blob: 6eb571d0c3fdfcb4ac6cef4b313f039ecfe2517b [file] [log] [blame]
Thomas Gleixnerd2912cb2019-06-04 10:11:33 +02001// SPDX-License-Identifier: GPL-2.0-only
Patrick McHardy96518512013-10-14 11:00:02 +02002/*
3 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
4 *
Patrick McHardy96518512013-10-14 11:00:02 +02005 * Development of this code funded by Astaro AG (http://www.astaro.com/)
6 */
7
Florian Westphal99d17122017-08-08 15:15:29 +02008#include <asm/unaligned.h>
Patrick McHardy96518512013-10-14 11:00:02 +02009#include <linux/kernel.h>
Patrick McHardy96518512013-10-14 11:00:02 +020010#include <linux/netlink.h>
11#include <linux/netfilter.h>
12#include <linux/netfilter/nf_tables.h>
Jeremy Sowdenb9f9a4852023-05-09 22:19:45 +010013#include <linux/dccp.h>
Phil Sutter133dc202021-05-04 17:54:06 +020014#include <linux/sctp.h>
Florian Westphald0103152018-04-16 19:15:56 +020015#include <net/netfilter/nf_tables_core.h>
Patrick McHardy96518512013-10-14 11:00:02 +020016#include <net/netfilter/nf_tables.h>
Manuel Messner935b7f62017-02-07 03:14:53 +010017#include <net/tcp.h>
Patrick McHardy96518512013-10-14 11:00:02 +020018
19struct nft_exthdr {
20 u8 type;
21 u8 offset;
22 u8 len;
Manuel Messner935b7f62017-02-07 03:14:53 +010023 u8 op;
Pablo Neira Ayuso345023b2021-01-25 18:27:22 +010024 u8 dreg;
Pablo Neira Ayuso4f16d252021-01-25 17:28:18 +010025 u8 sreg;
Phil Sutterc078ca32017-01-17 22:51:26 +010026 u8 flags;
Patrick McHardy96518512013-10-14 11:00:02 +020027};
28
Manuel Messner935b7f62017-02-07 03:14:53 +010029static unsigned int optlen(const u8 *opt, unsigned int offset)
30{
31 /* Beware zero-length options: make finite progress */
32 if (opt[offset] <= TCPOPT_NOP || opt[offset + 1] == 0)
33 return 1;
34 else
35 return opt[offset + 1];
36}
37
Florian Westphalfd94d9d2023-09-05 23:13:56 +020038static int nft_skb_copy_to_reg(const struct sk_buff *skb, int offset, u32 *dest, unsigned int len)
39{
40 if (len % NFT_REG32_SIZE)
41 dest[len / NFT_REG32_SIZE] = 0;
42
43 return skb_copy_bits(skb, offset, dest, len);
44}
45
Manuel Messner935b7f62017-02-07 03:14:53 +010046static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
47 struct nft_regs *regs,
48 const struct nft_pktinfo *pkt)
Patrick McHardy96518512013-10-14 11:00:02 +020049{
50 struct nft_exthdr *priv = nft_expr_priv(expr);
Patrick McHardy49499c32015-04-11 02:27:37 +010051 u32 *dest = &regs->data[priv->dreg];
Daniel Borkmann540436c2013-12-20 11:23:15 +010052 unsigned int offset = 0;
Patrick McHardy96518512013-10-14 11:00:02 +020053 int err;
54
Pablo Neira Ayusocdd73cc2021-06-10 20:20:30 +020055 if (pkt->skb->protocol != htons(ETH_P_IPV6))
56 goto err;
57
Patrick McHardy96518512013-10-14 11:00:02 +020058 err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
Phil Sutterc078ca32017-01-17 22:51:26 +010059 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
Stephen Suryaputrab4283362020-08-04 17:44:09 -040060 nft_reg_store8(dest, err >= 0);
Phil Sutterc078ca32017-01-17 22:51:26 +010061 return;
62 } else if (err < 0) {
Patrick McHardy96518512013-10-14 11:00:02 +020063 goto err;
Phil Sutterc078ca32017-01-17 22:51:26 +010064 }
Patrick McHardy96518512013-10-14 11:00:02 +020065 offset += priv->offset;
66
Florian Westphalfd94d9d2023-09-05 23:13:56 +020067 if (nft_skb_copy_to_reg(pkt->skb, offset, dest, priv->len) < 0)
Patrick McHardy96518512013-10-14 11:00:02 +020068 goto err;
69 return;
70err:
Patrick McHardya55e22e2015-04-11 02:27:31 +010071 regs->verdict.code = NFT_BREAK;
Patrick McHardy96518512013-10-14 11:00:02 +020072}
73
Stephen Suryaputradbb52812019-06-20 12:19:59 -040074/* find the offset to specified option.
75 *
76 * If target header is found, its offset is set in *offset and return option
77 * number. Otherwise, return negative error.
78 *
79 * If the first fragment doesn't contain the End of Options it is considered
80 * invalid.
