1
2
3
4
5
6
7
8
9
10
11#include <linux/kernel.h>
12#include <linux/init.h>
13#include <linux/module.h>
14#include <linux/netlink.h>
15#include <linux/netfilter.h>
16#include <linux/netfilter/nf_tables.h>
17#include <linux/in.h>
18#include <linux/ip.h>
19#include <linux/ipv6.h>
20#include <linux/smp.h>
21#include <linux/static_key.h>
22#include <net/dst.h>
23#include <net/sock.h>
24#include <net/tcp_states.h>
25#include <net/netfilter/nf_tables.h>
26#include <net/netfilter/nf_tables_core.h>
27#include <net/netfilter/nft_meta.h>
28
29#include <uapi/linux/netfilter_bridge.h>
30
31static DEFINE_PER_CPU(struct rnd_state, nft_prandom_state);
32
33void nft_meta_get_eval(const struct nft_expr *expr,
34 struct nft_regs *regs,
35 const struct nft_pktinfo *pkt)
36{
37 const struct nft_meta *priv = nft_expr_priv(expr);
38 const struct sk_buff *skb = pkt->skb;
39 const struct net_device *in = pkt->in, *out = pkt->out;
40 struct sock *sk;
41 u32 *dest = ®s->data[priv->dreg];
42
43 switch (priv->key) {
44 case NFT_META_LEN:
45 *dest = skb->len;
46 break;
47 case NFT_META_PROTOCOL:
48 *dest = 0;
49 *(__be16 *)dest = skb->protocol;
50 break;
51 case NFT_META_NFPROTO:
52 *dest = pkt->pf;
53 break;
54 case NFT_META_L4PROTO:
55 *dest = pkt->tprot;
56 break;
57 case NFT_META_PRIORITY:
58 *dest = skb->priority;
59 break;
60 case NFT_META_MARK:
61 *dest = skb->mark;
62 break;
63 case NFT_META_IIF:
64 if (in == NULL)
65 goto err;
66 *dest = in->ifindex;
67 break;
68 case NFT_META_OIF:
69 if (out == NULL)
70 goto err;
71 *dest = out->ifindex;
72 break;
73 case NFT_META_IIFNAME:
74 if (in == NULL)
75 goto err;
76 strncpy((char *)dest, in->name, IFNAMSIZ);
77 break;
78 case NFT_META_OIFNAME:
79 if (out == NULL)
80 goto err;
81 strncpy((char *)dest, out->name, IFNAMSIZ);
82 break;
83 case NFT_META_IIFTYPE:
84 if (in == NULL)
85 goto err;
86 *dest = 0;
87 *(u16 *)dest = in->type;
88 break;
89 case NFT_META_OIFTYPE:
90 if (out == NULL)
91 goto err;
92 *dest = 0;
93 *(u16 *)dest = out->type;
94 break;
95 case NFT_META_SKUID:
96 sk = skb_to_full_sk(skb);
97 if (!sk || !sk_fullsock(sk))
98 goto err;
99
100 read_lock_bh(&sk->sk_callback_lock);
101 if (sk->sk_socket == NULL ||
102 sk->sk_socket->file == NULL) {
103 read_unlock_bh(&sk->sk_callback_lock);
104 goto err;
105 }
106
107 *dest = from_kuid_munged(&init_user_ns,
108 sk->sk_socket->file->f_cred->fsuid);
109 read_unlock_bh(&sk->sk_callback_lock);
110 break;
111 case NFT_META_SKGID:
112 sk = skb_to_full_sk(skb);
113 if (!sk || !sk_fullsock(sk))
114 goto err;
115
116 read_lock_bh(&sk->sk_callback_lock);
117 if (sk->sk_socket == NULL ||
118 sk->sk_socket->file == NULL) {
119 read_unlock_bh(&sk->sk_callback_lock);
120 goto err;
121 }
122 *dest = from_kgid_munged(&init_user_ns,
123 sk->sk_socket->file->f_cred->fsgid);
124 read_unlock_bh(&sk->sk_callback_lock);
125 break;
126#ifdef CONFIG_IP_ROUTE_CLASSID
127 case NFT_META_RTCLASSID: {
128 const struct dst_entry *dst = skb_dst(skb);
129
130 if (dst == NULL)
131 goto err;
132 *dest = dst->tclassid;
133 break;
134 }
135#endif
136#ifdef CONFIG_NETWORK_SECMARK
137 case NFT_META_SECMARK:
138 *dest = skb->secmark;
139 break;
140#endif
141 case NFT_META_PKTTYPE:
142 if (skb->pkt_type != PACKET_LOOPBACK) {
143 *dest = skb->pkt_type;
144 break;
145 }
146
147 switch (pkt->pf) {
148 case NFPROTO_IPV4:
149 if (ipv4_is_multicast(ip_hdr(skb)->daddr))
150 *dest = PACKET_MULTICAST;
151 else
152 *dest = PACKET_BROADCAST;
153 break;
154 case NFPROTO_IPV6:
155 if (ipv6_hdr(skb)->daddr.s6_addr[0] == 0xFF)
156 *dest = PACKET_MULTICAST;
157 else
158 *dest = PACKET_BROADCAST;
159 break;
160 default:
161 WARN_ON(1);
162 goto err;
163 }
164 break;
165 case NFT_META_CPU:
166 *dest = raw_smp_processor_id();
167 break;
