net/netfilter/nf_flow_table_ip.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 #include <linux/kernel.h>
   3 #include <linux/init.h>
   4 #include <linux/module.h>
   5 #include <linux/netfilter.h>
   6 #include <linux/rhashtable.h>
   7 #include <linux/ip.h>
   8 #include <linux/ipv6.h>
   9 #include <linux/netdevice.h>
  10 #include <net/ip.h>
  11 #include <net/ipv6.h>
  12 #include <net/ip6_route.h>
  13 #include <net/neighbour.h>
  14 #include <net/netfilter/nf_flow_table.h>
  15 #include <net/netfilter/nf_conntrack_acct.h>
  16 /* For layer 4 checksum field offset. */
  17 #include <linux/tcp.h>
  18 #include <linux/udp.h>
  19
  20 static int nf_flow_state_check(struct flow_offload *flow, int proto,
  21                                struct sk_buff *skb, unsigned int thoff)
  22 {
  23         struct tcphdr *tcph;
  24
  25         if (proto != IPPROTO_TCP)
  26                 return 0;
  27
  28         tcph = (void *)(skb_network_header(skb) + thoff);
  29         if (unlikely(tcph->fin || tcph->rst)) {
  30                 flow_offload_teardown(flow);
  31                 return -1;
  32         }
  33
  34         return 0;
  35 }
  36
  37 static int nf_flow_nat_ip_tcp(struct sk_buff *skb, unsigned int thoff,
  38                               __be32 addr, __be32 new_addr)
  39 {
  40         struct tcphdr *tcph;
  41
  42         tcph = (void *)(skb_network_header(skb) + thoff);
  43         inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr, true);
  44
  45         return 0;
  46 }
  47
  48 static int nf_flow_nat_ip_udp(struct sk_buff *skb, unsigned int thoff,
  49                               __be32 addr, __be32 new_addr)
  50 {
  51         struct udphdr *udph;
  52
  53         udph = (void *)(skb_network_header(skb) + thoff);
  54         if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
  55                 inet_proto_csum_replace4(&udph->check, skb, addr,
  56                                          new_addr, true);
  57                 if (!udph->check)
  58                         udph->check = CSUM_MANGLED_0;
  59         }
  60
  61         return 0;
  62 }
  63
  64 static int nf_flow_nat_ip_l4proto(struct sk_buff *skb, struct iphdr *iph,
  65                                   unsigned int thoff, __be32 addr,
  66                                   __be32 new_addr)
  67 {
  68         switch (iph->protocol) {
  69         case IPPROTO_TCP:
  70                 if (nf_flow_nat_ip_tcp(skb, thoff, addr, new_addr) < 0)
  71                         return NF_DROP;
  72                 break;
  73         case IPPROTO_UDP:
  74                 if (nf_flow_nat_ip_udp(skb, thoff, addr, new_addr) < 0)
  75                         return NF_DROP;
  76                 break;
  77         }
  78
  79         return 0;
  80 }
  81
  82 static int nf_flow_snat_ip(const struct flow_offload *flow, struct sk_buff *skb,
  83                            struct iphdr *iph, unsigned int thoff,
  84                            enum flow_offload_tuple_dir dir)
  85 {
  86         __be32 addr, new_addr;
  87
  88         switch (dir) {
  89         case FLOW_OFFLOAD_DIR_ORIGINAL:
  90                 addr = iph->saddr;
  91                 new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4.s_addr;
  92                 iph->saddr = new_addr;
  93                 break;
  94         case FLOW_OFFLOAD_DIR_REPLY:
  95                 addr = iph->daddr;
  96                 new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4.s_addr;
  97                 iph->daddr = new_addr;
  98                 break;
  99         default:
 100                 return -1;
 101         }
 102         csum_replace4(&iph->check, addr, new_addr);
 103
 104         return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
 105 }
 106
 107 static int nf_flow_dnat_ip(const struct flow_offload *flow, struct sk_buff *skb,
 108                            struct iphdr *iph, unsigned int thoff,
