net/netfilter/nft_exthdr.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
   4  *
   5  * Development of this code funded by Astaro AG (http://www.astaro.com/)
   6  */
   7
   8 #include <asm/unaligned.h>
   9 #include <linux/kernel.h>
  10 #include <linux/netlink.h>
  11 #include <linux/netfilter.h>
  12 #include <linux/netfilter/nf_tables.h>
  13 #include <net/netfilter/nf_tables_core.h>
  14 #include <net/netfilter/nf_tables.h>
  15 #include <net/tcp.h>
  16
  17 struct nft_exthdr {
  18         u8                      type;
  19         u8                      offset;
  20         u8                      len;
  21         u8                      op;
  22         enum nft_registers      dreg:8;
  23         enum nft_registers      sreg:8;
  24         u8                      flags;
  25 };
  26
  27 static unsigned int optlen(const u8 *opt, unsigned int offset)
  28 {
  29         /* Beware zero-length options: make finite progress */
  30         if (opt[offset] <= TCPOPT_NOP || opt[offset + 1] == 0)
  31                 return 1;
  32         else
  33                 return opt[offset + 1];
  34 }
  35
  36 static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
  37                                  struct nft_regs *regs,
  38                                  const struct nft_pktinfo *pkt)
  39 {
  40         struct nft_exthdr *priv = nft_expr_priv(expr);
  41         u32 *dest = &regs->data[priv->dreg];
  42         unsigned int offset = 0;
  43         int err;
  44
  45         err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
  46         if (priv->flags & NFT_EXTHDR_F_PRESENT) {
  47                 *dest = (err >= 0);
  48                 return;
  49         } else if (err < 0) {
  50                 goto err;
  51         }
  52         offset += priv->offset;
  53
  54         dest[priv->len / NFT_REG32_SIZE] = 0;
  55         if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
  56                 goto err;
  57         return;
  58 err:
  59         regs->verdict.code = NFT_BREAK;
  60 }
  61
  62 static void *
  63 nft_tcp_header_pointer(const struct nft_pktinfo *pkt,
  64                        unsigned int len, void *buffer, unsigned int *tcphdr_len)
  65 {
  66         struct tcphdr *tcph;
  67
  68         if (!pkt->tprot_set || pkt->tprot != IPPROTO_TCP)
  69                 return NULL;
  70
  71         tcph = skb_header_pointer(pkt->skb, pkt->xt.thoff, sizeof(*tcph), buffer);
  72         if (!tcph)
  73                 return NULL;
  74
  75         *tcphdr_len = __tcp_hdrlen(tcph);
  76         if (*tcphdr_len < sizeof(*tcph) || *tcphdr_len > len)
  77                 return NULL;
  78
  79         return skb_header_pointer(pkt->skb, pkt->xt.thoff, *tcphdr_len, buffer);
  80 }
  81
  82 static void nft_exthdr_tcp_eval(const struct nft_expr *expr,
  83                                 struct nft_regs *regs,
  84                                 const struct nft_pktinfo *pkt)
  85 {
  86         u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
  87         struct nft_exthdr *priv = nft_expr_priv(expr);
  88         unsigned int i, optl, tcphdr_len, offset;
  89         u32 *dest = &regs->data[priv->dreg];
  90         struct tcphdr *tcph;
  91         u8 *opt;
  92
  93         tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
  94         if (!tcph)
  95                 goto err;
  96
  97         opt = (u8 *)tcph;
  98         for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
  99                 optl = optlen(opt, i);
 100
 101                 if (priv->type != opt[i])
 102                         continue;
 103
 104                 if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
 105                         goto err;
 106
 107                 offset = i + priv->offset;
 108                 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
 109                         *dest = 1;
 110                 } else {
 111                         dest[priv->len / NFT_REG32_SIZE] = 0;
 112                         memcpy(dest, opt + offset, priv->len);
 113                 }
 114
 115                 return;
 116         }
 117
 118 err:
 119         if (priv->flags & NFT_EXTHDR_F_PRESENT)
 120                 *dest = 0;
 121         else
 122                 regs->verdict.code = NFT_BREAK;
 123 }
 124
 125 static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr,
 126                                     struct nft_regs *regs,
 127                                     const struct nft_pktinfo *pkt)
 128 {
 129         u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
 130         struct nft_exthdr *priv = nft_expr_priv(expr);
 131         unsigned int i, optl, tcphdr_len, offset;
 132         struct tcphdr *tcph;
 133         u8 *opt;
 134         u32 src;
 135
 136         tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
 137         if (!tcph)
 138                 return;
 139
 140         opt = (u8 *)tcph;
 141         for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
 142                 union {
 143                         u8 octet;
 144                         __be16 v16;
 145                         __be32 v32;
