~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nft_meta.c

Version: ~ [ linux-5.12-rc1 ] ~ [ linux-5.11.2 ] ~ [ linux-5.10.19 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.101 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.177 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.222 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.258 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.258 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
  3  *
  4  * This program is free software; you can redistribute it and/or modify
  5  * it under the terms of the GNU General Public License version 2 as
  6  * published by the Free Software Foundation.
  7  *
  8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  9  */
 10 
 11 #include <linux/kernel.h>
 12 #include <linux/init.h>
 13 #include <linux/module.h>
 14 #include <linux/netlink.h>
 15 #include <linux/netfilter.h>
 16 #include <linux/netfilter/nf_tables.h>
 17 #include <linux/in.h>
 18 #include <linux/ip.h>
 19 #include <linux/ipv6.h>
 20 #include <linux/smp.h>
 21 #include <linux/static_key.h>
 22 #include <net/dst.h>
 23 #include <net/sock.h>
 24 #include <net/tcp_states.h> /* for TCP_TIME_WAIT */
 25 #include <net/netfilter/nf_tables.h>
 26 #include <net/netfilter/nf_tables_core.h>
 27 #include <net/netfilter/nft_meta.h>
 28 
 29 #include <uapi/linux/netfilter_bridge.h> /* NF_BR_PRE_ROUTING */
 30 
 31 static DEFINE_PER_CPU(struct rnd_state, nft_prandom_state);
 32 
 33 void nft_meta_get_eval(const struct nft_expr *expr,
 34                        struct nft_regs *regs,
 35                        const struct nft_pktinfo *pkt)
 36 {
 37         const struct nft_meta *priv = nft_expr_priv(expr);
 38         const struct sk_buff *skb = pkt->skb;
 39         const struct net_device *in = nft_in(pkt), *out = nft_out(pkt);
 40         struct sock *sk;
 41         u32 *dest = &regs->data[priv->dreg];
 42 
 43         switch (priv->key) {
 44         case NFT_META_LEN:
 45                 *dest = skb->len;
 46                 break;
 47         case NFT_META_PROTOCOL:
 48                 nft_reg_store16(dest, (__force u16)skb->protocol);
 49                 break;
 50         case NFT_META_NFPROTO:
 51                 nft_reg_store8(dest, nft_pf(pkt));
 52                 break;
 53         case NFT_META_L4PROTO:
 54                 if (!pkt->tprot_set)
 55                         goto err;
 56                 nft_reg_store8(dest, pkt->tprot);
 57                 break;
 58         case NFT_META_PRIORITY:
 59                 *dest = skb->priority;
 60                 break;
 61         case NFT_META_MARK:
 62                 *dest = skb->mark;
 63                 break;
 64         case NFT_META_IIF:
 65                 if (in == NULL)
 66                         goto err;
 67                 *dest = in->ifindex;
 68                 break;
 69         case NFT_META_OIF:
 70                 if (out == NULL)
 71                         goto err;
 72                 *dest = out->ifindex;
 73                 break;
 74         case NFT_META_IIFNAME:
 75                 if (in == NULL)
 76                         goto err;
 77                 strncpy((char *)dest, in->name, IFNAMSIZ);
 78                 break;
 79         case NFT_META_OIFNAME:
 80                 if (out == NULL)
 81                         goto err;
 82                 strncpy((char *)dest, out->name, IFNAMSIZ);
 83                 break;
 84         case NFT_META_IIFTYPE:
 85                 if (in == NULL)
 86                         goto err;
 87                 nft_reg_store16(dest, in->type);
 88                 break;
 89         case NFT_META_OIFTYPE:
 90                 if (out == NULL)
 91                         goto err;
 92                 nft_reg_store16(dest, out->type);
 93                 break;
 94         case NFT_META_SKUID:
 95                 sk = skb_to_full_sk(skb);
 96                 if (!sk || !sk_fullsock(sk))
 97                         goto err;
 98 
 99                 read_lock_bh(&sk->sk_callback_lock);
100                 if (sk->sk_socket == NULL ||
101                     sk->sk_socket->file == NULL) {
102                         read_unlock_bh(&sk->sk_callback_lock);
103                         goto err;
104                 }
105 
106                 *dest = from_kuid_munged(&init_user_ns,
107                                 sk->sk_socket->file->f_cred->fsuid);
108                 read_unlock_bh(&sk->sk_callback_lock);
109                 break;
110         case NFT_META_SKGID:
111                 sk = skb_to_full_sk(skb);
112                 if (!sk || !sk_fullsock(sk))
113                         goto err;
114 
115                 read_lock_bh(&sk->sk_callback_lock);
116                 if (sk->sk_socket == NULL ||
117                     sk->sk_socket->file == NULL) {
118                         read_unlock_bh(&sk->sk_callback_lock);
119                         goto err;
120                 }
121                 *dest = from_kgid_munged(&init_user_ns,
122                                  sk->sk_socket->file->f_cred->fsgid);
123                 read_unlock_bh(&sk->sk_callback_lock);
124                 break;
125 #ifdef CONFIG_IP_ROUTE_CLASSID
126         case NFT_META_RTCLASSID: {
127                 const struct dst_entry *dst = skb_dst(skb);
128 
129                 if (dst == NULL)
130                         goto err;
131                 *dest = dst->tclassid;
132                 break;
133         }
134 #endif
135 #ifdef CONFIG_NETWORK_SECMARK
136         case NFT_META_SECMARK:
137                 *dest = skb->secmark;
138                 break;
139 #endif
140         case NFT_META_PKTTYPE:
141                 if (skb->pkt_type != PACKET_LOOPBACK) {
142                         nft_reg_store8(dest, skb->pkt_type);
143                         break;
144                 }
145 
146                 switch (nft_pf(pkt)) {
147                 case NFPROTO_IPV4:
148                         if (ipv4_is_multicast(ip_hdr(skb)->daddr))
149                                 nft_reg_store8(dest, PACKET_MULTICAST);
150                         else
151                                 nft_reg_store8(dest, PACKET_BROADCAST);
152                         break;
153                 case NFPROTO_IPV6:
154                         nft_reg_store8(dest, PACKET_MULTICAST);
155                         break;
156                 case NFPROTO_NETDEV:
157                         switch (skb->protocol) {
158                         case htons(ETH_P_IP): {
159                                 int noff = skb_network_offset(skb);
160                                 struct iphdr *iph, _iph;
161 
162                                 iph = skb_header_pointer(skb, noff,
163                                                          sizeof(_iph), &_iph);
164                                 if (!iph)
165                                         goto err;
166 
167                                 if (ipv4_is_multicast(iph->daddr))
168                                         nft_reg_store8(dest, PACKET_MULTICAST);
169                                 else
170                                         nft_reg_store8(dest, PACKET_BROADCAST);
171 
172                                 break;
173                         }
174                         case htons(ETH_P_IPV6):
175                                 nft_reg_store8(dest, PACKET_MULTICAST);
176                                 break;
177                         default:
178                                 WARN_ON_ONCE(1);
179                                 goto err;
180                         }
181                         break;
182                 default:
183                         WARN_ON_ONCE(1);
184                         goto err;
185                 }
186                 break;
187         case NFT_META_CPU:
188                 *dest = raw_smp_processor_id();
189                 break;
190         case NFT_META_IIFGROUP:
191                 if (in == NULL)
192                         goto err;
193                 *dest = in->group;
194                 break;
195         case NFT_META_OIFGROUP:
196                 if (out == NULL)
197                         goto err;
198                 *dest = out->group;
199                 break;
200 #ifdef CONFIG_CGROUP_NET_CLASSID
201         case NFT_META_CGROUP:
202                 sk = skb_to_full_sk(skb);
203                 if (!sk || !sk_fullsock(sk))
204                         goto err;
205                 *dest = sock_cgroup_classid(&sk->sk_cgrp_data);
206                 break;
207 #endif
208         case NFT_META_PRANDOM: {
209                 struct rnd_state *state = this_cpu_ptr(&nft_prandom_state);
210                 *dest = prandom_u32_state(state);
211                 break;
212         }
213         default:
214                 WARN_ON(1);
215                 goto err;
216         }
217         return;
218 
219 err:
220         regs->verdict.code = NFT_BREAK;
221 }
222 EXPORT_SYMBOL_GPL(nft_meta_get_eval);
223 
224 void nft_meta_set_eval(const struct nft_expr *expr,
225                        struct nft_regs *regs,
