Blame view
net/netfilter/nft_meta.c
16.3 KB
d2912cb15
|
1 |
// SPDX-License-Identifier: GPL-2.0-only |
96518518c
|
2 |
/* |
ef1f7df91
|
3 |
* Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> |
bd2bbdb49
|
4 5 |
* Copyright (c) 2014 Intel Corporation * Author: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> |
96518518c
|
6 |
* |
96518518c
|
7 8 9 10 |
* Development of this code funded by Astaro AG (http://www.astaro.com/) */ #include <linux/kernel.h> |
96518518c
|
11 12 13 |
#include <linux/netlink.h> #include <linux/netfilter.h> #include <linux/netfilter/nf_tables.h> |
e2a093ff0
|
14 15 16 |
#include <linux/in.h> #include <linux/ip.h> #include <linux/ipv6.h> |
afc5be307
|
17 |
#include <linux/smp.h> |
e639f7ab0
|
18 |
#include <linux/static_key.h> |
96518518c
|
19 20 21 22 |
#include <net/dst.h> #include <net/sock.h> #include <net/tcp_states.h> /* for TCP_TIME_WAIT */ #include <net/netfilter/nf_tables.h> |
e639f7ab0
|
23 |
#include <net/netfilter/nf_tables_core.h> |
30e103fe2
|
24 |
#include <net/netfilter/nft_meta.h> |
c9626a2cb
|
25 |
#include <net/netfilter/nf_tables_offload.h> |
96518518c
|
26 |
|
b4aae759c
|
27 |
#include <uapi/linux/netfilter_bridge.h> /* NF_BR_PRE_ROUTING */ |
63d10e12b
|
28 29 30 31 |
#define NFT_META_SECS_PER_MINUTE 60 #define NFT_META_SECS_PER_HOUR 3600 #define NFT_META_SECS_PER_DAY 86400 #define NFT_META_DAYS_PER_WEEK 7 |
b07edbe1c
|
32 |
static DEFINE_PER_CPU(struct rnd_state, nft_prandom_state); |
6408c40c3
|
33 |
static u8 nft_meta_weekday(time64_t secs) |
63d10e12b
|
34 35 36 37 38 |
{ unsigned int dse; u8 wday; secs -= NFT_META_SECS_PER_MINUTE * sys_tz.tz_minuteswest; |
6408c40c3
|
39 |
dse = div_u64(secs, NFT_META_SECS_PER_DAY); |
63d10e12b
|
40 41 42 43 |
wday = (4 + dse) % NFT_META_DAYS_PER_WEEK; return wday; } |
6408c40c3
|
44 |
static u32 nft_meta_hour(time64_t secs) |
63d10e12b
|
45 46 47 48 49 50 51 52 53 |
{ struct tm tm; time64_to_tm(secs, 0, &tm); return tm.tm_hour * NFT_META_SECS_PER_HOUR + tm.tm_min * NFT_META_SECS_PER_MINUTE + tm.tm_sec; } |
222440b4e
|
54 55 56 |
void nft_meta_get_eval(const struct nft_expr *expr, struct nft_regs *regs, const struct nft_pktinfo *pkt) |
96518518c
|
57 58 59 |
{ const struct nft_meta *priv = nft_expr_priv(expr); const struct sk_buff *skb = pkt->skb; |
0e5a1c7eb
|
60 |
const struct net_device *in = nft_in(pkt), *out = nft_out(pkt); |
3aed82259
|
61 |
struct sock *sk; |
49499c3e6
|
62 |
u32 *dest = ®s->data[priv->dreg]; |
96518518c
|
63 64 65 |
switch (priv->key) { case NFT_META_LEN: |
fad136ea0
|
66 |
*dest = skb->len; |
96518518c
|
67 68 |
break; case NFT_META_PROTOCOL: |
10596608c
|
69 |
nft_reg_store16(dest, (__force u16)skb->protocol); |
96518518c
|
70 |
break; |
124edfa9e
|
71 |
case NFT_META_NFPROTO: |
10596608c
|
72 |
nft_reg_store8(dest, nft_pf(pkt)); |
