Loading...
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
4 *
5 * Development of this code funded by Astaro AG (http://www.astaro.com/)
6 */
7
8#include <asm/unaligned.h>
9#include <linux/kernel.h>
10#include <linux/netlink.h>
11#include <linux/netfilter.h>
12#include <linux/netfilter/nf_tables.h>
13#include <linux/sctp.h>
14#include <net/netfilter/nf_tables_core.h>
15#include <net/netfilter/nf_tables.h>
16#include <net/sctp/sctp.h>
17#include <net/tcp.h>
18
19struct nft_exthdr {
20 u8 type;
21 u8 offset;
22 u8 len;
23 u8 op;
24 u8 dreg;
25 u8 sreg;
26 u8 flags;
27};
28
29static unsigned int optlen(const u8 *opt, unsigned int offset)
30{
31 /* Beware zero-length options: make finite progress */
32 if (opt[offset] <= TCPOPT_NOP || opt[offset + 1] == 0)
33 return 1;
34 else
35 return opt[offset + 1];
36}
37
38static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
39 struct nft_regs *regs,
40 const struct nft_pktinfo *pkt)
41{
42 struct nft_exthdr *priv = nft_expr_priv(expr);
43 u32 *dest = ®s->data[priv->dreg];
44 unsigned int offset = 0;
45 int err;
46
47 if (pkt->skb->protocol != htons(ETH_P_IPV6))
48 goto err;
49
50 err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
51 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
52 nft_reg_store8(dest, err >= 0);
53 return;
54 } else if (err < 0) {
55 goto err;
56 }
57 offset += priv->offset;
58
59 dest[priv->len / NFT_REG32_SIZE] = 0;
60 if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
61 goto err;
62 return;
63err:
64 regs->verdict.code = NFT_BREAK;
65}
66
67/* find the offset to specified option.
68 *
69 * If target header is found, its offset is set in *offset and return option
70 * number. Otherwise, return negative error.
71 *
72 * If the first fragment doesn't contain the End of Options it is considered
73 * invalid.
74 */
75static int ipv4_find_option(struct net *net, struct sk_buff *skb,
76 unsigned int *offset, int target)
77{
78 unsigned char optbuf[sizeof(struct ip_options) + 40];
79 struct ip_options *opt = (struct ip_options *)optbuf;
80 struct iphdr *iph, _iph;
81 unsigned int start;
82 bool found = false;
83 __be32 info;
84 int optlen;
85
86 iph = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
87 if (!iph)
88 return -EBADMSG;
89 start = sizeof(struct iphdr);
90
91 optlen = iph->ihl * 4 - (int)sizeof(struct iphdr);
92 if (optlen <= 0)
93 return -ENOENT;
94
95 memset(opt, 0, sizeof(struct ip_options));
96 /* Copy the options since __ip_options_compile() modifies
97 * the options.
98 */
99 if (skb_copy_bits(skb, start, opt->__data, optlen))
100 return -EBADMSG;
101 opt->optlen = optlen;
102
103 if (__ip_options_compile(net, opt, NULL, &info))
104 return -EBADMSG;
105
106 switch (target) {
107 case IPOPT_SSRR:
108 case IPOPT_LSRR:
109 if (!opt->srr)
110 break;
111 found = target == IPOPT_SSRR ? opt->is_strictroute :
112 !opt->is_strictroute;
113 if (found)
114 *offset = opt->srr + start;
115 break;
116 case IPOPT_RR:
117 if (!opt->rr)
118 break;
119 *offset = opt->rr + start;
120 found = true;
121 break;
122 case IPOPT_RA:
123 if (!opt->router_alert)
124 break;
125 *offset = opt->router_alert + start;
126 found = true;
127 break;
128 default:
129 return -EOPNOTSUPP;
130 }
131 return found ? target : -ENOENT;
132}
133
134static void nft_exthdr_ipv4_eval(const struct nft_expr *expr,