 109                            enum flow_offload_tuple_dir dir)
 110 {
 111         __be32 addr, new_addr;
 112
 113         switch (dir) {
 114         case FLOW_OFFLOAD_DIR_ORIGINAL:
 115                 addr = iph->daddr;
 116                 new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4.s_addr;
 117                 iph->daddr = new_addr;
 118                 break;
 119         case FLOW_OFFLOAD_DIR_REPLY:
 120                 addr = iph->saddr;
 121                 new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4.s_addr;
 122                 iph->saddr = new_addr;
 123                 break;
 124         default:
 125                 return -1;
 126         }
 127         csum_replace4(&iph->check, addr, new_addr);
 128
 129         return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
 130 }
 131
 132 static int nf_flow_nat_ip(const struct flow_offload *flow, struct sk_buff *skb,
 133                           unsigned int thoff, enum flow_offload_tuple_dir dir,
 134                           struct iphdr *iph)
 135 {
 136         if (test_bit(NF_FLOW_SNAT, &flow->flags) &&
 137             (nf_flow_snat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
 138              nf_flow_snat_ip(flow, skb, iph, thoff, dir) < 0))
 139                 return -1;
 140
 141         if (test_bit(NF_FLOW_DNAT, &flow->flags) &&
 142             (nf_flow_dnat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
 143              nf_flow_dnat_ip(flow, skb, iph, thoff, dir) < 0))
 144                 return -1;
 145
 146         return 0;
 147 }
 148
 149 static bool ip_has_options(unsigned int thoff)
 150 {
 151         return thoff != sizeof(struct iphdr);
 152 }
 153
 154 static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev,
 155                             struct flow_offload_tuple *tuple, u32 *hdrsize)
 156 {
 157         struct flow_ports *ports;
 158         unsigned int thoff;
 159         struct iphdr *iph;
 160
 161         if (!pskb_may_pull(skb, sizeof(*iph)))
 162                 return -1;
 163
 164         iph = ip_hdr(skb);
 165         thoff = iph->ihl * 4;
 166
 167         if (ip_is_fragment(iph) ||
 168             unlikely(ip_has_options(thoff)))
 169                 return -1;
 170
 171         switch (iph->protocol) {
 172         case IPPROTO_TCP:
 173                 *hdrsize = sizeof(struct tcphdr);
 174                 break;
 175         case IPPROTO_UDP:
 176                 *hdrsize = sizeof(struct udphdr);
 177                 break;
 178         default:
 179                 return -1;
 180         }
 181
 182         if (iph->ttl <= 1)
 183                 return -1;
 184
 185         thoff = iph->ihl * 4;
 186         if (!pskb_may_pull(skb, thoff + *hdrsize))
 187                 return -1;
 188
 189         iph = ip_hdr(skb);
 190         ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
 191
 192         tuple->src_v4.s_addr    = iph->saddr;
 193         tuple->dst_v4.s_addr    = iph->daddr;
 194         tuple->src_port         = ports->source;
 195         tuple->dst_port         = ports->dest;
 196         tuple->l3proto          = AF_INET;
 197         tuple->l4proto          = iph->protocol;
 198         tuple->iifidx           = dev->ifindex;
 199
 200         return 0;
 201 }
 202
 203 /* Based on ip_exceeds_mtu(). */
 204 static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
 205 {
 206         if (skb->len <= mtu)
 207                 return false;
 208
 209         if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
 210                 return false;
 211
 212         return true;
 213 }
 214
 215 static int nf_flow_offload_dst_check(struct dst_entry *dst)
 216 {
 217         if (unlikely(dst_xfrm(dst)))
 218                 return dst_check(dst, 0) ? 0 : -1;
 219
 220         return 0;
 221 }
 222
 223 static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb,
 224                                       const struct nf_hook_state *state,
