[thirdparty/linux.git] / net / netfilter / nft_fwd_netdev.c

/*
 * Copyright (c) 2015 Pablo Neira Ayuso <pablo@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 as published by
 * the Free Software Foundation.
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_dup_netdev.h>
#include <net/neighbour.h>
#include <net/ip.h>

struct nft_fwd_netdev {
	enum nft_registers	sreg_dev:8;
};

static void nft_fwd_netdev_eval(const struct nft_expr *expr,
				struct nft_regs *regs,
				const struct nft_pktinfo *pkt)
{
	struct nft_fwd_netdev *priv = nft_expr_priv(expr);
	int oif = regs->data[priv->sreg_dev];

	nf_fwd_netdev_egress(pkt, oif);
	regs->verdict.code = NF_STOLEN;
}

static const struct nla_policy nft_fwd_netdev_policy[NFTA_FWD_MAX + 1] = {
	[NFTA_FWD_SREG_DEV]	= { .type = NLA_U32 },
	[NFTA_FWD_SREG_ADDR]	= { .type = NLA_U32 },
	[NFTA_FWD_NFPROTO]	= { .type = NLA_U32 },
};

static int nft_fwd_netdev_init(const struct nft_ctx *ctx,
			       const struct nft_expr *expr,
			       const struct nlattr * const tb[])
{
	struct nft_fwd_netdev *priv = nft_expr_priv(expr);

	if (tb[NFTA_FWD_SREG_DEV] == NULL)
		return -EINVAL;

	priv->sreg_dev = nft_parse_register(tb[NFTA_FWD_SREG_DEV]);
	return nft_validate_register_load(priv->sreg_dev, sizeof(int));
}

static int nft_fwd_netdev_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	struct nft_fwd_netdev *priv = nft_expr_priv(expr);

	if (nft_dump_register(skb, NFTA_FWD_SREG_DEV, priv->sreg_dev))
		goto nla_put_failure;

	return 0;

nla_put_failure:
	return -1;
}

struct nft_fwd_neigh {
	enum nft_registers	sreg_dev:8;
	enum nft_registers	sreg_addr:8;
	u8			nfproto;
};

static void nft_fwd_neigh_eval(const struct nft_expr *expr,
			      struct nft_regs *regs,
			      const struct nft_pktinfo *pkt)
{
	struct nft_fwd_neigh *priv = nft_expr_priv(expr);
	void *addr = &regs->data[priv->sreg_addr];
	int oif = regs->data[priv->sreg_dev];
	unsigned int verdict = NF_STOLEN;
	struct sk_buff *skb = pkt->skb;
	struct net_device *dev;
	int neigh_table;

	switch (priv->nfproto) {
	case NFPROTO_IPV4: {
		struct iphdr *iph;

		if (skb->protocol != htons(ETH_P_IP)) {
			verdict = NFT_BREAK;
			goto out;
		}
		if (skb_try_make_writable(skb, sizeof(*iph))) {
			verdict = NF_DROP;
			goto out;
		}
		iph = ip_hdr(skb);
		ip_decrease_ttl(iph);
		neigh_table = NEIGH_ARP_TABLE;
		break;
		}
	case NFPROTO_IPV6: {
		struct ipv6hdr *ip6h;

		if (skb->protocol != htons(ETH_P_IPV6)) {
			verdict = NFT_BREAK;
			goto out;
		}
		if (skb_try_make_writable(skb, sizeof(*ip6h))) {
			verdict = NF_DROP;
			goto out;
		}
		ip6h = ipv6_hdr(skb);
		ip6h->hop_limit--;
		neigh_table = NEIGH_ND_TABLE;
		break;
		}
	default:
		verdict = NFT_BREAK;
		goto out;
	}

	dev = dev_get_by_index_rcu(nft_net(pkt), oif);
	if (dev == NULL)
		return;

	skb->dev = dev;
	neigh_xmit(neigh_table, dev, addr, skb);
out:
	regs->verdict.code = verdict;
}

static int nft_fwd_neigh_init(const struct nft_ctx *ctx,
			      const struct nft_expr *expr,
			      const struct nlattr * const tb[])
{
	struct nft_fwd_neigh *priv = nft_expr_priv(expr);
	unsigned int addr_len;
	int err;

	if (!tb[NFTA_FWD_SREG_DEV] ||
	    !tb[NFTA_FWD_SREG_ADDR] ||
	    !tb[NFTA_FWD_NFPROTO])
		return -EINVAL;