135 struct nft_regs *regs,
136 const struct nft_pktinfo *pkt)
137{
138 struct nft_exthdr *priv = nft_expr_priv(expr);
139 u32 *dest = ®s->data[priv->dreg];
140 struct sk_buff *skb = pkt->skb;
141 unsigned int offset;
142 int err;
143
144 if (skb->protocol != htons(ETH_P_IP))
145 goto err;
146
147 err = ipv4_find_option(nft_net(pkt), skb, &offset, priv->type);
148 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
149 nft_reg_store8(dest, err >= 0);
150 return;
151 } else if (err < 0) {
152 goto err;
153 }
154 offset += priv->offset;
155
156 dest[priv->len / NFT_REG32_SIZE] = 0;
157 if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
158 goto err;
159 return;
160err:
161 regs->verdict.code = NFT_BREAK;
162}
163
164static void *
165nft_tcp_header_pointer(const struct nft_pktinfo *pkt,
166 unsigned int len, void *buffer, unsigned int *tcphdr_len)
167{
168 struct tcphdr *tcph;
169
170 if (pkt->tprot != IPPROTO_TCP)
171 return NULL;
172
173 tcph = skb_header_pointer(pkt->skb, nft_thoff(pkt), sizeof(*tcph), buffer);
174 if (!tcph)
175 return NULL;
176
177 *tcphdr_len = __tcp_hdrlen(tcph);
178 if (*tcphdr_len < sizeof(*tcph) || *tcphdr_len > len)
179 return NULL;
180
181 return skb_header_pointer(pkt->skb, nft_thoff(pkt), *tcphdr_len, buffer);
182}
183
184static void nft_exthdr_tcp_eval(const struct nft_expr *expr,
185 struct nft_regs *regs,
186 const struct nft_pktinfo *pkt)
187{
188 u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
189 struct nft_exthdr *priv = nft_expr_priv(expr);
190 unsigned int i, optl, tcphdr_len, offset;
191 u32 *dest = ®s->data[priv->dreg];
192 struct tcphdr *tcph;
193 u8 *opt;
194
195 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
196 if (!tcph)
197 goto err;
198
199 opt = (u8 *)tcph;
200 for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
201 optl = optlen(opt, i);
202
203 if (priv->type != opt[i])
204 continue;
205
206 if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
207 goto err;
208
209 offset = i + priv->offset;
210 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
211 *dest = 1;
212 } else {
213 dest[priv->len / NFT_REG32_SIZE] = 0;
214 memcpy(dest, opt + offset, priv->len);
215 }
216
217 return;
218 }
219
220err:
221 if (priv->flags & NFT_EXTHDR_F_PRESENT)
222 *dest = 0;
223 else
224 regs->verdict.code = NFT_BREAK;
225}
226
227static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr,
228 struct nft_regs *regs,
229 const struct nft_pktinfo *pkt)
230{
231 u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
232 struct nft_exthdr *priv = nft_expr_priv(expr);
233 unsigned int i, optl, tcphdr_len, offset;
234 struct tcphdr *tcph;
235 u8 *opt;
236
237 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
238 if (!tcph)
239 return;
240
241 opt = (u8 *)tcph;
242 for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
243 union {
244 __be16 v16;
245 __be32 v32;
246 } old, new;
247
248 optl = optlen(opt, i);
249
250 if (priv->type != opt[i])
251 continue;
252
253 if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
254 return;
255
256 if (skb_ensure_writable(pkt->skb,
257 nft_thoff(pkt) + i + priv->len))
258 return;
259
260 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff,
261 &tcphdr_len);
262 if (!tcph)
263 return;
264
265 offset = i + priv->offset;
266
267 switch (priv->len) {
268 case 2:
269 old.v16 = get_unaligned((u16 *)(opt + offset));
270 new.v16 = (__force __be16)nft_reg_load16(
271 ®s->data[priv->sreg]);
272
273 switch (priv->type) {
274 case TCPOPT_MSS:
275 /* increase can cause connection to stall */
276 if (ntohs(old.v16) <= ntohs(new.v16))
277 return;
278 break;
279 }
280
281 if (old.v16 == new.v16)
282 return;
283
284 put_unaligned(new.v16, (u16*)(opt + offset));
285 inet_proto_csum_replace2(&tcph->check, pkt->skb,
286 old.v16, new.v16, false);
287 break;
288 case 4:
289 new.v32 = regs->data[priv->sreg];
290 old.v32 = get_unaligned((u32 *)(opt + offset));
291
292 if (old.v32 == new.v32)
293 return;
294
295 put_unaligned(new.v32, (u32*)(opt + offset));
296 inet_proto_csum_replace4(&tcph->check, pkt->skb,
297 old.v32, new.v32, false);
298 break;
299 default:
300 WARN_ON_ONCE(1);
301 break;
302 }
303
304 return;
305 }
306}
307
308static void nft_exthdr_sctp_eval(const struct nft_expr *expr,
309 struct nft_regs *regs,
310 const struct nft_pktinfo *pkt)
311{
312 unsigned int offset = nft_thoff(pkt) + sizeof(struct sctphdr);
313 struct nft_exthdr *priv = nft_expr_priv(expr);
314 u32 *dest = ®s->data[priv->dreg];
315 const struct sctp_chunkhdr *sch;
316 struct sctp_chunkhdr _sch;
317
318 if (pkt->tprot != IPPROTO_SCTP)
319 goto err;
320
321 do {
322 sch = skb_header_pointer(pkt->skb, offset, sizeof(_sch), &_sch);
323 if (!sch || !sch->length)
324 break;
325
326 if (sch->type == priv->type) {
327 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
328 nft_reg_store8(dest, true);
329 return;
330 }
331 if (priv->offset + priv->len > ntohs(sch->length) ||
332 offset + ntohs(sch->length) > pkt->skb->len)
333 break;
334
335 dest[priv->len / NFT_REG32_SIZE] = 0;
336 if (skb_copy_bits(pkt->skb, offset + priv->offset,
337 dest, priv->len) < 0)
338 break;
339 return;
340 }
341 offset += SCTP_PAD4(ntohs(sch->length));
342 } while (offset < pkt->skb->len);
343err:
344 if (priv->flags & NFT_EXTHDR_F_PRESENT)
345 nft_reg_store8(dest, false);
346 else
347 regs->verdict.code = NFT_BREAK;
348}
349
350static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = {
351 [NFTA_EXTHDR_DREG] = { .type = NLA_U32 },
352 [NFTA_EXTHDR_TYPE] = { .type = NLA_U8 },
353 [NFTA_EXTHDR_OFFSET] = { .type = NLA_U32 },
354 [NFTA_EXTHDR_LEN] = { .type = NLA_U32 },
355 [NFTA_EXTHDR_FLAGS] = { .type = NLA_U32 },
356 [NFTA_EXTHDR_OP] = { .type = NLA_U32 },
357 [NFTA_EXTHDR_SREG] = { .type = NLA_U32 },
358};
359
360static int nft_exthdr_init(const struct nft_ctx *ctx,
361 const struct nft_expr *expr,
362 const struct nlattr * const tb[])
363{
364 struct nft_exthdr *priv = nft_expr_priv(expr);
365 u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
366 int err;
367
368 if (!tb[NFTA_EXTHDR_DREG] ||
369 !tb[NFTA_EXTHDR_TYPE] ||
370 !tb[NFTA_EXTHDR_OFFSET] ||
371 !tb[NFTA_EXTHDR_LEN])
372 return -EINVAL;
373
374 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
375 if (err < 0)
376 return err;
377
378 err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
379 if (err < 0)
380 return err;
381
382 if (tb[NFTA_EXTHDR_FLAGS]) {
383 err = nft_parse_u32_check(tb[NFTA_EXTHDR_FLAGS], U8_MAX, &flags);
384 if (err < 0)
385 return err;
386
387 if (flags & ~NFT_EXTHDR_F_PRESENT)
388 return -EINVAL;
389 }
390
391 if (tb[NFTA_EXTHDR_OP]) {
392 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
