1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * Copyright (c) 2016 Anders K. Pedersen <akp@cohaesio.com> |
4 | */ |
5 | |
6 | #include <linux/kernel.h> |
7 | #include <linux/netlink.h> |
8 | #include <linux/netfilter.h> |
9 | #include <linux/netfilter/nf_tables.h> |
10 | #include <net/dst.h> |
11 | #include <net/ip6_route.h> |
12 | #include <net/route.h> |
13 | #include <net/netfilter/nf_tables.h> |
14 | #include <net/netfilter/nf_tables_core.h> |
15 | |
16 | struct nft_rt { |
17 | enum nft_rt_keys key:8; |
18 | u8 dreg; |
19 | }; |
20 | |
21 | static u16 get_tcpmss(const struct nft_pktinfo *pkt, const struct dst_entry *skbdst) |
22 | { |
23 | u32 minlen = sizeof(struct ipv6hdr), mtu = dst_mtu(dst: skbdst); |
24 | const struct sk_buff *skb = pkt->skb; |
25 | struct dst_entry *dst = NULL; |
26 | struct flowi fl; |
27 | |
28 | memset(&fl, 0, sizeof(fl)); |
29 | |
30 | switch (nft_pf(pkt)) { |
31 | case NFPROTO_IPV4: |
32 | fl.u.ip4.daddr = ip_hdr(skb)->saddr; |
33 | minlen = sizeof(struct iphdr) + sizeof(struct tcphdr); |
34 | break; |
35 | case NFPROTO_IPV6: |
36 | fl.u.ip6.daddr = ipv6_hdr(skb)->saddr; |
37 | minlen = sizeof(struct ipv6hdr) + sizeof(struct tcphdr); |
38 | break; |
39 | } |
40 | |
41 | nf_route(net: nft_net(pkt), dst: &dst, fl: &fl, strict: false, family: nft_pf(pkt)); |
42 | if (dst) { |
43 | mtu = min(mtu, dst_mtu(dst)); |
44 | dst_release(dst); |
45 | } |
46 | |
47 | if (mtu <= minlen || mtu > 0xffff) |
48 | return TCP_MSS_DEFAULT; |
49 | |
50 | return mtu - minlen; |
51 | } |
52 | |
53 | void nft_rt_get_eval(const struct nft_expr *expr, |
54 | struct nft_regs *regs, |
55 | const struct nft_pktinfo *pkt) |
56 | { |
57 | const struct nft_rt *priv = nft_expr_priv(expr); |
58 | const struct sk_buff *skb = pkt->skb; |
59 | u32 *dest = ®s->data[priv->dreg]; |
60 | const struct dst_entry *dst; |
61 | |
62 | dst = skb_dst(skb); |
63 | if (!dst) |
64 | goto err; |
65 | |
66 | switch (priv->key) { |
67 | #ifdef CONFIG_IP_ROUTE_CLASSID |
68 | case NFT_RT_CLASSID: |
69 | *dest = dst->tclassid; |
70 | break; |
71 | #endif |
72 | case NFT_RT_NEXTHOP4: |
73 | if (nft_pf(pkt) != NFPROTO_IPV4) |
74 | goto err; |
75 | |
76 | *dest = (__force u32)rt_nexthop(rt: (const struct rtable *)dst, |
77 | daddr: ip_hdr(skb)->daddr); |
78 | break; |
79 | case NFT_RT_NEXTHOP6: |
80 | if (nft_pf(pkt) != NFPROTO_IPV6) |
81 | goto err; |
82 | |
83 | memcpy(dest, rt6_nexthop((struct rt6_info *)dst, |
84 | &ipv6_hdr(skb)->daddr), |
85 | sizeof(struct in6_addr)); |
86 | break; |
87 | case NFT_RT_TCPMSS: |
88 | nft_reg_store16(dreg: dest, val: get_tcpmss(pkt, skbdst: dst)); |
89 | break; |
90 | #ifdef CONFIG_XFRM |
91 | case NFT_RT_XFRM: |
92 | nft_reg_store8(dreg: dest, val: !!dst->xfrm); |
93 | break; |
94 | #endif |
95 | default: |
96 | WARN_ON(1); |
97 | goto err; |
98 | } |
99 | return; |
100 | |
101 | err: |
102 | regs->verdict.code = NFT_BREAK; |
103 | } |
104 | |
105 | static const struct nla_policy nft_rt_policy[NFTA_RT_MAX + 1] = { |
106 | [NFTA_RT_DREG] = { .type = NLA_U32 }, |