	priv->sreg_dev = nft_parse_register(tb[NFTA_FWD_SREG_DEV]);
	priv->sreg_addr = nft_parse_register(tb[NFTA_FWD_SREG_ADDR]);
	priv->nfproto = ntohl(nla_get_be32(tb[NFTA_FWD_NFPROTO]));

	switch (priv->nfproto) {
	case NFPROTO_IPV4:
		addr_len = sizeof(struct in_addr);
		break;
	case NFPROTO_IPV6:
		addr_len = sizeof(struct in6_addr);
		break;
	default:
		return -EOPNOTSUPP;
	}

	err = nft_validate_register_load(priv->sreg_dev, sizeof(int));
	if (err < 0)
		return err;

	return nft_validate_register_load(priv->sreg_addr, addr_len);
}

static int nft_fwd_neigh_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	struct nft_fwd_neigh *priv = nft_expr_priv(expr);

	if (nft_dump_register(skb, NFTA_FWD_SREG_DEV, priv->sreg_dev) ||
	    nft_dump_register(skb, NFTA_FWD_SREG_ADDR, priv->sreg_addr) ||
	    nla_put_be32(skb, NFTA_FWD_NFPROTO, htonl(priv->nfproto)))
		goto nla_put_failure;

	return 0;

nla_put_failure:
	return -1;
}

static struct nft_expr_type nft_fwd_netdev_type;
static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = {
	.type		= &nft_fwd_netdev_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_fwd_neigh)),
	.eval		= nft_fwd_neigh_eval,
	.init		= nft_fwd_neigh_init,
	.dump		= nft_fwd_neigh_dump,
};

static const struct nft_expr_ops nft_fwd_netdev_ops = {
	.type		= &nft_fwd_netdev_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_fwd_netdev)),
	.eval		= nft_fwd_netdev_eval,
	.init		= nft_fwd_netdev_init,
	.dump		= nft_fwd_netdev_dump,
};

static const struct nft_expr_ops *
nft_fwd_select_ops(const struct nft_ctx *ctx,
		   const struct nlattr * const tb[])
{
	if (tb[NFTA_FWD_SREG_ADDR])
		return &nft_fwd_neigh_netdev_ops;
	if (tb[NFTA_FWD_SREG_DEV])
		return &nft_fwd_netdev_ops;

        return ERR_PTR(-EOPNOTSUPP);
}

static struct nft_expr_type nft_fwd_netdev_type __read_mostly = {
	.family		= NFPROTO_NETDEV,
	.name		= "fwd",
	.select_ops	= nft_fwd_select_ops,
	.policy		= nft_fwd_netdev_policy,
	.maxattr	= NFTA_FWD_MAX,
	.owner		= THIS_MODULE,
};

static int __init nft_fwd_netdev_module_init(void)
{
	return nft_register_expr(&nft_fwd_netdev_type);
}

static void __exit nft_fwd_netdev_module_exit(void)
{
	nft_unregister_expr(&nft_fwd_netdev_type);
}