81 */
82static int ipv4_find_option(struct net *net, struct sk_buff *skb,
83 unsigned int *offset, int target)
84{
85 unsigned char optbuf[sizeof(struct ip_options) + 40];
86 struct ip_options *opt = (struct ip_options *)optbuf;
87 struct iphdr *iph, _iph;
88 unsigned int start;
89 bool found = false;
90 __be32 info;
91 int optlen;
92
93 iph = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
94 if (!iph)
95 return -EBADMSG;
96 start = sizeof(struct iphdr);
97
98 optlen = iph->ihl * 4 - (int)sizeof(struct iphdr);
99 if (optlen <= 0)
100 return -ENOENT;
101
102 memset(opt, 0, sizeof(struct ip_options));
103 /* Copy the options since __ip_options_compile() modifies
104 * the options.
105 */
106 if (skb_copy_bits(skb, start, opt->__data, optlen))
107 return -EBADMSG;
108 opt->optlen = optlen;
109
110 if (__ip_options_compile(net, opt, NULL, &info))
111 return -EBADMSG;
112
113 switch (target) {
114 case IPOPT_SSRR:
115 case IPOPT_LSRR:
116 if (!opt->srr)
117 break;
118 found = target == IPOPT_SSRR ? opt->is_strictroute :
119 !opt->is_strictroute;
120 if (found)
121 *offset = opt->srr + start;
122 break;
123 case IPOPT_RR:
124 if (!opt->rr)
125 break;
126 *offset = opt->rr + start;
127 found = true;
128 break;
129 case IPOPT_RA:
130 if (!opt->router_alert)
131 break;
132 *offset = opt->router_alert + start;
133 found = true;
134 break;
135 default:
136 return -EOPNOTSUPP;
137 }
138 return found ? target : -ENOENT;
139}
140
141static void nft_exthdr_ipv4_eval(const struct nft_expr *expr,
142 struct nft_regs *regs,
143 const struct nft_pktinfo *pkt)
144{
145 struct nft_exthdr *priv = nft_expr_priv(expr);
146 u32 *dest = &regs->data[priv->dreg];
147 struct sk_buff *skb = pkt->skb;
148 unsigned int offset;
149 int err;
150
151 if (skb->protocol != htons(ETH_P_IP))
152 goto err;
153
154 err = ipv4_find_option(nft_net(pkt), skb, &offset, priv->type);
155 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
Stephen Suryaputrab4283362020-08-04 17:44:09 -0400156 nft_reg_store8(dest, err >= 0);
Stephen Suryaputradbb52812019-06-20 12:19:59 -0400157 return;
158 } else if (err < 0) {
159 goto err;
160 }
161 offset += priv->offset;
162
Florian Westphalfd94d9d2023-09-05 23:13:56 +0200163 if (nft_skb_copy_to_reg(pkt->skb, offset, dest, priv->len) < 0)
Stephen Suryaputradbb52812019-06-20 12:19:59 -0400164 goto err;
165 return;
166err:
167 regs->verdict.code = NFT_BREAK;
168}
169
Florian Westphala1817702017-08-08 15:15:27 +0200170static void *
171nft_tcp_header_pointer(const struct nft_pktinfo *pkt,
172 unsigned int len, void *buffer, unsigned int *tcphdr_len)
173{
174 struct tcphdr *tcph;
175
Florian Westphala9e85032022-01-29 17:13:23 +0100176 if (pkt->tprot != IPPROTO_TCP || pkt->fragoff)
Florian Westphala1817702017-08-08 15:15:27 +0200177 return NULL;
178
Florian Westphal2d7b4ac2021-05-28 12:30:06 +0200179 tcph = skb_header_pointer(pkt->skb, nft_thoff(pkt), sizeof(*tcph), buffer);
Florian Westphala1817702017-08-08 15:15:27 +0200180 if (!tcph)
181 return NULL;
182
183 *tcphdr_len = __tcp_hdrlen(tcph);
184 if (*tcphdr_len < sizeof(*tcph) || *tcphdr_len > len)
185 return NULL;
186
Florian Westphal2d7b4ac2021-05-28 12:30:06 +0200187 return skb_header_pointer(pkt->skb, nft_thoff(pkt), *tcphdr_len, buffer);
Florian Westphala1817702017-08-08 15:15:27 +0200188}
189
Manuel Messner935b7f62017-02-07 03:14:53 +0100190static void nft_exthdr_tcp_eval(const struct nft_expr *expr,
191 struct nft_regs *regs,
192 const struct nft_pktinfo *pkt)
193{
194 u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
195 struct nft_exthdr *priv = nft_expr_priv(expr);
196 unsigned int i, optl, tcphdr_len, offset;
197 u32 *dest = &regs->data[priv->dreg];
198 struct tcphdr *tcph;
199 u8 *opt;
200
Florian Westphala1817702017-08-08 15:15:27 +0200201 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
Manuel Messner935b7f62017-02-07 03:14:53 +0100202 if (!tcph)
203 goto err;
204
205 opt = (u8 *)tcph;
206 for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
207 optl = optlen(opt, i);
208
209 if (priv->type != opt[i])
210 continue;
211
212 if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
213 goto err;
214
215 offset = i + priv->offset;
Phil Sutter3c1fece2017-02-20 17:52:27 +0100216 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
Florian Westphal63331e32023-12-04 12:29:54 +0100217 nft_reg_store8(dest, 1);
Phil Sutter3c1fece2017-02-20 17:52:27 +0100218 } else {
Florian Westphalfd94d9d2023-09-05 23:13:56 +0200219 if (priv->len % NFT_REG32_SIZE)
220 dest[priv->len / NFT_REG32_SIZE] = 0;
Phil Sutter3c1fece2017-02-20 17:52:27 +0100221 memcpy(dest, opt + offset, priv->len);
222 }
Manuel Messner935b7f62017-02-07 03:14:53 +0100223
224 return;
225 }
226
227err:
Phil Sutter3c1fece2017-02-20 17:52:27 +0100228 if (priv->flags & NFT_EXTHDR_F_PRESENT)
229 *dest = 0;
230 else
231 regs->verdict.code = NFT_BREAK;
Manuel Messner935b7f62017-02-07 03:14:53 +0100232}
233
Florian Westphal99d17122017-08-08 15:15:29 +0200234static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr,
235 struct nft_regs *regs,
236 const struct nft_pktinfo *pkt)
237{
238 u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
239 struct nft_exthdr *priv = nft_expr_priv(expr);
240 unsigned int i, optl, tcphdr_len, offset;
241 struct tcphdr *tcph;
242 u8 *opt;
Florian Westphal99d17122017-08-08 15:15:29 +0200243
244 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
245 if (!tcph)
Pablo Neira Ayuso962e5a42021-11-30 11:34:04 +0100246 goto err;
Florian Westphal99d17122017-08-08 15:15:29 +0200247
Xiao Liang28427f32023-08-25 13:33:27 +0800248 if (skb_ensure_writable(pkt->skb, nft_thoff(pkt) + tcphdr_len))
249 goto err;
250
251 tcph = (struct tcphdr *)(pkt->skb->data + nft_thoff(pkt));
Florian Westphal99d17122017-08-08 15:15:29 +0200252 opt = (u8 *)tcph;
Xiao Liang28427f32023-08-25 13:33:27 +0800253
Florian Westphal99d17122017-08-08 15:15:29 +0200254 for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
255 union {
Florian Westphal99d17122017-08-08 15:15:29 +0200256 __be16 v16;
257 __be32 v32;
258 } old, new;
259
260 optl = optlen(opt, i);
261
262 if (priv->type != opt[i])
263 continue;
264
265 if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
Pablo Neira Ayuso962e5a42021-11-30 11:34:04 +0100266 goto err;
Florian Westphal99d17122017-08-08 15:15:29 +0200267
Florian Westphal99d17122017-08-08 15:15:29 +0200268 offset = i + priv->offset;
269
270 switch (priv->len) {
271 case 2:
Florian Westphalffb3d9a2022-06-23 15:05:13 +0200272 old.v16 = (__force __be16)get_unaligned((u16 *)(opt + offset));
Sergey Marinkevich2e343282020-03-29 19:19:14 +0700273 new.v16 = (__force __be16)nft_reg_load16(
274 &regs->data[priv->sreg]);
Florian Westphal99d17122017-08-08 15:15:29 +0200275
276 switch (priv->type) {
277 case TCPOPT_MSS:
278 /* increase can cause connection to stall */
279 if (ntohs(old.v16) <= ntohs(new.v16))
280 return;
281 break;
282 }
283
284 if (old.v16 == new.v16)
285 return;
286
Florian Westphalffb3d9a2022-06-23 15:05:13 +0200287 put_unaligned(new.v16, (__be16*)(opt + offset));
Florian Westphal99d17122017-08-08 15:15:29 +0200288 inet_proto_csum_replace2(&tcph->check, pkt->skb,
289 old.v16, new.v16, false);
290 break;
291 case 4:
Florian Westphalffb3d9a2022-06-23 15:05:13 +0200292 new.v32 = nft_reg_load_be32(&regs->data[priv->sreg]);
293 old.v32 = (__force __be32)get_unaligned((u32 *)(opt + offset));
Florian Westphal99d17122017-08-08 15:15:29 +0200294
295 if (old.v32 == new.v32)
296 return;
297
Florian Westphalffb3d9a2022-06-23 15:05:13 +0200298 put_unaligned(new.v32, (__be32*)(opt + offset));
Florian Westphal99d17122017-08-08 15:15:29 +0200299 inet_proto_csum_replace4(&tcph->check, pkt->skb,
300 old.v32, new.v32, false);
301 break;
302 default:
303 WARN_ON_ONCE(1);
304 break;
305 }
306
307 return;
308 }
Pablo Neira Ayuso962e5a42021-11-30 11:34:04 +0100309 return;
310err:
311 regs->verdict.code = NFT_BREAK;
Florian Westphal99d17122017-08-08 15:15:29 +0200312}
313
Florian Westphal7890cbe2022-01-28 13:00:36 +0100314static void nft_exthdr_tcp_strip_eval(const struct nft_expr *expr,
315 struct nft_regs *regs,
316 const struct nft_pktinfo *pkt)
317{
318 u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
319 struct nft_exthdr *priv = nft_expr_priv(expr);