393 if (err < 0)
394 return err;
395 }
396
397 priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
398 priv->offset = offset;
399 priv->len = len;
400 priv->flags = flags;
401 priv->op = op;
402
403 return nft_parse_register_store(ctx, tb[NFTA_EXTHDR_DREG],
404 &priv->dreg, NULL, NFT_DATA_VALUE,
405 priv->len);
406}
407
408static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx,
409 const struct nft_expr *expr,
410 const struct nlattr * const tb[])
411{
412 struct nft_exthdr *priv = nft_expr_priv(expr);
413 u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
414 int err;
415
416 if (!tb[NFTA_EXTHDR_SREG] ||
417 !tb[NFTA_EXTHDR_TYPE] ||
418 !tb[NFTA_EXTHDR_OFFSET] ||
419 !tb[NFTA_EXTHDR_LEN])
420 return -EINVAL;
421
422 if (tb[NFTA_EXTHDR_DREG] || tb[NFTA_EXTHDR_FLAGS])
423 return -EINVAL;
424
425 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
426 if (err < 0)
427 return err;
428
429 err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
430 if (err < 0)
431 return err;
432
433 if (offset < 2)
434 return -EOPNOTSUPP;
435
436 switch (len) {
437 case 2: break;
438 case 4: break;
439 default:
440 return -EOPNOTSUPP;
441 }
442
443 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
444 if (err < 0)
445 return err;
446
447 priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
448 priv->offset = offset;
449 priv->len = len;
450 priv->flags = flags;
451 priv->op = op;
452
453 return nft_parse_register_load(tb[NFTA_EXTHDR_SREG], &priv->sreg,
454 priv->len);
455}
456
457static int nft_exthdr_ipv4_init(const struct nft_ctx *ctx,
458 const struct nft_expr *expr,
459 const struct nlattr * const tb[])
460{
461 struct nft_exthdr *priv = nft_expr_priv(expr);
462 int err = nft_exthdr_init(ctx, expr, tb);
463
464 if (err < 0)
465 return err;
466
467 switch (priv->type) {
468 case IPOPT_SSRR:
469 case IPOPT_LSRR:
470 case IPOPT_RR:
471 case IPOPT_RA:
472 break;
473 default:
474 return -EOPNOTSUPP;
475 }
476 return 0;
477}
478
479static int nft_exthdr_dump_common(struct sk_buff *skb, const struct nft_exthdr *priv)
480{
481 if (nla_put_u8(skb, NFTA_EXTHDR_TYPE, priv->type))
482 goto nla_put_failure;
483 if (nla_put_be32(skb, NFTA_EXTHDR_OFFSET, htonl(priv->offset)))
484 goto nla_put_failure;
485 if (nla_put_be32(skb, NFTA_EXTHDR_LEN, htonl(priv->len)))
486 goto nla_put_failure;
487 if (nla_put_be32(skb, NFTA_EXTHDR_FLAGS, htonl(priv->flags)))
488 goto nla_put_failure;
489 if (nla_put_be32(skb, NFTA_EXTHDR_OP, htonl(priv->op)))
490 goto nla_put_failure;
491 return 0;
492
493nla_put_failure:
494 return -1;
495}
496
497static int nft_exthdr_dump(struct sk_buff *skb, const struct nft_expr *expr)
498{
499 const struct nft_exthdr *priv = nft_expr_priv(expr);
500
501 if (nft_dump_register(skb, NFTA_EXTHDR_DREG, priv->dreg))
502 return -1;
503
504 return nft_exthdr_dump_common(skb, priv);
505}
506
507static int nft_exthdr_dump_set(struct sk_buff *skb, const struct nft_expr *expr)
508{
509 const struct nft_exthdr *priv = nft_expr_priv(expr);
510
511 if (nft_dump_register(skb, NFTA_EXTHDR_SREG, priv->sreg))
512 return -1;
513
514 return nft_exthdr_dump_common(skb, priv);
515}
516
517static const struct nft_expr_ops nft_exthdr_ipv6_ops = {
518 .type = &nft_exthdr_type,
519 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
520 .eval = nft_exthdr_ipv6_eval,