168 case NFT_META_IIFGROUP:
169 if (in == NULL)
170 goto err;
171 *dest = in->group;
172 break;
173 case NFT_META_OIFGROUP:
174 if (out == NULL)
175 goto err;
176 *dest = out->group;
177 break;
178#ifdef CONFIG_CGROUP_NET_CLASSID
179 case NFT_META_CGROUP:
180 sk = skb_to_full_sk(skb);
181 if (!sk || !sk_fullsock(sk))
182 goto err;
183 *dest = sock_cgroup_classid(&sk->sk_cgrp_data);
184 break;
185#endif
186 case NFT_META_PRANDOM: {
187 struct rnd_state *state = this_cpu_ptr(&nft_prandom_state);
188 *dest = prandom_u32_state(state);
189 break;
190 }
191 default:
192 WARN_ON(1);
193 goto err;
194 }
195 return;
196
197err:
198 regs->verdict.code = NFT_BREAK;
199}
200EXPORT_SYMBOL_GPL(nft_meta_get_eval);
201
202void nft_meta_set_eval(const struct nft_expr *expr,
203 struct nft_regs *regs,
204 const struct nft_pktinfo *pkt)
205{
206 const struct nft_meta *meta = nft_expr_priv(expr);
207 struct sk_buff *skb = pkt->skb;
208 u32 value = regs->data[meta->sreg];
209
210 switch (meta->key) {
211 case NFT_META_MARK:
212 skb->mark = value;
213 break;
214 case NFT_META_PRIORITY:
215 skb->priority = value;
216 break;
217 case NFT_META_PKTTYPE:
218 if (skb->pkt_type != value &&
219 skb_pkt_type_ok(value) && skb_pkt_type_ok(skb->pkt_type))
220 skb->pkt_type = value;
221 break;
222 case NFT_META_NFTRACE:
223 skb->nf_trace = !!value;
224 break;
225 default:
226 WARN_ON(1);
227 }
228}
229EXPORT_SYMBOL_GPL(nft_meta_set_eval);
230
231const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = {
232 [NFTA_META_DREG] = { .type = NLA_U32 },
233 [NFTA_META_KEY] = { .type = NLA_U32 },
234 [NFTA_META_SREG] = { .type = NLA_U32 },
235};
236EXPORT_SYMBOL_GPL(nft_meta_policy);
237
238int nft_meta_get_init(const struct nft_ctx *ctx,
239 const struct nft_expr *expr,
240 const struct nlattr * const tb[])
241{
242 struct nft_meta *priv = nft_expr_priv(expr);
243 unsigned int len;
244
245 priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
246 switch (priv->key) {
247 case NFT_META_PROTOCOL:
248 case NFT_META_IIFTYPE:
249 case NFT_META_OIFTYPE:
250 len = sizeof(u16);
251 break;
252 case NFT_META_NFPROTO:
253 case NFT_META_L4PROTO:
254 case NFT_META_LEN:
255 case NFT_META_PRIORITY:
256 case NFT_META_MARK:
257 case NFT_META_IIF:
258 case NFT_META_OIF:
259 case NFT_META_SKUID:
260 case NFT_META_SKGID:
261#ifdef CONFIG_IP_ROUTE_CLASSID
262 case NFT_META_RTCLASSID:
263#endif
264#ifdef CONFIG_NETWORK_SECMARK
265 case NFT_META_SECMARK:
266#endif
267 case NFT_META_PKTTYPE:
268 case NFT_META_CPU:
269 case NFT_META_IIFGROUP:
270 case NFT_META_OIFGROUP:
271#ifdef CONFIG_CGROUP_NET_CLASSID
272 case NFT_META_CGROUP:
273#endif
274 len = sizeof(u32);
275 break;
276 case NFT_META_IIFNAME:
277 case NFT_META_OIFNAME:
278 len = IFNAMSIZ;
279 break;
280 case NFT_META_PRANDOM:
281 prandom_init_once(&nft_prandom_state);
282 len = sizeof(u32);
283 break;
284 default:
285 return -EOPNOTSUPP;
286 }
287
288 priv->dreg = nft_parse_register(tb[NFTA_META_DREG]);
289 return nft_validate_register_store(ctx, priv->dreg, NULL,
290 NFT_DATA_VALUE, len);
291}
292EXPORT_SYMBOL_GPL(nft_meta_get_init);
293
294int nft_meta_set_validate(const struct nft_ctx *ctx,
295 const struct nft_expr *expr,
296 const struct nft_data **data)
297{
298 struct nft_meta *priv = nft_expr_priv(expr);
299 unsigned int hooks;
300
301 if (priv->key != NFT_META_PKTTYPE)
302 return 0;
303
304 switch (ctx->afi->family) {
305 case NFPROTO_BRIDGE:
306 hooks = 1 << NF_BR_PRE_ROUTING;
307 break;
308 case NFPROTO_NETDEV:
309 hooks = 1 << NF_NETDEV_INGRESS;
310 break;
311 default:
312 return -EOPNOTSUPP;
313 }
314
315 return nft_chain_validate_hooks(ctx->chain, hooks);
316}
317EXPORT_SYMBOL_GPL(nft_meta_set_validate);
318
319int nft_meta_set_init(const struct nft_ctx *ctx,
