1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net> 4 * 5 * Development of this code funded by Astaro AG (http://www.astaro.com/) 6 */ 7 8 #include <asm/unaligned.h> 9 #include <linux/kernel.h> 10 #include <linux/netlink.h> 11 #include <linux/netfilter.h> 12 #include <linux/netfilter/nf_tables.h> 13 #include <net/netfilter/nf_tables_core.h> 14 #include <net/netfilter/nf_tables.h> 15 #include <net/tcp.h> 16 17 struct nft_exthdr { 18 u8 type; 19 u8 offset; 20 u8 len; 21 u8 op; 22 enum nft_registers dreg:8; 23 enum nft_registers sreg:8; 24 u8 flags; 25 }; 26 27 static unsigned int optlen(const u8 *opt, unsigned int offset) 28 { 29 /* Beware zero-length options: make finite progress */ 30 if (opt[offset] <= TCPOPT_NOP || opt[offset + 1] == 0) 31 return 1; 32 else 33 return opt[offset + 1]; 34 } 35 36 static void nft_exthdr_ipv6_eval(const struct nft_expr *expr, 37 struct nft_regs *regs, 38 const struct nft_pktinfo *pkt) 39 { 40 struct nft_exthdr *priv = nft_expr_priv(expr); 41 u32 *dest = ®s->data[priv->dreg]; 42 unsigned int offset = 0; 43 int err; 44 45 err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL); 46 if (priv->flags & NFT_EXTHDR_F_PRESENT) { 47 *dest = (err >= 0); 48 return; 49 } else if (err < 0) { 50 goto err; 51 } 52 offset += priv->offset; 53 54 dest[priv->len / NFT_REG32_SIZE] = 0; 55 if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0) 56 goto err; 57 return; 58 err: 59 regs->verdict.code = NFT_BREAK; 60 } 61 62 /* find the offset to specified option. 63 * 64 * If target header is found, its offset is set in *offset and return option 65 * number. Otherwise, return negative error. 66 * 67 * If the first fragment doesn't contain the End of Options it is considered 68 * invalid. 69 */ 70 static int ipv4_find_option(struct net *net, struct sk_buff *skb, 71 unsigned int *offset, int target) 72 { 73 unsigned char optbuf[sizeof(struct ip_options) + 40]; 74 struct ip_options *opt = (struct ip_options *)optbuf; 75 struct iphdr *iph, _iph; 76 unsigned int start; 77 bool found = false; 78 __be32 info; 79 int optlen; 80 81 iph = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); 82 if (!iph) 83 return -EBADMSG; 84 start = sizeof(struct iphdr); 85 86 optlen = iph->ihl * 4 - (int)sizeof(struct iphdr); 87 if (optlen <= 0) 88 return -ENOENT; 89 90 memset(opt, 0, sizeof(struct ip_options)); 91 /* Copy the options since __ip_options_compile() modifies 92 * the options. 93 */ 94 if (skb_copy_bits(skb, start, opt->__data, optlen)) 95 return -EBADMSG; 96 opt->optlen = optlen; 97 98 if (__ip_options_compile(net, opt, NULL, &info)) 99 return -EBADMSG; 100 101 switch (target) { 102 case IPOPT_SSRR: 103 case IPOPT_LSRR: 104 if (!opt->srr) 105 break; 106 found = target == IPOPT_SSRR ? opt->is_strictroute : 107 !opt->is_strictroute; 108 if (found) 109 *offset = opt->srr + start; 110 break; 111 case IPOPT_RR: 112 if (!opt->rr) 113 break; 114 *offset = opt->rr + start; 115 found = true; 116 break; 117 case IPOPT_RA: 118 if (!opt->router_alert) 119 break; 120 *offset = opt->router_alert + start; 121 found = true; 122 break; 123 default: 124 return -EOPNOTSUPP; 125 } 126 return found ? target : -ENOENT; 127 } 128 129 static void nft_exthdr_ipv4_eval(const struct nft_expr *expr, 130 struct nft_regs *regs, 131 const struct nft_pktinfo *pkt) 132 { 133 struct nft_exthdr *priv = nft_expr_priv(expr); 134 u32 *dest = ®s->data[priv->dreg]; 135 struct sk_buff *skb = pkt->skb; 136 unsigned int offset; 137 int err; 138 139 if (skb->protocol != htons(ETH_P_IP)) 140 goto err; 141 142 err = ipv4_find_option(nft_net(pkt), skb, &offset, priv->type); 143 if (priv->flags & NFT_EXTHDR_F_PRESENT) { 144 *dest = (err >= 0); 145 return; 146 } else if (err < 0) { 147 goto err; 148 } 149 offset += priv->offset; 150 151 dest[priv->len / NFT_REG32_SIZE] = 0; 152 if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0) 153 goto err; 154 return; 155 err: 156 regs->verdict.code = NFT_BREAK; 157 } 158 159 static void * 160 nft_tcp_header_pointer(const struct nft_pktinfo *pkt, 161 unsigned int len, void *buffer, unsigned int *tcphdr_len) 162 { 163 struct tcphdr *tcph; 164 165 if (!pkt->tprot_set || pkt->tprot != IPPROTO_TCP) 166 return NULL; 167 168 tcph = skb_header_pointer(pkt->skb, pkt->xt.thoff, sizeof(*tcph), buffer); 169 if (!tcph) 170 return NULL; 171 172 *tcphdr_len = __tcp_hdrlen(tcph); 173 if (*tcphdr_len < sizeof(*tcph) || *tcphdr_len > len) 174 return NULL; 175 176 return skb_header_pointer(pkt->skb, pkt->xt.thoff, *tcphdr_len, buffer); 177 } 178 179 static void nft_exthdr_tcp_eval(const struct nft_expr *expr, 180 struct nft_regs *regs, 181 const struct nft_pktinfo *pkt) 182 { 183 u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE]; 184 struct nft_exthdr *priv = nft_expr_priv(expr); 185 unsigned int i, optl, tcphdr_len, offset; 186 u32 *dest = ®s->data[priv->dreg]; 187 struct tcphdr *tcph; 188 u8 *opt; 189 190 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len); 191 if (!tcph) 192 goto err; 193 194 opt = (u8 *)tcph; 195 for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) { 196 optl = optlen(opt, i); 197 198 if (priv->type != opt[i]) 199 continue; 200 201 if (i + optl > tcphdr_len || priv->len + priv->offset > optl) 202 goto err; 203 204 offset = i + priv->offset; 205 if (priv->flags & NFT_EXTHDR_F_PRESENT) { 206 *dest = 1; 207 } else { 208 dest[priv->len / NFT_REG32_SIZE] = 0; 209 memcpy(dest, opt + offset, priv->len); 210 } 211 212 return; 213 } 214 215 err: 216 if (priv->flags & NFT_EXTHDR_F_PRESENT) 217 *dest = 0; 218 else 219 regs->verdict.code = NFT_BREAK; 220 } 221 222 static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr, 223 struct nft_regs *regs, 224 const struct nft_pktinfo *pkt) 225 { 226 u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE]; 227 struct nft_exthdr *priv = nft_expr_priv(expr); 228 unsigned int i, optl, tcphdr_len, offset; 229 struct tcphdr *tcph; 230 u8 *opt; 231 u32 src; 232 233 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len); 234 if (!tcph) 235 return; 236 237 opt = (u8 *)tcph; 238 for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) { 239 union { 240 u8 octet; 241 __be16 v16; 242 __be32 v32; 243 } old, new; 244 245 optl = optlen(opt, i); 246 247 if (priv->type != opt[i]) 248 continue; 249 250 if (i + optl > tcphdr_len || priv->len + priv->offset > optl) 251 return; 252 253 if (skb_ensure_writable(pkt->skb, 254 pkt->xt.thoff + i + priv->len)) 255 return; 256 257 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, 258 &tcphdr_len); 259 if (!tcph) 260 return; 261 262 src = regs->data[priv->sreg]; 263 offset = i + priv->offset; 264 265 switch (priv->len) { 266 case 2: 267 old.v16 = get_unaligned((u16 *)(opt + offset)); 268 new.v16 = src; 269 270 switch (priv->type) { 271 case TCPOPT_MSS: 272 /* increase can cause connection to stall */ 273 if (ntohs(old.v16) <= ntohs(new.v16)) 274 return; 275 break; 276 } 277 278 if (old.v16 == new.v16) 279 return; 280 281 put_unaligned(new.v16, (u16*)(opt + offset)); 282 inet_proto_csum_replace2(&tcph->check, pkt->skb, 283 old.v16, new.v16, false); 