net/netfilter/nft_meta.c

   1 /*
   2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   3  * Copyright (c) 2014 Intel Corporation
   4  * Author: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  *
  10  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  11  */
  12
  13 #include <linux/kernel.h>
  14 #include <linux/netlink.h>
  15 #include <linux/netfilter.h>
  16 #include <linux/netfilter/nf_tables.h>
  17 #include <linux/in.h>
  18 #include <linux/ip.h>
  19 #include <linux/ipv6.h>
  20 #include <linux/smp.h>
  21 #include <linux/static_key.h>
  22 #include <net/dst.h>
  23 #include <net/sock.h>
  24 #include <net/tcp_states.h> /* for TCP_TIME_WAIT */
  25 #include <net/netfilter/nf_tables.h>
  26 #include <net/netfilter/nf_tables_core.h>
  27
  28 #include <uapi/linux/netfilter_bridge.h> /* NF_BR_PRE_ROUTING */
  29
  30 struct nft_meta {
  31         enum nft_meta_keys      key:8;
  32         union {
  33                 enum nft_registers      dreg:8;
  34                 enum nft_registers      sreg:8;
  35         };
  36 };
  37
  38 static DEFINE_PER_CPU(struct rnd_state, nft_prandom_state);
  39
  40 #ifdef CONFIG_NF_TABLES_BRIDGE
  41 #include "../bridge/br_private.h"
  42 #endif
  43
  44 void nft_meta_get_eval(const struct nft_expr *expr,
  45                        struct nft_regs *regs,
  46                        const struct nft_pktinfo *pkt)
  47 {
  48         const struct nft_meta *priv = nft_expr_priv(expr);
  49         const struct sk_buff *skb = pkt->skb;
  50         const struct net_device *in = nft_in(pkt), *out = nft_out(pkt);
  51         struct sock *sk;
  52         u32 *dest = &regs->data[priv->dreg];
  53 #ifdef CONFIG_NF_TABLES_BRIDGE
  54         const struct net_bridge_port *p;
  55 #endif
  56
  57         switch (priv->key) {
  58         case NFT_META_LEN:
  59                 *dest = skb->len;
  60                 break;
  61         case NFT_META_PROTOCOL:
  62                 nft_reg_store16(dest, (__force u16)skb->protocol);
  63                 break;
  64         case NFT_META_NFPROTO:
  65                 nft_reg_store8(dest, nft_pf(pkt));
  66                 break;
  67         case NFT_META_L4PROTO:
  68                 if (!pkt->tprot_set)
  69                         goto err;
  70                 nft_reg_store8(dest, pkt->tprot);
  71                 break;
  72         case NFT_META_PRIORITY:
  73                 *dest = skb->priority;
  74                 break;
  75         case NFT_META_MARK:
  76                 *dest = skb->mark;
  77                 break;
  78         case NFT_META_IIF:
  79                 if (in == NULL)
  80                         goto err;
  81                 *dest = in->ifindex;
  82                 break;
  83         case NFT_META_OIF:
  84                 if (out == NULL)
  85                         goto err;
  86                 *dest = out->ifindex;
  87                 break;
  88         case NFT_META_IIFNAME:
  89                 if (in == NULL)
  90                         goto err;
  91                 strncpy((char *)dest, in->name, IFNAMSIZ);
  92                 break;
  93         case NFT_META_OIFNAME:
  94                 if (out == NULL)
  95                         goto err;
  96                 strncpy((char *)dest, out->name, IFNAMSIZ);
  97                 break;
  98         case NFT_META_IIFTYPE:
  99                 if (in == NULL)
 100                         goto err;
 101                 nft_reg_store16(dest, in->type);
 102                 break;
 103         case NFT_META_OIFTYPE:
 104                 if (out == NULL)
 105                         goto err;
 106                 nft_reg_store16(dest, out->type);
 107                 break;
 108         case NFT_META_SKUID:
 109                 sk = skb_to_full_sk(skb);
 110                 if (!sk || !sk_fullsock(sk) ||
 111                     !net_eq(nft_net(pkt), sock_net(sk)))
 112                         goto err;
 113