521 .init = nft_exthdr_init,
522 .dump = nft_exthdr_dump,
523};
524
525static const struct nft_expr_ops nft_exthdr_ipv4_ops = {
526 .type = &nft_exthdr_type,
527 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
528 .eval = nft_exthdr_ipv4_eval,
529 .init = nft_exthdr_ipv4_init,
530 .dump = nft_exthdr_dump,
531};
532
533static const struct nft_expr_ops nft_exthdr_tcp_ops = {
534 .type = &nft_exthdr_type,
535 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
536 .eval = nft_exthdr_tcp_eval,
537 .init = nft_exthdr_init,
538 .dump = nft_exthdr_dump,
539};
540
541static const struct nft_expr_ops nft_exthdr_tcp_set_ops = {
542 .type = &nft_exthdr_type,
543 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
544 .eval = nft_exthdr_tcp_set_eval,
545 .init = nft_exthdr_tcp_set_init,
546 .dump = nft_exthdr_dump_set,
547};
548
549static const struct nft_expr_ops nft_exthdr_sctp_ops = {
550 .type = &nft_exthdr_type,
551 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
552 .eval = nft_exthdr_sctp_eval,
553 .init = nft_exthdr_init,
554 .dump = nft_exthdr_dump,
555};
556
557static const struct nft_expr_ops *
558nft_exthdr_select_ops(const struct nft_ctx *ctx,
559 const struct nlattr * const tb[])
560{
561 u32 op;
562
563 if (!tb[NFTA_EXTHDR_OP])
564 return &nft_exthdr_ipv6_ops;
565
566 if (tb[NFTA_EXTHDR_SREG] && tb[NFTA_EXTHDR_DREG])
567 return ERR_PTR(-EOPNOTSUPP);
568
569 op = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OP]));
570 switch (op) {
571 case NFT_EXTHDR_OP_TCPOPT:
572 if (tb[NFTA_EXTHDR_SREG])
573 return &nft_exthdr_tcp_set_ops;
574 if (tb[NFTA_EXTHDR_DREG])
575 return &nft_exthdr_tcp_ops;
576 break;
577 case NFT_EXTHDR_OP_IPV6:
578 if (tb[NFTA_EXTHDR_DREG])
579 return &nft_exthdr_ipv6_ops;
580 break;
581 case NFT_EXTHDR_OP_IPV4:
582 if (ctx->family != NFPROTO_IPV6) {
583 if (tb[NFTA_EXTHDR_DREG])
584 return &nft_exthdr_ipv4_ops;
585 }
586 break;
587 case NFT_EXTHDR_OP_SCTP:
588 if (tb[NFTA_EXTHDR_DREG])
589 return &nft_exthdr_sctp_ops;
590 break;
591 }
592
593 return ERR_PTR(-EOPNOTSUPP);
594}
595
596struct nft_expr_type nft_exthdr_type __read_mostly = {
597 .name = "exthdr",
598 .select_ops = nft_exthdr_select_ops,
599 .policy = nft_exthdr_policy,
600 .maxattr = NFTA_EXTHDR_MAX,
601 .owner = THIS_MODULE,
602};
1/*
2 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <asm/unaligned.h>
12#include <linux/kernel.h>
13#include <linux/init.h>
14#include <linux/module.h>
15#include <linux/netlink.h>
16#include <linux/netfilter.h>
17#include <linux/netfilter/nf_tables.h>
18#include <net/netfilter/nf_tables.h>
19#include <net/tcp.h>
20
21struct nft_exthdr {
22 u8 type;
23 u8 offset;
24 u8 len;
25 u8 op;
26 enum nft_registers dreg:8;
27 enum nft_registers sreg:8;
28 u8 flags;
29};
30
31static unsigned int optlen(const u8 *opt, unsigned int offset)
32{
33 /* Beware zero-length options: make finite progress */
34 if (opt[offset] <= TCPOPT_NOP || opt[offset + 1] == 0)
35 return 1;
36 else
37 return opt[offset + 1];
38}
39
40static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
41 struct nft_regs *regs,
42 const struct nft_pktinfo *pkt)
43{
44 struct nft_exthdr *priv = nft_expr_priv(expr);
45 u32 *dest = ®s->data[priv->dreg];
46 unsigned int offset = 0;
47 int err;
48
49 err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
50 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
51 *dest = (err >= 0);
52 return;
53 } else if (err < 0) {
54 goto err;
55 }
56 offset += priv->offset;
57
58 dest[priv->len / NFT_REG32_SIZE] = 0;
59 if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
60 goto err;
61 return;
62err:
63 regs->verdict.code = NFT_BREAK;
64}
65
66static void *
67nft_tcp_header_pointer(const struct nft_pktinfo *pkt,
68 unsigned int len, void *buffer, unsigned int *tcphdr_len)
69{
70 struct tcphdr *tcph;
71
72 if (!pkt->tprot_set || pkt->tprot != IPPROTO_TCP)
73 return NULL;
74
75 tcph = skb_header_pointer(pkt->skb, pkt->xt.thoff, sizeof(*tcph), buffer);
76 if (!tcph)
77 return NULL;
78
79 *tcphdr_len = __tcp_hdrlen(tcph);
80 if (*tcphdr_len < sizeof(*tcph) || *tcphdr_len > len)
81 return NULL;
82
83 return skb_header_pointer(pkt->skb, pkt->xt.thoff, *tcphdr_len, buffer);
84}
85
86static void nft_exthdr_tcp_eval(const struct nft_expr *expr,
87 struct nft_regs *regs,
88 const struct nft_pktinfo *pkt)
89{
90 u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
91 struct nft_exthdr *priv = nft_expr_priv(expr);
92 unsigned int i, optl, tcphdr_len, offset;
93 u32 *dest = ®s->data[priv->dreg];
94 struct tcphdr *tcph;
95 u8 *opt;
96
97 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
98 if (!tcph)
99 goto err;
100
101 opt = (u8 *)tcph;
102 for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
103 optl = optlen(opt, i);
104
105 if (priv->type != opt[i])
106 continue;
107
108 if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
109 goto err;
110
111 offset = i + priv->offset;
112 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
113 *dest = 1;
114 } else {
115 dest[priv->len / NFT_REG32_SIZE] = 0;
116 memcpy(dest, opt + offset, priv->len);
117 }
118
119 return;
120 }
121
122err:
123 if (priv->flags & NFT_EXTHDR_F_PRESENT)
124 *dest = 0;
125 else
126 regs->verdict.code = NFT_BREAK;
127}
128
129static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr,
130 struct nft_regs *regs,
131 const struct nft_pktinfo *pkt)
132{
133 u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
134 struct nft_exthdr *priv = nft_expr_priv(expr);
135 unsigned int i, optl, tcphdr_len, offset;
136 struct tcphdr *tcph;
137 u8 *opt;
138 u32 src;
139
140 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
141 if (!tcph)
142 return;
143
144 opt = (u8 *)tcph;
145 for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
146 union {
147 u8 octet;
148 __be16 v16;
149 __be32 v32;
150 } old, new;
151
152 optl = optlen(opt, i);
153
154 if (priv->type != opt[i])
155 continue;
156
157 if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
158 return;
159
160 if (!skb_make_writable(pkt->skb, pkt->xt.thoff + i + priv->len))
161 return;
162
163 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff,
164 &tcphdr_len);
165 if (!tcph)
166 return;
167
168 src = regs->data[priv->sreg];
169 offset = i + priv->offset;
170
171 switch (priv->len) {
172 case 2:
173 old.v16 = get_unaligned((u16 *)(opt + offset));
174 new.v16 = src;
175
176 switch (priv->type) {
177 case TCPOPT_MSS:
178 /* increase can cause connection to stall */
179 if (ntohs(old.v16) <= ntohs(new.v16))
180 return;
181 break;
182 }
183
184 if (old.v16 == new.v16)
185 return;
186
187 put_unaligned(new.v16, (u16*)(opt + offset));