107 | [NFTA_RT_KEY] = NLA_POLICY_MAX(NLA_BE32, 255), |
108 | }; |
109 | |
110 | static int nft_rt_get_init(const struct nft_ctx *ctx, |
111 | const struct nft_expr *expr, |
112 | const struct nlattr * const tb[]) |
113 | { |
114 | struct nft_rt *priv = nft_expr_priv(expr); |
115 | unsigned int len; |
116 | |
117 | if (tb[NFTA_RT_KEY] == NULL || |
118 | tb[NFTA_RT_DREG] == NULL) |
119 | return -EINVAL; |
120 | |
121 | priv->key = ntohl(nla_get_be32(tb[NFTA_RT_KEY])); |
122 | switch (priv->key) { |
123 | #ifdef CONFIG_IP_ROUTE_CLASSID |
124 | case NFT_RT_CLASSID: |
125 | #endif |
126 | case NFT_RT_NEXTHOP4: |
127 | len = sizeof(u32); |
128 | break; |
129 | case NFT_RT_NEXTHOP6: |
130 | len = sizeof(struct in6_addr); |
131 | break; |
132 | case NFT_RT_TCPMSS: |
133 | len = sizeof(u16); |
134 | break; |
135 | #ifdef CONFIG_XFRM |
136 | case NFT_RT_XFRM: |
137 | len = sizeof(u8); |
138 | break; |
139 | #endif |
140 | default: |
141 | return -EOPNOTSUPP; |
142 | } |
143 | |
144 | return nft_parse_register_store(ctx, attr: tb[NFTA_RT_DREG], dreg: &priv->dreg, |
145 | NULL, type: NFT_DATA_VALUE, len); |
146 | } |
147 | |
148 | static int nft_rt_get_dump(struct sk_buff *skb, |
149 | const struct nft_expr *expr, bool reset) |
150 | { |
151 | const struct nft_rt *priv = nft_expr_priv(expr); |
152 | |
153 | if (nla_put_be32(skb, attrtype: NFTA_RT_KEY, htonl(priv->key))) |
154 | goto nla_put_failure; |
155 | if (nft_dump_register(skb, attr: NFTA_RT_DREG, reg: priv->dreg)) |
156 | goto nla_put_failure; |
157 | return 0; |
158 | |
159 | nla_put_failure: |
160 | return -1; |
161 | } |
162 | |
163 | static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, |
164 | const struct nft_data **data) |
165 | { |
166 | const struct nft_rt *priv = nft_expr_priv(expr); |
167 | unsigned int hooks; |
168 | |
169 | if (ctx->family != NFPROTO_IPV4 && |
170 | ctx->family != NFPROTO_IPV6 && |
171 | ctx->family != NFPROTO_INET) |
172 | return -EOPNOTSUPP; |
173 | |
174 | switch (priv->key) { |
175 | case NFT_RT_NEXTHOP4: |
176 | case NFT_RT_NEXTHOP6: |
177 | case NFT_RT_CLASSID: |
178 | case NFT_RT_XFRM: |
179 | return 0; |
180 | case NFT_RT_TCPMSS: |
181 | hooks = (1 << NF_INET_FORWARD) | |
182 | (1 << NF_INET_LOCAL_OUT) | |
183 | (1 << NF_INET_POST_ROUTING); |
184 | break; |
185 | default: |
186 | return -EINVAL; |
187 | } |
188 | |
189 | return nft_chain_validate_hooks(chain: ctx->chain, hook_flags: hooks); |
190 | } |
191 | |
192 | static const struct nft_expr_ops nft_rt_get_ops = { |
193 | .type = &nft_rt_type, |
194 | .size = NFT_EXPR_SIZE(sizeof(struct nft_rt)), |
195 | .eval = nft_rt_get_eval, |
196 | .init = nft_rt_get_init, |
197 | .dump = nft_rt_get_dump, |
198 | .validate = nft_rt_validate, |
199 | .reduce = NFT_REDUCE_READONLY, |
200 | }; |
201 | |
202 | struct nft_expr_type nft_rt_type __read_mostly = { |
203 | .name = "rt" , |
204 | .ops = &nft_rt_get_ops, |
205 | .policy = nft_rt_policy, |
206 | .maxattr = NFTA_RT_MAX, |
207 | .owner = THIS_MODULE, |
208 | }; |
209 | |