284 break; 285 case 4: 286 new.v32 = src; 287 old.v32 = get_unaligned((u32 *)(opt + offset)); 288 289 if (old.v32 == new.v32) 290 return; 291 292 put_unaligned(new.v32, (u32*)(opt + offset)); 293 inet_proto_csum_replace4(&tcph->check, pkt->skb, 294 old.v32, new.v32, false); 295 break; 296 default: 297 WARN_ON_ONCE(1); 298 break; 299 } 300 301 return; 302 } 303 } 304 305 static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = { 306 [NFTA_EXTHDR_DREG] = { .type = NLA_U32 }, 307 [NFTA_EXTHDR_TYPE] = { .type = NLA_U8 }, 308 [NFTA_EXTHDR_OFFSET] = { .type = NLA_U32 }, 309 [NFTA_EXTHDR_LEN] = { .type = NLA_U32 }, 310 [NFTA_EXTHDR_FLAGS] = { .type = NLA_U32 }, 311 [NFTA_EXTHDR_OP] = { .type = NLA_U32 }, 312 [NFTA_EXTHDR_SREG] = { .type = NLA_U32 }, 313 }; 314 315 static int nft_exthdr_init(const struct nft_ctx *ctx, 316 const struct nft_expr *expr, 317 const struct nlattr * const tb[]) 318 { 319 struct nft_exthdr *priv = nft_expr_priv(expr); 320 u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6; 321 int err; 322 323 if (!tb[NFTA_EXTHDR_DREG] || 324 !tb[NFTA_EXTHDR_TYPE] || 325 !tb[NFTA_EXTHDR_OFFSET] || 326 !tb[NFTA_EXTHDR_LEN]) 327 return -EINVAL; 328 329 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset); 330 if (err < 0) 331 return err; 332 333 err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len); 334 if (err < 0) 335 return err; 336 337 if (tb[NFTA_EXTHDR_FLAGS]) { 338 err = nft_parse_u32_check(tb[NFTA_EXTHDR_FLAGS], U8_MAX, &flags); 339 if (err < 0) 340 return err; 341 342 if (flags & ~NFT_EXTHDR_F_PRESENT) 343 return -EINVAL; 344 } 345 346 if (tb[NFTA_EXTHDR_OP]) { 347 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op); 348 if (err < 0) 349 return err; 350 } 351 352 priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]); 353 priv->offset = offset; 354 priv->len = len; 355 priv->dreg = nft_parse_register(tb[NFTA_EXTHDR_DREG]); 356 priv->flags = flags; 357 priv->op = op; 358 359 return nft_validate_register_store(ctx, priv->dreg, NULL, 360 NFT_DATA_VALUE, priv->len); 361 } 362 363 static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx, 364 const struct nft_expr *expr, 365 const struct nlattr * const tb[]) 366 { 367 struct nft_exthdr *priv = nft_expr_priv(expr); 368 u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6; 369 int err; 370 371 if (!tb[NFTA_EXTHDR_SREG] || 372 !tb[NFTA_EXTHDR_TYPE] || 373 !tb[NFTA_EXTHDR_OFFSET] || 374 !tb[NFTA_EXTHDR_LEN]) 375 return -EINVAL; 376 377 if (tb[NFTA_EXTHDR_DREG] || tb[NFTA_EXTHDR_FLAGS]) 378 return -EINVAL; 379 380 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset); 381 if (err < 0) 382 return err; 383 384 err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len); 385 if (err < 0) 386 return err; 387 388 if (offset < 2) 389 return -EOPNOTSUPP; 390 391 switch (len) { 392 case 2: break; 393 case 4: break; 394 default: 395 return -EOPNOTSUPP; 396 } 397 398 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op); 399 if (err < 0) 400 return err; 401 402 priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]); 403 priv->offset = offset; 404 priv->len = len; 405 priv->sreg = nft_parse_register(tb[NFTA_EXTHDR_SREG]); 406 priv->flags = flags; 407 priv->op = op; 408 409 return nft_validate_register_load(priv->sreg, priv->len); 410 } 411 412 static int nft_exthdr_ipv4_init(const struct nft_ctx *ctx, 413 const struct nft_expr *expr, 414 const struct nlattr * const tb[]) 415 { 416 struct nft_exthdr *priv = nft_expr_priv(expr); 417 int err = nft_exthdr_init(ctx, expr, tb); 418 419 if (err < 0) 420 return err; 421 422 switch (priv->type) { 423 case IPOPT_SSRR: 424 case IPOPT_LSRR: 425 case IPOPT_RR: 426 case IPOPT_RA: 427 break; 428 default: 429 return -EOPNOTSUPP; 430 } 431 return 0; 432 } 433 434 static int nft_exthdr_dump_common(struct sk_buff *skb, const struct nft_exthdr *priv) 435 { 436 if (nla_put_u8(skb, NFTA_EXTHDR_TYPE, priv->type)) 437 goto nla_put_failure; 438 if (nla_put_be32(skb, NFTA_EXTHDR_OFFSET, htonl(priv->offset))) 439 goto nla_put_failure; 440 if (nla_put_be32(skb, NFTA_EXTHDR_LEN, htonl(priv->len))) 441 goto nla_put_failure; 442 if (nla_put_be32(skb, NFTA_EXTHDR_FLAGS, htonl(priv->flags))) 443 goto nla_put_failure; 444 if (nla_put_be32(skb, NFTA_EXTHDR_OP, htonl(priv->op))) 445 goto nla_put_failure; 446 return 0; 447 448 nla_put_failure: 449 return -1; 450 } 451 452 static int nft_exthdr_dump(struct sk_buff *skb, const struct nft_expr *expr) 453 { 454 const struct nft_exthdr *priv = nft_expr_priv(expr); 455 456 if (nft_dump_register(skb, NFTA_EXTHDR_DREG, priv->dreg)) 457 return -1; 458 459 return nft_exthdr_dump_common(skb, priv); 460 } 461 462 static int nft_exthdr_dump_set(struct sk_buff *skb, const struct nft_expr *expr) 463 { 464 const struct nft_exthdr *priv = nft_expr_priv(expr); 465 466 if (nft_dump_register(skb, NFTA_EXTHDR_SREG, priv->sreg)) 467 return -1; 468 469 return nft_exthdr_dump_common(skb, priv); 470 } 471 472 static const struct nft_expr_ops nft_exthdr_ipv6_ops = { 473 .type = &nft_exthdr_type, 474 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), 475 .eval = nft_exthdr_ipv6_eval, 476 .init = nft_exthdr_init, 477 .dump = nft_exthdr_dump, 478 }; 479 480 static const struct nft_expr_ops nft_exthdr_ipv4_ops = { 481 .type = &nft_exthdr_type, 482 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), 483 .eval = nft_exthdr_ipv4_eval, 484 .init = nft_exthdr_ipv4_init, 485 .dump = nft_exthdr_dump, 486 }; 487 488 static const struct nft_expr_ops nft_exthdr_tcp_ops = { 489 .type = &nft_exthdr_type, 490 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), 491 .eval = nft_exthdr_tcp_eval, 492 .init = nft_exthdr_init, 493 .dump = nft_exthdr_dump, 494 }; 495 496 static const struct nft_expr_ops nft_exthdr_tcp_set_ops = { 497 .type = &nft_exthdr_type, 498 .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), 499 .eval = nft_exthdr_tcp_set_eval, 500 .init = nft_exthdr_tcp_set_init, 501 .dump = nft_exthdr_dump_set, 502 }; 503 504 static const struct nft_expr_ops * 505 nft_exthdr_select_ops(const struct nft_ctx *ctx, 506 const struct nlattr * const tb[]) 507 { 508 u32 op; 509 510 if (!tb[NFTA_EXTHDR_OP]) 511 return &nft_exthdr_ipv6_ops; 512 513 if (tb[NFTA_EXTHDR_SREG] && tb[NFTA_EXTHDR_DREG]) 514 return ERR_PTR(-EOPNOTSUPP); 515 516 op = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OP])); 517 switch (op) { 518 case NFT_EXTHDR_OP_TCPOPT: 519 if (tb[NFTA_EXTHDR_SREG]) 520 return &nft_exthdr_tcp_set_ops; 521 if (tb[NFTA_EXTHDR_DREG]) 522 return &nft_exthdr_tcp_ops; 523 break; 524 case NFT_EXTHDR_OP_IPV6: 525 if (tb[NFTA_EXTHDR_DREG]) 526 return &nft_exthdr_ipv6_ops; 527 break; 528 case NFT_EXTHDR_OP_IPV4: 529 if (ctx->family != NFPROTO_IPV6) { 530 if (tb[NFTA_EXTHDR_DREG]) 531 return &nft_exthdr_ipv4_ops; 532 } 533 break; 534 } 535 536 return ERR_PTR(-EOPNOTSUPP); 537 } 538 539 struct nft_expr_type nft_exthdr_type __read_mostly = { 540 .name = "exthdr", 541 .select_ops = nft_exthdr_select_ops, 542 .policy = nft_exthdr_policy, 543 .maxattr = NFTA_EXTHDR_MAX, 544 .owner = THIS_MODULE, 545 }; 546