226                        const struct nft_pktinfo *pkt)
227 {
228         const struct nft_meta *meta = nft_expr_priv(expr);
229         struct sk_buff *skb = pkt->skb;
230         u32 *sreg = &regs->data[meta->sreg];
231         u32 value = *sreg;
232         u8 pkt_type;
233 
234         switch (meta->key) {
235         case NFT_META_MARK:
236                 skb->mark = value;
237                 break;
238         case NFT_META_PRIORITY:
239                 skb->priority = value;
240                 break;
241         case NFT_META_PKTTYPE:
242                 pkt_type = nft_reg_load8(sreg);
243 
244                 if (skb->pkt_type != pkt_type &&
245                     skb_pkt_type_ok(pkt_type) &&
246                     skb_pkt_type_ok(skb->pkt_type))
247                         skb->pkt_type = pkt_type;
248                 break;
249         case NFT_META_NFTRACE:
250                 skb->nf_trace = !!value;
251                 break;
252         default:
253                 WARN_ON(1);
254         }
255 }
256 EXPORT_SYMBOL_GPL(nft_meta_set_eval);
257 
258 const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = {
259         [NFTA_META_DREG]        = { .type = NLA_U32 },
260         [NFTA_META_KEY]         = { .type = NLA_U32 },
261         [NFTA_META_SREG]        = { .type = NLA_U32 },
262 };
263 EXPORT_SYMBOL_GPL(nft_meta_policy);
264 
265 int nft_meta_get_init(const struct nft_ctx *ctx,
266                       const struct nft_expr *expr,
267                       const struct nlattr * const tb[])
268 {
269         struct nft_meta *priv = nft_expr_priv(expr);
270         unsigned int len;
271 
272         priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
273         switch (priv->key) {
274         case NFT_META_PROTOCOL:
275         case NFT_META_IIFTYPE:
276         case NFT_META_OIFTYPE:
277                 len = sizeof(u16);
278                 break;
279         case NFT_META_NFPROTO:
280         case NFT_META_L4PROTO:
281         case NFT_META_LEN:
282         case NFT_META_PRIORITY:
283         case NFT_META_MARK:
284         case NFT_META_IIF:
285         case NFT_META_OIF:
286         case NFT_META_SKUID:
287         case NFT_META_SKGID:
288 #ifdef CONFIG_IP_ROUTE_CLASSID
289         case NFT_META_RTCLASSID:
290 #endif
291 #ifdef CONFIG_NETWORK_SECMARK
292         case NFT_META_SECMARK:
293 #endif
294         case NFT_META_PKTTYPE:
295         case NFT_META_CPU:
296         case NFT_META_IIFGROUP:
297         case NFT_META_OIFGROUP:
298 #ifdef CONFIG_CGROUP_NET_CLASSID
299         case NFT_META_CGROUP:
300 #endif
301                 len = sizeof(u32);
302                 break;
303         case NFT_META_IIFNAME:
304         case NFT_META_OIFNAME:
305                 len = IFNAMSIZ;
306                 break;
307         case NFT_META_PRANDOM:
308                 prandom_init_once(&nft_prandom_state);
309                 len = sizeof(u32);
310                 break;
311         default:
312                 return -EOPNOTSUPP;
313         }
314 
315         priv->dreg = nft_parse_register(tb[NFTA_META_DREG]);
316         return nft_validate_register_store(ctx, priv->dreg, NULL,
317                                            NFT_DATA_VALUE, len);
318 }
319 EXPORT_SYMBOL_GPL(nft_meta_get_init);
320 
321 int nft_meta_set_validate(const struct nft_ctx *ctx,
322                           const struct nft_expr *expr,
323                           const struct nft_data **data)
324 {
325         struct nft_meta *priv = nft_expr_priv(expr);
326         unsigned int hooks;
327 
328         if (priv->key != NFT_META_PKTTYPE)
329                 return 0;
330 
331         switch (ctx->afi->family) {
332         case NFPROTO_BRIDGE:
333                 hooks = 1 << NF_BR_PRE_ROUTING;
334                 break;
335         case NFPROTO_NETDEV:
336                 hooks = 1 << NF_NETDEV_INGRESS;
337                 break;
338         case NFPROTO_IPV4:
339         case NFPROTO_IPV6:
340         case NFPROTO_INET:
341                 hooks = 1 << NF_INET_PRE_ROUTING;
342                 break;
343         default:
344                 return -EOPNOTSUPP;
345         }
346 
347         return nft_chain_validate_hooks(ctx->chain, hooks);
348 }
349 EXPORT_SYMBOL_GPL(nft_meta_set_validate);
350 
351 int nft_meta_set_init(const struct nft_ctx *ctx,
352                       const struct nft_expr *expr,
353                       const struct nlattr * const tb[])
354 {
355         struct nft_meta *priv = nft_expr_priv(expr);
356         unsigned int len;