320 unsigned int i, tcphdr_len, optl;
321 struct tcphdr *tcph;
322 u8 *opt;
323
324 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
325 if (!tcph)
326 goto err;
327
328 if (skb_ensure_writable(pkt->skb, nft_thoff(pkt) + tcphdr_len))
329 goto drop;
330
Xiao Liang28427f32023-08-25 13:33:27 +0800331 tcph = (struct tcphdr *)(pkt->skb->data + nft_thoff(pkt));
332 opt = (u8 *)tcph;
333
Florian Westphal7890cbe2022-01-28 13:00:36 +0100334 for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
335 unsigned int j;
336
337 optl = optlen(opt, i);
338 if (priv->type != opt[i])
339 continue;
340
341 if (i + optl > tcphdr_len)
342 goto drop;
343
344 for (j = 0; j < optl; ++j) {
345 u16 n = TCPOPT_NOP;
346 u16 o = opt[i+j];
347
348 if ((i + j) % 2 == 0) {
349 o <<= 8;
350 n <<= 8;
351 }
352 inet_proto_csum_replace2(&tcph->check, pkt->skb, htons(o),
353 htons(n), false);
354 }
355 memset(opt + i, TCPOPT_NOP, optl);
356 return;
357 }
358
359 /* option not found, continue. This allows to do multiple
360 * option removals per rule.
361 */
362 return;
363err:
364 regs->verdict.code = NFT_BREAK;
365 return;
366drop:
367 /* can't remove, no choice but to drop */
368 regs->verdict.code = NF_DROP;
369}
370
Phil Sutter133dc202021-05-04 17:54:06 +0200371static void nft_exthdr_sctp_eval(const struct nft_expr *expr,
372 struct nft_regs *regs,
373 const struct nft_pktinfo *pkt)
374{
Florian Westphal2d7b4ac2021-05-28 12:30:06 +0200375 unsigned int offset = nft_thoff(pkt) + sizeof(struct sctphdr);
Phil Sutter133dc202021-05-04 17:54:06 +0200376 struct nft_exthdr *priv = nft_expr_priv(expr);
377 u32 *dest = &regs->data[priv->dreg];
378 const struct sctp_chunkhdr *sch;
379 struct sctp_chunkhdr _sch;
380
Phil Sutter5acc44f2021-06-11 19:06:45 +0200381 if (pkt->tprot != IPPROTO_SCTP)
382 goto err;
383
Phil Sutter133dc202021-05-04 17:54:06 +0200384 do {
385 sch = skb_header_pointer(pkt->skb, offset, sizeof(_sch), &_sch);
386 if (!sch || !sch->length)
387 break;
388
389 if (sch->type == priv->type) {
390 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
391 nft_reg_store8(dest, true);
392 return;
393 }
394 if (priv->offset + priv->len > ntohs(sch->length) ||
395 offset + ntohs(sch->length) > pkt->skb->len)
396 break;
397
Florian Westphalfd94d9d2023-09-05 23:13:56 +0200398 if (nft_skb_copy_to_reg(pkt->skb, offset + priv->offset,
399 dest, priv->len) < 0)
Phil Suttercf6b5ff2021-06-08 11:40:57 +0200400 break;
Phil Sutter133dc202021-05-04 17:54:06 +0200401 return;
402 }
403 offset += SCTP_PAD4(ntohs(sch->length));
404 } while (offset < pkt->skb->len);
Phil Sutter5acc44f2021-06-11 19:06:45 +0200405err:
Phil Sutter133dc202021-05-04 17:54:06 +0200406 if (priv->flags & NFT_EXTHDR_F_PRESENT)
407 nft_reg_store8(dest, false);
408 else
409 regs->verdict.code = NFT_BREAK;
410}
411
Jeremy Sowdenb9f9a4852023-05-09 22:19:45 +0100412static void nft_exthdr_dccp_eval(const struct nft_expr *expr,
413 struct nft_regs *regs,
414 const struct nft_pktinfo *pkt)
415{
416 struct nft_exthdr *priv = nft_expr_priv(expr);
417 unsigned int thoff, dataoff, optoff, optlen, i;
418 u32 *dest = &regs->data[priv->dreg];
419 const struct dccp_hdr *dh;
420 struct dccp_hdr _dh;
421
422 if (pkt->tprot != IPPROTO_DCCP || pkt->fragoff)
423 goto err;
424
425 thoff = nft_thoff(pkt);
426
427 dh = skb_header_pointer(pkt->skb, thoff, sizeof(_dh), &_dh);
428 if (!dh)
429 goto err;
430
431 dataoff = dh->dccph_doff * sizeof(u32);
432 optoff = __dccp_hdr_len(dh);
433 if (dataoff <= optoff)
434 goto err;
435
436 optlen = dataoff - optoff;
437
438 for (i = 0; i < optlen; ) {
439 /* Options 0 (DCCPO_PADDING) - 31 (DCCPO_MAX_RESERVED) are 1B in
440 * the length; the remaining options are at least 2B long. In
441 * all cases, the first byte contains the option type. In
442 * multi-byte options, the second byte contains the option
443 * length, which must be at least two: 1 for the type plus 1 for
444 * the length plus 0-253 for any following option data. We
445 * aren't interested in the option data, only the type and the
446 * length, so we don't need to read more than two bytes at a
447 * time.
