1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * Copyright (c) 2014 Intel Corporation
5 * Author: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
7 * Development of this code funded by Astaro AG (http://www.astaro.com/)
10 #include <linux/kernel.h>
11 #include <linux/netlink.h>
12 #include <linux/netfilter.h>
13 #include <linux/netfilter/nf_tables.h>
16 #include <linux/ipv6.h>
17 #include <linux/smp.h>
18 #include <linux/static_key.h>
21 #include <net/tcp_states.h> /* for TCP_TIME_WAIT */
22 #include <net/netfilter/nf_tables.h>
23 #include <net/netfilter/nf_tables_core.h>
24 #include <net/netfilter/nft_meta.h>
25 #include <net/netfilter/nf_tables_offload.h>
27 #include <uapi/linux/netfilter_bridge.h> /* NF_BR_PRE_ROUTING */
29 static DEFINE_PER_CPU(struct rnd_state
, nft_prandom_state
);
31 void nft_meta_get_eval(const struct nft_expr
*expr
,
32 struct nft_regs
*regs
,
33 const struct nft_pktinfo
*pkt
)
35 const struct nft_meta
*priv
= nft_expr_priv(expr
);
36 const struct sk_buff
*skb
= pkt
->skb
;
37 const struct net_device
*in
= nft_in(pkt
), *out
= nft_out(pkt
);
39 u32
*dest
= ®s
->data
[priv
->dreg
];
45 case NFT_META_PROTOCOL
:
46 nft_reg_store16(dest
, (__force u16
)skb
->protocol
);
48 case NFT_META_NFPROTO
:
49 nft_reg_store8(dest
, nft_pf(pkt
));
51 case NFT_META_L4PROTO
:
54 nft_reg_store8(dest
, pkt
->tprot
);
56 case NFT_META_PRIORITY
:
57 *dest
= skb
->priority
;
72 case NFT_META_IIFNAME
:
75 strncpy((char *)dest
, in
->name
, IFNAMSIZ
);
77 case NFT_META_OIFNAME
:
80 strncpy((char *)dest
, out
->name
, IFNAMSIZ
);
82 case NFT_META_IIFTYPE
:
85 nft_reg_store16(dest
, in
->type
);
87 case NFT_META_OIFTYPE
:
90 nft_reg_store16(dest
, out
->type
);
93 sk
= skb_to_full_sk(skb
);
94 if (!sk
|| !sk_fullsock(sk
) ||
95 !net_eq(nft_net(pkt
), sock_net(sk
)))
98 read_lock_bh(&sk
->sk_callback_lock
);
99 if (sk
->sk_socket
== NULL
||
100 sk
->sk_socket
->file
== NULL
) {
101 read_unlock_bh(&sk
->sk_callback_lock
);
105 *dest
= from_kuid_munged(&init_user_ns
,
106 sk
->sk_socket
->file
->f_cred
->fsuid
);
107 read_unlock_bh(&sk
->sk_callback_lock
);
110 sk
= skb_to_full_sk(skb
);
111 if (!sk
|| !sk_fullsock(sk
) ||
112 !net_eq(nft_net(pkt
), sock_net(sk
)))
115 read_lock_bh(&sk
->sk_callback_lock
);
116 if (sk
->sk_socket
== NULL
||
117 sk
->sk_socket
->file
== NULL
) {
118 read_unlock_bh(&sk
->sk_callback_lock
);
121 *dest
= from_kgid_munged(&init_user_ns
,
122 sk
->sk_socket
->file
->f_cred
->fsgid
);
123 read_unlock_bh(&sk
->sk_callback_lock
);
125 #ifdef CONFIG_IP_ROUTE_CLASSID
126 case NFT_META_RTCLASSID
: {
127 const struct dst_entry