 146                 } old, new;
 147
 148                 optl = optlen(opt, i);
 149
 150                 if (priv->type != opt[i])
 151                         continue;
 152
 153                 if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
 154                         return;
 155
 156                 if (!skb_make_writable(pkt->skb, pkt->xt.thoff + i + priv->len))
 157                         return;
 158
 159                 tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff,
 160                                               &tcphdr_len);
 161                 if (!tcph)
 162                         return;
 163
 164                 src = regs->data[priv->sreg];
 165                 offset = i + priv->offset;
 166
 167                 switch (priv->len) {
 168                 case 2:
 169                         old.v16 = get_unaligned((u16 *)(opt + offset));
 170                         new.v16 = src;
 171
 172                         switch (priv->type) {
 173                         case TCPOPT_MSS:
 174                                 /* increase can cause connection to stall */
 175                                 if (ntohs(old.v16) <= ntohs(new.v16))
 176                                         return;
 177                         break;
 178                         }
 179
 180                         if (old.v16 == new.v16)
 181                                 return;
 182
 183                         put_unaligned(new.v16, (u16*)(opt + offset));
 184                         inet_proto_csum_replace2(&tcph->check, pkt->skb,
 185                                                  old.v16, new.v16, false);
 186                         break;
 187                 case 4:
 188                         new.v32 = src;
 189                         old.v32 = get_unaligned((u32 *)(opt + offset));
 190
 191                         if (old.v32 == new.v32)
 192                                 return;
 193
 194                         put_unaligned(new.v32, (u32*)(opt + offset));
 195                         inet_proto_csum_replace4(&tcph->check, pkt->skb,
 196                                                  old.v32, new.v32, false);
 197                         break;
 198                 default:
 199                         WARN_ON_ONCE(1);
 200                         break;
 201                 }
 202
 203                 return;
 204         }
 205 }
 206
 207 static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = {
 208         [NFTA_EXTHDR_DREG]              = { .type = NLA_U32 },
 209         [NFTA_EXTHDR_TYPE]              = { .type = NLA_U8 },
 210         [NFTA_EXTHDR_OFFSET]            = { .type = NLA_U32 },
 211         [NFTA_EXTHDR_LEN]               = { .type = NLA_U32 },
 212         [NFTA_EXTHDR_FLAGS]             = { .type = NLA_U32 },
 213         [NFTA_EXTHDR_OP]                = { .type = NLA_U32 },
 214         [NFTA_EXTHDR_SREG]              = { .type = NLA_U32 },
 215 };
 216
 217 static int nft_exthdr_init(const struct nft_ctx *ctx,
 218                            const struct nft_expr *expr,
 219                            const struct nlattr * const tb[])
 220 {
 221         struct nft_exthdr *priv = nft_expr_priv(expr);
 222         u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
 223         int err;
 224
 225         if (!tb[NFTA_EXTHDR_DREG] ||
 226             !tb[NFTA_EXTHDR_TYPE] ||
 227             !tb[NFTA_EXTHDR_OFFSET] ||
 228             !tb[NFTA_EXTHDR_LEN])
 229                 return -EINVAL;
 230
 231         err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
 232         if (err < 0)
 233                 return err;
 234
 235         err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
 236         if (err < 0)
 237                 return err;
 238
 239         if (tb[NFTA_EXTHDR_FLAGS]) {
 240                 err = nft_parse_u32_check(tb[NFTA_EXTHDR_FLAGS], U8_MAX, &flags);
 241                 if (err < 0)
 242                         return err;
 243
 244                 if (flags & ~NFT_EXTHDR_F_PRESENT)
 245                         return -EINVAL;
 246         }
 247
 248         if (tb[NFTA_EXTHDR_OP]) {
 249                 err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
 250                 if (err < 0)
 251                         return err;
 252         }
 253
 254         priv->type   = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
 255         priv->offset = offset;
 256         priv->len    = len;
 257         priv->dreg   = nft_parse_register(tb[NFTA_EXTHDR_DREG]);
 258         priv->flags  = flags;
 259         priv->op     = op;
 260
 261         return nft_validate_register_store(ctx, priv->dreg, NULL,
 262                                            NFT_DATA_VALUE, priv->len);
 263 }
 264
 265 static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx,
 266                                    const struct nft_expr *expr,
 267                                    const struct nlattr * const tb[])
 268 {
 269         struct nft_exthdr *priv = nft_expr_priv(expr);
 270         u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
 271         int err;
 272