320 const struct nft_expr *expr,
321 const struct nlattr * const tb[])
322{
323 struct nft_meta *priv = nft_expr_priv(expr);
324 unsigned int len;
325 int err;
326
327 priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
328 switch (priv->key) {
329 case NFT_META_MARK:
330 case NFT_META_PRIORITY:
331 len = sizeof(u32);
332 break;
333 case NFT_META_NFTRACE:
334 len = sizeof(u8);
335 break;
336 case NFT_META_PKTTYPE:
337 len = sizeof(u8);
338 break;
339 default:
340 return -EOPNOTSUPP;
341 }
342
343 err = nft_meta_set_validate(ctx, expr, NULL);
344 if (err < 0)
345 return err;
346
347 priv->sreg = nft_parse_register(tb[NFTA_META_SREG]);
348 err = nft_validate_register_load(priv->sreg, len);
349 if (err < 0)
350 return err;
351
352 if (priv->key == NFT_META_NFTRACE)
353 static_branch_inc(&nft_trace_enabled);
354
355 return 0;
356}
357EXPORT_SYMBOL_GPL(nft_meta_set_init);
358
359int nft_meta_get_dump(struct sk_buff *skb,
360 const struct nft_expr *expr)
361{
362 const struct nft_meta *priv = nft_expr_priv(expr);
363
364 if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key)))
365 goto nla_put_failure;
366 if (nft_dump_register(skb, NFTA_META_DREG, priv->dreg))
367 goto nla_put_failure;
368 return 0;
369
370nla_put_failure:
371 return -1;
372}
373EXPORT_SYMBOL_GPL(nft_meta_get_dump);
374
375int nft_meta_set_dump(struct sk_buff *skb,
376 const struct nft_expr *expr)
377{
378 const struct nft_meta *priv = nft_expr_priv(expr);
379
380 if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key)))
381 goto nla_put_failure;
382 if (nft_dump_register(skb, NFTA_META_SREG, priv->sreg))
383 goto nla_put_failure;
384
385 return 0;
386
387nla_put_failure:
388 return -1;
389}
390EXPORT_SYMBOL_GPL(nft_meta_set_dump);
391
392void nft_meta_set_destroy(const struct nft_ctx *ctx,
393 const struct nft_expr *expr)
394{
395 const struct nft_meta *priv = nft_expr_priv(expr);
396
397 if (priv->key == NFT_META_NFTRACE)
398 static_branch_dec(&nft_trace_enabled);
399}
400EXPORT_SYMBOL_GPL(nft_meta_set_destroy);
401
402static struct nft_expr_type nft_meta_type;
403static const struct nft_expr_ops nft_meta_get_ops = {
404 .type = &nft_meta_type,
405 .size = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
406 .eval = nft_meta_get_eval,
407 .init = nft_meta_get_init,
408 .dump = nft_meta_get_dump,
409};
410
411static const struct nft_expr_ops nft_meta_set_ops = {
412 .type = &nft_meta_type,
413 .size = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
414 .eval = nft_meta_set_eval,
415 .init = nft_meta_set_init,
416 .destroy = nft_meta_set_destroy,
417 .dump = nft_meta_set_dump,
418 .validate = nft_meta_set_validate,
419};
420
421static const struct nft_expr_ops *
422nft_meta_select_ops(const struct nft_ctx *ctx,
423 const struct nlattr * const tb[])
424{
425 if (tb[NFTA_META_KEY] == NULL)
426 return ERR_PTR(-EINVAL);
427
428 if (tb[NFTA_META_DREG] && tb[NFTA_META_SREG])
429 return ERR_PTR(-EINVAL);
430
431 if (tb[NFTA_META_DREG])
432 return &nft_meta_get_ops;
433
434 if (tb[NFTA_META_SREG])
435 return &nft_meta_set_ops;
436
437 return ERR_PTR(-EINVAL);
438}
439
440static struct nft_expr_type nft_meta_type __read_mostly = {
441 .name = "meta",
442 .select_ops = &nft_meta_select_ops,
443 .policy = nft_meta_policy,
444 .maxattr = NFTA_META_MAX,
445 .owner = THIS_MODULE,
446};
447
448static int __init nft_meta_module_init(void)
449{
450 return nft_register_expr(&nft_meta_type);
451}
452
453static void __exit nft_meta_module_exit(void)
454{
455 nft_unregister_expr(&nft_meta_type);
456}
457
458module_init(nft_meta_module_init);
459module_exit(nft_meta_module_exit);
460
461MODULE_LICENSE("GPL");
462MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
463MODULE_ALIAS_NFT_EXPR("meta");
464