188 inet_proto_csum_replace2(&tcph->check, pkt->skb,
189 old.v16, new.v16, false);
190 break;
191 case 4:
192 new.v32 = src;
193 old.v32 = get_unaligned((u32 *)(opt + offset));
194
195 if (old.v32 == new.v32)
196 return;
197
198 put_unaligned(new.v32, (u32*)(opt + offset));
199 inet_proto_csum_replace4(&tcph->check, pkt->skb,
200 old.v32, new.v32, false);
201 break;
202 default:
203 WARN_ON_ONCE(1);
204 break;
205 }
206
207 return;
208 }
209}
210
211static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = {
212 [NFTA_EXTHDR_DREG] = { .type = NLA_U32 },
213 [NFTA_EXTHDR_TYPE] = { .type = NLA_U8 },
214 [NFTA_EXTHDR_OFFSET] = { .type = NLA_U32 },
215 [NFTA_EXTHDR_LEN] = { .type = NLA_U32 },
216 [NFTA_EXTHDR_FLAGS] = { .type = NLA_U32 },
217 [NFTA_EXTHDR_OP] = { .type = NLA_U32 },
218 [NFTA_EXTHDR_SREG] = { .type = NLA_U32 },
219};
220
221static int nft_exthdr_init(const struct nft_ctx *ctx,
222 const struct nft_expr *expr,
223 const struct nlattr * const tb[])
224{
225 struct nft_exthdr *priv = nft_expr_priv(expr);
226 u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
227 int err;
228
229 if (!tb[NFTA_EXTHDR_DREG] ||
230 !tb[NFTA_EXTHDR_TYPE] ||
231 !tb[NFTA_EXTHDR_OFFSET] ||
232 !tb[NFTA_EXTHDR_LEN])
233 return -EINVAL;
234
235 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
236 if (err < 0)
237 return err;
238
239 err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
240 if (err < 0)
241 return err;
242
243 if (tb[NFTA_EXTHDR_FLAGS]) {
244 err = nft_parse_u32_check(tb[NFTA_EXTHDR_FLAGS], U8_MAX, &flags);
245 if (err < 0)
246 return err;
247
248 if (flags & ~NFT_EXTHDR_F_PRESENT)
249 return -EINVAL;
250 }
251
252 if (tb[NFTA_EXTHDR_OP]) {
253 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
254 if (err < 0)
255 return err;
256 }
257
258 priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
259 priv->offset = offset;
260 priv->len = len;
261 priv->dreg = nft_parse_register(tb[NFTA_EXTHDR_DREG]);
262 priv->flags = flags;
263 priv->op = op;
264
265 return nft_validate_register_store(ctx, priv->dreg, NULL,
266 NFT_DATA_VALUE, priv->len);
267}
268
269static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx,
270 const struct nft_expr *expr,
271 const struct nlattr * const tb[])
272{
273 struct nft_exthdr *priv = nft_expr_priv(expr);
274 u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
275 int err;
276
277 if (!tb[NFTA_EXTHDR_SREG] ||
278 !tb[NFTA_EXTHDR_TYPE] ||
279 !tb[NFTA_EXTHDR_OFFSET] ||
280 !tb[NFTA_EXTHDR_LEN])
281 return -EINVAL;
282
283 if (tb[NFTA_EXTHDR_DREG] || tb[NFTA_EXTHDR_FLAGS])
284 return -EINVAL;
285
286 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
287 if (err < 0)
288 return err;
289
290 err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
291 if (err < 0)
292 return err;
293
294 if (offset < 2)
295 return -EOPNOTSUPP;
296
297 switch (len) {
298 case 2: break;
299 case 4: break;
300 default:
301 return -EOPNOTSUPP;
302 }
303
304 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
305 if (err < 0)
306 return err;
307
308 priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
309 priv->offset = offset;
310 priv->len = len;
311 priv->sreg = nft_parse_register(tb[NFTA_EXTHDR_SREG]);
312 priv->flags = flags;
313 priv->op = op;
314
315 return nft_validate_register_load(priv->sreg, priv->len);
316}
317
