1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net> 4 * 5 * Development of this code funded by Astaro AG (http://www.astaro.com/) 6 */ 7 8 #include <asm/unaligned.h> 9 #include <linux/kernel.h> 10 #include <linux/netlink.h> 11 #include <linux/netfilter.h> 12 #include <linux/netfilter/nf_tables.h> 13 #include <linux/dccp.h> 14 #include <linux/sctp.h> 15 #include <net/netfilter/nf_tables_core.h> 16 #include <net/netfilter/nf_tables.h> 17 #include <net/tcp.h> 18 19 struct nft_exthdr { 20 u8 type; 21 u8 offset; 22 u8 len; 23 u8 op; 24 u8 dreg; 25 u8 sreg; 26 u8 flags; 27 }; 28 29 static unsigned int optlen(const u8 *opt, unsigned int offset) 30 { 31 /* Beware zero-length options: make finite progress */ 32 if (opt[offset] <= TCPOPT_NOP || opt[offset + 1] == 0) 33 return 1; 34 else 35 return opt[offset + 1]; 36 } 37 38 static void nft_exthdr_ipv6_eval(const struct nft_expr *expr, 39 struct nft_regs *regs, 40 const struct nft_pktinfo *pkt) 41 { 42 struct nft_exthdr *priv = nft_expr_priv(expr); 43 u32 *dest = ®s->data[priv->dreg]; 44 unsigned int offset = 0; 45 int err; 46 47 if (pkt->skb->protocol != htons(ETH_P_IPV6)) 48 goto err; 49 50 err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL); 51 if (priv->flags & NFT_EXTHDR_F_PRESENT) { 52 nft_reg_store8(dest, err >= 0); 53 return; 54 } else if (err < 0) { 55 goto err; 56 } 57 offset += priv->offset; 58 59 dest[priv->len / NFT_REG32_SIZE] = 0; 60 if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0) 61 goto err; 62 return; 63 err: 64 regs->verdict.code = NFT_BREAK; 65 } 66 67 /* find the offset to specified option. 68 * 69 * If target header is found, its offset is set in *offset and return option 70 * number. Otherwise, return negative error. 71 * 72 * If the first fragment doesn't contain the End of Options it is considered 73 * invalid. 74 */ 75 static int ipv4_find_option(struct net *net, struct sk_buff *skb, 76 unsigned int *offset, int target) 77 { 78 unsigned char optbuf[sizeof(struct ip_options) + 40]; 79 struct ip_options *opt = (struct ip_options *)optbuf; 80 struct iphdr *iph, _iph; 81 unsigned int start; 82 bool found = false; 83 __be32 info; 84 int optlen; 85 86 iph = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); 87 if (!iph) 88 return -EBADMSG; 89 start = sizeof(struct iphdr); 90 91 optlen = iph->ihl * 4 - (int)sizeof(struct iphdr); 92 if (optlen <= 0) 93 return -ENOENT; 94 95 memset(opt, 0, sizeof(struct ip_options)); 96 /* Copy the options since __ip_options_compile() modifies 97 * the options. 98 */ 99 if (skb_copy_bits(skb, start, opt->__data, optlen)) 100 return -EBADMSG; 101 opt->optlen = optlen; 102 103 if (__ip_options_compile(net, opt, NULL, &info)) 104 return -EBADMSG; 105 106 switch (target) { 107 case IPOPT_SSRR: 108 case IPOPT_LSRR: 109 if (!opt->srr) 110 break; 111 found = target == IPOPT_SSRR ? opt->is_strictroute : 112 !opt->is_strictroute; 113 if (found) 114 *offset = opt->srr + start; 115 break; 116 case IPOPT_RR: 117 if (!opt->rr) 118 break; 119 *offset = opt->rr + start; 120 found = true; 121 break; 122 case IPOPT_RA: 123 if (!opt->router_alert) 124 break; 125 *offset = opt->router_alert + start; 126 found = true; 127 break; 128 default: 129 return -EOPNOTSUPP; 130 } 131 return found ? target : -ENOENT; 132 } 133 134 static void nft_exthdr_ipv4_eval(const struct nft_expr *expr, 135 struct nft_regs *regs, 136 const struct nft_pktinfo *pkt) 137 { 138 struct nft_exthdr *priv = nft_expr_priv(expr); 139 u32 *dest = ®s->data[priv->dreg]; 140 struct sk_buff *skb = pkt->skb; 141 unsigned int offset; 142 int err; 143 144 if (skb->protocol != htons(ETH_P_IP)) 145 goto err; 146 147 err = ipv4_find_option(nft_net(pkt), skb, &offset, priv->type); 148 if (priv->flags & NFT_EXTHDR_F_PRESENT) { 149 nft_reg_store8(dest, err >= 0); 150 return; 151 } else if (err < 0) { 152 goto err; 153 } 154 offset += priv->offset; 155 156 dest[priv->len / NFT_REG32_SIZE] = 0; 157 if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0) 158 goto err; 159 return; 160 err: 161 regs->verdict.code = NFT_BREAK; 162 } 163 164 static void * 165 nft_tcp_header_pointer(const struct nft_pktinfo *pkt, 166 unsigned int len, void *buffer, unsigned int *tcphdr_len) 167 { 168 struct tcphdr *tcph; 169 170 if (pkt->tprot != IPPROTO_TCP || pkt->fragoff) 171 return NULL; 172 173 tcph = skb_header_pointer(pkt->skb, nft_thoff(pkt), sizeof(*tcph), buffer); 174 if (!tcph) 175 return NULL; 176 177 *tcphdr_len = __tcp_hdrlen(tcph); 178 if (*tcphdr_len < sizeof(*tcph) || *tcphdr_len > len) 179 return NULL; 180 181 return skb_header_pointer(pkt->skb, nft_thoff(pkt), *tcphdr_len, buffer); 182 } 183 184 static void nft_exthdr_tcp_eval(const struct nft_expr *expr, 185 struct nft_regs *regs, 186 const struct nft_pktinfo *pkt) 187 { 188 u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE]; 189 struct nft_exthdr *priv = nft_expr_priv(expr); 190 unsigned int i, optl, tcphdr_len, offset; 191 u32 *dest = ®s->data[priv->dreg]; 192 struct tcphdr *tcph; 193 u8 *opt; 194 195 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len); 196 if (!tcph) 197 goto err; 198 199 opt = (u8 *)tcph; 200 for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) { 201 optl = optlen(opt, i); 202 203 if (priv->type != opt[i]) 204 continue; 205 206 if (i + optl > tcphdr_len || priv->len + priv->offset > optl) 207 goto err; 208 209 offset = i + priv->offset; 210 if (priv->flags & NFT_EXTHDR_F_PRESENT) { 211 *dest = 1; 212 } else { 213 dest[priv->len / NFT_REG32_SIZE] = 0; 214 memcpy(dest, opt + offset, priv->len); 215 } 216 217 return; 218 } 219 220 err: 221 if (priv->flags & NFT_EXTHDR_F_PRESENT) 222 *dest = 0; 223 else 224 regs->verdict.code = NFT_BREAK; 225 } 226 227 static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr, 228 struct nft_regs *regs, 229 const struct nft_pktinfo *pkt) 230 { 231 u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE]; 232 struct nft_exthdr *priv = nft_expr_priv(expr); 233 unsigned int i, optl, tcphdr_len, offset; 234 struct tcphdr *tcph; 235 u8 *opt; 236 237 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len); 238 if (!tcph) 239 goto err; 240 241 opt = (u8 *)tcph; 242 for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) { 243 union { 244 __be16 v16; 245 __be32 v32; 246 } old, new; 247 248 