124edfa9e
|
73 |
break; |
4566bf270
|
74 |
case NFT_META_L4PROTO: |
beac5afa2
|
75 76 |
if (!pkt->tprot_set) goto err; |
10596608c
|
77 |
nft_reg_store8(dest, pkt->tprot); |
4566bf270
|
78 |
break; |
96518518c
|
79 |
case NFT_META_PRIORITY: |
fad136ea0
|
80 |
*dest = skb->priority; |
96518518c
|
81 82 |
break; case NFT_META_MARK: |
fad136ea0
|
83 |
*dest = skb->mark; |
96518518c
|
84 85 |
break; case NFT_META_IIF: |
cb81572e8
|
86 |
*dest = in ? in->ifindex : 0; |
96518518c
|
87 88 |
break; case NFT_META_OIF: |
cb81572e8
|
89 |
*dest = out ? out->ifindex : 0; |
96518518c
|
90 91 |
break; case NFT_META_IIFNAME: |
cb81572e8
|
92 |
strncpy((char *)dest, in ? in->name : "", IFNAMSIZ); |
96518518c
|
93 94 |
break; case NFT_META_OIFNAME: |
cb81572e8
|
95 |
strncpy((char *)dest, out ? out->name : "", IFNAMSIZ); |
96518518c
|
96 97 98 99 |
break; case NFT_META_IIFTYPE: if (in == NULL) goto err; |
10596608c
|
100 |
nft_reg_store16(dest, in->type); |
96518518c
|
101 102 103 104 |
break; case NFT_META_OIFTYPE: if (out == NULL) goto err; |
10596608c
|
105 |
nft_reg_store16(dest, out->type); |
96518518c
|
106 107 |
break; case NFT_META_SKUID: |
3aed82259
|
108 |
sk = skb_to_full_sk(skb); |
f56465010
|
109 110 |
if (!sk || !sk_fullsock(sk) || !net_eq(nft_net(pkt), sock_net(sk))) |
96518518c
|
111 |
goto err; |
3aed82259
|
112 113 114 115 |
read_lock_bh(&sk->sk_callback_lock); if (sk->sk_socket == NULL || sk->sk_socket->file == NULL) { read_unlock_bh(&sk->sk_callback_lock); |
96518518c
|
116 117 |
goto err; } |
fad136ea0
|
118 |
*dest = from_kuid_munged(&init_user_ns, |
3aed82259
|
119 120 |
sk->sk_socket->file->f_cred->fsuid); read_unlock_bh(&sk->sk_callback_lock); |
96518518c
|
121 122 |
break; case NFT_META_SKGID: |
3aed82259
|
123 |
sk = skb_to_full_sk(skb); |
f56465010
|
124 125 |
if (!sk || !sk_fullsock(sk) || !net_eq(nft_net(pkt), sock_net(sk))) |
96518518c
|
126 |
goto err; |
3aed82259
|
127 128 129 130 |
read_lock_bh(&sk->sk_callback_lock); if (sk->sk_socket == NULL || sk->sk_socket->file == NULL) { read_unlock_bh(&sk->sk_callback_lock); |
96518518c
|
131 132 |
goto err; } |
fad136ea0
|
133 |
*dest = from_kgid_munged(&init_user_ns, |
3aed82259
|
134 135 |
sk->sk_socket->file->f_cred->fsgid); read_unlock_bh(&sk->sk_callback_lock); |
96518518c
|
136 |
break; |
06efbd6d5
|
137 |
#ifdef CONFIG_IP_ROUTE_CLASSID |
96518518c
|
138 139 140 141 142 |
case NFT_META_RTCLASSID: { const struct dst_entry *dst = skb_dst(skb); if (dst == NULL) goto err; |
fad136ea0
|
143 |
*dest = dst->tclassid; |
96518518c
|
144 145 146 147 148 |
break; } #endif #ifdef CONFIG_NETWORK_SECMARK case NFT_META_SECMARK: |
fad136ea0
|
149 |
*dest = skb->secmark; |
96518518c
|
150 151 |
break; #endif |
e2a093ff0
|
152 153 |
case NFT_META_PKTTYPE: if (skb->pkt_type != PACKET_LOOPBACK) { |
