]>
Commit | Line | Data |
---|---|---|
2fa84193 AP |
1 | /* |
2 | * Copyright (c) 2016 Anders K. Pedersen <akp@cohaesio.com> | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify | |
5 | * it under the terms of the GNU General Public License version 2 as | |
6 | * published by the Free Software Foundation. | |
7 | */ | |
8 | ||
9 | #include <linux/kernel.h> | |
10 | #include <linux/init.h> | |
11 | #include <linux/module.h> | |
12 | #include <linux/netlink.h> | |
13 | #include <linux/netfilter.h> | |
14 | #include <linux/netfilter/nf_tables.h> | |
15 | #include <net/dst.h> | |
16 | #include <net/ip6_route.h> | |
17 | #include <net/route.h> | |
18 | #include <net/netfilter/nf_tables.h> | |
19 | #include <net/netfilter/nf_tables_core.h> | |
20 | ||
21 | struct nft_rt { | |
22 | enum nft_rt_keys key:8; | |
23 | enum nft_registers dreg:8; | |
24 | }; | |
25 | ||
6b5dc98e FW |
26 | static u16 get_tcpmss(const struct nft_pktinfo *pkt, const struct dst_entry *skbdst) |
27 | { | |
28 | u32 minlen = sizeof(struct ipv6hdr), mtu = dst_mtu(skbdst); | |
29 | const struct sk_buff *skb = pkt->skb; | |
30 | const struct nf_afinfo *ai; | |
31 | struct flowi fl; | |
32 | ||
33 | memset(&fl, 0, sizeof(fl)); | |
34 | ||
35 | switch (nft_pf(pkt)) { | |
36 | case NFPROTO_IPV4: | |
37 | fl.u.ip4.daddr = ip_hdr(skb)->saddr; | |
1aff6471 | 38 | minlen = sizeof(struct iphdr) + sizeof(struct tcphdr); |
6b5dc98e FW |
39 | break; |
40 | case NFPROTO_IPV6: | |
41 | fl.u.ip6.daddr = ipv6_hdr(skb)->saddr; | |
1aff6471 | 42 | minlen = sizeof(struct ipv6hdr) + sizeof(struct tcphdr); |
6b5dc98e FW |
43 | break; |
44 | } | |
45 | ||
46 | ai = nf_get_afinfo(nft_pf(pkt)); | |
47 | if (ai) { | |
48 | struct dst_entry *dst = NULL; | |
49 | ||
50 | ai->route(nft_net(pkt), &dst, &fl, false); | |
51 | if (dst) { | |
52 | mtu = min(mtu, dst_mtu(dst)); | |
53 | dst_release(dst); | |
54 | } | |
55 | } | |
56 | ||
57 | if (mtu <= minlen || mtu > 0xffff) | |
58 | return TCP_MSS_DEFAULT; | |
59 | ||
60 | return mtu - minlen; | |
61 | } | |
62 | ||
cad43944 | 63 | static void nft_rt_get_eval(const struct nft_expr *expr, |
64 | struct nft_regs *regs, | |
65 | const struct nft_pktinfo *pkt) | |
2fa84193 AP |
66 | { |
67 | const struct nft_rt *priv = nft_expr_priv(expr); | |
68 | const struct sk_buff *skb = pkt->skb; | |
69 | u32 *dest = ®s->data[priv->dreg]; | |
70 | const struct dst_entry *dst; | |
71 | ||
72 | dst = skb_dst(skb); | |
73 | if (!dst) | |
74 | goto err; | |
75 | ||
76 | switch (priv->key) { | |
77 | #ifdef CONFIG_IP_ROUTE_CLASSID | |
78 | case NFT_RT_CLASSID: | |
79 | *dest = dst->tclassid; | |
80 | break; | |
81 | #endif | |
82 | case NFT_RT_NEXTHOP4: | |
0e5a1c7e | 83 | if (nft_pf(pkt) != NFPROTO_IPV4) |
2fa84193 AP |
84 | goto err; |
85 | ||
5fd02ebe FW |
86 | *dest = (__force u32)rt_nexthop((const struct rtable *)dst, |
87 | ip_hdr(skb)->daddr); | |
2fa84193 AP |
88 | break; |
89 | case NFT_RT_NEXTHOP6: | |
0e5a1c7e | 90 | if (nft_pf(pkt) != NFPROTO_IPV6) |
2fa84193 AP |
91 | goto err; |
92 | ||
93 | memcpy(dest, rt6_nexthop((struct rt6_info *)dst, | |
94 | &ipv6_hdr(skb)->daddr), | |
95 | sizeof(struct in6_addr)); | |
96 | break; | |
6b5dc98e FW |
97 | case NFT_RT_TCPMSS: |
98 | nft_reg_store16(dest, get_tcpmss(pkt, dst)); | |
99 | break; | |
2fa84193 AP |
100 | default: |
101 | WARN_ON(1); | |
102 | goto err; | |
103 | } | |
104 | return; | |
105 | ||
106 | err: | |
107 | regs->verdict.code = NFT_BREAK; | |
108 | } | |
109 | ||
5fd02ebe | 110 | static const struct nla_policy nft_rt_policy[NFTA_RT_MAX + 1] = { |
2fa84193 AP |
111 | [NFTA_RT_DREG] = { .type = NLA_U32 }, |
112 | [NFTA_RT_KEY] = { .type = NLA_U32 }, | |
113 | }; | |
114 | ||
cad43944 | 115 | static int nft_rt_get_init(const struct nft_ctx *ctx, |
116 | const struct nft_expr *expr, | |
117 | const struct nlattr * const tb[]) | |
2fa84193 AP |
118 | { |
119 | struct nft_rt *priv = nft_expr_priv(expr); | |
120 | unsigned int len; | |
121 | ||
122 | if (tb[NFTA_RT_KEY] == NULL || | |
123 | tb[NFTA_RT_DREG] == NULL) | |
124 | return -EINVAL; | |
125 | ||
126 | priv->key = ntohl(nla_get_be32(tb[NFTA_RT_KEY])); | |
127 | switch (priv->key) { | |
128 | #ifdef CONFIG_IP_ROUTE_CLASSID | |
129 | case NFT_RT_CLASSID: | |
130 | #endif | |
131 | case NFT_RT_NEXTHOP4: | |
132 | len = sizeof(u32); | |
133 | break; | |
134 | case NFT_RT_NEXTHOP6: | |
135 | len = sizeof(struct in6_addr); | |
136 | break; | |
6b5dc98e FW |
137 | case NFT_RT_TCPMSS: |
138 | len = sizeof(u16); | |
139 | break; | |
2fa84193 AP |
140 | default: |
141 | return -EOPNOTSUPP; | |
142 | } | |
143 | ||
144 | priv->dreg = nft_parse_register(tb[NFTA_RT_DREG]); | |
145 | return nft_validate_register_store(ctx, priv->dreg, NULL, | |
146 | NFT_DATA_VALUE, len); | |
147 | } | |
148 | ||
cad43944 | 149 | static int nft_rt_get_dump(struct sk_buff *skb, |
150 | const struct nft_expr *expr) | |
2fa84193 AP |
151 | { |
152 | const struct nft_rt *priv = nft_expr_priv(expr); | |
153 | ||
154 | if (nla_put_be32(skb, NFTA_RT_KEY, htonl(priv->key))) | |
155 | goto nla_put_failure; | |
156 | if (nft_dump_register(skb, NFTA_RT_DREG, priv->dreg)) | |
157 | goto nla_put_failure; | |
158 | return 0; | |
159 | ||
160 | nla_put_failure: | |
161 | return -1; | |
162 | } | |
163 | ||
6b5dc98e FW |
164 | static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, |
165 | const struct nft_data **data) | |
166 | { | |
167 | const struct nft_rt *priv = nft_expr_priv(expr); | |
168 | unsigned int hooks; | |
169 | ||
170 | switch (priv->key) { | |
171 | case NFT_RT_NEXTHOP4: | |
172 | case NFT_RT_NEXTHOP6: | |
173 | case NFT_RT_CLASSID: | |
174 | return 0; | |
175 | case NFT_RT_TCPMSS: | |
176 | hooks = (1 << NF_INET_FORWARD) | | |
177 | (1 << NF_INET_LOCAL_OUT) | | |
178 | (1 << NF_INET_POST_ROUTING); | |
179 | break; | |
180 | default: | |
181 | return -EINVAL; | |
182 | } | |
183 | ||
184 | return nft_chain_validate_hooks(ctx->chain, hooks); | |
185 | } | |
186 | ||
2fa84193 AP |
187 | static struct nft_expr_type nft_rt_type; |
188 | static const struct nft_expr_ops nft_rt_get_ops = { | |
189 | .type = &nft_rt_type, | |
190 | .size = NFT_EXPR_SIZE(sizeof(struct nft_rt)), | |
191 | .eval = nft_rt_get_eval, | |
192 | .init = nft_rt_get_init, | |
193 | .dump = nft_rt_get_dump, | |
6b5dc98e | 194 | .validate = nft_rt_validate, |
2fa84193 AP |
195 | }; |
196 | ||
197 | static struct nft_expr_type nft_rt_type __read_mostly = { | |
198 | .name = "rt", | |
199 | .ops = &nft_rt_get_ops, | |
200 | .policy = nft_rt_policy, | |
201 | .maxattr = NFTA_RT_MAX, | |
202 | .owner = THIS_MODULE, | |
203 | }; | |
204 | ||
205 | static int __init nft_rt_module_init(void) | |
206 | { | |
207 | return nft_register_expr(&nft_rt_type); | |
208 | } | |
209 | ||
210 | static void __exit nft_rt_module_exit(void) | |
211 | { | |
212 | nft_unregister_expr(&nft_rt_type); | |
213 | } | |
214 | ||
215 | module_init(nft_rt_module_init); | |
216 | module_exit(nft_rt_module_exit); | |
217 | ||
218 | MODULE_LICENSE("GPL"); | |
219 | MODULE_AUTHOR("Anders K. Pedersen <akp@cohaesio.com>"); | |
220 | MODULE_ALIAS_NFT_EXPR("rt"); |