optl = optlen(opt, i); 249 250 if (priv->type != opt[i]) 251 continue; 252 253 if (i + optl > tcphdr_len || priv->len + priv->offset > optl) 254 goto err; 255 256 if (skb_ensure_writable(pkt->skb, 257 nft_thoff(pkt) + i + priv->len)) 258 goto err; 259 260 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, 261 &tcphdr_len); 262 if (!tcph) 263 goto err; 264 265 offset = i + priv->offset; 266 267 switch (priv->len) { 268 case 2: 269 old.v16 = (__force __be16)get_unaligned((u16 *)(opt + offset)); 270 new.v16 = (__force __be16)nft_reg_load16( 271 ®s->data[priv->sreg]); 272 273 switch (priv->type) { 274 case TCPOPT_MSS: 275 /* increase can cause connection to stall */ 276 if (ntohs(old.v16) <= ntohs(new.v16)) 277 return; 278 break; 279 } 280 281 if (old.v16 == new.v16) 282 return; 283 284 put_unaligned(new.v16, (__be16*)(opt + offset)); 285 inet_proto_csum_replace2(&tcph->check, pkt->skb, 286 old.v16, new.v16, false); 287 break; 288 case 4: 289 new.v32 = nft_reg_load_be32(®s->data[priv->sreg]); 290 old.v32 = (__force __be32)get_unaligned((u32 *)(opt + offset)); 291 292 if (old.v32 == new.v32) 293 return; 294 295 put_unaligned(new.v32, (__be32*)(opt + offset)); 296 inet_proto_csum_replace4(&tcph->check, pkt->skb, 297 old.v32, new.v32, false); 298 break; 299 default: 300 WARN_ON_ONCE(1); 301 break; 302 } 303 304 return; 305 } 306 return; 307 err: 308 regs->verdict.code = NFT_BREAK; 309 } 310 311 static void nft_exthdr_tcp_strip_eval(const struct nft_expr *expr, 312 struct nft_regs *regs, 313 const struct nft_pktinfo *pkt) 314 { 315 u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE]; 316 struct nft_exthdr *priv = nft_expr_priv(expr); 317 unsigned int i, tcphdr_len, optl; 318 struct tcphdr *tcph; 319 u8 *opt; 320 321 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len); 322 if (!tcph) 323 goto err; 324 325 if (skb_ensure_writable(pkt->skb, nft_thoff(pkt) + tcphdr_len)) 326 goto drop; 327 328 opt = (u8 *)nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len); 329 if (!opt) 330 goto err; 331 for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) { 332 unsigned int j; 333 334 optl = optlen(opt, i); 335 if (priv->type != opt[i]) 336 continue; 337 338 if (i + optl > tcphdr_len) 339 goto drop; 340 341 for (j = 0; j < optl; ++j) { 342 u16 n = TCPOPT_NOP; 343 u16 o = opt[i+j]; 344 345 if ((i + j) % 2 == 0) { 346 o <<= 8; 347 n <<= 8; 348 } 349 inet_proto_csum_replace2(&tcph->check, pkt->skb, htons(o), 350 htons(n), false); 351 } 352 memset(opt + i, TCPOPT_NOP, optl); 353 return; 354 } 355 356 /* option not found, continue. This allows to do multiple 357 * option removals per rule. 358 */ 359 return; 360 err: 361 regs->verdict.code = NFT_BREAK; 362 return; 363 drop: 364 /* can't remove, no choice but to drop */ 365 regs->verdict.code = NF_DROP; 366 } 367 368 static void nft_exthdr_sctp_eval(const struct nft_expr *expr, 369 struct nft_regs *regs, 370 const struct nft_pktinfo *pkt) 371 { 372 unsigned int offset = nft_thoff(pkt) + sizeof(struct sctphdr); 373 struct nft_exthdr *priv = nft_expr_priv(expr); 374 u32 *dest = ®s->data[priv->dreg]; 375 const struct sctp_chunkhdr *sch; 