 225                                       struct dst_entry *dst)
 226 {
 227         skb_orphan(skb);
 228         skb_dst_set_noref(skb, dst);
 229         dst_output(state->net, state->sk, skb);
 230         return NF_STOLEN;
 231 }
 232
 233 unsigned int
 234 nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
 235                         const struct nf_hook_state *state)
 236 {
 237         struct flow_offload_tuple_rhash *tuplehash;
 238         struct nf_flowtable *flow_table = priv;
 239         struct flow_offload_tuple tuple = {};
 240         enum flow_offload_tuple_dir dir;
 241         struct flow_offload *flow;
 242         struct net_device *outdev;
 243         struct rtable *rt;
 244         unsigned int thoff;
 245         struct iphdr *iph;
 246         __be32 nexthop;
 247         u32 hdrsize;
 248
 249         if (skb->protocol != htons(ETH_P_IP))
 250                 return NF_ACCEPT;
 251
 252         if (nf_flow_tuple_ip(skb, state->in, &tuple, &hdrsize) < 0)
 253                 return NF_ACCEPT;
 254
 255         tuplehash = flow_offload_lookup(flow_table, &tuple);
 256         if (tuplehash == NULL)
 257                 return NF_ACCEPT;
 258
 259         dir = tuplehash->tuple.dir;
 260         flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
 261         rt = (struct rtable *)flow->tuplehash[dir].tuple.dst_cache;
 262         outdev = rt->dst.dev;
 263
 264         if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
 265                 return NF_ACCEPT;
 266
 267         iph = ip_hdr(skb);
 268         thoff = iph->ihl * 4;
 269         if (nf_flow_state_check(flow, iph->protocol, skb, thoff))
 270                 return NF_ACCEPT;
 271
 272         flow_offload_refresh(flow_table, flow);
 273
 274         if (nf_flow_offload_dst_check(&rt->dst)) {
 275                 flow_offload_teardown(flow);
 276                 return NF_ACCEPT;
 277         }
 278
 279         if (skb_try_make_writable(skb, thoff + hdrsize))
 280                 return NF_DROP;
 281
 282         iph = ip_hdr(skb);
 283         if (nf_flow_nat_ip(flow, skb, thoff, dir, iph) < 0)
 284                 return NF_DROP;
 285
 286         ip_decrease_ttl(iph);
 287         skb->tstamp = 0;
 288
 289         if (flow_table->flags & NF_FLOWTABLE_COUNTER)
 290                 nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len);
 291
 292         if (unlikely(dst_xfrm(&rt->dst))) {
 293                 memset(skb->cb, 0, sizeof(struct inet_skb_parm));
 294                 IPCB(skb)->iif = skb->dev->ifindex;
 295                 IPCB(skb)->flags = IPSKB_FORWARDED;
 296                 return nf_flow_xmit_xfrm(skb, state, &rt->dst);
 297         }
 298
 299         skb->dev = outdev;
 300         nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr);
 301         skb_dst_set_noref(skb, &rt->dst);
 302         neigh_xmit(NEIGH_ARP_TABLE, outdev, &nexthop, skb);
 303
 304         return NF_STOLEN;
 305 }
 306 EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook);
 307
 308 static int nf_flow_nat_ipv6_tcp(struct sk_buff *skb, unsigned int thoff,
 309                                 struct in6_addr *addr,
 310                                 struct in6_addr *new_addr)
 311 {
 312         struct tcphdr *tcph;
 313
 314         tcph = (void *)(skb_network_header(skb) + thoff);
 315         inet_proto_csum_replace16(&tcph->check, skb, addr->s6_addr32,
 316                                   new_addr->s6_addr32, true);
 317
 318         return 0;
 319 }
 320
 321 static int nf_flow_nat_ipv6_udp(struct sk_buff *skb, unsigned int thoff,
 322                                 struct in6_addr *addr,
 323                                 struct in6_addr *new_addr)
 324 {
 325         struct udphdr *udph;
 326
 327         udph = (void *)(skb_network_header(skb) + thoff);
 328         if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
 329                 inet_proto_csum_replace16(&udph->check, skb, addr->s6_addr32,