10596608c
|
154 |
nft_reg_store8(dest, skb->pkt_type); |
e2a093ff0
|
155 156 |
break; } |
0e5a1c7eb
|
157 |
switch (nft_pf(pkt)) { |
e2a093ff0
|
158 159 |
case NFPROTO_IPV4: if (ipv4_is_multicast(ip_hdr(skb)->daddr)) |
10596608c
|
160 |
nft_reg_store8(dest, PACKET_MULTICAST); |
e2a093ff0
|
161 |
else |
10596608c
|
162 |
nft_reg_store8(dest, PACKET_BROADCAST); |
e2a093ff0
|
163 164 |
break; case NFPROTO_IPV6: |
10596608c
|
165 |
nft_reg_store8(dest, PACKET_MULTICAST); |
e2a093ff0
|
166 |
break; |
f169fd695
|
167 168 169 170 171 172 173 174 175 176 177 178 |
case NFPROTO_NETDEV: switch (skb->protocol) { case htons(ETH_P_IP): { int noff = skb_network_offset(skb); struct iphdr *iph, _iph; iph = skb_header_pointer(skb, noff, sizeof(_iph), &_iph); if (!iph) goto err; if (ipv4_is_multicast(iph->daddr)) |
10596608c
|
179 |
nft_reg_store8(dest, PACKET_MULTICAST); |
f169fd695
|
180 |
else |
10596608c
|
181 |
nft_reg_store8(dest, PACKET_BROADCAST); |
f169fd695
|
182 183 184 185 |
break; } case htons(ETH_P_IPV6): |
10596608c
|
186 |
nft_reg_store8(dest, PACKET_MULTICAST); |
f169fd695
|
187 188 189 190 191 192 |
break; default: WARN_ON_ONCE(1); goto err; } break; |
e2a093ff0
|
193 |
default: |
f169fd695
|
194 |
WARN_ON_ONCE(1); |
e2a093ff0
|
195 196 197 |
goto err; } break; |
afc5be307
|
198 |
case NFT_META_CPU: |
fad136ea0
|
199 |
*dest = raw_smp_processor_id(); |
afc5be307
|
200 |
break; |
3045d7607
|
201 202 203 |
case NFT_META_IIFGROUP: if (in == NULL) goto err; |
fad136ea0
|
204 |
*dest = in->group; |
3045d7607
|
205 206 207 208 |
break; case NFT_META_OIFGROUP: if (out == NULL) goto err; |
fad136ea0
|
209 |
*dest = out->group; |
3045d7607
|
210 |
break; |
e181a5430
|
211 |
#ifdef CONFIG_CGROUP_NET_CLASSID |
ce674173e
|
212 |
case NFT_META_CGROUP: |
3aed82259
|
213 |
sk = skb_to_full_sk(skb); |
f56465010
|
214 215 |
if (!sk || !sk_fullsock(sk) || !net_eq(nft_net(pkt), sock_net(sk))) |
c5035c77f
|
216 |
goto err; |
2a56a1fec
|
217 |
*dest = sock_cgroup_classid(&sk->sk_cgrp_data); |
ce674173e
|
218 |
break; |
e181a5430
|
219 |
#endif |
b07edbe1c
|
220 221 222 223 224 |
case NFT_META_PRANDOM: { struct rnd_state *state = this_cpu_ptr(&nft_prandom_state); *dest = prandom_u32_state(state); break; } |
f6931f5f5
|
225 226 |
#ifdef CONFIG_XFRM case NFT_META_SECPATH: |
7af8f4ca3
|
227 |
nft_reg_store8(dest, secpath_exists(skb)); |
f6931f5f5
|
228 229 |
break; #endif |
0fb4d2195
|
230 231 232 233 234 235 236 237 238 239 |
case NFT_META_IIFKIND: if (in == NULL || in->rtnl_link_ops == NULL) goto err; strncpy((char *)dest, in->rtnl_link_ops->kind, IFNAMSIZ); break; case NFT_META_OIFKIND: if (out == NULL || out->rtnl_link_ops == NULL) goto err; strncpy((char *)dest, out->rtnl_link_ops->kind, IFNAMSIZ); break; |
63d10e12b
|
240 241 242 243 |
case NFT_META_TIME_NS: nft_reg_store64(dest, ktime_get_real_ns()); break; case NFT_META_TIME_DAY: |
6408c40c3
|
244 |
nft_reg_store8(dest, nft_meta_weekday(ktime_get_real_seconds())); |
63d10e12b
|
245 246 |
break; case NFT_META_TIME_HOUR: |
6408c40c3
|
247 |
*dest = nft_meta_hour(ktime_get_real_seconds()); |
63d10e12b
|
248 |
break; |
96518518c
|
249 250 251 252 253 254 255 |
default: WARN_ON(1); goto err; } return; err: |
a55e22e92
|
256 |
regs->verdict.code = NFT_BREAK; |
96518518c
|
257 |
} |
30e103fe2
|
258 |
EXPORT_SYMBOL_GPL(nft_meta_get_eval); |
96518518c
|
259 |
|
30e103fe2
|
260 261 262 |
void nft_meta_set_eval(const struct nft_expr *expr, struct nft_regs *regs, const struct nft_pktinfo *pkt) |
e035b77ac
|
263 264 265 |
{ const struct nft_meta *meta = nft_expr_priv(expr); struct sk_buff *skb = pkt->skb; |
10596608c
|
266 267 |
u32 *sreg = ®s->data[meta->sreg]; u32 value = *sreg; |
97a0549b1
|
268 |
u8 value8; |
e035b77ac
|
269 270 271 272 273 274 275 276 |
switch (meta->key) { case NFT_META_MARK: skb->mark = value; break; case NFT_META_PRIORITY: skb->priority = value; break; |
b4aae759c
|
277 |
case NFT_META_PKTTYPE: |
97a0549b1
|
278 |
value8 = nft_reg_load8(sreg); |
10596608c
|
279 |
|
97a0549b1
|
280 281 |
if (skb->pkt_type != value8 && skb_pkt_type_ok(value8) && |
10596608c
|
282 |
skb_pkt_type_ok(skb->pkt_type)) |
97a0549b1
|
283 |
skb->pkt_type = value8; |
b4aae759c
|
284 |
break; |
e035b77ac
|
285 |
case NFT_META_NFTRACE: |
97a0549b1
|
286 287 288 |
value8 = nft_reg_load8(sreg); skb->nf_trace = !!value8; |
e035b77ac
|
289 |
break; |
b473a1f5d
|
290 291 292 293 294 |
#ifdef CONFIG_NETWORK_SECMARK case NFT_META_SECMARK: skb->secmark = value; break; #endif |
e035b77ac
|
295 296 297 298 |
default: WARN_ON(1); } } |
30e103fe2
|
299 |
EXPORT_SYMBOL_GPL(nft_meta_set_eval); |
e035b77ac
|
300 |
|
30e103fe2
|
301 |
const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = { |
96518518c
|
302 303 |
[NFTA_META_DREG] = { .type = NLA_U32 }, [NFTA_META_KEY] = { .type = NLA_U32 }, |
e035b77ac
|
304 |
[NFTA_META_SREG] = { .type = NLA_U32 }, |
96518518c
|
305 |
}; |
30e103fe2
|
306 |
EXPORT_SYMBOL_GPL(nft_meta_policy); |
96518518c
|
307 |
|
30e103fe2
|
308 309 310 |
int nft_meta_get_init(const struct nft_ctx *ctx, const struct nft_expr *expr, const struct nlattr * const tb[]) |
96518518c
|
311 |
{ |
d2caa696a
|
312 |
struct nft_meta *priv = nft_expr_priv(expr); |
45d9bcda2
|
313 |
unsigned int len; |
96518518c
|
314 |
|
d2caa696a
|
315 316 |
priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY])); switch (priv->key) { |
96518518c
|
317 |
case NFT_META_PROTOCOL: |
45d9bcda2
|
318 319 320 321 |
case NFT_META_IIFTYPE: case NFT_META_OIFTYPE: len = sizeof(u16); break; |
124edfa9e
|
322 |
case NFT_META_NFPROTO: |
4566bf270
|
323 |
case NFT_META_L4PROTO: |
45d9bcda2
|
324 |
case NFT_META_LEN: |
96518518c
|
325 326 327 328 |
case NFT_META_PRIORITY: case NFT_META_MARK: case NFT_META_IIF: case NFT_META_OIF: |
96518518c
|
329 330 |
case NFT_META_SKUID: case NFT_META_SKGID: |
06efbd6d5
|
331 |
#ifdef CONFIG_IP_ROUTE_CLASSID |
96518518c
|
332 333 334 335 336 |
case NFT_META_RTCLASSID: #endif #ifdef CONFIG_NETWORK_SECMARK case NFT_META_SECMARK: #endif |
e2a093ff0
|
337 |
case NFT_META_PKTTYPE: |
afc5be307
|
338 |
case NFT_META_CPU: |
3045d7607
|
339 340 |
case NFT_META_IIFGROUP: case NFT_META_OIFGROUP: |
e181a5430
|
341 |
#ifdef CONFIG_CGROUP_NET_CLASSID |
ce674173e
|
342 |
case NFT_META_CGROUP: |
e181a5430
|
343 |
#endif |
45d9bcda2
|
344 345 346 347 |
len = sizeof(u32); break; case NFT_META_IIFNAME: case NFT_META_OIFNAME: |
0fb4d2195
|
348 349 |
case NFT_META_IIFKIND: case NFT_META_OIFKIND: |
45d9bcda2
|
350 |
len = IFNAMSIZ; |
d2caa696a
|
351 |
break; |
b07edbe1c
|
352 353 354 355 |
case NFT_META_PRANDOM: prandom_init_once(&nft_prandom_state); len = sizeof(u32); break; |
f6931f5f5
|
356 357 358 359 360 |
#ifdef CONFIG_XFRM case NFT_META_SECPATH: len = sizeof(u8); break; #endif |
63d10e12b
|
361 362 363 364 365 366 367 368 369 |
case NFT_META_TIME_NS: len = sizeof(u64); break; case NFT_META_TIME_DAY: len = sizeof(u8); break; case NFT_META_TIME_HOUR: len = sizeof(u32); break; |
96518518c
|
370 371 372 |
default: return -EOPNOTSUPP; } |
b1c96ed37
|
373 |
priv->dreg = nft_parse_register(tb[NFTA_META_DREG]); |
27e6d2017
|
374 375 |
return nft_validate_register_store(ctx, priv->dreg, NULL, NFT_DATA_VALUE, len); |
e035b77ac
|
376 |
} |
30e103fe2
|
377 |
EXPORT_SYMBOL_GPL(nft_meta_get_init); |
e035b77ac
|
378 |
|
f6931f5f5
|
379 380 381 382 383 384 385 386 387 388 |
static int nft_meta_get_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, const struct nft_data **data) { #ifdef CONFIG_XFRM const struct nft_meta *priv = nft_expr_priv(expr); unsigned int hooks; if (priv->key != NFT_META_SECPATH) return 0; |
36596dadf
|
389 |
switch (ctx->family) { |
f6931f5f5
|
390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 |
case NFPROTO_NETDEV: hooks = 1 << NF_NETDEV_INGRESS; break; case NFPROTO_IPV4: case NFPROTO_IPV6: case NFPROTO_INET: hooks = (1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD); break; default: return -EOPNOTSUPP; } return nft_chain_validate_hooks(ctx->chain, hooks); #else return 0; #endif } |
30e103fe2
|
409 410 411 |
int nft_meta_set_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, const struct nft_data **data) |
b4aae759c
|
412 |
{ |
960fa72f6
|
413 |
struct nft_meta *priv = nft_expr_priv(expr); |
b4aae759c
|
414 |
unsigned int hooks; |
960fa72f6
|
415 416 |
if (priv->key != NFT_META_PKTTYPE) return 0; |
36596dadf
|
417 |
switch (ctx->family) { |
b4aae759c
|
418 419 420 421 422 423 |