448 */
449 unsigned int buflen = optlen - i;
450 u8 buf[2], *bufp;
451 u8 type, len;
452
453 if (buflen > sizeof(buf))
454 buflen = sizeof(buf);
455
456 bufp = skb_header_pointer(pkt->skb, thoff + optoff + i, buflen,
457 &buf);
458 if (!bufp)
459 goto err;
460
461 type = bufp[0];
462
463 if (type == priv->type) {
Florian Westphal63331e32023-12-04 12:29:54 +0100464 nft_reg_store8(dest, 1);
Jeremy Sowdenb9f9a4852023-05-09 22:19:45 +0100465 return;
466 }
467
468 if (type <= DCCPO_MAX_RESERVED) {
469 i++;
470 continue;
471 }
472
473 if (buflen < 2)
474 goto err;
475
476 len = bufp[1];
477
478 if (len < 2)
479 goto err;
480
481 i += len;
482 }
483
484err:
485 *dest = 0;
486}
487
Patrick McHardy96518512013-10-14 11:00:02 +0200488static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = {
489 [NFTA_EXTHDR_DREG] = { .type = NLA_U32 },
490 [NFTA_EXTHDR_TYPE] = { .type = NLA_U8 },
491 [NFTA_EXTHDR_OFFSET] = { .type = NLA_U32 },
Florian Westphala412dbf2023-06-21 21:11:03 +0200492 [NFTA_EXTHDR_LEN] = NLA_POLICY_MAX(NLA_BE32, 255),
Phil Sutterc078ca32017-01-17 22:51:26 +0100493 [NFTA_EXTHDR_FLAGS] = { .type = NLA_U32 },
Florian Westphala412dbf2023-06-21 21:11:03 +0200494 [NFTA_EXTHDR_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
Florian Westphalf5b57022017-12-11 10:14:27 +0100495 [NFTA_EXTHDR_SREG] = { .type = NLA_U32 },
Patrick McHardy96518512013-10-14 11:00:02 +0200496};
497
498static int nft_exthdr_init(const struct nft_ctx *ctx,
499 const struct nft_expr *expr,
500 const struct nlattr * const tb[])
501{
502 struct nft_exthdr *priv = nft_expr_priv(expr);
Manuel Messner935b7f62017-02-07 03:14:53 +0100503 u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
Dan Carpenter21a9e0f2016-10-12 09:09:12 +0300504 int err;
Patrick McHardy96518512013-10-14 11:00:02 +0200505
Manuel Messner935b7f62017-02-07 03:14:53 +0100506 if (!tb[NFTA_EXTHDR_DREG] ||
507 !tb[NFTA_EXTHDR_TYPE] ||
508 !tb[NFTA_EXTHDR_OFFSET] ||
509 !tb[NFTA_EXTHDR_LEN])
Patrick McHardy96518512013-10-14 11:00:02 +0200510 return -EINVAL;
511
Laura Garcia Liebana36b701f2016-09-14 15:00:02 +0200512 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
513 if (err < 0)
514 return err;
Laura Garcia Liebana4da449a2016-08-09 20:46:16 +0200515
Laura Garcia Liebana36b701f2016-09-14 15:00:02 +0200516 err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
517 if (err < 0)
518 return err;
Laura Garcia Liebana4da449a2016-08-09 20:46:16 +0200519
Phil Sutterc078ca32017-01-17 22:51:26 +0100520 if (tb[NFTA_EXTHDR_FLAGS]) {
521 err = nft_parse_u32_check(tb[NFTA_EXTHDR_FLAGS], U8_MAX, &flags);
522 if (err < 0)
523 return err;
524
525 if (flags & ~NFT_EXTHDR_F_PRESENT)
526 return -EINVAL;
527 }
528
Manuel Messner935b7f62017-02-07 03:14:53 +0100529 if (tb[NFTA_EXTHDR_OP]) {
530 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
531 if (err < 0)
532 return err;
533 }
534
Patrick McHardy96518512013-10-14 11:00:02 +0200535 priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
Laura Garcia Liebana4da449a2016-08-09 20:46:16 +0200536 priv->offset = offset;
537 priv->len = len;
Phil Sutterc078ca32017-01-17 22:51:26 +0100538 priv->flags = flags;
Manuel Messner935b7f62017-02-07 03:14:53 +0100539 priv->op = op;
Patrick McHardy96518512013-10-14 11:00:02 +0200540
Pablo Neira Ayuso345023b2021-01-25 18:27:22 +0100541 return nft_parse_register_store(ctx, tb[NFTA_EXTHDR_DREG],
542 &priv->dreg, NULL, NFT_DATA_VALUE,
543 priv->len);
Patrick McHardy96518512013-10-14 11:00:02 +0200544}
545
Florian Westphal99d17122017-08-08 15:15:29 +0200546static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx,
547 const struct nft_expr *expr,