357         int err;
358 
359         priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
360         switch (priv->key) {
361         case NFT_META_MARK:
362         case NFT_META_PRIORITY:
363                 len = sizeof(u32);
364                 break;
365         case NFT_META_NFTRACE:
366                 len = sizeof(u8);
367                 break;
368         case NFT_META_PKTTYPE:
369                 len = sizeof(u8);
370                 break;
371         default:
372                 return -EOPNOTSUPP;
373         }
374 
375         priv->sreg = nft_parse_register(tb[NFTA_META_SREG]);
376         err = nft_validate_register_load(priv->sreg, len);
377         if (err < 0)
378                 return err;
379 
380         if (priv->key == NFT_META_NFTRACE)
381                 static_branch_inc(&nft_trace_enabled);
382 
383         return 0;
384 }
385 EXPORT_SYMBOL_GPL(nft_meta_set_init);
386 
387 int nft_meta_get_dump(struct sk_buff *skb,
388                       const struct nft_expr *expr)
389 {
390         const struct nft_meta *priv = nft_expr_priv(expr);
391 
392         if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key)))
393                 goto nla_put_failure;
394         if (nft_dump_register(skb, NFTA_META_DREG, priv->dreg))
395                 goto nla_put_failure;
396         return 0;
397 
398 nla_put_failure:
399         return -1;
400 }
401 EXPORT_SYMBOL_GPL(nft_meta_get_dump);
402 
403 int nft_meta_set_dump(struct sk_buff *skb,
404                       const struct nft_expr *expr)
405 {
406         const struct nft_meta *priv = nft_expr_priv(expr);
407 
408         if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key)))
409                 goto nla_put_failure;
410         if (nft_dump_register(skb, NFTA_META_SREG, priv->sreg))
411                 goto nla_put_failure;
412 
413         return 0;
414 
415 nla_put_failure:
416         return -1;
417 }
418 EXPORT_SYMBOL_GPL(nft_meta_set_dump);
419 
420 void nft_meta_set_destroy(const struct nft_ctx *ctx,
421                           const struct nft_expr *expr)
422 {
423         const struct nft_meta *priv = nft_expr_priv(expr);
424 
425         if (priv->key == NFT_META_NFTRACE)
426                 static_branch_dec(&nft_trace_enabled);
427 }
428 EXPORT_SYMBOL_GPL(nft_meta_set_destroy);
429 
430 static struct nft_expr_type nft_meta_type;
431 static const struct nft_expr_ops nft_meta_get_ops = {
432         .type           = &nft_meta_type,
433         .size           = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
434         .eval           = nft_meta_get_eval,
435         .init           = nft_meta_get_init,
436         .dump           = nft_meta_get_dump,
437 };
438 
439 static const struct nft_expr_ops nft_meta_set_ops = {
440         .type           = &nft_meta_type,
441         .size           = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
442         .eval           = nft_meta_set_eval,
443         .init           = nft_meta_set_init,
444         .destroy        = nft_meta_set_destroy,
445         .dump           = nft_meta_set_dump,
446         .validate       = nft_meta_set_validate,
447 };
448 
449 static const struct nft_expr_ops *
450 nft_meta_select_ops(const struct nft_ctx *ctx,
451                     const struct nlattr * const tb[])
452 {
453         if (tb[NFTA_META_KEY] == NULL)
454                 return ERR_PTR(-EINVAL);
455 
456         if (tb[NFTA_META_DREG] && tb[NFTA_META_SREG])
457                 return ERR_PTR(-EINVAL);
458 
459         if (tb[NFTA_META_DREG])
460                 return &nft_meta_get_ops;
461 
462         if (tb[NFTA_META_SREG])
463                 return &nft_meta_set_ops;
464 
465         return ERR_PTR(-EINVAL);
466 }
467 
468 static struct nft_expr_type nft_meta_type __read_mostly = {
469         .name           = "meta",
470         .select_ops     = nft_meta_select_ops,
471         .policy         = nft_meta_policy,
472         .maxattr        = NFTA_META_MAX,
473         .owner          = THIS_MODULE,
474 };
475 
476 static int __init nft_meta_module_init(void)
477 {
478         return nft_register_expr(&nft_meta_type);
479 }
480 
481 static void __exit nft_meta_module_exit(void)
482 {
483         nft_unregister_expr(&nft_meta_type);
484 }
485 
486 module_init(nft_meta_module_init);
487 module_exit(nft_meta_module_exit);
488 
489 MODULE_LICENSE("GPL");
490 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
491 MODULE_ALIAS_NFT_EXPR("meta");
492 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp