net/netfilter/nft_rt.c

   1 /*
   2  * Copyright (c) 2016 Anders K. Pedersen <akp@cohaesio.com>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8
   9 #include <linux/kernel.h>
  10 #include <linux/netlink.h>
  11 #include <linux/netfilter.h>
  12 #include <linux/netfilter/nf_tables.h>
  13 #include <net/dst.h>
  14 #include <net/ip6_route.h>
  15 #include <net/route.h>
  16 #include <net/netfilter/nf_tables.h>
  17 #include <net/netfilter/nf_tables_core.h>
  18
  19 struct nft_rt {
  20         enum nft_rt_keys        key:8;
  21         enum nft_registers      dreg:8;
  22 };
  23
  24 static u16 get_tcpmss(const struct nft_pktinfo *pkt, const struct dst_entry *skbdst)
  25 {
  26         u32 minlen = sizeof(struct ipv6hdr), mtu = dst_mtu(skbdst);
  27         const struct sk_buff *skb = pkt->skb;
  28         struct dst_entry *dst = NULL;
  29         struct flowi fl;
  30
  31         memset(&fl, 0, sizeof(fl));
  32
  33         switch (nft_pf(pkt)) {
  34         case NFPROTO_IPV4:
  35                 fl.u.ip4.daddr = ip_hdr(skb)->saddr;
  36                 minlen = sizeof(struct iphdr) + sizeof(struct tcphdr);
  37                 break;
  38         case NFPROTO_IPV6:
  39                 fl.u.ip6.daddr = ipv6_hdr(skb)->saddr;
  40                 minlen = sizeof(struct ipv6hdr) + sizeof(struct tcphdr);
  41                 break;
  42         }
  43
  44         nf_route(nft_net(pkt), &dst, &fl, false, nft_pf(pkt));
  45         if (dst) {
  46                 mtu = min(mtu, dst_mtu(dst));
  47                 dst_release(dst);
  48         }
  49
  50         if (mtu <= minlen || mtu > 0xffff)
  51                 return TCP_MSS_DEFAULT;
  52
  53         return mtu - minlen;
  54 }
  55
  56 void nft_rt_get_eval(const struct nft_expr *expr,
  57                      struct nft_regs *regs,
  58                      const struct nft_pktinfo *pkt)
  59 {
  60         const struct nft_rt *priv = nft_expr_priv(expr);
  61         const struct sk_buff *skb = pkt->skb;
  62         u32 *dest = &regs->data[priv->dreg];
  63         const struct dst_entry *dst;
  64
  65         dst = skb_dst(skb);
  66         if (!dst)
  67                 goto err;
  68
  69         switch (priv->key) {
  70 #ifdef CONFIG_IP_ROUTE_CLASSID
  71         case NFT_RT_CLASSID:
  72                 *dest = dst->tclassid;
  73                 break;
  74 #endif
  75         case NFT_RT_NEXTHOP4:
  76                 if (nft_pf(pkt) != NFPROTO_IPV4)
  77                         goto err;
  78
  79                 *dest = (__force u32)rt_nexthop((const struct rtable *)dst,
  80                                                 ip_hdr(skb)->daddr);
  81                 break;
  82         case NFT_RT_NEXTHOP6:
  83                 if (nft_pf(pkt) != NFPROTO_IPV6)
  84                         goto err;
  85
  86                 memcpy(dest, rt6_nexthop((struct rt6_info *)dst,
  87                                          &ipv6_hdr(skb)->daddr),
  88                        sizeof(struct in6_addr));
  89                 break;
  90         case NFT_RT_TCPMSS:
  91                 nft_reg_store16(dest, get_tcpmss(pkt, dst));
  92                 break;
  93 #ifdef CONFIG_XFRM
  94         case NFT_RT_XFRM:
  95                 nft_reg_store8(dest, !!dst->xfrm);
  96                 break;
  97 #endif
  98         default:
  99                 WARN_ON(1);
 100                 goto err;
 101         }
 102         return;
 103
 104 err:
 105         regs->verdict.code = NFT_BREAK;
 106 }