548 const struct nlattr * const tb[])
549{
550 struct nft_exthdr *priv = nft_expr_priv(expr);
551 u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
552 int err;
553
554 if (!tb[NFTA_EXTHDR_SREG] ||
555 !tb[NFTA_EXTHDR_TYPE] ||
556 !tb[NFTA_EXTHDR_OFFSET] ||
557 !tb[NFTA_EXTHDR_LEN])
558 return -EINVAL;
559
560 if (tb[NFTA_EXTHDR_DREG] || tb[NFTA_EXTHDR_FLAGS])
561 return -EINVAL;
562
563 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
564 if (err < 0)
565 return err;
566
567 err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
568 if (err < 0)
569 return err;
570
571 if (offset < 2)
572 return -EOPNOTSUPP;
573
574 switch (len) {
575 case 2: break;
576 case 4: break;
577 default:
578 return -EOPNOTSUPP;
579 }
580
581 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
582 if (err < 0)
583 return err;
584
585 priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
586 priv->offset = offset;
587 priv->len = len;
Florian Westphal99d17122017-08-08 15:15:29 +0200588 priv->flags = flags;
589 priv->op = op;
590
Pablo Neira Ayuso4f16d252021-01-25 17:28:18 +0100591 return nft_parse_register_load(tb[NFTA_EXTHDR_SREG], &priv->sreg,
592 priv->len);
Florian Westphal99d17122017-08-08 15:15:29 +0200593}
594
Florian Westphal7890cbe2022-01-28 13:00:36 +0100595static int nft_exthdr_tcp_strip_init(const struct nft_ctx *ctx,
596 const struct nft_expr *expr,
597 const struct nlattr * const tb[])
598{
599 struct nft_exthdr *priv = nft_expr_priv(expr);
600
601 if (tb[NFTA_EXTHDR_SREG] ||
602 tb[NFTA_EXTHDR_DREG] ||
603 tb[NFTA_EXTHDR_FLAGS] ||
604 tb[NFTA_EXTHDR_OFFSET] ||
605 tb[NFTA_EXTHDR_LEN])
606 return -EINVAL;
607
608 if (!tb[NFTA_EXTHDR_TYPE])
609 return -EINVAL;
610
611 priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
612 priv->op = NFT_EXTHDR_OP_TCPOPT;
613
614 return 0;
615}
616
Stephen Suryaputradbb52812019-06-20 12:19:59 -0400617static int nft_exthdr_ipv4_init(const struct nft_ctx *ctx,
618 const struct nft_expr *expr,
619 const struct nlattr * const tb[])
620{
621 struct nft_exthdr *priv = nft_expr_priv(expr);
622 int err = nft_exthdr_init(ctx, expr, tb);
623
624 if (err < 0)
625 return err;
626
627 switch (priv->type) {
628 case IPOPT_SSRR:
629 case IPOPT_LSRR:
630 case IPOPT_RR:
631 case IPOPT_RA:
632 break;
633 default:
634 return -EOPNOTSUPP;
635 }
636 return 0;
637}
638
Jeremy Sowdenb9f9a4852023-05-09 22:19:45 +0100639static int nft_exthdr_dccp_init(const struct nft_ctx *ctx,
640 const struct nft_expr *expr,
641 const struct nlattr * const tb[])
642{
643 struct nft_exthdr *priv = nft_expr_priv(expr);
644 int err = nft_exthdr_init(ctx, expr, tb);
645
646 if (err < 0)
647 return err;
648
649 if (!(priv->flags & NFT_EXTHDR_F_PRESENT))
650 return -EOPNOTSUPP;
651
652 return 0;
653}
654
Florian Westphal5e7d6952017-08-08 15:15:28 +0200655static int nft_exthdr_dump_common(struct sk_buff *skb, const struct nft_exthdr *priv)
Patrick McHardy96518512013-10-14 11:00:02 +0200656{
Patrick McHardy96518512013-10-14 11:00:02 +0200657 if (nla_put_u8(skb, NFTA_EXTHDR_TYPE, priv->type))
658 goto nla_put_failure;
659 if (nla_put_be32(skb, NFTA_EXTHDR_OFFSET, htonl(priv->offset)))
660 goto nla_put_failure;
661 if (nla_put_be32(skb, NFTA_EXTHDR_LEN, htonl(priv->len)))
662 goto nla_put_failure;
Phil Sutterc078ca32017-01-17 22:51:26 +0100663 if (nla_put_be32(skb, NFTA_EXTHDR_FLAGS, htonl(priv->flags)))
664 goto nla_put_failure;
Manuel Messner935b7f62017-02-07 03:14:53 +0100665 if (nla_put_be32(skb, NFTA_EXTHDR_OP, htonl(priv->op)))
666 goto nla_put_failure;
Patrick McHardy96518512013-10-14 11:00:02 +0200667 return 0;
668
669nla_put_failure:
670 return -1;