318static int nft_exthdr_dump_common(struct sk_buff *skb, const struct nft_exthdr *priv)
319{
320 if (nla_put_u8(skb, NFTA_EXTHDR_TYPE, priv->type))
321 goto nla_put_failure;
322 if (nla_put_be32(skb, NFTA_EXTHDR_OFFSET, htonl(priv->offset)))
323 goto nla_put_failure;
324 if (nla_put_be32(skb, NFTA_EXTHDR_LEN, htonl(priv->len)))
325 goto nla_put_failure;
326 if (nla_put_be32(skb, NFTA_EXTHDR_FLAGS, htonl(priv->flags)))
327 goto nla_put_failure;
328 if (nla_put_be32(skb, NFTA_EXTHDR_OP, htonl(priv->op)))
329 goto nla_put_failure;
330 return 0;
331
332nla_put_failure:
333 return -1;
334}
335
336static int nft_exthdr_dump(struct sk_buff *skb, const struct nft_expr *expr)
337{
338 const struct nft_exthdr *priv = nft_expr_priv(expr);
339
340 if (nft_dump_register(skb, NFTA_EXTHDR_DREG, priv->dreg))
341 return -1;
342
343 return nft_exthdr_dump_common(skb, priv);
344}
345
346static int nft_exthdr_dump_set(struct sk_buff *skb, const struct nft_expr *expr)
347{
348 const struct nft_exthdr *priv = nft_expr_priv(expr);
349
350 if (nft_dump_register(skb, NFTA_EXTHDR_SREG, priv->sreg))
351 return -1;
352
353 return nft_exthdr_dump_common(skb, priv);
354}
355
356static struct nft_expr_type nft_exthdr_type;
357static const struct nft_expr_ops nft_exthdr_ipv6_ops = {
358 .type = &nft_exthdr_type,
359 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
360 .eval = nft_exthdr_ipv6_eval,
361 .init = nft_exthdr_init,
362 .dump = nft_exthdr_dump,
363};
364
365static const struct nft_expr_ops nft_exthdr_tcp_ops = {
366 .type = &nft_exthdr_type,
367 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
368 .eval = nft_exthdr_tcp_eval,
369 .init = nft_exthdr_init,
370 .dump = nft_exthdr_dump,
371};
372
373static const struct nft_expr_ops nft_exthdr_tcp_set_ops = {
374 .type = &nft_exthdr_type,
375 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
376 .eval = nft_exthdr_tcp_set_eval,
377 .init = nft_exthdr_tcp_set_init,
378 .dump = nft_exthdr_dump_set,
379};
380
381static const struct nft_expr_ops *
382nft_exthdr_select_ops(const struct nft_ctx *ctx,
383 const struct nlattr * const tb[])
384{
385 u32 op;
386
387 if (!tb[NFTA_EXTHDR_OP])
388 return &nft_exthdr_ipv6_ops;
389
390 if (tb[NFTA_EXTHDR_SREG] && tb[NFTA_EXTHDR_DREG])
391 return ERR_PTR(-EOPNOTSUPP);
392
393 op = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OP]));
394 switch (op) {
395 case NFT_EXTHDR_OP_TCPOPT:
396 if (tb[NFTA_EXTHDR_SREG])
397 return &nft_exthdr_tcp_set_ops;
398 if (tb[NFTA_EXTHDR_DREG])
399 return &nft_exthdr_tcp_ops;
400 break;
401 case NFT_EXTHDR_OP_IPV6:
402 if (tb[NFTA_EXTHDR_DREG])
403 return &nft_exthdr_ipv6_ops;
404 break;
405 }
406
407 return ERR_PTR(-EOPNOTSUPP);
408}
409
410static struct nft_expr_type nft_exthdr_type __read_mostly = {
411 .name = "exthdr",
412 .select_ops = nft_exthdr_select_ops,
413 .policy = nft_exthdr_policy,
414 .maxattr = NFTA_EXTHDR_MAX,
415 .owner = THIS_MODULE,
416};
417
418static int __init nft_exthdr_module_init(void)
419{
420 return nft_register_expr(&nft_exthdr_type);
421}
422
423static void __exit nft_exthdr_module_exit(void)
424{
425 nft_unregister_expr(&nft_exthdr_type);
426}
427
428module_init(nft_exthdr_module_init);
429module_exit(nft_exthdr_module_exit);
430
431MODULE_LICENSE("GPL");
432MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
433MODULE_ALIAS_NFT_EXPR("exthdr");