 114                 read_lock_bh(&sk->sk_callback_lock);
 115                 if (sk->sk_socket == NULL ||
 116                     sk->sk_socket->file == NULL) {
 117                         read_unlock_bh(&sk->sk_callback_lock);
 118                         goto err;
 119                 }
 120
 121                 *dest = from_kuid_munged(&init_user_ns,
 122                                 sk->sk_socket->file->f_cred->fsuid);
 123                 read_unlock_bh(&sk->sk_callback_lock);
 124                 break;
 125         case NFT_META_SKGID:
 126                 sk = skb_to_full_sk(skb);
 127                 if (!sk || !sk_fullsock(sk) ||
 128                     !net_eq(nft_net(pkt), sock_net(sk)))
 129                         goto err;
 130
 131                 read_lock_bh(&sk->sk_callback_lock);
 132                 if (sk->sk_socket == NULL ||
 133                     sk->sk_socket->file == NULL) {
 134                         read_unlock_bh(&sk->sk_callback_lock);
 135                         goto err;
 136                 }
 137                 *dest = from_kgid_munged(&init_user_ns,
 138                                  sk->sk_socket->file->f_cred->fsgid);
 139                 read_unlock_bh(&sk->sk_callback_lock);
 140                 break;
 141 #ifdef CONFIG_IP_ROUTE_CLASSID
 142         case NFT_META_RTCLASSID: {
 143                 const struct dst_entry *dst = skb_dst(skb);
 144
 145                 if (dst == NULL)
 146                         goto err;
 147                 *dest = dst->tclassid;
 148                 break;
 149         }
 150 #endif
 151 #ifdef CONFIG_NETWORK_SECMARK
 152         case NFT_META_SECMARK:
 153                 *dest = skb->secmark;
 154                 break;
 155 #endif
 156         case NFT_META_PKTTYPE:
 157                 if (skb->pkt_type != PACKET_LOOPBACK) {
 158                         nft_reg_store8(dest, skb->pkt_type);
 159                         break;
 160                 }
 161
 162                 switch (nft_pf(pkt)) {
 163                 case NFPROTO_IPV4:
 164                         if (ipv4_is_multicast(ip_hdr(skb)->daddr))
 165                                 nft_reg_store8(dest, PACKET_MULTICAST);
 166                         else
 167                                 nft_reg_store8(dest, PACKET_BROADCAST);
 168                         break;
 169                 case NFPROTO_IPV6:
 170                         nft_reg_store8(dest, PACKET_MULTICAST);
 171                         break;
 172                 case NFPROTO_NETDEV:
 173                         switch (skb->protocol) {
 174                         case htons(ETH_P_IP): {
 175                                 int noff = skb_network_offset(skb);
 176                                 struct iphdr *iph, _iph;
 177
 178                                 iph = skb_header_pointer(skb, noff,
 179                                                          sizeof(_iph), &_iph);
 180                                 if (!iph)
 181                                         goto err;
 182
 183                                 if (ipv4_is_multicast(iph->daddr))
 184                                         nft_reg_store8(dest, PACKET_MULTICAST);
 185                                 else
 186                                         nft_reg_store8(dest, PACKET_BROADCAST);
 187
 188                                 break;
 189                         }
 190                         case htons(ETH_P_IPV6):
 191                                 nft_reg_store8(dest, PACKET_MULTICAST);
 192                                 break;
 193                         default:
 194                                 WARN_ON_ONCE(1);
 195                                 goto err;
 196                         }
 197                         break;
 198                 default:
 199                         WARN_ON_ONCE(1);
 200                         goto err;
 201                 }
 202                 break;
 203         case NFT_META_CPU:
 204                 *dest = raw_smp_processor_id();
 205                 break;
 206         case NFT_META_IIFGROUP:
 207                 if (in == NULL)
 208                         goto err;
 209                 *dest = in->group;
 210                 break;
 211         case NFT_META_OIFGROUP:
 212                 if (out == NULL)
 213                         goto err;
 214                 *dest = out->group;
 215                 break;
 216 #ifdef CONFIG_CGROUP_NET_CLASSID
 217         case NFT_META_CGROUP:
 218                 sk = skb_to_full_sk(skb);
 219                 if (!sk || !sk_fullsock(sk) ||
 220                     !net_eq(nft_net(pkt), sock_net(sk)))
 221                         goto err;
 222                 *dest = sock_cgroup_classid(&sk->sk_cgrp_data);
 223                 break;
 224 #endif
 225         case NFT_META_PRANDOM: {
 226                 struct rnd_state *state = this_cpu_ptr(&nft_prandom_state);
 227                 *dest = prandom_u32_state(state);
 228                 break;
 229         }
 230 #ifdef CONFIG_XFRM
 231         case NFT_META_SECPATH:
 232                 nft_reg_store8(dest, !!skb->sp);
 233                 break;
 234 #endif
 235 #ifdef CONFIG_NF_TABLES_BRIDGE
 236         case NFT_META_BRI_IIFNAME:
 237                 if (in == NULL || (p = br_port_get_rcu(in)) == NULL)
 238                         goto err;
 239                 strncpy((char *)dest, p->br->dev->name, IFNAMSIZ);
 240                 return;
 241         case NFT_META_BRI_OIFNAME:
 242                 if (out == NULL || (p = br_port_get_rcu(out)) == NULL)
 243                         goto err;
 244                 strncpy((char *)dest, p->br->dev->name, IFNAMSIZ);
 245                 return;
 246 #endif
 247         default:
 248                 WARN_ON(1);
 249                 goto err;
 250         }
 251         return;
 252
 253 err:
 254         regs->verdict.code = NFT_BREAK;
 255 }
 256
 257 static void nft_meta_set_eval(const struct nft_expr *expr,
 258                               struct nft_regs *regs,
 259                                const struct nft_pktinfo *pkt)
 260 {
 261         const struct nft_meta *meta = nft_expr_priv(expr);
 262         struct sk_buff *skb = pkt->skb;
 263         u32 *sreg = &regs->data[meta->sreg];
 264         u32 value = *sreg;
 265         u8 value8;
 266
 267         switch (meta->key) {
 268         case NFT_META_MARK:
 269                 skb->mark = value;
 270                 break;
 271         case NFT_META_PRIORITY:
 272                 skb->priority = value;
 273                 break;
 274         case NFT_META_PKTTYPE:
 275                 value8 = nft_reg_load8(sreg);
 276
 277                 if (skb->pkt_type != value8 &&
 278                     skb_pkt_type_ok(value8) &&
 279                     skb_pkt_type_ok(skb->pkt_type))
 280                         skb->pkt_type = value8;
 281                 break;
 282         case NFT_META_NFTRACE:
 283                 value8 = nft_reg_load8(sreg);
 284
 285                 skb->nf_trace = !!value8;
 286                 break;
 287 #ifdef CONFIG_NETWORK_SECMARK
 288         case NFT_META_SECMARK:
 289                 skb->secmark = value;
 290                 break;
 291 #endif
 292         default:
 293                 WARN_ON(1);
 294         }
 295 }
 296
 297 static const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = {
 298         [NFTA_META_DREG]        = { .type = NLA_U32 },
 299         [NFTA_META_KEY]         = { .type = NLA_U32 },
 300         [NFTA_META_SREG]        = { .type = NLA_U32 },
 301 };
 302
 303 static int nft_meta_get_init(const struct nft_ctx *ctx,
 304                              const struct nft_expr *expr,
 305                              const struct nlattr * const tb[])
 306 {
 307         struct nft_meta *priv = nft_expr_priv(expr);
 308         unsigned int len;
 309
 310         priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