671}
672
Phil Sutter7d34aa32022-10-14 23:45:58 +0200673static int nft_exthdr_dump(struct sk_buff *skb,
674 const struct nft_expr *expr, bool reset)
Florian Westphal5e7d6952017-08-08 15:15:28 +0200675{
676 const struct nft_exthdr *priv = nft_expr_priv(expr);
677
678 if (nft_dump_register(skb, NFTA_EXTHDR_DREG, priv->dreg))
679 return -1;
680
681 return nft_exthdr_dump_common(skb, priv);
682}
683
Phil Sutter7d34aa32022-10-14 23:45:58 +0200684static int nft_exthdr_dump_set(struct sk_buff *skb,
685 const struct nft_expr *expr, bool reset)
Florian Westphal99d17122017-08-08 15:15:29 +0200686{
687 const struct nft_exthdr *priv = nft_expr_priv(expr);
688
689 if (nft_dump_register(skb, NFTA_EXTHDR_SREG, priv->sreg))
690 return -1;
691
692 return nft_exthdr_dump_common(skb, priv);
693}
694
Phil Sutter7d34aa32022-10-14 23:45:58 +0200695static int nft_exthdr_dump_strip(struct sk_buff *skb,
696 const struct nft_expr *expr, bool reset)
Florian Westphal7890cbe2022-01-28 13:00:36 +0100697{
698 const struct nft_exthdr *priv = nft_expr_priv(expr);
699
700 return nft_exthdr_dump_common(skb, priv);
701}
702
Florian Westphale86dbdb2022-03-14 18:23:13 +0100703static bool nft_exthdr_reduce(struct nft_regs_track *track,
704 const struct nft_expr *expr)
705{
706 const struct nft_exthdr *priv = nft_expr_priv(expr);
707 const struct nft_exthdr *exthdr;
708
709 if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
710 nft_reg_track_update(track, expr, priv->dreg, priv->len);
711 return false;
712 }
713
714 exthdr = nft_expr_priv(track->regs[priv->dreg].selector);
715 if (priv->type != exthdr->type ||
716 priv->op != exthdr->op ||
717 priv->flags != exthdr->flags ||
718 priv->offset != exthdr->offset ||
719 priv->len != exthdr->len) {
720 nft_reg_track_update(track, expr, priv->dreg, priv->len);
721 return false;
722 }
723
724 if (!track->regs[priv->dreg].bitwise)
725 return true;
726
727 return nft_expr_reduce_bitwise(track, expr);
728}
729
Manuel Messner935b7f62017-02-07 03:14:53 +0100730static const struct nft_expr_ops nft_exthdr_ipv6_ops = {
Patrick McHardyef1f7df2013-10-10 11:41:20 +0200731 .type = &nft_exthdr_type,
Patrick McHardy96518512013-10-14 11:00:02 +0200732 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
Manuel Messner935b7f62017-02-07 03:14:53 +0100733 .eval = nft_exthdr_ipv6_eval,
Patrick McHardy96518512013-10-14 11:00:02 +0200734 .init = nft_exthdr_init,
735 .dump = nft_exthdr_dump,
Florian Westphale86dbdb2022-03-14 18:23:13 +0100736 .reduce = nft_exthdr_reduce,
Patrick McHardyef1f7df2013-10-10 11:41:20 +0200737};
738
Stephen Suryaputradbb52812019-06-20 12:19:59 -0400739static const struct nft_expr_ops nft_exthdr_ipv4_ops = {
740 .type = &nft_exthdr_type,
741 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
742 .eval = nft_exthdr_ipv4_eval,
743 .init = nft_exthdr_ipv4_init,
744 .dump = nft_exthdr_dump,
Florian Westphale86dbdb2022-03-14 18:23:13 +0100745 .reduce = nft_exthdr_reduce,
Stephen Suryaputradbb52812019-06-20 12:19:59 -0400746};
747
Manuel Messner935b7f62017-02-07 03:14:53 +0100748static const struct nft_expr_ops nft_exthdr_tcp_ops = {
749 .type = &nft_exthdr_type,
750 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
751 .eval = nft_exthdr_tcp_eval,
752 .init = nft_exthdr_init,
753 .dump = nft_exthdr_dump,
Florian Westphale86dbdb2022-03-14 18:23:13 +0100754 .reduce = nft_exthdr_reduce,
Manuel Messner935b7f62017-02-07 03:14:53 +0100755};
756
Florian Westphal99d17122017-08-08 15:15:29 +0200757static const struct nft_expr_ops nft_exthdr_tcp_set_ops = {
758 .type = &nft_exthdr_type,
759 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
