1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * (C) 2015 Red Hat GmbH 4 * Author: Florian Westphal <fw@strlen.de> 5 */ 6 7 #include <linux/module.h> 8 #include <linux/static_key.h> 9 #include <linux/hash.h> 10 #include <linux/jhash.h> 11 #include <linux/if_vlan.h> 12 #include <linux/init.h> 13 #include <linux/skbuff.h> 14 #include <linux/netlink.h> 15 #include <linux/netfilter.h> 16 #include <linux/netfilter/nfnetlink.h> 17 #include <linux/netfilter/nf_tables.h> 18 #include <net/netfilter/nf_tables_core.h> 19 #include <net/netfilter/nf_tables.h> 20 21 #define NFT_TRACETYPE_LL_HSIZE 20 22 #define NFT_TRACETYPE_NETWORK_HSIZE 40 23 #define NFT_TRACETYPE_TRANSPORT_HSIZE 20 24 25 DEFINE_STATIC_KEY_FALSE(nft_trace_enabled); 26 EXPORT_SYMBOL_GPL(nft_trace_enabled); 27 28 static int trace_fill_id(struct sk_buff *nlskb, struct sk_buff *skb) 29 { 30 __be32 id; 31 32 /* using skb address as ID results in a limited number of 33 * values (and quick reuse). 34 * 35 * So we attempt to use as many skb members that will not 36 * change while skb is with netfilter. 37 */ 38 id = (__be32)jhash_2words(hash32_ptr(skb), skb_get_hash(skb), 39 skb->skb_iif); 40 41 return nla_put_be32(nlskb, NFTA_TRACE_ID, id); 42 } 43 44 static int trace_fill_header(struct sk_buff *nlskb, u16 type, 45 const struct sk_buff *skb, 46 int off, unsigned int len) 47 { 48 struct nlattr *nla; 49 50 if (len == 0) 51 return 0; 52 53 nla = nla_reserve(nlskb, type, len); 54 if (!nla || skb_copy_bits(skb, off, nla_data(nla), len)) 55 return -1; 56 57 return 0; 58 } 59 60 static int nf_trace_fill_ll_header(struct sk_buff *nlskb, 61 const struct sk_buff *skb) 62 { 63 struct vlan_ethhdr veth; 64 int off; 65 66 BUILD_BUG_ON(sizeof(veth) > NFT_TRACETYPE_LL_HSIZE); 67 68 off = skb_mac_header(skb) - skb->data; 69 if (off != -ETH_HLEN) 70 return -1; 71 72 if (skb_copy_bits(skb, off, &veth, ETH_HLEN)) 73 return -1; 74 75 veth.h_vlan_proto = skb->vlan_proto; 76 veth.h_vlan_TCI = htons(skb_vlan_tag_get(skb)); 77 veth.h_vlan_encapsulated_proto = skb->protocol; 78 79 return nla_put(nlskb, NFTA_TRACE_LL_HEADER, sizeof(veth), &veth); 80 } 81 82 static int nf_trace_fill_dev_info(struct sk_buff *nlskb, 83 const struct net_device *indev, 84 const struct net_device *outdev) 85 { 86 if (indev) { 87 if (nla_put_be32(nlskb, NFTA_TRACE_IIF, 88 htonl(indev->ifindex))) 89 return -1; 90 91 if (nla_put_be16(nlskb, NFTA_TRACE_IIFTYPE, 92 htons(indev->type))) 93 return -1; 94 } 95 96 if (outdev) { 97 if (nla_put_be32(nlskb, NFTA_TRACE_OIF, 98 htonl(outdev->ifindex))) 99 return -1; 100 101 if (nla_put_be16(nlskb, NFTA_TRACE_OIFTYPE, 102 htons(outdev->type))) 103 return -1; 104 } 105 106 return 0; 107 } 108 109 static int nf_trace_fill_pkt_info(struct sk_buff *nlskb, 110 const struct nft_pktinfo *pkt) 111 { 112 const struct sk_buff *skb = pkt->skb; 113 int off = skb_network_offset(skb); 114 unsigned int len, nh_end; 115 116 nh_end = pkt->flags & NFT_PKTINFO_L4PROTO ? nft_thoff(pkt) : skb->len; 117 len = min_t(unsigned int, nh_end - skb_network_offset(skb), 118 NFT_TRACETYPE_NETWORK_HSIZE); 119 if (trace_fill_header(nlskb, NFTA_TRACE_NETWORK_HEADER, skb, off, len)) 120 return -1; 121 122 if (pkt->flags & NFT_PKTINFO_L4PROTO) { 123 len = min_t(unsigned int, skb->len - nft_thoff(pkt), 124 NFT_TRACETYPE_TRANSPORT_HSIZE); 125 if (trace_fill_header(nlskb, NFTA_TRACE_TRANSPORT_HEADER, skb, 126 nft_thoff(pkt), len)) 127 return -1; 128 } 129 130 if (!skb_mac_header_was_set(skb)) 131 return 0; 132 133 if (skb_vlan_tag_get(skb)) 134 return nf_trace_fill_ll_header(nlskb, skb); 135 136 off = skb_mac_header(skb) - skb->data; 137 len = min_t(unsigned int, -off, NFT_TRACETYPE_LL_HSIZE); 138 return trace_fill_header(nlskb, NFTA_TRACE_LL_HEADER, 139 skb, off, len); 140 } 141 142 static int nf_trace_fill_rule_info(struct sk_buff *nlskb, 143 const struct nft_traceinfo *info) 144 { 145 if (!info->rule || info->rule->is_last) 146 return 0; 147 148 /* a continue verdict with ->type == RETURN means that this is 149 * an implicit return (end of chain reached). 