 311         switch (priv->key) {
 312         case NFT_META_PROTOCOL:
 313         case NFT_META_IIFTYPE:
 314         case NFT_META_OIFTYPE:
 315                 len = sizeof(u16);
 316                 break;
 317         case NFT_META_NFPROTO:
 318         case NFT_META_L4PROTO:
 319         case NFT_META_LEN:
 320         case NFT_META_PRIORITY:
 321         case NFT_META_MARK:
 322         case NFT_META_IIF:
 323         case NFT_META_OIF:
 324         case NFT_META_SKUID:
 325         case NFT_META_SKGID:
 326 #ifdef CONFIG_IP_ROUTE_CLASSID
 327         case NFT_META_RTCLASSID:
 328 #endif
 329 #ifdef CONFIG_NETWORK_SECMARK
 330         case NFT_META_SECMARK:
 331 #endif
 332         case NFT_META_PKTTYPE:
 333         case NFT_META_CPU:
 334         case NFT_META_IIFGROUP:
 335         case NFT_META_OIFGROUP:
 336 #ifdef CONFIG_CGROUP_NET_CLASSID
 337         case NFT_META_CGROUP:
 338 #endif
 339                 len = sizeof(u32);
 340                 break;
 341         case NFT_META_IIFNAME:
 342         case NFT_META_OIFNAME:
 343                 len = IFNAMSIZ;
 344                 break;
 345         case NFT_META_PRANDOM:
 346                 prandom_init_once(&nft_prandom_state);
 347                 len = sizeof(u32);
 348                 break;
 349 #ifdef CONFIG_XFRM
 350         case NFT_META_SECPATH:
 351                 len = sizeof(u8);
 352                 break;
 353 #endif
 354 #ifdef CONFIG_NF_TABLES_BRIDGE
 355         case NFT_META_BRI_IIFNAME:
 356         case NFT_META_BRI_OIFNAME:
 357                 if (ctx->family != NFPROTO_BRIDGE)
 358                         return -EOPNOTSUPP;
 359                 len = IFNAMSIZ;
 360                 break;
 361 #endif
 362         default:
 363                 return -EOPNOTSUPP;
 364         }
 365
 366         priv->dreg = nft_parse_register(tb[NFTA_META_DREG]);
 367         return nft_validate_register_store(ctx, priv->dreg, NULL,
 368                                            NFT_DATA_VALUE, len);
 369 }
 370
 371 static int nft_meta_get_validate(const struct nft_ctx *ctx,
 372                                  const struct nft_expr *expr,
 373                                  const struct nft_data **data)
 374 {
 375 #ifdef CONFIG_XFRM
 376         const struct nft_meta *priv = nft_expr_priv(expr);
 377         unsigned int hooks;
 378
 379         if (priv->key != NFT_META_SECPATH)
 380                 return 0;
 381
 382         switch (ctx->family) {
 383         case NFPROTO_NETDEV:
 384                 hooks = 1 << NF_NETDEV_INGRESS;
 385                 break;
 386         case NFPROTO_IPV4:
 387         case NFPROTO_IPV6:
 388         case NFPROTO_INET:
 389                 hooks = (1 << NF_INET_PRE_ROUTING) |
 390                         (1 << NF_INET_LOCAL_IN) |
 391                         (1 << NF_INET_FORWARD);
 392                 break;
 393         default:
 394                 return -EOPNOTSUPP;
 395         }
 396
 397         return nft_chain_validate_hooks(ctx->chain, hooks);
 398 #else
 399         return 0;
 400 #endif
 401 }
 402
 403 static int nft_meta_set_validate(const struct nft_ctx *ctx,
 404                                  const struct nft_expr *expr,
 405                                  const struct nft_data **data)
 406 {
 407         struct nft_meta *priv = nft_expr_priv(expr);
 408         unsigned int hooks;
 409
 410         if (priv->key != NFT_META_PKTTYPE)
 411                 return 0;
 412
 413         switch (ctx->family) {
 414         case NFPROTO_BRIDGE:
 415                 hooks = 1 << NF_BR_PRE_ROUTING;
 416                 break;
 417         case NFPROTO_NETDEV:
 418                 hooks = 1 << NF_NETDEV_INGRESS;
 419                 break;
 420         case NFPROTO_IPV4:
 421         case NFPROTO_IPV6:
 422         case NFPROTO_INET:
 423                 hooks = 1 << NF_INET_PRE_ROUTING;
 424                 break;
 425         default:
 426                 return -EOPNOTSUPP;
