net/netfilter/nft_rt.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (c) 2016 Anders K. Pedersen <akp@cohaesio.com>
   4  */
   5
   6 #include <linux/kernel.h>
   7 #include <linux/netlink.h>
   8 #include <linux/netfilter.h>
   9 #include <linux/netfilter/nf_tables.h>
  10 #include <net/dst.h>
  11 #include <net/ip6_route.h>
  12 #include <net/route.h>
  13 #include <net/netfilter/nf_tables.h>
  14 #include <net/netfilter/nf_tables_core.h>
  15
  16 struct nft_rt {
  17         enum nft_rt_keys        key:8;
  18         u8                      dreg;
  19 };
  20
  21 static u16 get_tcpmss(const struct nft_pktinfo *pkt, const struct dst_entry *skbdst)
  22 {
  23         u32 minlen = sizeof(struct ipv6hdr), mtu = dst_mtu(skbdst);
  24         const struct sk_buff *skb = pkt->skb;
  25         struct dst_entry *dst = NULL;
  26         struct flowi fl;
  27
  28         memset(&fl, 0, sizeof(fl));
  29
  30         switch (nft_pf(pkt)) {
  31         case NFPROTO_IPV4:
  32                 fl.u.ip4.daddr = ip_hdr(skb)->saddr;
  33                 minlen = sizeof(struct iphdr) + sizeof(struct tcphdr);
  34                 break;
  35         case NFPROTO_IPV6:
  36                 fl.u.ip6.daddr = ipv6_hdr(skb)->saddr;
  37                 minlen = sizeof(struct ipv6hdr) + sizeof(struct tcphdr);
  38                 break;
  39         }
  40
  41         nf_route(nft_net(pkt), &dst, &fl, false, nft_pf(pkt));
  42         if (dst) {
  43                 mtu = min(mtu, dst_mtu(dst));
  44                 dst_release(dst);
  45         }
  46
  47         if (mtu <= minlen || mtu > 0xffff)
  48                 return TCP_MSS_DEFAULT;
  49
  50         return mtu - minlen;
  51 }
  52
  53 void nft_rt_get_eval(const struct nft_expr *expr,
  54                      struct nft_regs *regs,
  55                      const struct nft_pktinfo *pkt)
  56 {
  57         const struct nft_rt *priv = nft_expr_priv(expr);
  58         const struct sk_buff *skb = pkt->skb;
  59         u32 *dest = &regs->data[priv->dreg];
  60         const struct dst_entry *dst;
  61
  62         dst = skb_dst(skb);
  63         if (!dst)
  64                 goto err;
  65
  66         switch (priv->key) {
  67 #ifdef CONFIG_IP_ROUTE_CLASSID
  68         case NFT_RT_CLASSID:
  69                 *dest = dst->tclassid;
  70                 break;
  71 #endif
  72         case NFT_RT_NEXTHOP4:
  73                 if (nft_pf(pkt) != NFPROTO_IPV4)
  74                         goto err;
  75
  76                 *dest = (__force u32)rt_nexthop(dst_rtable(dst),
  77                                                 ip_hdr(skb)->daddr);
  78                 break;
  79         case NFT_RT_NEXTHOP6:
  80                 if (nft_pf(pkt) != NFPROTO_IPV6)
  81                         goto err;
  82
  83                 memcpy(dest, rt6_nexthop(dst_rt6_info(dst),
  84                                          &ipv6_hdr(skb)->daddr),
  85                        sizeof(struct in6_addr));
  86                 break;
  87         case NFT_RT_TCPMSS:
  88                 nft_reg_store16(dest, get_tcpmss(pkt, dst));
  89                 break;
  90 #ifdef CONFIG_XFRM
  91         case NFT_RT_XFRM:
  92                 nft_reg_store8(dest, !!dst->xfrm);
  93                 break;
  94 #endif
  95         default:
  96                 WARN_ON(1);
  97                 goto err;
  98         }
  99         return;
 100
 101 err:
 102         regs->verdict.code = NFT_BREAK;
 103 }
 104
 105 static const struct nla_policy nft_rt_policy[NFTA_RT_MAX + 1] = {
