xref: /openbmc/linux/net/netfilter/nft_exthdr.c (revision 160b8e75) 
1 /*
2  * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License version 2 as
6  * published by the Free Software Foundation.
7  *
8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
9  */
10 
11 #include <asm/unaligned.h>
12 #include <linux/kernel.h>
13 #include <linux/init.h>
14 #include <linux/module.h>
15 #include <linux/netlink.h>
16 #include <linux/netfilter.h>
17 #include <linux/netfilter/nf_tables.h>
18 #include <net/netfilter/nf_tables.h>
19 #include <net/tcp.h>
20 
21 struct nft_exthdr {
22 	u8			type;
23 	u8			offset;
24 	u8			len;
25 	u8			op;
26 	enum nft_registers	dreg:8;
27 	enum nft_registers	sreg:8;
28 	u8			flags;
29 };
30 
31 static unsigned int optlen(const u8 *opt, unsigned int offset)
32 {
33 	/* Beware zero-length options: make finite progress */
34 	if (opt[offset] <= TCPOPT_NOP || opt[offset + 1] == 0)
35 		return 1;
36 	else
37 		return opt[offset + 1];
38 }
39 
40 static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
41 				 struct nft_regs *regs,
42 				 const struct nft_pktinfo *pkt)
43 {
44 	struct nft_exthdr *priv = nft_expr_priv(expr);
45 	u32 *dest = &regs->data[priv->dreg];
46 	unsigned int offset = 0;
47 	int err;
48 
49 	err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
50 	if (priv->flags & NFT_EXTHDR_F_PRESENT) {
51 		*dest = (err >= 0);
52 		return;
53 	} else if (err < 0) {
54 		goto err;
55 	}
56 	offset += priv->offset;
57 
58 	dest[priv->len / NFT_REG32_SIZE] = 0;
59 	if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
60 		goto err;
61 	return;
62 err:
63 	regs->verdict.code = NFT_BREAK;
64 }
65 
66 static void *
67 nft_tcp_header_pointer(const struct nft_pktinfo *pkt,
68 		       unsigned int len, void *buffer, unsigned int *tcphdr_len)
69 {
70 	struct tcphdr *tcph;
71 
72 	if (!pkt->tprot_set || pkt->tprot != IPPROTO_TCP)
73 		return NULL;
74 
75 	tcph = skb_header_pointer(pkt->skb, pkt->xt.thoff, sizeof(*tcph), buffer);
76 	if (!tcph)
77 		return NULL;
78 
79 	*tcphdr_len = __tcp_hdrlen(tcph);
80 	if (*tcphdr_len < sizeof(*tcph) || *tcphdr_len > len)
81 		return NULL;
82 
83 	return skb_header_pointer(pkt->skb, pkt->xt.thoff, *tcphdr_len, buffer);
84 }
85 
86 static void nft_exthdr_tcp_eval(const struct nft_expr *expr,
87 				struct nft_regs *regs,
88 				const struct nft_pktinfo *pkt)
89 {
90 	u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
91 	struct nft_exthdr *priv = nft_expr_priv(expr);
92 	unsigned int i, optl, tcphdr_len, offset;
93 	u32 *dest = &regs->data[priv->dreg];
94 	struct tcphdr *tcph;
95 	u8 *opt;
96 
97 	tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
98 	if (!tcph)
99 		goto err;
100 
101 	opt = (u8 *)tcph;
102 	for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
103 		optl = optlen(opt, i);
104 
105 		if (priv->type != opt[i])
106 			continue;
107 
108 		if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
109 			goto err;
110 
111 		offset = i + priv->offset;
112 		if (priv->flags & NFT_EXTHDR_F_PRESENT) {
113 			*dest = 1;
114 		} else {
115 			dest[priv->len / NFT_REG32_SIZE] = 0;
116 			memcpy(dest, opt + offset, priv->len);
117 		}
118 
119 		return;
120 	}
121 
122 err:
123 	if (priv->flags & NFT_EXTHDR_F_PRESENT)
124 		*dest = 0;
125 	else
126 		regs->verdict.code = NFT_BREAK;
127 }
128 
129 static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr,
130 				    struct nft_regs *regs,
131 				    const struct nft_pktinfo *pkt)
132 {
133 	u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
134 	struct nft_exthdr *priv = nft_expr_priv(expr);
135 	unsigned int i, optl, tcphdr_len, offset;
136 	struct tcphdr *tcph;
137 	u8 *opt;
138 	u32 src;
139 
140 	tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
141 	if (!tcph)
142 		return;
143 
144 	opt = (u8 *)tcph;
145 	for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
146 		union {
147 			u8 octet;
148 			__be16 v16;
149 			__be32 v32;
150 		} old, new;
151 
152 		optl = optlen(opt, i);
153 
154 		if (priv->type != opt[i])
155 			continue;
156 
157 		if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
158 			return;
159 
160 		if (!skb_make_writable(pkt->skb, pkt->xt.thoff + i + priv->len))
161 			return;
162 
163 		tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff,
164 					      &tcphdr_len);
165 		if (!tcph)
166 			return;
167 
168 		src = regs->data[priv->sreg];
169 		offset = i + priv->offset;
170 
171 		switch (priv->len) {
172 		case 2:
173 			old.v16 = get_unaligned((u16 *)(opt + offset));
174 			new.v16 = src;
175 
176 			switch (priv->type) {
177 			case TCPOPT_MSS:
178 				/* increase can cause connection to stall */
179 				if (ntohs(old.v16) <= ntohs(new.v16))
180 					return;
181 			break;
182 			}
183 
184 			if (old.v16 == new.v16)
185 				return;
186 
187 			put_unaligned(new.v16, (u16*)(opt + offset));
188 			inet_proto_csum_replace2(&tcph->check, pkt->skb,
189 						 old.v16, new.v16, false);
190 			break;
191 		case 4:
192 			new.v32 = src;
193 			old.v32 = get_unaligned((u32 *)(opt + offset));
194 
195 			if (old.v32 == new.v32)
196 				return;
197 
198 			put_unaligned(new.v32, (u32*)(opt + offset));
199 			inet_proto_csum_replace4(&tcph->check, pkt->skb,
200 						 old.v32, new.v32, false);
201 			break;
202 		default:
203 			WARN_ON_ONCE(1);
204 			break;
205 		}
206 
207 		return;
208 	}
209 }
210 
211 static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = {
212 	[NFTA_EXTHDR_DREG]		= { .type = NLA_U32 },
213 	[NFTA_EXTHDR_TYPE]		= { .type = NLA_U8 },
214 	[NFTA_EXTHDR_OFFSET]		= { .type = NLA_U32 },
215 	[NFTA_EXTHDR_LEN]		= { .type = NLA_U32 },
216 	[NFTA_EXTHDR_FLAGS]		= { .type = NLA_U32 },
217 	[NFTA_EXTHDR_OP]		= { .type = NLA_U32 },
218 	[NFTA_EXTHDR_SREG]		= { .type = NLA_U32 },
219 };
220 
221 static int nft_exthdr_init(const struct nft_ctx *ctx,
222 			   const struct nft_expr *expr,
223 			   const struct nlattr * const tb[])
224 {
225 	struct nft_exthdr *priv = nft_expr_priv(expr);
226 	u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
227 	int err;
228 
229 	if (!tb[NFTA_EXTHDR_DREG] ||
230 	    !tb[NFTA_EXTHDR_TYPE] ||
231 	    !tb[NFTA_EXTHDR_OFFSET] ||
232 	    !tb[NFTA_EXTHDR_LEN])
233 		return -EINVAL;
234 
235 	err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
236 	if (err < 0)
237 		return err;
238 
239 	err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
240 	if (err < 0)
241 		return err;
242 
243 	if (tb[NFTA_EXTHDR_FLAGS]) {
244 		err = nft_parse_u32_check(tb[NFTA_EXTHDR_FLAGS], U8_MAX, &flags);
245 		if (err < 0)
246 			return err;
247 
248 		if (flags & ~NFT_EXTHDR_F_PRESENT)
249 			return -EINVAL;
250 	}
251 
252 	if (tb[NFTA_EXTHDR_OP]) {
253 		err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
254 		if (err < 0)
255 			return err;
256 	}
257 
258 	priv->type   = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
259 	priv->offset = offset;
260 	priv->len    = len;
261 	priv->dreg   = nft_parse_register(tb[NFTA_EXTHDR_DREG]);
262 	priv->flags  = flags;
263 	priv->op     = op;
264 
265 	return nft_validate_register_store(ctx, priv->dreg, NULL,
266 					   NFT_DATA_VALUE, priv->len);
267 }
268 
269 static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx,
270 				   const struct nft_expr *expr,
271 				   const struct nlattr * const tb[])
272 {
273 	struct nft_exthdr *priv = nft_expr_priv(expr);
274 	u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
275 	int err;
276 
277 	if (!tb[NFTA_EXTHDR_SREG] ||
278 	    !tb[NFTA_EXTHDR_TYPE] ||
279 	    !tb[NFTA_EXTHDR_OFFSET] ||
280 	    !tb[NFTA_EXTHDR_LEN])
281 		return -EINVAL;
282 
283 	if (tb[NFTA_EXTHDR_DREG] || tb[NFTA_EXTHDR_FLAGS])
284 		return -EINVAL;
285 
286 	err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
287 	if (err < 0)
288 		return err;
289 
290 	err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
291 	if (err < 0)
292 		return err;
293 
294 	if (offset < 2)
295 		return -EOPNOTSUPP;
296 
297 	switch (len) {
298 	case 2: break;