module_init(nft_fwd_netdev_module_init);
module_exit(nft_fwd_netdev_module_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
MODULE_ALIAS_NFT_AF_EXPR(5, "fwd");
Commit	Line	Data
39e6dea2 PNA	1	/*
	2	* Copyright (c) 2015 Pablo Neira Ayuso <pablo@netfilter.org>
	3	*
	4	* This program is free software; you can redistribute it and/or modify it
	5	* under the terms of the GNU General Public License version 2 as published by
	6	* the Free Software Foundation.
	7	*/
	8
	9	#include <linux/kernel.h>
	10	#include <linux/init.h>
	11	#include <linux/module.h>
	12	#include <linux/netlink.h>
	13	#include <linux/netfilter.h>
	14	#include <linux/netfilter/nf_tables.h>
d32de98e PNA	15	#include <linux/ip.h>
d32de98e PNA	16	#include <linux/ipv6.h>
39e6dea2 PNA	17	#include <net/netfilter/nf_tables.h>
39e6dea2 PNA	18	#include <net/netfilter/nf_dup_netdev.h>
d32de98e PNA	19	#include <net/neighbour.h>
d32de98e PNA	20	#include <net/ip.h>
39e6dea2 PNA	21
	22	struct nft_fwd_netdev {
	23	enum nft_registers sreg_dev:8;
	24	};
	25
	26	static void nft_fwd_netdev_eval(const struct nft_expr *expr,
	27	struct nft_regs *regs,
	28	const struct nft_pktinfo *pkt)
	29	{
	30	struct nft_fwd_netdev *priv = nft_expr_priv(expr);
	31	int oif = regs->data[priv->sreg_dev];
	32
3bf32761 FW	33	nf_fwd_netdev_egress(pkt, oif);
3bf32761 FW	34	regs->verdict.code = NF_STOLEN;
39e6dea2 PNA	35	}
	36
	37	static const struct nla_policy nft_fwd_netdev_policy[NFTA_FWD_MAX + 1] = {
	38	[NFTA_FWD_SREG_DEV] = { .type = NLA_U32 },
d32de98e PNA	39	[NFTA_FWD_SREG_ADDR] = { .type = NLA_U32 },
d32de98e PNA	40	[NFTA_FWD_NFPROTO] = { .type = NLA_U32 },
39e6dea2 PNA	41	};
	42
	43	static int nft_fwd_netdev_init(const struct nft_ctx *ctx,
	44	const struct nft_expr *expr,
	45	const struct nlattr * const tb[])
	46	{
	47	struct nft_fwd_netdev *priv = nft_expr_priv(expr);
	48
	49	if (tb[NFTA_FWD_SREG_DEV] == NULL)
	50	return -EINVAL;
	51
	52	priv->sreg_dev = nft_parse_register(tb[NFTA_FWD_SREG_DEV]);
	53	return nft_validate_register_load(priv->sreg_dev, sizeof(int));
	54	}
	55
39e6dea2 PNA	56	static int nft_fwd_netdev_dump(struct sk_buff skb, const struct nft_expr expr)
	57	{
	58	struct nft_fwd_netdev *priv = nft_expr_priv(expr);
	59
	60	if (nft_dump_register(skb, NFTA_FWD_SREG_DEV, priv->sreg_dev))
	61	goto nla_put_failure;
	62
	63	return 0;
	64
	65	nla_put_failure:
	66	return -1;
	67	}
	68
d32de98e PNA	69	struct nft_fwd_neigh {
	70	enum nft_registers sreg_dev:8;
	71	enum nft_registers sreg_addr:8;
	72	u8 nfproto;
	73	};
	74
	75	static void nft_fwd_neigh_eval(const struct nft_expr *expr,
	76	struct nft_regs *regs,
	77	const struct nft_pktinfo *pkt)
	78	{
	79	struct nft_fwd_neigh *priv = nft_expr_priv(expr);
	80	void *addr = &regs->data[priv->sreg_addr];
	81	int oif = regs->data[priv->sreg_dev];
	82	unsigned int verdict = NF_STOLEN;
	83	struct sk_buff *skb = pkt->skb;
	84	struct net_device *dev;
	85	int neigh_table;
	86
	87	switch (priv->nfproto) {
	88	case NFPROTO_IPV4: {
	89	struct iphdr *iph;
	90
	91	if (skb->protocol != htons(ETH_P_IP)) {
	92	verdict = NFT_BREAK;
	93	goto out;
	94	}
	95	if (skb_try_make_writable(skb, sizeof(*iph))) {
	96	verdict = NF_DROP;
	97	goto out;
	98	}
	99	iph = ip_hdr(skb);
	100	ip_decrease_ttl(iph);
	101	neigh_table = NEIGH_ARP_TABLE;
	102	break;
	103	}
	104	case NFPROTO_IPV6: {
	105	struct ipv6hdr *ip6h;
	106
	107	if (skb->protocol != htons(ETH_P_IPV6)) {
	108	verdict = NFT_BREAK;
	109	goto out;
	110	}
	111	if (skb_try_make_writable(skb, sizeof(*ip6h))) {
	112	verdict = NF_DROP;
	113	goto out;
	114	}
	115	ip6h = ipv6_hdr(skb);
