nft_ctx *ctx,
 271                       const struct nft_expr *expr,
 272                       const struct nlattr * const tb[])
 273 {
 274         struct nft_meta *priv = nft_expr_priv(expr);
 275         unsigned int len;
 276
 277         priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
 278         switch (priv->key) {
 279         case NFT_META_PROTOCOL:
 280         case NFT_META_IIFTYPE:
 281         case NFT_META_OIFTYPE:
 282                 len = sizeof(u16);
 283                 break;
 284         case NFT_META_NFPROTO:
 285         case NFT_META_L4PROTO:
 286         case NFT_META_LEN:
 287         case NFT_META_PRIORITY:
 288         case NFT_META_MARK:
 289         case NFT_META_IIF:
 290         case NFT_META_OIF:
 291         case NFT_META_SKUID:
 292         case NFT_META_SKGID:
 293 #ifdef CONFIG_IP_ROUTE_CLASSID
 294         case NFT_META_RTCLASSID:
 295 #endif
 296 #ifdef CONFIG_NETWORK_SECMARK
 297         case NFT_META_SECMARK:
 298 #endif
 299         case NFT_META_PKTTYPE:
 300         case NFT_META_CPU:
 301         case NFT_META_IIFGROUP:
 302         case NFT_META_OIFGROUP:
 303 #ifdef CONFIG_CGROUP_NET_CLASSID
 304         case NFT_META_CGROUP:
 305 #endif
 306                 len = sizeof(u32);
 307                 break;
 308         case NFT_META_IIFNAME:
 309         case NFT_META_OIFNAME:
 310                 len = IFNAMSIZ;
 311                 break;
 312         case NFT_META_PRANDOM:
 313                 prandom_init_once(&nft_prandom_state);
 314                 len = sizeof(u32);
 315                 break;
 316 #ifdef CONFIG_XFRM
 317         case NFT_META_SECPATH:
 318                 len = sizeof(u8);
 319                 break;
 320 #endif
 321         default:
 322                 return -EOPNOTSUPP;
 323         }
 324
 325         priv->dreg = nft_parse_register(tb[NFTA_META_DREG]);
 326         return nft_validate_register_store(ctx, priv->dreg, NULL,
 327                                            NFT_DATA_VALUE, len);
 328 }
 329 EXPORT_SYMBOL_GPL(nft_meta_get_init);
 330
 331 static int nft_meta_get_validate(const struct nft_ctx *ctx,
 332                                  const struct nft_expr *expr,
 333                                  const struct nft_data **data)
 334 {
 335 #ifdef CONFIG_XFRM
 336         const struct nft_meta *priv = nft_expr_priv(expr);
 337         unsigned int hooks;
 338
 339         if (priv->key != NFT_META_SECPATH)
 340                 return 0;
 341
 342         switch (ctx->family) {
 343         case NFPROTO_NETDEV:
 344                 hooks = 1 << NF_NETDEV_INGRESS;
 345                 break;
 346         case NFPROTO_IPV4:
 347         case NFPROTO_IPV6:
 348         case NFPROTO_INET:
 349                 hooks = (1 << NF_INET_PRE_ROUTING) |
 350                         (1 << NF_INET_LOCAL_IN) |
 351                         (1 << NF_INET_FORWARD);
 352                 break;
 353         default:
 354                 return -EOPNOTSUPP;
 355         }
 356
 357         return nft_chain_validate_hooks(ctx->chain, hooks);
 358 #else
 359         return 0;
 360 #endif
 361 }
 362
 363 int nft_meta_set_validate(const struct nft_ctx *ctx,
 364                           const struct nft_expr *expr,
 365                           const struct nft_data **data)
 366 {
 367         struct nft_meta *priv = nft_expr_priv(expr);
 368         unsigned int hooks;
 369
 370         if (priv->key != NFT_META_PKTTYPE)
 371                 return 0;
 372
 373         switch (ctx->family) {
 374         case NFPROTO_BRIDGE:
 375                 hooks = 1 << NF_BR_PRE_ROUTING;
 376                 break;
 377         case NFPROTO_NETDEV:
 378                 hooks = 1 << NF_NETDEV_INGRESS;
 379                 break;
 380         case NFPROTO_IPV4:
 381         case NFPROTO_IPV6:
 382         case NFPROTO_INET:
 383                 hooks = 1 << NF_INET_PRE_ROUTING;
 384                 break;
 385         default:
 386                 return -EOPNOTSUPP;
 387         }
 388
 389         return nft_chain_validate_hooks(ctx->chain, hooks);
 390 }
 391 EXPORT_SYMBOL_GPL(nft_meta_set_validate);
 392
 393 int nft_meta_set_init(const struct nft_ctx *ctx,
 394                       const struct nft_expr *expr,
 395                       const struct nlattr * const tb[])
 396 {
 397         struct nft_meta *priv = nft_expr_priv(expr);
 398         unsigned int len;
 399         int err;
 400
 401         priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
 402         switch (priv->key) {