376 struct sctp_chunkhdr _sch; 377 378 if (pkt->tprot != IPPROTO_SCTP) 379 goto err; 380 381 do { 382 sch = skb_header_pointer(pkt->skb, offset, sizeof(_sch), &_sch); 383 if (!sch || !sch->length) 384 break; 385 386 if (sch->type == priv->type) { 387 if (priv->flags & NFT_EXTHDR_F_PRESENT) { 388 nft_reg_store8(dest, true); 389 return; 390 } 391 if (priv->offset + priv->len > ntohs(sch->length) || 392 offset + ntohs(sch->length) > pkt->skb->len) 393 break; 394 395 dest[priv->len / NFT_REG32_SIZE] = 0; 396 if (skb_copy_bits(pkt->skb, offset + priv->offset, 397 dest, priv->len) < 0) 398 break; 399 return; 400 } 401 offset += SCTP_PAD4(ntohs(sch->length)); 402 } while (offset < pkt->skb->len); 403 err: 404 if (priv->flags & NFT_EXTHDR_F_PRESENT) 405 nft_reg_store8(dest, false); 406 else 407 regs->verdict.code = NFT_BREAK; 408 } 409 410 static void nft_exthdr_dccp_eval(const struct nft_expr *expr, 411 struct nft_regs *regs, 412 const struct nft_pktinfo *pkt) 413 { 414 struct nft_exthdr *priv = nft_expr_priv(expr); 415 unsigned int thoff, dataoff, optoff, optlen, i; 416 u32 *dest = ®s->data[priv->dreg]; 417 const struct dccp_hdr *dh; 418 struct dccp_hdr _dh; 419 420 if (pkt->tprot != IPPROTO_DCCP || pkt->fragoff) 421 goto err; 422 423 thoff = nft_thoff(pkt); 424 425 dh = skb_header_pointer(pkt->skb, thoff, sizeof(_dh), &_dh); 426 if (!dh) 427 goto err; 428 429 dataoff = dh->dccph_doff * sizeof(u32); 430 optoff = __dccp_hdr_len(dh); 431 if (dataoff <= optoff) 432 goto err; 433 434 optlen = dataoff - optoff; 435 436 for (i = 0; i < optlen; ) { 437 /* Options 0 (DCCPO_PADDING) - 31 (DCCPO_MAX_RESERVED) are 1B in 438 * the length; the remaining options are at least 2B long. In 439 * all cases, the first byte contains the option type. In 440 * multi-byte options, the second byte contains the option 441 * length, which must be at least two: 1 for the type plus 1 for 442 * the length plus 0-253 for any following option data. We 443 * aren't interested in the option data, only the type and the 444 * length, so we don't need to read more than two bytes at a 445 * time. 446 */ 447 unsigned int buflen = optlen - i; 448 u8 buf[2], *bufp; 449 u8 type, len; 450 451 if (buflen > sizeof(buf)) 452 buflen = sizeof(buf); 453 454 bufp = skb_header_pointer(pkt->skb, thoff + optoff + i, buflen, 455 &buf); 456 if (!bufp) 457 goto err; 458 459 type = bufp[0]; 460 461 if (type == priv->type) { 462 *dest = 1; 463 return; 464 } 465 466 if (type <= DCCPO_MAX_RESERVED) { 467 i++; 468 continue; 469 } 470 471 if (buflen < 2) 472 goto err; 473 474 len = bufp[1]; 475 476 if (len < 2) 477 goto err; 478 479 i += len; 480 } 481 482 err: 483 *dest = 0; 484 } 485 486 static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = { 487 [NFTA_EXTHDR_DREG] = { .type = NLA_U32 }, 488 [NFTA_EXTHDR_TYPE] = { .type = NLA_U8 }, 489 [NFTA_EXTHDR_OFFSET] = { .type = NLA_U32 }, 490 [NFTA_EXTHDR_LEN] = NLA_POLICY_MAX(NLA_BE32, 255), 491 [NFTA_EXTHDR_FLAGS] = { .type = NLA_U32 }, 492 [NFTA_EXTHDR_OP] = NLA_POLICY_MAX(NLA_BE32, 255), 493 [NFTA_EXTHDR_SREG] = { .type = NLA_U32 }, 494 }; 495 496 static int nft_exthdr_init(const struct