 106         [NFTA_RT_DREG]          = { .type = NLA_U32 },
 107         [NFTA_RT_KEY]           = NLA_POLICY_MAX(NLA_BE32, 255),
 108 };
 109
 110 static int nft_rt_get_init(const struct nft_ctx *ctx,
 111                            const struct nft_expr *expr,
 112                            const struct nlattr * const tb[])
 113 {
 114         struct nft_rt *priv = nft_expr_priv(expr);
 115         unsigned int len;
 116
 117         if (tb[NFTA_RT_KEY] == NULL ||
 118             tb[NFTA_RT_DREG] == NULL)
 119                 return -EINVAL;
 120
 121         priv->key = ntohl(nla_get_be32(tb[NFTA_RT_KEY]));
 122         switch (priv->key) {
 123 #ifdef CONFIG_IP_ROUTE_CLASSID
 124         case NFT_RT_CLASSID:
 125 #endif
 126         case NFT_RT_NEXTHOP4:
 127                 len = sizeof(u32);
 128                 break;
 129         case NFT_RT_NEXTHOP6:
 130                 len = sizeof(struct in6_addr);
 131                 break;
 132         case NFT_RT_TCPMSS:
 133                 len = sizeof(u16);
 134                 break;
 135 #ifdef CONFIG_XFRM
 136         case NFT_RT_XFRM:
 137                 len = sizeof(u8);
 138                 break;
 139 #endif
 140         default:
 141                 return -EOPNOTSUPP;
 142         }
 143
 144         return nft_parse_register_store(ctx, tb[NFTA_RT_DREG], &priv->dreg,
 145                                         NULL, NFT_DATA_VALUE, len);
 146 }
 147
 148 static int nft_rt_get_dump(struct sk_buff *skb,
 149                            const struct nft_expr *expr, bool reset)
 150 {
 151         const struct nft_rt *priv = nft_expr_priv(expr);
 152
 153         if (nla_put_be32(skb, NFTA_RT_KEY, htonl(priv->key)))
 154                 goto nla_put_failure;
 155         if (nft_dump_register(skb, NFTA_RT_DREG, priv->dreg))
 156                 goto nla_put_failure;
 157         return 0;
 158
 159 nla_put_failure:
 160         return -1;
 161 }
 162
 163 static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr)
 164 {
 165         const struct nft_rt *priv = nft_expr_priv(expr);
 166         unsigned int hooks;
 167
 168         if (ctx->family != NFPROTO_IPV4 &&
 169             ctx->family != NFPROTO_IPV6 &&
 170             ctx->family != NFPROTO_INET)
 171                 return -EOPNOTSUPP;
 172
 173         switch (priv->key) {
 174         case NFT_RT_NEXTHOP4:
 175         case NFT_RT_NEXTHOP6:
 176         case NFT_RT_CLASSID:
 177         case NFT_RT_XFRM:
 178                 return 0;
 179         case NFT_RT_TCPMSS:
 180                 hooks = (1 << NF_INET_FORWARD) |
 181                         (1 << NF_INET_LOCAL_OUT) |
 182                         (1 << NF_INET_POST_ROUTING);
 183                 break;
 184         default:
 185                 return -EINVAL;
 186         }
 187
 188         return nft_chain_validate_hooks(ctx->chain, hooks);
 189 }
 190
 191 static const struct nft_expr_ops nft_rt_get_ops = {
 192         .type           = &nft_rt_type,
 193         .size           = NFT_EXPR_SIZE(sizeof(struct nft_rt)),
 194         .eval           = nft_rt_get_eval,
 195         .init           = nft_rt_get_init,
 196         .dump           = nft_rt_get_dump,
 197         .validate       = nft_rt_validate,
 198         .reduce         = NFT_REDUCE_READONLY,
 199 };
 200
 201 struct nft_expr_type nft_rt_type __read_mostly = {
 202         .name           = "rt",
 203         .ops            = &nft_rt_get_ops,
 204         .policy         = nft_rt_policy,
 205         .maxattr        = NFTA_RT_MAX,
 206         .owner          = THIS_MODULE,
 207 };