*dst
= skb_dst(skb
);
131 *dest
= dst
->tclassid
;
135 #ifdef CONFIG_NETWORK_SECMARK
136 case NFT_META_SECMARK
:
137 *dest
= skb
->secmark
;
140 case NFT_META_PKTTYPE
:
141 if (skb
->pkt_type
!= PACKET_LOOPBACK
) {
142 nft_reg_store8(dest
, skb
->pkt_type
);
146 switch (nft_pf(pkt
)) {
148 if (ipv4_is_multicast(ip_hdr(skb
)->daddr
))
149 nft_reg_store8(dest
, PACKET_MULTICAST
);
151 nft_reg_store8(dest
, PACKET_BROADCAST
);
154 nft_reg_store8(dest
, PACKET_MULTICAST
);
157 switch (skb
->protocol
) {
158 case htons(ETH_P_IP
): {
159 int noff
= skb_network_offset(skb
);
160 struct iphdr
*iph
, _iph
;
162 iph
= skb_header_pointer(skb
, noff
,
163 sizeof(_iph
), &_iph
);
167 if (ipv4_is_multicast(iph
->daddr
))
168 nft_reg_store8(dest
, PACKET_MULTICAST
);
170 nft_reg_store8(dest
, PACKET_BROADCAST
);
174 case htons(ETH_P_IPV6
):
175 nft_reg_store8(dest
, PACKET_MULTICAST
);
188 *dest
= raw_smp_processor_id();
190 case NFT_META_IIFGROUP
:
195 case NFT_META_OIFGROUP
:
200 #ifdef CONFIG_CGROUP_NET_CLASSID
201 case NFT_META_CGROUP
:
202 sk
= skb_to_full_sk(skb
);
203 if (!sk
|| !sk_fullsock(sk
) ||
204 !net_eq(nft_net(pkt
), sock_net(sk
)))
206 *dest
= sock_cgroup_classid(&sk
->sk_cgrp_data
);
209 case NFT_META_PRANDOM
: {
210 struct rnd_state
*state
= this_cpu_ptr(&nft_prandom_state
);
211 *dest
= prandom_u32_state(state
);
215 case NFT_META_SECPATH
:
216 nft_reg_store8(dest
, secpath_exists(skb
));
219 case NFT_META_IIFKIND
:
220 if (in
== NULL
|| in
->rtnl_link_ops
== NULL
)
222 strncpy((char *)dest
, in
->rtnl_link_ops
->kind
, IFNAMSIZ
);
224 case NFT_META_OIFKIND
:
225 if (out
== NULL
|| out
->rtnl_link_ops
== NULL
)
227 strncpy((char *)dest
, out
->rtnl_link_ops
->kind
, IFNAMSIZ
);
236 regs
->verdict
.code
= NFT_BREAK
;
238 EXPORT_SYMBOL_GPL(nft_meta_get_eval
);
240 void nft_meta_set_eval(const struct nft_expr
*expr
,
241 struct nft_regs
*regs
,
242 const struct nft_pktinfo
*pkt
)
244 const struct nft_meta
*meta
= nft_expr_priv(expr
);
245 struct sk_buff
*skb
= pkt
->skb
;
246 u32
*sreg
= ®s
->data
[meta
->sreg
];
254 case NFT_META_PRIORITY
:
255 skb
->priority
= value
;
257 case NFT_META_PKTTYPE
:
258 value8
= nft_reg_load8(sreg
);
260 if (skb
->pkt_type
!= value8
&&
261 skb_pkt_type_ok(value8
) &&
262 skb_pkt_type_ok(skb
->pkt_type
))
263 skb
->pkt_type
= value8
;
265 case NFT_META_NFTRACE
:
266 value8
= nft_reg_load8(sreg
);
268 skb
->nf_trace
= !!value8
;
270 #ifdef CONFIG_NETWORK_SECMARK
271 case NFT_META_SECMARK
:
272 skb
->secmark
= value
;
279 EXPORT_SYMBOL_GPL(nft_meta_set_eval
);
281 const struct nla_policy nft_meta_policy
[NFTA_META_MAX
+ 1] = {
