Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1/*
2 * Copyright (c) 2016 Anders K. Pedersen <akp@cohaesio.com>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 */
8
9#include <linux/kernel.h>
10#include <linux/netlink.h>
11#include <linux/netfilter.h>
12#include <linux/netfilter/nf_tables.h>
13#include <net/dst.h>
14#include <net/ip6_route.h>
15#include <net/route.h>
16#include <net/netfilter/nf_tables.h>
17#include <net/netfilter/nf_tables_core.h>
18
19struct nft_rt {
20 enum nft_rt_keys key:8;
21 enum nft_registers dreg:8;
22};
23
24static u16 get_tcpmss(const struct nft_pktinfo *pkt, const struct dst_entry *skbdst)
25{
26 u32 minlen = sizeof(struct ipv6hdr), mtu = dst_mtu(skbdst);
27 const struct sk_buff *skb = pkt->skb;
28 struct dst_entry *dst = NULL;
29 struct flowi fl;
30
31 memset(&fl, 0, sizeof(fl));
32
33 switch (nft_pf(pkt)) {
34 case NFPROTO_IPV4:
35 fl.u.ip4.daddr = ip_hdr(skb)->saddr;
36 minlen = sizeof(struct iphdr) + sizeof(struct tcphdr);
37 break;
38 case NFPROTO_IPV6:
39 fl.u.ip6.daddr = ipv6_hdr(skb)->saddr;
40 minlen = sizeof(struct ipv6hdr) + sizeof(struct tcphdr);
41 break;
42 }
43
44 nf_route(nft_net(pkt), &dst, &fl, false, nft_pf(pkt));
45 if (dst) {
46 mtu = min(mtu, dst_mtu(dst));
47 dst_release(dst);
48 }
49
50 if (mtu <= minlen || mtu > 0xffff)
51 return TCP_MSS_DEFAULT;
52
53 return mtu - minlen;
54}
55
56static void nft_rt_get_eval(const struct nft_expr *expr,
57 struct nft_regs *regs,
58 const struct nft_pktinfo *pkt)
59{
60 const struct nft_rt *priv = nft_expr_priv(expr);
61 const struct sk_buff *skb = pkt->skb;
62 u32 *dest = ®s->data[priv->dreg];
63 const struct dst_entry *dst;
64
65 dst = skb_dst(skb);
66 if (!dst)
67 goto err;
68
69 switch (priv->key) {
70#ifdef CONFIG_IP_ROUTE_CLASSID
71 case NFT_RT_CLASSID:
72 *dest = dst->tclassid;
73 break;
74#endif
75 case NFT_RT_NEXTHOP4:
76 if (nft_pf(pkt) != NFPROTO_IPV4)
77 goto err;
78
79 *dest = (__force u32)rt_nexthop((const struct rtable *)dst,
80 ip_hdr(skb)->daddr);
81 break;
82 case NFT_RT_NEXTHOP6:
83 if (nft_pf(pkt) != NFPROTO_IPV6)
84 goto err;
85
86 memcpy(dest, rt6_nexthop((struct rt6_info *)dst,
87 &ipv6_hdr(skb)->daddr),
88 sizeof(struct in6_addr));
89 break;
90 case NFT_RT_TCPMSS:
91 nft_reg_store16(dest, get_tcpmss(pkt, dst));
92 break;
93#ifdef CONFIG_XFRM
94 case NFT_RT_XFRM:
95 nft_reg_store8(dest, !!dst->xfrm);
96 break;
97#endif
98 default:
99 WARN_ON(1);
100 goto err;
101 }
102 return;
103
104err:
105 regs->verdict.code = NFT_BREAK;
106}
107
108static const struct nla_policy nft_rt_policy[NFTA_RT_MAX + 1] = {
109 [NFTA_RT_DREG] = { .type = NLA_U32 },
110 [NFTA_RT_KEY] = { .type = NLA_U32 },
111};
112
113static int nft_rt_get_init(const struct nft_ctx *ctx,
114 const struct nft_expr *expr,
115 const struct nlattr * const tb[])
116{
117 struct nft_rt *priv = nft_expr_priv(expr);
118 unsigned int len;
119
120 if (tb[NFTA_RT_KEY] == NULL ||
121 tb[NFTA_RT_DREG] == NULL)
122 return -EINVAL;
123
124 priv->key = ntohl(nla_get_be32(tb[NFTA_RT_KEY]));
125 switch (priv->key) {
126#ifdef CONFIG_IP_ROUTE_CLASSID
127 case NFT_RT_CLASSID:
128#endif
129 case NFT_RT_NEXTHOP4:
130 len = sizeof(u32);
131 break;
132 case NFT_RT_NEXTHOP6:
133 len = sizeof(struct in6_addr);
134 break;
135 case NFT_RT_TCPMSS:
136 len = sizeof(u16);
137 break;
138#ifdef CONFIG_XFRM
139 case NFT_RT_XFRM:
140 len = sizeof(u8);
141 break;
142#endif
143 default:
144 return -EOPNOTSUPP;
145 }
146
147 priv->dreg = nft_parse_register(tb[NFTA_RT_DREG]);
148 return nft_validate_register_store(ctx, priv->dreg, NULL,
149 NFT_DATA_VALUE, len);
150}
151
152static int nft_rt_get_dump(struct sk_buff *skb,
153 const struct nft_expr *expr)
154{
155 const struct nft_rt *priv = nft_expr_priv(expr);
156
157 if (nla_put_be32(skb, NFTA_RT_KEY, htonl(priv->key)))
158 goto nla_put_failure;
159 if (nft_dump_register(skb, NFTA_RT_DREG, priv->dreg))
160 goto nla_put_failure;
161 return 0;
162
163nla_put_failure:
164 return -1;
165}
166
167static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
168 const struct nft_data **data)
169{
170 const struct nft_rt *priv = nft_expr_priv(expr);
171 unsigned int hooks;
172
173 switch (priv->key) {
174 case NFT_RT_NEXTHOP4:
175 case NFT_RT_NEXTHOP6:
176 case NFT_RT_CLASSID:
177 case NFT_RT_XFRM:
178 return 0;
179 case NFT_RT_TCPMSS:
180 hooks = (1 << NF_INET_FORWARD) |
181 (1 << NF_INET_LOCAL_OUT) |
182 (1 << NF_INET_POST_ROUTING);
183 break;
184 default:
185 return -EINVAL;
186 }
187
188 return nft_chain_validate_hooks(ctx->chain, hooks);
189}
190
191static const struct nft_expr_ops nft_rt_get_ops = {
192 .type = &nft_rt_type,
193 .size = NFT_EXPR_SIZE(sizeof(struct nft_rt)),
194 .eval = nft_rt_get_eval,
195 .init = nft_rt_get_init,
196 .dump = nft_rt_get_dump,
197 .validate = nft_rt_validate,
198};
199
200struct nft_expr_type nft_rt_type __read_mostly = {
201 .name = "rt",
202 .ops = &nft_rt_get_ops,
203 .policy = nft_rt_policy,
204 .maxattr = NFTA_RT_MAX,
205 .owner = THIS_MODULE,
206};