1 /*
2 * Copyright (c) 2016 Anders K. Pedersen <akp@cohaesio.com>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 */
8
9 #include <linux/kernel.h>
10 #include <linux/netlink.h>
11 #include <linux/netfilter.h>
12 #include <linux/netfilter/nf_tables.h>
13 #include <net/dst.h>
14 #include <net/ip6_route.h>
15 #include <net/route.h>
16 #include <net/netfilter/nf_tables.h>
17 #include <net/netfilter/nf_tables_core.h>
18
19 struct nft_rt {
20 enum nft_rt_keys key:8;
21 enum nft_registers dreg:8;
22 };
23
get_tcpmss(const struct nft_pktinfo * pkt,const struct dst_entry * skbdst)24 static u16 get_tcpmss(const struct nft_pktinfo *pkt, const struct dst_entry *skbdst)
25 {
26 u32 minlen = sizeof(struct ipv6hdr), mtu = dst_mtu(skbdst);
27 const struct sk_buff *skb = pkt->skb;
28 struct dst_entry *dst = NULL;
29 struct flowi fl;
30
31 memset(&fl, 0, sizeof(fl));
32
33 switch (nft_pf(pkt)) {
34 case NFPROTO_IPV4:
35 fl.u.ip4.daddr = ip_hdr(skb)->saddr;
36 minlen = sizeof(struct iphdr) + sizeof(struct tcphdr);
37 break;
38 case NFPROTO_IPV6:
39 fl.u.ip6.daddr = ipv6_hdr(skb)->saddr;
40 minlen = sizeof(struct ipv6hdr) + sizeof(struct tcphdr);
41 break;
42 }
43
44 nf_route(nft_net(pkt), &dst, &fl, false, nft_pf(pkt));
45 if (dst) {
46 mtu = min(mtu, dst_mtu(dst));
47 dst_release(dst);
48 }
49
50 if (mtu <= minlen || mtu > 0xffff)
51 return TCP_MSS_DEFAULT;
52
53 return mtu - minlen;
54 }
55
nft_rt_get_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)56 static void nft_rt_get_eval(const struct nft_expr *expr,
57 struct nft_regs *regs,
58 const struct nft_pktinfo *pkt)
59 {
60 const struct nft_rt *priv = nft_expr_priv(expr);
61 const struct sk_buff *skb = pkt->skb;
62 u32 *dest = ®s->data[priv->dreg];
63 const struct dst_entry *dst;
64
65 dst = skb_dst(skb);
66 if (!dst)
67 goto err;
68
69 switch (priv->key) {
70 #ifdef CONFIG_IP_ROUTE_CLASSID
71 case NFT_RT_CLASSID:
72 *dest = dst->tclassid;
73 break;
74 #endif
75 case NFT_RT_NEXTHOP4:
76 if (nft_pf(pkt) != NFPROTO_IPV4)
77 goto err;
78
79 *dest = (__force u32)rt_nexthop((const struct rtable *)dst,
80 ip_hdr(skb)->daddr);
81 break;
82 case NFT_RT_NEXTHOP6:
83 if (nft_pf(pkt) != NFPROTO_IPV6)
84 goto err;
85
86 memcpy(dest, rt6_nexthop((struct rt6_info *)dst,
87 &ipv6_hdr(skb)->daddr),
88 sizeof(struct in6_addr));
89 break;
90 case NFT_RT_TCPMSS:
91 nft_reg_store16(dest, get_tcpmss(pkt, dst));
92 break;
93 default:
94 WARN_ON(1);
95 goto err;
96 }
97 return;
98
99 err:
100 regs->verdict.code = NFT_BREAK;
101 }
102
103 static const struct nla_policy nft_rt_policy[NFTA_RT_MAX + 1] = {
104 [NFTA_RT_DREG] = { .type = NLA_U32 },
105 [NFTA_RT_KEY] = { .type = NLA_U32 },
106 };
107
nft_rt_get_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])108 static int nft_rt_get_init(const struct nft_ctx *ctx,
109 const struct nft_expr *expr,
110 const struct nlattr * const tb[])
111 {
112 struct nft_rt *priv = nft_expr_priv(expr);
113 unsigned int len;
114
115 if (tb[NFTA_RT_KEY] == NULL ||
116 tb[NFTA_RT_DREG] == NULL)
117 return -EINVAL;
118
119 priv->key = ntohl(nla_get_be32(tb[NFTA_RT_KEY]));
120 switch (priv->key) {
121 #ifdef CONFIG_IP_ROUTE_CLASSID
122 case NFT_RT_CLASSID:
123 #endif
124 case NFT_RT_NEXTHOP4:
125 len = sizeof(u32);
126 break;
127 case NFT_RT_NEXTHOP6:
128 len = sizeof(struct in6_addr);
129 break;
130 case NFT_RT_TCPMSS:
131 len = sizeof(u16);
132 break;
133 default:
134 return -EOPNOTSUPP;
135 }
136
137 priv->dreg = nft_parse_register(tb[NFTA_RT_DREG]);
138 return nft_validate_register_store(ctx, priv->dreg, NULL,
139 NFT_DATA_VALUE, len);
140 }
141
nft_rt_get_dump(struct sk_buff * skb,const struct nft_expr * expr)142 static int nft_rt_get_dump(struct sk_buff *skb,
143 const struct nft_expr *expr)
144 {
145 const struct nft_rt *priv = nft_expr_priv(expr);
146
147 if (nla_put_be32(skb, NFTA_RT_KEY, htonl(priv->key)))
148 goto nla_put_failure;
149 if (nft_dump_register(skb, NFTA_RT_DREG, priv->dreg))
150 goto nla_put_failure;
151 return 0;
152
153 nla_put_failure:
154 return -1;
155 }
156
nft_rt_validate(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nft_data ** data)157 static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
158 const struct nft_data **data)
159 {
160 const struct nft_rt *priv = nft_expr_priv(expr);
161 unsigned int hooks;
162
163 switch (priv->key) {
164 case NFT_RT_NEXTHOP4:
165 case NFT_RT_NEXTHOP6:
166 case NFT_RT_CLASSID:
167 return 0;
168 case NFT_RT_TCPMSS:
169 hooks = (1 << NF_INET_FORWARD) |
170 (1 << NF_INET_LOCAL_OUT) |
171 (1 << NF_INET_POST_ROUTING);
172 break;
173 default:
174 return -EINVAL;
175 }
176
177 return nft_chain_validate_hooks(ctx->chain, hooks);
178 }
179
180 static const struct nft_expr_ops nft_rt_get_ops = {
181 .type = &nft_rt_type,
182 .size = NFT_EXPR_SIZE(sizeof(struct nft_rt)),
183 .eval = nft_rt_get_eval,
184 .init = nft_rt_get_init,
185 .dump = nft_rt_get_dump,
186 .validate = nft_rt_validate,
187 };
188
189 struct nft_expr_type nft_rt_type __read_mostly = {
190 .name = "rt",
191 .ops = &nft_rt_get_ops,
192 .policy = nft_rt_policy,
193 .maxattr = NFTA_RT_MAX,
194 .owner = THIS_MODULE,
195 };
196