case NFPROTO_BRIDGE: hooks = 1 << NF_BR_PRE_ROUTING; break; case NFPROTO_NETDEV: hooks = 1 << NF_NETDEV_INGRESS; break; |
96d9f2a72
|
424 425 426 427 428 |
case NFPROTO_IPV4: case NFPROTO_IPV6: case NFPROTO_INET: hooks = 1 << NF_INET_PRE_ROUTING; break; |
b4aae759c
|
429 430 431 432 433 434 |
default: return -EOPNOTSUPP; } return nft_chain_validate_hooks(ctx->chain, hooks); } |
30e103fe2
|
435 |
EXPORT_SYMBOL_GPL(nft_meta_set_validate); |
b4aae759c
|
436 |
|
30e103fe2
|
437 438 439 |
int nft_meta_set_init(const struct nft_ctx *ctx, const struct nft_expr *expr, const struct nlattr * const tb[]) |
e035b77ac
|
440 441 |
{ struct nft_meta *priv = nft_expr_priv(expr); |
d07db9884
|
442 |
unsigned int len; |
e035b77ac
|
443 444 445 |
int err; priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY])); |
d2caa696a
|
446 447 448 |
switch (priv->key) { case NFT_META_MARK: case NFT_META_PRIORITY: |
b473a1f5d
|
449 450 451 |
#ifdef CONFIG_NETWORK_SECMARK case NFT_META_SECMARK: #endif |
d07db9884
|
452 453 |
len = sizeof(u32); break; |
d2caa696a
|
454 |
case NFT_META_NFTRACE: |
d07db9884
|
455 |
len = sizeof(u8); |
d2caa696a
|
456 |
break; |
b4aae759c
|
457 |
case NFT_META_PKTTYPE: |
b4aae759c
|
458 459 |
len = sizeof(u8); break; |
d2caa696a
|
460 461 |
default: return -EOPNOTSUPP; |
e035b77ac
|
462 |
} |
b1c96ed37
|
463 |
priv->sreg = nft_parse_register(tb[NFTA_META_SREG]); |
d07db9884
|
464 |
err = nft_validate_register_load(priv->sreg, len); |
b38895c57
|
465 466 |
if (err < 0) return err; |
e035b77ac
|
467 |
|
e639f7ab0
|
468 469 |
if (priv->key == NFT_META_NFTRACE) static_branch_inc(&nft_trace_enabled); |
e035b77ac
|
470 |
return 0; |
96518518c
|
471 |
} |
30e103fe2
|
472 |
EXPORT_SYMBOL_GPL(nft_meta_set_init); |
96518518c
|
473 |
|
30e103fe2
|
474 475 |
int nft_meta_get_dump(struct sk_buff *skb, const struct nft_expr *expr) |
96518518c
|
476 477 |
{ const struct nft_meta *priv = nft_expr_priv(expr); |
e035b77ac
|
478 479 |
if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key))) goto nla_put_failure; |
b1c96ed37
|
480 |
if (nft_dump_register(skb, NFTA_META_DREG, priv->dreg)) |
96518518c
|
481 |
goto nla_put_failure; |
e035b77ac
|
482 483 484 485 486 |
return 0; nla_put_failure: return -1; } |
30e103fe2
|
487 |
EXPORT_SYMBOL_GPL(nft_meta_get_dump); |
e035b77ac
|
488 |
|
30e103fe2
|
489 |
int nft_meta_set_dump(struct sk_buff *skb, const struct nft_expr *expr) |
e035b77ac
|
490 491 |
{ const struct nft_meta *priv = nft_expr_priv(expr); |
96518518c
|
492 493 |
if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key))) goto nla_put_failure; |
b1c96ed37
|
494 |
if (nft_dump_register(skb, NFTA_META_SREG, priv->sreg)) |
e035b77ac
|
495 |
goto nla_put_failure; |
96518518c
|
496 497 498 499 500 |
return 0; nla_put_failure: return -1; } |
30e103fe2
|
501 |