299 	case 4: break;
300 	default:
301 		return -EOPNOTSUPP;
302 	}
303 
304 	err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
305 	if (err < 0)
306 		return err;
307 
308 	priv->type   = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
309 	priv->offset = offset;
310 	priv->len    = len;
311 	priv->sreg   = nft_parse_register(tb[NFTA_EXTHDR_SREG]);
312 	priv->flags  = flags;
313 	priv->op     = op;
314 
315 	return nft_validate_register_load(priv->sreg, priv->len);
316 }
317 
318 static int nft_exthdr_dump_common(struct sk_buff *skb, const struct nft_exthdr *priv)
319 {
320 	if (nla_put_u8(skb, NFTA_EXTHDR_TYPE, priv->type))
321 		goto nla_put_failure;
322 	if (nla_put_be32(skb, NFTA_EXTHDR_OFFSET, htonl(priv->offset)))
323 		goto nla_put_failure;
324 	if (nla_put_be32(skb, NFTA_EXTHDR_LEN, htonl(priv->len)))
325 		goto nla_put_failure;
326 	if (nla_put_be32(skb, NFTA_EXTHDR_FLAGS, htonl(priv->flags)))
327 		goto nla_put_failure;
328 	if (nla_put_be32(skb, NFTA_EXTHDR_OP, htonl(priv->op)))
329 		goto nla_put_failure;
330 	return 0;
331 
332 nla_put_failure:
333 	return -1;
334 }
335 
336 static int nft_exthdr_dump(struct sk_buff *skb, const struct nft_expr *expr)
337 {
338 	const struct nft_exthdr *priv = nft_expr_priv(expr);
339 
340 	if (nft_dump_register(skb, NFTA_EXTHDR_DREG, priv->dreg))
341 		return -1;
342 
343 	return nft_exthdr_dump_common(skb, priv);
344 }
345 
346 static int nft_exthdr_dump_set(struct sk_buff *skb, const struct nft_expr *expr)
347 {
348 	const struct nft_exthdr *priv = nft_expr_priv(expr);
349 
350 	if (nft_dump_register(skb, NFTA_EXTHDR_SREG, priv->sreg))
351 		return -1;
352 
353 	return nft_exthdr_dump_common(skb, priv);
354 }
355 
356 static struct nft_expr_type nft_exthdr_type;
357 static const struct nft_expr_ops nft_exthdr_ipv6_ops = {
358 	.type		= &nft_exthdr_type,
359 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
360 	.eval		= nft_exthdr_ipv6_eval,
361 	.init		= nft_exthdr_init,
362 	.dump		= nft_exthdr_dump,
363 };
364 
365 static const struct nft_expr_ops nft_exthdr_tcp_ops = {
366 	.type		= &nft_exthdr_type,
367 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
368 	.eval		= nft_exthdr_tcp_eval,
369 	.init		= nft_exthdr_init,
370 	.dump		= nft_exthdr_dump,
371 };
372 
373 static const struct nft_expr_ops nft_exthdr_tcp_set_ops = {
374 	.type		= &nft_exthdr_type,
375 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
376 	.eval		= nft_exthdr_tcp_set_eval,
377 	.init		= nft_exthdr_tcp_set_init,
378 	.dump		= nft_exthdr_dump_set,
379 };
380 
381 static const struct nft_expr_ops *
382 nft_exthdr_select_ops(const struct nft_ctx *ctx,
383 		      const struct nlattr * const tb[])
384 {
385 	u32 op;
386 
387 	if (!tb[NFTA_EXTHDR_OP])
388 		return &nft_exthdr_ipv6_ops;
389 
390 	if (tb[NFTA_EXTHDR_SREG] && tb[NFTA_EXTHDR_DREG])
391 		return ERR_PTR(-EOPNOTSUPP);
392 
393 	op = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OP]));
394 	switch (op) {
395 	case NFT_EXTHDR_OP_TCPOPT:
396 		if (tb[NFTA_EXTHDR_SREG])
397 			return &nft_exthdr_tcp_set_ops;
398 		if (tb[NFTA_EXTHDR_DREG])
399 			return &nft_exthdr_tcp_ops;
400 		break;
401 	case NFT_EXTHDR_OP_IPV6:
402 		if (tb[NFTA_EXTHDR_DREG])
403 			return &nft_exthdr_ipv6_ops;
404 		break;
405 	}
406 
407 	return ERR_PTR(-EOPNOTSUPP);
408 }
409 
410 static struct nft_expr_type nft_exthdr_type __read_mostly = {
411 	.name		= "exthdr",
412 	.select_ops	= nft_exthdr_select_ops,
413 	.policy		= nft_exthdr_policy,
414 	.maxattr	= NFTA_EXTHDR_MAX,
415 	.owner		= THIS_MODULE,
416 };
417 
418 static int __init nft_exthdr_module_init(void)
419 {
420 	return nft_register_expr(&nft_exthdr_type);
421 }
422 
423 static void __exit nft_exthdr_module_exit(void)
424 {
425 	nft_unregister_expr(&nft_exthdr_type);
426 }
427 
428 module_init(nft_exthdr_module_init);
429 module_exit(nft_exthdr_module_exit);
430 
431 MODULE_LICENSE("GPL");
432 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
433 MODULE_ALIAS_NFT_EXPR("exthdr");
434