150 * 151 * Since no rule matched, the ->rule pointer is invalid. 152 */ 153 if (info->type == NFT_TRACETYPE_RETURN && 154 info->verdict->code == NFT_CONTINUE) 155 return 0; 156 157 return nla_put_be64(nlskb, NFTA_TRACE_RULE_HANDLE, 158 cpu_to_be64(info->rule->handle), 159 NFTA_TRACE_PAD); 160 } 161 162 static bool nft_trace_have_verdict_chain(struct nft_traceinfo *info) 163 { 164 switch (info->type) { 165 case NFT_TRACETYPE_RETURN: 166 case NFT_TRACETYPE_RULE: 167 break; 168 default: 169 return false; 170 } 171 172 switch (info->verdict->code) { 173 case NFT_JUMP: 174 case NFT_GOTO: 175 break; 176 default: 177 return false; 178 } 179 180 return true; 181 } 182 183 void nft_trace_notify(struct nft_traceinfo *info) 184 { 185 const struct nft_pktinfo *pkt = info->pkt; 186 struct nlmsghdr *nlh; 187 struct sk_buff *skb; 188 unsigned int size; 189 u16 event; 190 191 if (!nfnetlink_has_listeners(nft_net(pkt), NFNLGRP_NFTRACE)) 192 return; 193 194 size = nlmsg_total_size(sizeof(struct nfgenmsg)) + 195 nla_total_size(strlen(info->chain->table->name)) + 196 nla_total_size(strlen(info->chain->name)) + 197 nla_total_size_64bit(sizeof(__be64)) + /* rule handle */ 198 nla_total_size(sizeof(__be32)) + /* trace type */ 199 nla_total_size(0) + /* VERDICT, nested */ 200 nla_total_size(sizeof(u32)) + /* verdict code */ 201 nla_total_size(sizeof(u32)) + /* id */ 202 nla_total_size(NFT_TRACETYPE_LL_HSIZE) + 203 nla_total_size(NFT_TRACETYPE_NETWORK_HSIZE) + 204 nla_total_size(NFT_TRACETYPE_TRANSPORT_HSIZE) + 205 nla_total_size(sizeof(u32)) + /* iif */ 206 nla_total_size(sizeof(__be16)) + /* iiftype */ 207 nla_total_size(sizeof(u32)) + /* oif */ 208 nla_total_size(sizeof(__be16)) + /* oiftype */ 209 nla_total_size(sizeof(u32)) + /* mark */ 210 nla_total_size(sizeof(u32)) + /* nfproto */ 211 nla_total_size(sizeof(u32)); /* policy */ 212 213 if (nft_trace_have_verdict_chain(info)) 214 size += nla_total_size(strlen(info->verdict->chain->name)); /* jump target */ 215 216 skb = nlmsg_new(size, GFP_ATOMIC); 217 if (!skb) 218 return; 219 220 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_TRACE); 221 nlh = nfnl_msg_put(skb, 0, 0, event, 0, info->basechain->type->family, 222 NFNETLINK_V0, 0); 223 if (!nlh) 224 goto nla_put_failure; 225 226 if (nla_put_be32(skb, NFTA_TRACE_NFPROTO, htonl(nft_pf(pkt)))) 227 goto nla_put_failure; 228 229 if (nla_put_be32(skb, NFTA_TRACE_TYPE, htonl(info->type))) 230 goto nla_put_failure; 231 232 if (trace_fill_id(skb, pkt->skb)) 233 goto nla_put_failure; 234 235 if (nla_put_string(skb, NFTA_TRACE_CHAIN, info->chain->name)) 236 goto nla_put_failure; 237 238 if (nla_put_string(skb, NFTA_TRACE_TABLE, info->chain->table->name)) 239 goto nla_put_failure; 240 241 if (nf_trace_fill_rule_info(skb, info)) 242 goto nla_put_failure; 243 244 switch (info->type) { 245 case NFT_TRACETYPE_UNSPEC: 246 case __NFT_TRACETYPE_MAX: 247 break; 248 case NFT_TRACETYPE_RETURN: 249 case NFT_TRACETYPE_RULE: 250 if (nft_verdict_dump(skb, NFTA_TRACE_VERDICT, info->verdict)) 251 goto nla_put_failure; 252 break; 253 case NFT_TRACETYPE_POLICY: 254 if (nla_put_be32(skb, NFTA_TRACE_POLICY, 255 htonl(info->basechain->policy))) 256 goto nla_put_failure; 257 break; 258 } 259 260 if (pkt->skb->mark && 261 nla_put_be32(skb, NFTA_TRACE_MARK, htonl(pkt->skb->mark))) 262 goto nla_put_failure; 263 264 if (!info->packet_dumped) { 265 if (nf_trace_fill_dev_info(skb, nft_in(pkt), nft_out(pkt))) 266 goto nla_put_failure; 267 268 if (nf_trace_fill_pkt_info(skb, pkt)) 269 goto nla_put_failure; 270 info->packet_dumped = true; 271 } 272 273 nlmsg_end(skb, nlh); 274 nfnetlink_send(skb, nft_net(pkt), 0, NFNLGRP_NFTRACE, 0, GFP_ATOMIC); 275 return; 276 277 nla_put_failure: 278 WARN_ON_ONCE(1); 279 kfree_skb(skb); 280 } 281 282 void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt, 283 const struct nft_verdict *verdict, 284 const struct nft_chain *chain) 285 { 286 info->basechain = nft_base_chain(chain); 287 info->trace = true; 288 info->packet_dumped = false; 289 info->pkt = pkt; 290 info->verdict = verdict; 291 } 292