EXPORT_SYMBOL_GPL(nft_meta_set_dump); |
96518518c
|
502 |
|
30e103fe2
|
503 504 |
void nft_meta_set_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) |
e639f7ab0
|
505 506 507 508 509 510 |
{ const struct nft_meta *priv = nft_expr_priv(expr); if (priv->key == NFT_META_NFTRACE) static_branch_dec(&nft_trace_enabled); } |
30e103fe2
|
511 |
EXPORT_SYMBOL_GPL(nft_meta_set_destroy); |
e639f7ab0
|
512 |
|
c9626a2cb
|
513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 |
static int nft_meta_get_offload(struct nft_offload_ctx *ctx, struct nft_flow_rule *flow, const struct nft_expr *expr) { const struct nft_meta *priv = nft_expr_priv(expr); struct nft_offload_reg *reg = &ctx->regs[priv->dreg]; switch (priv->key) { case NFT_META_PROTOCOL: NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic, n_proto, sizeof(__u16), reg); nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_NETWORK); break; case NFT_META_L4PROTO: NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic, ip_proto, sizeof(__u8), reg); nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_TRANSPORT); break; |
25da5eb32
|
531 532 533 534 |
case NFT_META_IIF: NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_META, meta, ingress_ifindex, sizeof(__u32), reg); break; |
8819efc94
|
535 536 537 538 |
case NFT_META_IIFTYPE: NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_META, meta, ingress_iftype, sizeof(__u16), reg); break; |
c9626a2cb
|
539 540 541 542 543 544 |
default: return -EOPNOTSUPP; } return 0; } |
e035b77ac
|
545 |
static const struct nft_expr_ops nft_meta_get_ops = { |
ef1f7df91
|
546 |
.type = &nft_meta_type, |
96518518c
|
547 |
.size = NFT_EXPR_SIZE(sizeof(struct nft_meta)), |
e035b77ac
|
548 |
.eval = nft_meta_get_eval, |
d2caa696a
|
549 |
.init = nft_meta_get_init, |
e035b77ac
|
550 |
.dump = nft_meta_get_dump, |
f6931f5f5
|
551 |
.validate = nft_meta_get_validate, |
c9626a2cb
|
552 |
.offload = nft_meta_get_offload, |
ef1f7df91
|
553 |
}; |
e035b77ac
|
554 555 556 557 |
static const struct nft_expr_ops nft_meta_set_ops = { .type = &nft_meta_type, .size = NFT_EXPR_SIZE(sizeof(struct nft_meta)), .eval = nft_meta_set_eval, |
d2caa696a
|
558 |
.init = nft_meta_set_init, |
e639f7ab0
|
559 |
.destroy = nft_meta_set_destroy, |
e035b77ac
|
560 |
.dump = nft_meta_set_dump, |
960fa72f6
|
561 |
.validate = nft_meta_set_validate, |
e035b77ac
|
562 563 564 565 566 567 568 569 570 571 572 |
}; static const struct nft_expr_ops * nft_meta_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[]) { if (tb[NFTA_META_KEY] == NULL) return ERR_PTR(-EINVAL); if (tb[NFTA_META_DREG] && tb[NFTA_META_SREG]) return ERR_PTR(-EINVAL); |
dfee0e99b
|
573 |
#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE) && IS_MODULE(CONFIG_NFT_BRIDGE_META) |
0ef1efd13
|
574 575 576 |