	116	ip6h->hop_limit--;
	117	neigh_table = NEIGH_ND_TABLE;
	118	break;
	119	}
	120	default:
	121	verdict = NFT_BREAK;
	122	goto out;
	123	}
	124
	125	dev = dev_get_by_index_rcu(nft_net(pkt), oif);
	126	if (dev == NULL)
	127	return;
	128
	129	skb->dev = dev;
	130	neigh_xmit(neigh_table, dev, addr, skb);
	131	out:
	132	regs->verdict.code = verdict;
133	}
134
135	static int nft_fwd_neigh_init(const struct nft_ctx *ctx,
136	const struct nft_expr *expr,
137	const struct nlattr * const tb[])
138	{
139	struct nft_fwd_neigh *priv = nft_expr_priv(expr);
140	unsigned int addr_len;
141	int err;
142
143	if (!tb[NFTA_FWD_SREG_DEV] \|\|
144	!tb[NFTA_FWD_SREG_ADDR] \|\|
145	!tb[NFTA_FWD_NFPROTO])
146	return -EINVAL;
147
148	priv->sreg_dev = nft_parse_register(tb[NFTA_FWD_SREG_DEV]);
149	priv->sreg_addr = nft_parse_register(tb[NFTA_FWD_SREG_ADDR]);
150	priv->nfproto = ntohl(nla_get_be32(tb[NFTA_FWD_NFPROTO]));
151
152	switch (priv->nfproto) {
153	case NFPROTO_IPV4:
154	addr_len = sizeof(struct in_addr);
155	break;
156	case NFPROTO_IPV6:
157	addr_len = sizeof(struct in6_addr);
158	break;
159	default:
160	return -EOPNOTSUPP;
161	}
162
163	err = nft_validate_register_load(priv->sreg_dev, sizeof(int));
164	if (err < 0)
165	return err;
166
167	return nft_validate_register_load(priv->sreg_addr, addr_len);
168	}
169
d32de98e PNA	170	static int nft_fwd_neigh_dump(struct sk_buff skb, const struct nft_expr expr)
	171	{
	172	struct nft_fwd_neigh *priv = nft_expr_priv(expr);
	173
	174	if (nft_dump_register(skb, NFTA_FWD_SREG_DEV, priv->sreg_dev) \|\|
	175	nft_dump_register(skb, NFTA_FWD_SREG_ADDR, priv->sreg_addr) \|\|
	176	nla_put_be32(skb, NFTA_FWD_NFPROTO, htonl(priv->nfproto)))
	177	goto nla_put_failure;
	178
	179	return 0;
	180
	181	nla_put_failure:
	182	return -1;
	183	}
	184
39e6dea2	185	static struct nft_expr_type nft_fwd_netdev_type;
d32de98e PNA	186	static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = {
	187	.type = &nft_fwd_netdev_type,
	188	.size = NFT_EXPR_SIZE(sizeof(struct nft_fwd_neigh)),
	189	.eval = nft_fwd_neigh_eval,
	190	.init = nft_fwd_neigh_init,
	191	.dump = nft_fwd_neigh_dump,
	192	};
	193
39e6dea2 PNA	194	static const struct nft_expr_ops nft_fwd_netdev_ops = {
	195	.type = &nft_fwd_netdev_type,
	196	.size = NFT_EXPR_SIZE(sizeof(struct nft_fwd_netdev)),
	197	.eval = nft_fwd_netdev_eval,
	198	.init = nft_fwd_netdev_init,
	199	.dump = nft_fwd_netdev_dump,
	200	};
	201
d32de98e PNA	202	static const struct nft_expr_ops *
	203	nft_fwd_select_ops(const struct nft_ctx *ctx,
	204	const struct nlattr * const tb[])
	205	{
	206	if (tb[NFTA_FWD_SREG_ADDR])
	207	return &nft_fwd_neigh_netdev_ops;
	208	if (tb[NFTA_FWD_SREG_DEV])
	209	return &nft_fwd_netdev_ops;
	210
	211	return ERR_PTR(-EOPNOTSUPP);
	212	}
	213
39e6dea2 PNA	214	static struct nft_expr_type nft_fwd_netdev_type __read_mostly = {
	215	.family = NFPROTO_NETDEV,
	216	.name = "fwd",
d32de98e	217	.select_ops = nft_fwd_select_ops,
39e6dea2 PNA	218	.policy = nft_fwd_netdev_policy,
	219	.maxattr = NFTA_FWD_MAX,
	220	.owner = THIS_MODULE,
	221	};
	222
	223	static int __init nft_fwd_netdev_module_init(void)
	224	{
	225	return nft_register_expr(&nft_fwd_netdev_type);
	226	}
	227
	228	static void __exit nft_fwd_netdev_module_exit(void)
	229	{
	230	nft_unregister_expr(&nft_fwd_netdev_type);
	231	}
	232
	233	module_init(nft_fwd_netdev_module_init);
	234	module_exit(nft_fwd_netdev_module_exit);
	235
	236	MODULE_LICENSE("GPL");
	237	MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
	238	MODULE_ALIAS_NFT_AF_EXPR(5, "fwd");