nft_ctx *ctx, 497 const struct nft_expr *expr, 498 const struct nlattr * const tb[]) 499 { 500 struct nft_exthdr *priv = nft_expr_priv(expr); 501 u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6; 502 int err; 503 504 if (!tb[NFTA_EXTHDR_DREG] || 505 !tb[NFTA_EXTHDR_TYPE] || 506 !tb[NFTA_EXTHDR_OFFSET] || 507 !tb[NFTA_EXTHDR_LEN]) 508 return -EINVAL; 509 510 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset); 511 if (err < 0) 512 return err; 513 514 err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len); 515 if (err < 0) 516 return err; 517 518 if (tb[NFTA_EXTHDR_FLAGS]) { 519 err = nft_parse_u32_check(tb[NFTA_EXTHDR_FLAGS], U8_MAX, &flags); 520 if (err < 0) 521 return err; 522 523 if (flags & ~NFT_EXTHDR_F_PRESENT) 524 return -EINVAL; 525 } 526 527 if (tb[NFTA_EXTHDR_OP]) { 528 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op); 529 if (err < 0) 530 return err; 531 } 532 533 priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]); 534 priv->offset = offset; 535 priv->len = len; 536 priv->flags = flags; 537 priv->op = op; 538 539 return nft_parse_register_store(ctx, tb[NFTA_EXTHDR_DREG], 540 &priv->dreg, NULL, NFT_DATA_VALUE, 541 priv->len); 542 } 543 544 static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx, 545 const struct nft_expr *expr, 546 const struct nlattr * const tb[]) 547 { 548 struct nft_exthdr *priv = nft_expr_priv(expr); 549 u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6; 550 int err; 551 552 if (!tb[NFTA_EXTHDR_SREG] || 553 !tb[NFTA_EXTHDR_TYPE] || 554 !tb[NFTA_EXTHDR_OFFSET] || 555 !tb[NFTA_EXTHDR_LEN]) 556 return -EINVAL; 557 558 if (tb[NFTA_EXTHDR_DREG] || tb[NFTA_EXTHDR_FLAGS]) 559 return -EINVAL; 560 561 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset); 562 if (err < 0) 563 return err; 564 565 err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len); 566 if (err < 0) 567 return err; 568 569 if (offset < 2) 570 return -EOPNOTSUPP; 571 572 switch (len) { 573 case 2: break; 574 case 4: break; 575 default: 576 return -EOPNOTSUPP; 577 } 578 579 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op); 580 if (err < 0) 581 return err; 582 583 priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]); 584 priv->offset = offset; 585 priv->len = len; 586 priv->flags = flags; 587 priv->op = op; 588 589 return nft_parse_register_load(tb[NFTA_EXTHDR_SREG], &priv->sreg, 590 priv->len); 591 } 592 593 static int nft_exthdr_tcp_strip_init(const struct nft_ctx *ctx, 594 const struct nft_expr *expr, 595 const struct nlattr * const tb[]) 596 { 597 struct nft_exthdr *priv = nft_expr_priv(expr); 598 599 if (tb[NFTA_EXTHDR_SREG] || 600 tb[NFTA_EXTHDR_DREG] || 601 tb[NFTA_EXTHDR_FLAGS] || 602 tb[NFTA_EXTHDR_OFFSET] || 603 tb[NFTA_EXTHDR_LEN]) 604 return -EINVAL; 605 606 if (!tb[NFTA_EXTHDR_TYPE]) 607 return -EINVAL; 608 609 priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]); 610 priv->op = NFT_EXTHDR_OP_TCPOPT; 611 612 return 0; 613 } 614 615 static int nft_exthdr_ipv4_init(const struct nft_ctx *ctx, 616 const struct nft_expr *expr, 617 const struct nlattr * const tb[]) 618 { 619 struct nft_exthdr *priv = nft_expr_priv(expr); 