 107
 108 static const struct nla_policy nft_rt_policy[NFTA_RT_MAX + 1] = {
 109         [NFTA_RT_DREG]          = { .type = NLA_U32 },
 110         [NFTA_RT_KEY]           = { .type = NLA_U32 },
 111 };
 112
 113 static int nft_rt_get_init(const struct nft_ctx *ctx,
 114                            const struct nft_expr *expr,
 115                            const struct nlattr * const tb[])
 116 {
 117         struct nft_rt *priv = nft_expr_priv(expr);
 118         unsigned int len;
 119
 120         if (tb[NFTA_RT_KEY] == NULL ||
 121             tb[NFTA_RT_DREG] == NULL)
 122                 return -EINVAL;
 123
 124         priv->key = ntohl(nla_get_be32(tb[NFTA_RT_KEY]));
 125         switch (priv->key) {
 126 #ifdef CONFIG_IP_ROUTE_CLASSID
 127         case NFT_RT_CLASSID:
 128 #endif
 129         case NFT_RT_NEXTHOP4:
 130                 len = sizeof(u32);
 131                 break;
 132         case NFT_RT_NEXTHOP6:
 133                 len = sizeof(struct in6_addr);
 134                 break;
 135         case NFT_RT_TCPMSS:
 136                 len = sizeof(u16);
 137                 break;
 138 #ifdef CONFIG_XFRM
 139         case NFT_RT_XFRM:
 140                 len = sizeof(u8);
 141                 break;
 142 #endif
 143         default:
 144                 return -EOPNOTSUPP;
 145         }
 146
 147         priv->dreg = nft_parse_register(tb[NFTA_RT_DREG]);
 148         return nft_validate_register_store(ctx, priv->dreg, NULL,
 149                                            NFT_DATA_VALUE, len);
 150 }
 151
 152 static int nft_rt_get_dump(struct sk_buff *skb,
 153                            const struct nft_expr *expr)
 154 {
 155         const struct nft_rt *priv = nft_expr_priv(expr);
 156
 157         if (nla_put_be32(skb, NFTA_RT_KEY, htonl(priv->key)))
 158                 goto nla_put_failure;
 159         if (nft_dump_register(skb, NFTA_RT_DREG, priv->dreg))
 160                 goto nla_put_failure;
 161         return 0;
 162
 163 nla_put_failure:
 164         return -1;
 165 }
 166
 167 static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
 168                            const struct nft_data **data)
 169 {
 170         const struct nft_rt *priv = nft_expr_priv(expr);
 171         unsigned int hooks;
 172
 173         switch (priv->key) {
 174         case NFT_RT_NEXTHOP4:
 175         case NFT_RT_NEXTHOP6:
 176         case NFT_RT_CLASSID:
 177         case NFT_RT_XFRM:
 178                 return 0;
 179         case NFT_RT_TCPMSS:
 180                 hooks = (1 << NF_INET_FORWARD) |
 181                         (1 << NF_INET_LOCAL_OUT) |
 182                         (1 << NF_INET_POST_ROUTING);
 183                 break;
 184         default:
 185                 return -EINVAL;
 186         }
 187
 188         return nft_chain_validate_hooks(ctx->chain, hooks);
 189 }
 190
 191 static const struct nft_expr_ops nft_rt_get_ops = {
 192         .type           = &nft_rt_type,
 193         .size           = NFT_EXPR_SIZE(sizeof(struct nft_rt)),
 194         .eval           = nft_rt_get_eval,
 195         .init           = nft_rt_get_init,
 196         .dump           = nft_rt_get_dump,
 197         .validate       = nft_rt_validate,
 198 };
 199
 200 struct nft_expr_type nft_rt_type __read_mostly = {
 201         .name           = "rt",
 202         .ops            = &nft_rt_get_ops,
 203         .policy         = nft_rt_policy,
 204         .maxattr        = NFTA_RT_MAX,
 205         .owner          = THIS_MODULE,
 206 };