 273         if (!tb[NFTA_EXTHDR_SREG] ||
 274             !tb[NFTA_EXTHDR_TYPE] ||
 275             !tb[NFTA_EXTHDR_OFFSET] ||
 276             !tb[NFTA_EXTHDR_LEN])
 277                 return -EINVAL;
 278
 279         if (tb[NFTA_EXTHDR_DREG] || tb[NFTA_EXTHDR_FLAGS])
 280                 return -EINVAL;
 281
 282         err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
 283         if (err < 0)
 284                 return err;
 285
 286         err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
 287         if (err < 0)
 288                 return err;
 289
 290         if (offset < 2)
 291                 return -EOPNOTSUPP;
 292
 293         switch (len) {
 294         case 2: break;
 295         case 4: break;
 296         default:
 297                 return -EOPNOTSUPP;
 298         }
 299
 300         err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
 301         if (err < 0)
 302                 return err;
 303
 304         priv->type   = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
 305         priv->offset = offset;
 306         priv->len    = len;
 307         priv->sreg   = nft_parse_register(tb[NFTA_EXTHDR_SREG]);
 308         priv->flags  = flags;
 309         priv->op     = op;
 310
 311         return nft_validate_register_load(priv->sreg, priv->len);
 312 }
 313
 314 static int nft_exthdr_dump_common(struct sk_buff *skb, const struct nft_exthdr *priv)
 315 {
 316         if (nla_put_u8(skb, NFTA_EXTHDR_TYPE, priv->type))
 317                 goto nla_put_failure;
 318         if (nla_put_be32(skb, NFTA_EXTHDR_OFFSET, htonl(priv->offset)))
 319                 goto nla_put_failure;
 320         if (nla_put_be32(skb, NFTA_EXTHDR_LEN, htonl(priv->len)))
 321                 goto nla_put_failure;
 322         if (nla_put_be32(skb, NFTA_EXTHDR_FLAGS, htonl(priv->flags)))
 323                 goto nla_put_failure;
 324         if (nla_put_be32(skb, NFTA_EXTHDR_OP, htonl(priv->op)))
 325                 goto nla_put_failure;
 326         return 0;
 327
 328 nla_put_failure:
 329         return -1;
 330 }
 331
 332 static int nft_exthdr_dump(struct sk_buff *skb, const struct nft_expr *expr)
 333 {
 334         const struct nft_exthdr *priv = nft_expr_priv(expr);
 335
 336         if (nft_dump_register(skb, NFTA_EXTHDR_DREG, priv->dreg))
 337                 return -1;
 338
 339         return nft_exthdr_dump_common(skb, priv);
 340 }
 341
 342 static int nft_exthdr_dump_set(struct sk_buff *skb, const struct nft_expr *expr)
 343 {
 344         const struct nft_exthdr *priv = nft_expr_priv(expr);
 345
 346         if (nft_dump_register(skb, NFTA_EXTHDR_SREG, priv->sreg))
 347                 return -1;
 348
 349         return nft_exthdr_dump_common(skb, priv);
 350 }
 351
 352 static const struct nft_expr_ops nft_exthdr_ipv6_ops = {
 353         .type           = &nft_exthdr_type,
 354         .size           = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
 355         .eval           = nft_exthdr_ipv6_eval,
 356         .init           = nft_exthdr_init,
 357         .dump           = nft_exthdr_dump,
 358 };
 359
 360 static const struct nft_expr_ops nft_exthdr_tcp_ops = {
 361         .type           = &nft_exthdr_type,
 362         .size           = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
 363         .eval           = nft_exthdr_tcp_eval,
 364         .init           = nft_exthdr_init,
 365         .dump           = nft_exthdr_dump,
 366 };
 367
 368 static const struct nft_expr_ops nft_exthdr_tcp_set_ops = {
 369         .type           = &nft_exthdr_type,
 370         .size           = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
 371         .eval           = nft_exthdr_tcp_set_eval,
 372         .init           = nft_exthdr_tcp_set_init,
 373         .dump           = nft_exthdr_dump_set,
 374 };
 375
 376 static const struct nft_expr_ops *
 377 nft_exthdr_select_ops(const struct nft_ctx *ctx,
 378                       const struct nlattr * const tb[])
 379 {
 380         u32 op;
 381
 382         if (!tb[NFTA_EXTHDR_OP])
 383                 return &nft_exthdr_ipv6_ops;
 384
 385         if (tb[NFTA_EXTHDR_SREG] && tb[NFTA_EXTHDR_DREG])
 386                 return ERR_PTR(-EOPNOTSUPP);
 387
 388         op = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OP]));
 389         switch (op) {
 390         case NFT_EXTHDR_OP_TCPOPT:
 391                 if (tb[NFTA_EXTHDR_SREG])
 392                         return &nft_exthdr_tcp_set_ops;
 393                 if (tb[NFTA_EXTHDR_DREG])
 394                         return &nft_exthdr_tcp_ops;
 395                 break;
 396         case NFT_EXTHDR_OP_IPV6:
 397                 if (tb[NFTA_EXTHDR_DREG])
 398                         return &nft_exthdr_ipv6_ops;
 399                 break;
 400         }
 401
 402         return ERR_PTR(-EOPNOTSUPP);
 403 }
 404
 405 struct nft_expr_type nft_exthdr_type __read_mostly = {
 406         .name           = "exthdr",
 407         .select_ops     = nft_exthdr_select_ops,
 408         .policy         = nft_exthdr_policy,
 409         .maxattr        = NFTA_EXTHDR_MAX,
 410         .owner          = THIS_MODULE,
 411 };