282 [NFTA_META_DREG
] = { .type
= NLA_U32
},
283 [NFTA_META_KEY
] = { .type
= NLA_U32
},
284 [NFTA_META_SREG
] = { .type
= NLA_U32
},
286 EXPORT_SYMBOL_GPL(nft_meta_policy
);
288 int nft_meta_get_init(const struct nft_ctx
*ctx
,
289 const struct nft_expr
*expr
,
290 const struct nlattr
* const tb
[])
292 struct nft_meta
*priv
= nft_expr_priv(expr
);
295 priv
->key
= ntohl(nla_get_be32(tb
[NFTA_META_KEY
]));
297 case NFT_META_PROTOCOL
:
298 case NFT_META_IIFTYPE
:
299 case NFT_META_OIFTYPE
:
302 case NFT_META_NFPROTO
:
303 case NFT_META_L4PROTO
:
305 case NFT_META_PRIORITY
:
311 #ifdef CONFIG_IP_ROUTE_CLASSID
312 case NFT_META_RTCLASSID
:
314 #ifdef CONFIG_NETWORK_SECMARK
315 case NFT_META_SECMARK
:
317 case NFT_META_PKTTYPE
:
319 case NFT_META_IIFGROUP
:
320 case NFT_META_OIFGROUP
:
321 #ifdef CONFIG_CGROUP_NET_CLASSID
322 case NFT_META_CGROUP
:
326 case NFT_META_IIFNAME
:
327 case NFT_META_OIFNAME
:
328 case NFT_META_IIFKIND
:
329 case NFT_META_OIFKIND
:
332 case NFT_META_PRANDOM
:
333 prandom_init_once(&nft_prandom_state
);
337 case NFT_META_SECPATH
:
345 priv
->dreg
= nft_parse_register(tb
[NFTA_META_DREG
]);
346 return nft_validate_register_store(ctx
, priv
->dreg
, NULL
,
347 NFT_DATA_VALUE
, len
);
349 EXPORT_SYMBOL_GPL(nft_meta_get_init
);
351 static int nft_meta_get_validate(const struct nft_ctx
*ctx
,
352 const struct nft_expr
*expr
,
353 const struct nft_data
**data
)
356 const struct nft_meta
*priv
= nft_expr_priv(expr
);
359 if (priv
->key
!= NFT_META_SECPATH
)
362 switch (ctx
->family
) {
364 hooks
= 1 << NF_NETDEV_INGRESS
;
369 hooks
= (1 << NF_INET_PRE_ROUTING
) |
370 (1 << NF_INET_LOCAL_IN
) |
371 (1 << NF_INET_FORWARD
);
377 return nft_chain_validate_hooks(ctx
->chain
, hooks
);
383 int nft_meta_set_validate(const struct nft_ctx
*ctx
,
384 const struct nft_expr
*expr
,
385 const struct nft_data
**data
)
387 struct nft_meta
*priv
= nft_expr_priv(expr
);
390 if (priv
->key
!= NFT_META_PKTTYPE
)
393 switch (ctx
->family
) {
395 hooks
= 1 << NF_BR_PRE_ROUTING
;
398 hooks
= 1 << NF_NETDEV_INGRESS
;
403 hooks
= 1 << NF_INET_PRE_ROUTING
;
409 return nft_chain_validate_hooks(ctx
->chain
, hooks
);
411 EXPORT_SYMBOL_GPL(nft_meta_set_validate
);
413 int nft_meta_set_init(const struct nft_ctx
*ctx
,
414 const struct nft_expr
*expr
,
415 const struct nlattr
* const tb
[])
417 struct nft_meta
*priv
= nft_expr_priv(expr
);
421 priv
->key
= ntohl(nla_get_be32(tb
[NFTA_META_KEY
]));
424 case NFT_META_PRIORITY
:
425 #ifdef CONFIG_NETWORK_SECMARK
426 case NFT_META_SECMARK
:
430 case NFT_META_NFTRACE
:
433 case NFT_META_PKTTYPE
:
440 priv
->sreg