620 int err = nft_exthdr_init(ctx, expr, tb); 621 622 if (err < 0) 623 return err; 624 625 switch (priv->type) { 626 case IPOPT_SSRR: 627 case IPOPT_LSRR: 628 case IPOPT_RR: 629 case IPOPT_RA: 630 break; 631 default: 632 return -EOPNOTSUPP; 633 } 634 return 0; 635 } 636 637 static int nft_exthdr_dccp_init(const struct nft_ctx *ctx, 638 const struct nft_expr *expr, 639 const struct nlattr * const tb[]) 640 { 641 struct nft_exthdr *priv = nft_expr_priv(expr); 642 int err = nft_exthdr_init(ctx, expr, tb); 643 644 if (err < 0) 645 return err; 646 647 if (!(priv->flags & NFT_EXTHDR_F_PRESENT)) 648 return -EOPNOTSUPP; 649 650 return 0; 651 } 652 653 static int nft_exthdr_dump_common(struct sk_buff *skb, const struct nft_exthdr *priv) 654 { 655 if (nla_put_u8(skb, NFTA_EXTHDR_TYPE, priv->type)) 656 goto nla_put_failure; 657 if (nla_put_be32(skb, NFTA_EXTHDR_OFFSET, htonl(priv->offset))) 658 goto nla_put_failure; 659 if (nla_put_be32(skb, NFTA_EXTHDR_LEN, htonl(priv->len))) 660 goto nla_put_failure; 661 if (nla_put_be32(skb, NFTA_EXTHDR_FLAGS, htonl(priv->flags))) 662 goto nla_put_failure; 663 if (nla_put_be32(skb, NFTA_EXTHDR_OP, htonl(priv->op))) 664 goto nla_put_failure; 665 return 0; 666 667 nla_put_failure: 668 return -1; 669 } 670 671 static int nft_exthdr_dump(struct sk_buff *skb, 672 const struct nft_expr *expr, bool reset) 673 { 674 const struct nft_exthdr *priv = nft_expr_priv(expr); 675 676 if (nft_dump_register(skb, NFTA_EXTHDR_DREG, priv->dreg)) 677 return -1; 678 679 return nft_exthdr_dump_common(skb, priv); 680 } 681 682 static int nft_exthdr_dump_set(struct sk_buff *skb, 683 const struct nft_expr *expr, bool reset) 684 { 685 const struct nft_exthdr *priv = nft_expr_priv(expr); 686 687 if (nft_dump_register(skb, NFTA_EXTHDR_SREG, priv->sreg)) 688 return -1; 689 690 return nft_exthdr_dump_common(skb, priv); 691 } 692 693 static int nft_exthdr_dump_strip(struct sk_buff *skb, 694 const struct nft_expr *expr, bool reset) 695 { 696 const struct nft_exthdr *priv = nft_expr_priv(expr); 697 698 return nft_exthdr_dump_common(skb, priv); 699 } 700 701 static bool nft_exthdr_reduce(struct nft_regs_track *track, 702 const struct nft_expr *expr) 703 { 704 const struct nft_exthdr *priv = nft_expr_priv(expr); 705 const struct nft_exthdr *exthdr; 706 707 if (!nft_reg_track_cmp(track, expr, priv->dreg)) { 708 nft_reg_track_update(track, expr, priv->dreg, priv->len); 709 return false; 710 } 711 712 exthdr = nft_expr_priv(track->regs[priv->dreg].selector); 713 if (priv->type != exthdr->type || 714 priv->op != exthdr->op || 715 priv->flags != exthdr->flags || 716 priv->offset != exthdr->offset || 717 priv->len != exthdr->len) { 718 nft_reg_track_update(track, expr, priv->dreg, priv->len); 719 return false; 720 } 721 722 if (!track->regs[priv->dreg].bitwise) 723 return true; 724 725 return nft_expr_reduce_bitwise(track, expr); 726 } 727 728 static const struct nft_expr_ops nft_exthdr_ipv6_ops = { 729 .type = &nft_exthdr_type, 730 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), 731 .eval = nft_exthdr_ipv6_eval, 732 .init = nft_exthdr_init, 733 .dump = nft_exthdr_dump, 734 .reduce = nft_exthdr_reduce, 735 }; 736 737 static const struct nft_expr_ops nft_exthdr_ipv4_ops = { 738 .type = &nft_exthdr_type, 739 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), 740 .eval = nft_exthdr_ipv4_eval, 741 .init = nft_exthdr_ipv4_init, 742 .dump = nft_exthdr_dump, 743 .reduce = nft_exthdr_reduce, 744 }; 745 746 static const struct nft_expr_ops nft_exthdr_tcp_ops = { 747 .type = &nft_exthdr_type, 748 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), 749 .eval = nft_exthdr_tcp_eval, 750 .init = nft_exthdr_init, 751 .dump = nft_exthdr_dump, 752 .reduce = nft_exthdr_reduce, 753 }; 754 755 static const struct nft_expr_ops nft_exthdr_tcp_set_ops = { 756 .type = &nft_exthdr_type, 757 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), 758 .eval = nft_exthdr_tcp_set_eval, 759 .init = nft_exthdr_tcp_set_init, 760 .dump = nft_exthdr_dump_set, 761 .reduce = NFT_REDUCE_READONLY, 762 }; 763 764 static const struct nft_expr_ops nft_exthdr_tcp_strip_ops = { 765 .type = &nft_exthdr_type, 766 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), 767 .eval = nft_exthdr_tcp_strip_eval, 768 .init = nft_exthdr_tcp_strip_init, 769 .dump = nft_exthdr_dump_strip, 770 .reduce = NFT_REDUCE_READONLY, 771 }; 772 773 static const struct nft_expr_ops nft_exthdr_sctp_ops = { 774 .type = &nft_exthdr_type, 775 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), 776 .eval = nft_exthdr_sctp_eval, 777 .init = nft_exthdr_init, 778 .dump = nft_exthdr_dump, 779 .reduce = nft_exthdr_reduce, 780 }; 781 782 static const struct nft_expr_ops nft_exthdr_dccp_ops = { 783 .type = &nft_exthdr_type, 784 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), 785 .eval = nft_exthdr_dccp_eval, 786 .init = nft_exthdr_dccp_init, 787 .dump = nft_exthdr_dump, 788 .reduce = nft_exthdr_reduce, 789 }; 790 791 static const struct nft_expr_ops * 792 nft_exthdr_select_ops(const struct nft_ctx *ctx, 793 const struct nlattr * const tb[]) 794 { 795 u32 op; 796 797 if (!tb[NFTA_EXTHDR_OP]) 798 return &nft_exthdr_ipv6_ops; 799 800 if (tb[NFTA_EXTHDR_SREG] && tb[NFTA_EXTHDR_DREG]) 801 return ERR_PTR(-EOPNOTSUPP); 802 803 op = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OP])); 804 switch (op) { 805 case NFT_EXTHDR_OP_TCPOPT: 806 if (tb[NFTA_EXTHDR_SREG]) 807 return &nft_exthdr_tcp_set_ops; 808 if (tb[NFTA_EXTHDR_DREG]) 809 return &nft_exthdr_tcp_ops; 810 return &nft_exthdr_tcp_strip_ops; 811 case NFT_EXTHDR_OP_IPV6: 812 if (tb[NFTA_EXTHDR_DREG]) 813 return &nft_exthdr_ipv6_ops; 814 break; 815 case NFT_EXTHDR_OP_IPV4: 816 if (ctx->family != NFPROTO_IPV6) { 817 if (tb[NFTA_EXTHDR_DREG]) 818 return &nft_exthdr_ipv4_ops; 819 } 820 break; 821 case NFT_EXTHDR_OP_SCTP: 822 if (tb[NFTA_EXTHDR_DREG]) 823 return &nft_exthdr_sctp_ops; 824 break; 825 case NFT_EXTHDR_OP_DCCP: 826 if (tb[NFTA_EXTHDR_DREG]) 827 return &nft_exthdr_dccp_ops; 828 break; 829 } 830 831 return ERR_PTR(-EOPNOTSUPP); 832 } 833 834 struct nft_expr_type nft_exthdr_type __read_mostly = { 835 .name = "exthdr", 836 .select_ops = nft_exthdr_select_ops, 837 .policy = nft_exthdr_policy, 838 .maxattr = NFTA_EXTHDR_MAX, 839 .owner = THIS_MODULE, 840 }; 841