 330                                           new_addr->s6_addr32, true);
 331                 if (!udph->check)
 332                         udph->check = CSUM_MANGLED_0;
 333         }
 334
 335         return 0;
 336 }
 337
 338 static int nf_flow_nat_ipv6_l4proto(struct sk_buff *skb, struct ipv6hdr *ip6h,
 339                                     unsigned int thoff, struct in6_addr *addr,
 340                                     struct in6_addr *new_addr)
 341 {
 342         switch (ip6h->nexthdr) {
 343         case IPPROTO_TCP:
 344                 if (nf_flow_nat_ipv6_tcp(skb, thoff, addr, new_addr) < 0)
 345                         return NF_DROP;
 346                 break;
 347         case IPPROTO_UDP:
 348                 if (nf_flow_nat_ipv6_udp(skb, thoff, addr, new_addr) < 0)
 349                         return NF_DROP;
 350                 break;
 351         }
 352
 353         return 0;
 354 }
 355
 356 static int nf_flow_snat_ipv6(const struct flow_offload *flow,
 357                              struct sk_buff *skb, struct ipv6hdr *ip6h,
 358                              unsigned int thoff,
 359                              enum flow_offload_tuple_dir dir)
 360 {
 361         struct in6_addr addr, new_addr;
 362
 363         switch (dir) {
 364         case FLOW_OFFLOAD_DIR_ORIGINAL:
 365                 addr = ip6h->saddr;
 366                 new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6;
 367                 ip6h->saddr = new_addr;
 368                 break;
 369         case FLOW_OFFLOAD_DIR_REPLY:
 370                 addr = ip6h->daddr;
 371                 new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6;
 372                 ip6h->daddr = new_addr;
 373                 break;
 374         default:
 375                 return -1;
 376         }
 377
 378         return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
 379 }
 380
 381 static int nf_flow_dnat_ipv6(const struct flow_offload *flow,
 382                              struct sk_buff *skb, struct ipv6hdr *ip6h,
 383                              unsigned int thoff,
 384                              enum flow_offload_tuple_dir dir)
 385 {
 386         struct in6_addr addr, new_addr;
 387
 388         switch (dir) {
 389         case FLOW_OFFLOAD_DIR_ORIGINAL:
 390                 addr = ip6h->daddr;
 391                 new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6;
 392                 ip6h->daddr = new_addr;
 393                 break;
 394         case FLOW_OFFLOAD_DIR_REPLY:
 395                 addr = ip6h->saddr;
 396                 new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6;
 397                 ip6h->saddr = new_addr;
 398                 break;
 399         default:
 400                 return -1;
 401         }
 402
 403         return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
 404 }
 405
 406 static int nf_flow_nat_ipv6(const struct flow_offload *flow,
 407                             struct sk_buff *skb,
 408                             enum flow_offload_tuple_dir dir,
 409                             struct ipv6hdr *ip6h)
 410 {
 411         unsigned int thoff = sizeof(*ip6h);
 412
 413         if (test_bit(NF_FLOW_SNAT, &flow->flags) &&
 414             (nf_flow_snat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
 415              nf_flow_snat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
 416                 return -1;
 417
 418         if (test_bit(NF_FLOW_DNAT, &flow->flags) &&
 419             (nf_flow_dnat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
 420              nf_flow_dnat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
 421                 return -1;
 422
 423         return 0;
 424 }
 425
 426 static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
 427                               struct flow_offload_tuple *tuple, u32 *hdrsize)
 428 {
 429         struct flow_ports *ports;
 430         struct ipv6hdr *ip6h;