= nft_parse_register(tb
[NFTA_META_SREG
]);
441 err
= nft_validate_register_load(priv
->sreg
, len
);
445 if (priv
->key
== NFT_META_NFTRACE
)
446 static_branch_inc(&nft_trace_enabled
);
450 EXPORT_SYMBOL_GPL(nft_meta_set_init
);
452 int nft_meta_get_dump(struct sk_buff
*skb
,
453 const struct nft_expr
*expr
)
455 const struct nft_meta
*priv
= nft_expr_priv(expr
);
457 if (nla_put_be32(skb
, NFTA_META_KEY
, htonl(priv
->key
)))
458 goto nla_put_failure
;
459 if (nft_dump_register(skb
, NFTA_META_DREG
, priv
->dreg
))
460 goto nla_put_failure
;
466 EXPORT_SYMBOL_GPL(nft_meta_get_dump
);
468 int nft_meta_set_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
470 const struct nft_meta
*priv
= nft_expr_priv(expr
);
472 if (nla_put_be32(skb
, NFTA_META_KEY
, htonl(priv
->key
)))
473 goto nla_put_failure
;
474 if (nft_dump_register(skb
, NFTA_META_SREG
, priv
->sreg
))
475 goto nla_put_failure
;
482 EXPORT_SYMBOL_GPL(nft_meta_set_dump
);
484 void nft_meta_set_destroy(const struct nft_ctx
*ctx
,
485 const struct nft_expr
*expr
)
487 const struct nft_meta
*priv
= nft_expr_priv(expr
);
489 if (priv
->key
== NFT_META_NFTRACE
)
490 static_branch_dec(&nft_trace_enabled
);
492 EXPORT_SYMBOL_GPL(nft_meta_set_destroy
);
494 static int nft_meta_get_offload(struct nft_offload_ctx
*ctx
,
495 struct nft_flow_rule
*flow
,
496 const struct nft_expr
*expr
)
498 const struct nft_meta
*priv
= nft_expr_priv(expr
);
499 struct nft_offload_reg
*reg
= &ctx
->regs
[priv
->dreg
];
502 case NFT_META_PROTOCOL
:
503 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC
, basic
, n_proto
,
505 nft_offload_set_dependency(ctx
, NFT_OFFLOAD_DEP_NETWORK
);
507 case NFT_META_L4PROTO
:
508 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC
, basic
, ip_proto
,
510 nft_offload_set_dependency(ctx
, NFT_OFFLOAD_DEP_TRANSPORT
);
519 static const struct nft_expr_ops nft_meta_get_ops
= {
520 .type
= &nft_meta_type
,
521 .size
= NFT_EXPR_SIZE(sizeof(struct nft_meta
)),
522 .eval
= nft_meta_get_eval
,
523 .init
= nft_meta_get_init
,
524 .dump
= nft_meta_get_dump
,
525 .validate
= nft_meta_get_validate
,
526 .offload
= nft_meta_get_offload
,
529 static const struct nft_expr_ops nft_meta_set_ops
= {
530 .type
= &nft_meta_type
,
531 .size
= NFT_EXPR_SIZE(sizeof(struct nft_meta
)),
532 .eval
= nft_meta_set_eval
,
533 .init
= nft_meta_set_init
,
534 .destroy
= nft_meta_set_destroy
,
535 .dump
= nft_meta_set_dump
,
536 .validate
= nft_meta_set_validate
,
539 static const struct nft_expr_ops
*
540 nft_meta_select_ops(const struct nft_ctx
*ctx
,
541 const struct nlattr
* const tb
[])
543 if (tb
[NFTA_META_KEY