 427         }
 428
 429         return nft_chain_validate_hooks(ctx->chain, hooks);
 430 }
 431
 432 static int nft_meta_set_init(const struct nft_ctx *ctx,
 433                              const struct nft_expr *expr,
 434                              const struct nlattr * const tb[])
 435 {
 436         struct nft_meta *priv = nft_expr_priv(expr);
 437         unsigned int len;
 438         int err;
 439
 440         priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
 441         switch (priv->key) {
 442         case NFT_META_MARK:
 443         case NFT_META_PRIORITY:
 444 #ifdef CONFIG_NETWORK_SECMARK
 445         case NFT_META_SECMARK:
 446 #endif
 447                 len = sizeof(u32);
 448                 break;
 449         case NFT_META_NFTRACE:
 450                 len = sizeof(u8);
 451                 break;
 452         case NFT_META_PKTTYPE:
 453                 len = sizeof(u8);
 454                 break;
 455         default:
 456                 return -EOPNOTSUPP;
 457         }
 458
 459         priv->sreg = nft_parse_register(tb[NFTA_META_SREG]);
 460         err = nft_validate_register_load(priv->sreg, len);
 461         if (err < 0)
 462                 return err;
 463
 464         if (priv->key == NFT_META_NFTRACE)
 465                 static_branch_inc(&nft_trace_enabled);
 466
 467         return 0;
 468 }
 469
 470 static int nft_meta_get_dump(struct sk_buff *skb,
 471                              const struct nft_expr *expr)
 472 {
 473         const struct nft_meta *priv = nft_expr_priv(expr);
 474
 475         if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key)))
 476                 goto nla_put_failure;
 477         if (nft_dump_register(skb, NFTA_META_DREG, priv->dreg))
 478                 goto nla_put_failure;
 479         return 0;
 480
 481 nla_put_failure:
 482         return -1;
 483 }
 484
 485 static int nft_meta_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
 486 {
 487         const struct nft_meta *priv = nft_expr_priv(expr);
 488
 489         if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key)))
 490                 goto nla_put_failure;
 491         if (nft_dump_register(skb, NFTA_META_SREG, priv->sreg))
 492                 goto nla_put_failure;
 493
 494         return 0;
 495
 496 nla_put_failure:
 497         return -1;
 498 }
 499
 500 static void nft_meta_set_destroy(const struct nft_ctx *ctx,
 501                                  const struct nft_expr *expr)
 502 {
 503         const struct nft_meta *priv = nft_expr_priv(expr);
 504
 505         if (priv->key == NFT_META_NFTRACE)
 506                 static_branch_dec(&nft_trace_enabled);
 507 }
 508
 509 static const struct nft_expr_ops nft_meta_get_ops = {
 510         .type           = &nft_meta_type,
 511         .size           = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
 512         .eval           = nft_meta_get_eval,
 513         .init           = nft_meta_get_init,
 514         .dump           = nft_meta_get_dump,
 515         .validate       = nft_meta_get_validate,
 516 };
 517
 518 static const struct nft_expr_ops nft_meta_set_ops = {
 519         .type           = &nft_meta_type,
 520         .size           = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
 521         .eval           = nft_meta_set_eval,
 522         .init           = nft_meta_set_init,
 523         .destroy        = nft_meta_set_destroy,
 524         .dump           = nft_meta_set_dump,
 525         .validate       = nft_meta_set_validate,
 526 };
 527
 528 static const struct nft_expr_ops *
 529 nft_meta_select_ops(const struct nft_ctx *ctx,
 530                     const struct nlattr * const tb[])
 531 {
 532         if (tb[NFTA_META_KEY] == NULL)
 533                 return ERR_PTR(-EINVAL);
 534
 535         if (tb[NFTA_META_DREG] && tb[NFTA_META_SREG])
 536                 return ERR_PTR(-EINVAL);
 537
 538         if (tb[NFTA_META_DREG])