 403         case NFT_META_MARK:
 404         case NFT_META_PRIORITY:
 405                 len = sizeof(u32);
 406                 break;
 407         case NFT_META_NFTRACE:
 408                 len = sizeof(u8);
 409                 break;
 410         case NFT_META_PKTTYPE:
 411                 len = sizeof(u8);
 412                 break;
 413         default:
 414                 return -EOPNOTSUPP;
 415         }
 416
 417         priv->sreg = nft_parse_register(tb[NFTA_META_SREG]);
 418         err = nft_validate_register_load(priv->sreg, len);
 419         if (err < 0)
 420                 return err;
 421
 422         if (priv->key == NFT_META_NFTRACE)
 423                 static_branch_inc(&nft_trace_enabled);
 424
 425         return 0;
 426 }
 427 EXPORT_SYMBOL_GPL(nft_meta_set_init);
 428
 429 int nft_meta_get_dump(struct sk_buff *skb,
 430                       const struct nft_expr *expr)
 431 {
 432         const struct nft_meta *priv = nft_expr_priv(expr);
 433
 434         if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key)))
 435                 goto nla_put_failure;
 436         if (nft_dump_register(skb, NFTA_META_DREG, priv->dreg))
 437                 goto nla_put_failure;
 438         return 0;
 439
 440 nla_put_failure:
 441         return -1;
 442 }
 443 EXPORT_SYMBOL_GPL(nft_meta_get_dump);
 444
 445 int nft_meta_set_dump(struct sk_buff *skb,
 446                       const struct nft_expr *expr)
 447 {
 448         const struct nft_meta *priv = nft_expr_priv(expr);
 449
 450         if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key)))
 451                 goto nla_put_failure;
 452         if (nft_dump_register(skb, NFTA_META_SREG, priv->sreg))
 453                 goto nla_put_failure;
 454
 455         return 0;
 456
 457 nla_put_failure:
 458         return -1;
 459 }
 460 EXPORT_SYMBOL_GPL(nft_meta_set_dump);
 461
 462 void nft_meta_set_destroy(const struct nft_ctx *ctx,
 463                           const struct nft_expr *expr)
 464 {
 465         const struct nft_meta *priv = nft_expr_priv(expr);
 466
 467         if (priv->key == NFT_META_NFTRACE)
 468                 static_branch_dec(&nft_trace_enabled);
 469 }
 470 EXPORT_SYMBOL_GPL(nft_meta_set_destroy);
 471
 472 static struct nft_expr_type nft_meta_type;
 473 static const struct nft_expr_ops nft_meta_get_ops = {
 474         .type           = &nft_meta_type,
 475         .size           = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
 476         .eval           = nft_meta_get_eval,
 477         .init           = nft_meta_get_init,
 478         .dump           = nft_meta_get_dump,
 479         .validate       = nft_meta_get_validate,
 480 };
 481
 482 static const struct nft_expr_ops nft_meta_set_ops = {
 483         .type           = &nft_meta_type,
 484         .size           = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
 485         .eval           = nft_meta_set_eval,
 486         .init           = nft_meta_set_init,
 487         .destroy        = nft_meta_set_destroy,
 488         .dump           = nft_meta_set_dump,
 489         .validate       = nft_meta_set_validate,
 490 };
 491
 492 static const struct nft_expr_ops *
 493 nft_meta_select_ops(const struct nft_ctx *ctx,
 494                     const struct nlattr * const tb[])
 495 {
 496         if (tb[NFTA_META_KEY] == NULL)
 497                 return ERR_PTR(-EINVAL);
 498
 499         if (tb[NFTA_META_DREG] && tb[NFTA_META_SREG])
 500                 return ERR_PTR(-EINVAL);
 501
 502         if (tb[NFTA_META_DREG])
 503                 return &nft_meta_get_ops;
 504
 505         if (tb[NFTA_META_SREG])
 506                 return &nft_meta_set_ops;
 507
 508         return ERR_PTR(-EINVAL);
 509 }
 510
 511 static struct nft_expr_type nft_meta_type __read_mostly = {
 512         .name           = "meta",
 513         .select_ops     = nft_meta_select_ops,
 514         .policy         = nft_meta_policy,
 515         .maxattr        = NFTA_META_MAX,
 516         .owner          = THIS_MODULE,
 517 };
 518
 519 static int __init nft_meta_module_init(void)
 520 {
 521         return nft_register_expr(&nft_meta_type);
 522 }
 523
 524 static void __exit nft_meta_module_exit(void)
 525 {
 526         nft_unregister_expr(&nft_meta_type);
 527 }
 528
 529 module_init(nft_meta_module_init);
 530 module_exit(nft_meta_module_exit);
 531
 532 MODULE_LICENSE("GPL");
 533 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 534 MODULE_ALIAS_NFT_EXPR("meta");