] == NULL
)
544 return ERR_PTR(-EINVAL
);
546 if (tb
[NFTA_META_DREG
] && tb
[NFTA_META_SREG
])
547 return ERR_PTR(-EINVAL
);
549 #ifdef CONFIG_NF_TABLES_BRIDGE
550 if (ctx
->family
== NFPROTO_BRIDGE
)
551 return ERR_PTR(-EAGAIN
);
553 if (tb
[NFTA_META_DREG
])
554 return &nft_meta_get_ops
;
556 if (tb
[NFTA_META_SREG
])
557 return &nft_meta_set_ops
;
559 return ERR_PTR(-EINVAL
);
562 struct nft_expr_type nft_meta_type __read_mostly
= {
564 .select_ops
= nft_meta_select_ops
,
565 .policy
= nft_meta_policy
,
566 .maxattr
= NFTA_META_MAX
,
567 .owner
= THIS_MODULE
,
570 #ifdef CONFIG_NETWORK_SECMARK
576 static const struct nla_policy nft_secmark_policy
[NFTA_SECMARK_MAX
+ 1] = {
577 [NFTA_SECMARK_CTX
] = { .type
= NLA_STRING
, .len
= NFT_SECMARK_CTX_MAXLEN
},
580 static int nft_secmark_compute_secid(struct nft_secmark
*priv
)
585 err
= security_secctx_to_secid(priv
->ctx
, strlen(priv
->ctx
), &tmp_secid
);
592 err
= security_secmark_relabel_packet(tmp_secid
);
596 priv
->secid
= tmp_secid
;
600 static void nft_secmark_obj_eval(struct nft_object
*obj
, struct nft_regs
*regs
,
601 const struct nft_pktinfo
*pkt
)
603 const struct nft_secmark
*priv
= nft_obj_data(obj
);
604 struct sk_buff
*skb
= pkt
->skb
;
606 skb
->secmark
= priv
->secid
;
609 static int nft_secmark_obj_init(const struct nft_ctx
*ctx
,
610 const struct nlattr
* const tb
[],
611 struct nft_object
*obj
)
613 struct nft_secmark
*priv
= nft_obj_data(obj
);
616 if (tb
[NFTA_SECMARK_CTX
] == NULL
)
619 priv
->ctx
= nla_strdup(tb
[NFTA_SECMARK_CTX
], GFP_KERNEL
);
623 err
= nft_secmark_compute_secid(priv
);
629 security_secmark_refcount_inc();
634 static int nft_secmark_obj_dump(struct sk_buff
*skb
, struct nft_object
*obj
,
637 struct nft_secmark
*priv
= nft_obj_data(obj
);
640 if (nla_put_string(skb
, NFTA_SECMARK_CTX
, priv
->ctx
))
644 err
= nft_secmark_compute_secid(priv
);
652 static void nft_secmark_obj_destroy(const struct nft_ctx
*ctx
, struct nft_object
*obj
)
654 struct nft_secmark
*priv
= nft_obj_data(obj
);
656 security_secmark_refcount_dec();
661 static const struct nft_object_ops nft_secmark_obj_ops
= {
662 .type
= &nft_secmark_obj_type
,
663 .size
= sizeof(struct nft_secmark
),
664 .init
= nft_secmark_obj_init
,
665 .eval
= nft_secmark_obj_eval
,
666 .dump
= nft_secmark_obj_dump
,
667 .destroy
= nft_secmark_obj_destroy
,
669 struct nft_object_type nft_secmark_obj_type __read_mostly
= {
670 .type
= NFT_OBJECT_SECMARK
,
671 .ops
= &nft_secmark_obj_ops
,
672 .maxattr
= NFTA_SECMARK_MAX
,
673 .policy
= nft_secmark_policy
,
674 .owner
= THIS_MODULE
,
676 #endif /* CONFIG_NETWORK_SECMARK */