 539                 return &nft_meta_get_ops;
 540
 541         if (tb[NFTA_META_SREG])
 542                 return &nft_meta_set_ops;
 543
 544         return ERR_PTR(-EINVAL);
 545 }
 546
 547 struct nft_expr_type nft_meta_type __read_mostly = {
 548         .name           = "meta",
 549         .select_ops     = nft_meta_select_ops,
 550         .policy         = nft_meta_policy,
 551         .maxattr        = NFTA_META_MAX,
 552         .owner          = THIS_MODULE,
 553 };
 554
 555 #ifdef CONFIG_NETWORK_SECMARK
 556 struct nft_secmark {
 557         u32 secid;
 558         char *ctx;
 559 };
 560
 561 static const struct nla_policy nft_secmark_policy[NFTA_SECMARK_MAX + 1] = {
 562         [NFTA_SECMARK_CTX]     = { .type = NLA_STRING, .len = NFT_SECMARK_CTX_MAXLEN },
 563 };
 564
 565 static int nft_secmark_compute_secid(struct nft_secmark *priv)
 566 {
 567         u32 tmp_secid = 0;
 568         int err;
 569
 570         err = security_secctx_to_secid(priv->ctx, strlen(priv->ctx), &tmp_secid);
 571         if (err)
 572                 return err;
 573
 574         if (!tmp_secid)
 575                 return -ENOENT;
 576
 577         err = security_secmark_relabel_packet(tmp_secid);
 578         if (err)
 579                 return err;
 580
 581         priv->secid = tmp_secid;
 582         return 0;
 583 }
 584
 585 static void nft_secmark_obj_eval(struct nft_object *obj, struct nft_regs *regs,
 586                                  const struct nft_pktinfo *pkt)
 587 {
 588         const struct nft_secmark *priv = nft_obj_data(obj);
 589         struct sk_buff *skb = pkt->skb;
 590
 591         skb->secmark = priv->secid;
 592 }
 593
 594 static int nft_secmark_obj_init(const struct nft_ctx *ctx,
 595                                 const struct nlattr * const tb[],
 596                                 struct nft_object *obj)
 597 {
 598         struct nft_secmark *priv = nft_obj_data(obj);
 599         int err;
 600
 601         if (tb[NFTA_SECMARK_CTX] == NULL)
 602                 return -EINVAL;
 603
 604         priv->ctx = nla_strdup(tb[NFTA_SECMARK_CTX], GFP_KERNEL);
 605         if (!priv->ctx)
 606                 return -ENOMEM;
 607
 608         err = nft_secmark_compute_secid(priv);
 609         if (err) {
 610                 kfree(priv->ctx);
 611                 return err;
 612         }
 613
 614         security_secmark_refcount_inc();
 615
 616         return 0;
 617 }
 618
 619 static int nft_secmark_obj_dump(struct sk_buff *skb, struct nft_object *obj,
 620                                 bool reset)
 621 {
 622         struct nft_secmark *priv = nft_obj_data(obj);
 623         int err;
 624
 625         if (nla_put_string(skb, NFTA_SECMARK_CTX, priv->ctx))
 626                 return -1;
 627
 628         if (reset) {
 629                 err = nft_secmark_compute_secid(priv);
 630                 if (err)
 631                         return err;
 632         }
 633
 634         return 0;
 635 }
 636
 637 static void nft_secmark_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
 638 {
 639         struct nft_secmark *priv = nft_obj_data(obj);
 640
 641         security_secmark_refcount_dec();
 642
 643         kfree(priv->ctx);
 644 }
 645
 646 static const struct nft_object_ops nft_secmark_obj_ops = {
 647         .type           = &nft_secmark_obj_type,
 648         .size           = sizeof(struct nft_secmark),
 649         .init           = nft_secmark_obj_init,
 650         .eval           = nft_secmark_obj_eval,
 651         .dump           = nft_secmark_obj_dump,
 652         .destroy        = nft_secmark_obj_destroy,
 653 };
 654 struct nft_object_type nft_secmark_obj_type __read_mostly = {
 655         .type           = NFT_OBJECT_SECMARK,
 656         .ops            = &nft_secmark_obj_ops,
 657         .maxattr        = NFTA_SECMARK_MAX,
 658         .policy         = nft_secmark_policy,
 659         .owner          = THIS_MODULE,
 660 };
 661 #endif /* CONFIG_NETWORK_SECMARK */