 431         unsigned int thoff;
 432
 433         if (!pskb_may_pull(skb, sizeof(*ip6h)))
 434                 return -1;
 435
 436         ip6h = ipv6_hdr(skb);
 437
 438         switch (ip6h->nexthdr) {
 439         case IPPROTO_TCP:
 440                 *hdrsize = sizeof(struct tcphdr);
 441                 break;
 442         case IPPROTO_UDP:
 443                 *hdrsize = sizeof(struct udphdr);
 444                 break;
 445         default:
 446                 return -1;
 447         }
 448
 449         if (ip6h->hop_limit <= 1)
 450                 return -1;
 451
 452         thoff = sizeof(*ip6h);
 453         if (!pskb_may_pull(skb, thoff + *hdrsize))
 454                 return -1;
 455
 456         ip6h = ipv6_hdr(skb);
 457         ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
 458
 459         tuple->src_v6           = ip6h->saddr;
 460         tuple->dst_v6           = ip6h->daddr;
 461         tuple->src_port         = ports->source;
 462         tuple->dst_port         = ports->dest;
 463         tuple->l3proto          = AF_INET6;
 464         tuple->l4proto          = ip6h->nexthdr;
 465         tuple->iifidx           = dev->ifindex;
 466
 467         return 0;
 468 }
 469
 470 unsigned int
 471 nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
 472                           const struct nf_hook_state *state)
 473 {
 474         struct flow_offload_tuple_rhash *tuplehash;
 475         struct nf_flowtable *flow_table = priv;
 476         struct flow_offload_tuple tuple = {};
 477         enum flow_offload_tuple_dir dir;
 478         const struct in6_addr *nexthop;
 479         struct flow_offload *flow;
 480         struct net_device *outdev;
 481         struct ipv6hdr *ip6h;
 482         struct rt6_info *rt;
 483         u32 hdrsize;
 484
 485         if (skb->protocol != htons(ETH_P_IPV6))
 486                 return NF_ACCEPT;
 487
 488         if (nf_flow_tuple_ipv6(skb, state->in, &tuple, &hdrsize) < 0)
 489                 return NF_ACCEPT;
 490
 491         tuplehash = flow_offload_lookup(flow_table, &tuple);
 492         if (tuplehash == NULL)
 493                 return NF_ACCEPT;
 494
 495         dir = tuplehash->tuple.dir;
 496         flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
 497         rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache;
 498         outdev = rt->dst.dev;
 499
 500         if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
 501                 return NF_ACCEPT;
 502
 503         if (nf_flow_state_check(flow, ipv6_hdr(skb)->nexthdr, skb,
 504                                 sizeof(*ip6h)))
 505                 return NF_ACCEPT;
 506
 507         flow_offload_refresh(flow_table, flow);
 508
 509         if (nf_flow_offload_dst_check(&rt->dst)) {
 510                 flow_offload_teardown(flow);
 511                 return NF_ACCEPT;
 512         }
 513
 514         if (skb_try_make_writable(skb, sizeof(*ip6h) + hdrsize))
 515                 return NF_DROP;
 516
 517         ip6h = ipv6_hdr(skb);
 518         if (nf_flow_nat_ipv6(flow, skb, dir, ip6h) < 0)
 519                 return NF_DROP;
 520
 521         ip6h->hop_limit--;
 522         skb->tstamp = 0;
 523
 524         if (flow_table->flags & NF_FLOWTABLE_COUNTER)
 525                 nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len);
 526
 527         if (unlikely(dst_xfrm(&rt->dst))) {
 528                 memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
 529                 IP6CB(skb)->iif = skb->dev->ifindex;
 530                 IP6CB(skb)->flags = IP6SKB_FORWARDED;
 531                 return nf_flow_xmit_xfrm(skb, state, &rt->dst);
 532         }
 533
 534         skb->dev = outdev;
 535         nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6);
 536         skb_dst_set_noref(skb, &rt->dst);
 537         neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb);
 538
 539         return NF_STOLEN;
 540 }
 541 EXPORT_SYMBOL_GPL(nf_flow_offload_ipv6_hook);