760 .eval = nft_exthdr_tcp_set_eval,
761 .init = nft_exthdr_tcp_set_init,
762 .dump = nft_exthdr_dump_set,
Florian Westphale86dbdb2022-03-14 18:23:13 +0100763 .reduce = NFT_REDUCE_READONLY,
Florian Westphal99d17122017-08-08 15:15:29 +0200764};
765
Florian Westphal7890cbe2022-01-28 13:00:36 +0100766static const struct nft_expr_ops nft_exthdr_tcp_strip_ops = {
767 .type = &nft_exthdr_type,
768 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
769 .eval = nft_exthdr_tcp_strip_eval,
770 .init = nft_exthdr_tcp_strip_init,
771 .dump = nft_exthdr_dump_strip,
Florian Westphale86dbdb2022-03-14 18:23:13 +0100772 .reduce = NFT_REDUCE_READONLY,
Florian Westphal7890cbe2022-01-28 13:00:36 +0100773};
774
Phil Sutter133dc202021-05-04 17:54:06 +0200775static const struct nft_expr_ops nft_exthdr_sctp_ops = {
776 .type = &nft_exthdr_type,
777 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
778 .eval = nft_exthdr_sctp_eval,
779 .init = nft_exthdr_init,
780 .dump = nft_exthdr_dump,
Florian Westphale86dbdb2022-03-14 18:23:13 +0100781 .reduce = nft_exthdr_reduce,
Phil Sutter133dc202021-05-04 17:54:06 +0200782};
783
Jeremy Sowdenb9f9a4852023-05-09 22:19:45 +0100784static const struct nft_expr_ops nft_exthdr_dccp_ops = {
785 .type = &nft_exthdr_type,
786 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
787 .eval = nft_exthdr_dccp_eval,
788 .init = nft_exthdr_dccp_init,
789 .dump = nft_exthdr_dump,
790 .reduce = nft_exthdr_reduce,
791};
792
Manuel Messner935b7f62017-02-07 03:14:53 +0100793static const struct nft_expr_ops *
794nft_exthdr_select_ops(const struct nft_ctx *ctx,
795 const struct nlattr * const tb[])
796{
797 u32 op;
798
799 if (!tb[NFTA_EXTHDR_OP])
800 return &nft_exthdr_ipv6_ops;
801
Florian Westphal99d17122017-08-08 15:15:29 +0200802 if (tb[NFTA_EXTHDR_SREG] && tb[NFTA_EXTHDR_DREG])
803 return ERR_PTR(-EOPNOTSUPP);
804
Florian Westphal5fd02eb2017-08-21 16:19:26 +0200805 op = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OP]));
Manuel Messner935b7f62017-02-07 03:14:53 +0100806 switch (op) {
807 case NFT_EXTHDR_OP_TCPOPT:
Florian Westphal99d17122017-08-08 15:15:29 +0200808 if (tb[NFTA_EXTHDR_SREG])
809 return &nft_exthdr_tcp_set_ops;
810 if (tb[NFTA_EXTHDR_DREG])
811 return &nft_exthdr_tcp_ops;
Florian Westphal7890cbe2022-01-28 13:00:36 +0100812 return &nft_exthdr_tcp_strip_ops;
Manuel Messner935b7f62017-02-07 03:14:53 +0100813 case NFT_EXTHDR_OP_IPV6:
Florian Westphal99d17122017-08-08 15:15:29 +0200814 if (tb[NFTA_EXTHDR_DREG])
815 return &nft_exthdr_ipv6_ops;
816 break;
Stephen Suryaputradbb52812019-06-20 12:19:59 -0400817 case NFT_EXTHDR_OP_IPV4:
818 if (ctx->family != NFPROTO_IPV6) {
819 if (tb[NFTA_EXTHDR_DREG])
820 return &nft_exthdr_ipv4_ops;
821 }
822 break;
Phil Sutter133dc202021-05-04 17:54:06 +0200823 case NFT_EXTHDR_OP_SCTP:
824 if (tb[NFTA_EXTHDR_DREG])
825 return &nft_exthdr_sctp_ops;
826 break;
Jeremy Sowdenb9f9a4852023-05-09 22:19:45 +0100827 case NFT_EXTHDR_OP_DCCP:
828 if (tb[NFTA_EXTHDR_DREG])
829 return &nft_exthdr_dccp_ops;
830 break;
Manuel Messner935b7f62017-02-07 03:14:53 +0100831 }
832
833 return ERR_PTR(-EOPNOTSUPP);
834}
835
Florian Westphald0103152018-04-16 19:15:56 +0200836struct nft_expr_type nft_exthdr_type __read_mostly = {
Patrick McHardyef1f7df2013-10-10 11:41:20 +0200837 .name = "exthdr",
Arushi Singhald4ef3832017-04-02 14:52:12 +0530838 .select_ops = nft_exthdr_select_ops,
Patrick McHardy96518512013-10-14 11:00:02 +0200839 .policy = nft_exthdr_policy,
840 .maxattr = NFTA_EXTHDR_MAX,
Patrick McHardyef1f7df2013-10-10 11:41:20 +0200841 .owner = THIS_MODULE,
Patrick McHardy96518512013-10-14 11:00:02 +0200842};