if (ctx->family == NFPROTO_BRIDGE) return ERR_PTR(-EAGAIN); #endif |
e035b77ac
|
577 578 579 580 581 582 583 584 |
if (tb[NFTA_META_DREG]) return &nft_meta_get_ops; if (tb[NFTA_META_SREG]) return &nft_meta_set_ops; return ERR_PTR(-EINVAL); } |
8a22543c8
|
585 |
struct nft_expr_type nft_meta_type __read_mostly = { |
ef1f7df91
|
586 |
.name = "meta", |
d4ef38354
|
587 |
.select_ops = nft_meta_select_ops, |
96518518c
|
588 589 |
.policy = nft_meta_policy, .maxattr = NFTA_META_MAX, |
ef1f7df91
|
590 |
.owner = THIS_MODULE, |
96518518c
|
591 |
}; |
fb9619454
|
592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 |
#ifdef CONFIG_NETWORK_SECMARK struct nft_secmark { u32 secid; char *ctx; }; static const struct nla_policy nft_secmark_policy[NFTA_SECMARK_MAX + 1] = { [NFTA_SECMARK_CTX] = { .type = NLA_STRING, .len = NFT_SECMARK_CTX_MAXLEN }, }; static int nft_secmark_compute_secid(struct nft_secmark *priv) { u32 tmp_secid = 0; int err; err = security_secctx_to_secid(priv->ctx, strlen(priv->ctx), &tmp_secid); if (err) return err; if (!tmp_secid) return -ENOENT; err = security_secmark_relabel_packet(tmp_secid); if (err) return err; priv->secid = tmp_secid; return 0; } static void nft_secmark_obj_eval(struct nft_object *obj, struct nft_regs *regs, const struct nft_pktinfo *pkt) { const struct nft_secmark *priv = nft_obj_data(obj); struct sk_buff *skb = pkt->skb; skb->secmark = priv->secid; } static int nft_secmark_obj_init(const struct nft_ctx *ctx, const struct nlattr * const tb[], struct nft_object *obj) { struct nft_secmark *priv = nft_obj_data(obj); int err; if (tb[NFTA_SECMARK_CTX] == NULL) return -EINVAL; priv->ctx = nla_strdup(tb[NFTA_SECMARK_CTX], GFP_KERNEL); if (!priv->ctx) return -ENOMEM; err = nft_secmark_compute_secid(priv); if (err) { kfree(priv->ctx); return err; } security_secmark_refcount_inc(); return 0; } static int nft_secmark_obj_dump(struct sk_buff *skb, struct nft_object *obj, bool reset) { struct nft_secmark *priv = nft_obj_data(obj); int err; if (nla_put_string(skb, NFTA_SECMARK_CTX, priv->ctx)) return -1; if (reset) { err = nft_secmark_compute_secid(priv); if (err) return err; } return 0; } static void nft_secmark_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj) { struct nft_secmark *priv = nft_obj_data(obj); security_secmark_refcount_dec(); kfree(priv->ctx); } static const struct nft_object_ops nft_secmark_obj_ops = { .type = &nft_secmark_obj_type, .size = sizeof(struct nft_secmark), .init = nft_secmark_obj_init, .eval = nft_secmark_obj_eval, .dump = nft_secmark_obj_dump, .destroy = nft_secmark_obj_destroy, }; struct nft_object_type nft_secmark_obj_type __read_mostly = { .type = NFT_OBJECT_SECMARK, .ops = &nft_secmark_obj_ops, .maxattr = NFTA_SECMARK_MAX, .policy = nft_secmark_policy, .owner = THIS_MODULE, }; #endif /* CONFIG_NETWORK_SECMARK */ |