net/netfilter/nft_payload.c

   1 /*
   2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   3  * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  10  */
  11
  12 #include <linux/kernel.h>
  13 #include <linux/if_vlan.h>
  14 #include <linux/init.h>
  15 #include <linux/module.h>
  16 #include <linux/netlink.h>
  17 #include <linux/netfilter.h>
  18 #include <linux/netfilter/nf_tables.h>
  19 #include <net/netfilter/nf_tables_core.h>
  20 #include <net/netfilter/nf_tables.h>
  21 /* For layer 4 checksum field offset. */
  22 #include <linux/tcp.h>
  23 #include <linux/udp.h>
  24 #include <linux/icmpv6.h>
  25
  26 /* add vlan header into the user buffer for if tag was removed by offloads */
  27 static bool
  28 nft_payload_copy_vlan(u32 *d, const struct sk_buff *skb, u8 offset, u8 len)
  29 {
  30         int mac_off = skb_mac_header(skb) - skb->data;
  31         u8 vlan_len, *vlanh, *dst_u8 = (u8 *) d;
  32         struct vlan_ethhdr veth;
  33
  34         vlanh = (u8 *) &veth;
  35         if (offset < ETH_HLEN) {
  36                 u8 ethlen = min_t(u8, len, ETH_HLEN - offset);
  37
  38                 if (skb_copy_bits(skb, mac_off, &veth, ETH_HLEN))
  39                         return false;
  40
  41                 veth.h_vlan_proto = skb->vlan_proto;
  42
  43                 memcpy(dst_u8, vlanh + offset, ethlen);
  44
  45                 len -= ethlen;
  46                 if (len == 0)
  47                         return true;
  48
  49                 dst_u8 += ethlen;
  50                 offset = ETH_HLEN;
  51         } else if (offset >= VLAN_ETH_HLEN) {
  52                 offset -= VLAN_HLEN;
  53                 goto skip;
  54         }
  55
  56         veth.h_vlan_TCI = htons(skb_vlan_tag_get(skb));
  57         veth.h_vlan_encapsulated_proto = skb->protocol;
  58
  59         vlanh += offset;
  60
  61         vlan_len = min_t(u8, len, VLAN_ETH_HLEN - offset);
  62         memcpy(dst_u8, vlanh, vlan_len);
  63
  64         len -= vlan_len;
  65         if (!len)
  66                 return true;
  67
  68         dst_u8 += vlan_len;
  69  skip:
  70         return skb_copy_bits(skb, offset + mac_off, dst_u8, len) == 0;
  71 }
  72
  73 static void nft_payload_eval(const struct nft_expr *expr,
  74                              struct nft_regs *regs,
  75                              const struct nft_pktinfo *pkt)
  76 {
  77         const struct nft_payload *priv = nft_expr_priv(expr);
  78         const struct sk_buff *skb = pkt->skb;
  79         u32 *dest = &regs->data[priv->dreg];
  80         int offset;
  81
  82         dest[priv->len / NFT_REG32_SIZE] = 0;
  83         switch (priv->base) {
  84         case NFT_PAYLOAD_LL_HEADER:
  85                 if (!skb_mac_header_was_set(skb))
  86                         goto err;
  87
  88                 if (skb_vlan_tag_present(skb)) {
  89                         if (!nft_payload_copy_vlan(dest, skb,
  90                                                    priv->offset, priv->len))
  91                                 goto err;
  92                         return;
  93                 }
  94                 offset = skb_mac_header(skb) - skb->data;
  95                 break;
  96         case NFT_PAYLOAD_NETWORK_HEADER:
  97                 offset = skb_network_offset(skb);
  98                 break;
  99         case NFT_PAYLOAD_TRANSPORT_HEADER:
 100                 if (!pkt->tprot_set)
 101                         goto err;
 102                 offset = pkt->xt.thoff;
 103                 break;
 104         default:
 105                 BUG();
 106         }
 107         offset += priv->offset;
 108
 109         if (skb_copy_bits(skb, offset, dest, priv->len) < 0)
 110                 goto err;
 111         return;
 112 err:
 113         regs->verdict.code = NFT_BREAK;
 114 }
 115
 116 static const struct nla_policy nft_payload_policy[NFTA_PAYLOAD_MAX + 1] = {
 117         [NFTA_PAYLOAD_SREG]             = { .type = NLA_U32 },
 118         [NFTA_PAYLOAD_DREG]             = { .type = NLA_U32 },
 119         [NFTA_PAYLOAD_BASE]             = { .type = NLA_U32 },
 120         [NFTA_PAYLOAD_OFFSET]           = { .type = NLA_U32 },
 121         [NFTA_PAYLOAD_LEN]              = { .type = NLA_U32 },
 122         [NFTA_PAYLOAD_CSUM_TYPE]        = { .type = NLA_U32 },
 123         [NFTA_PAYLOAD_CSUM_OFFSET]      = { .type = NLA_U32 },
 124 };
 125
 126 static int nft_payload_init(const struct nft_ctx *ctx,
 127                             const struct nft_expr *expr,
 128                             const struct nlattr * const tb[])
 129 {
 130         struct nft_payload *priv = nft_expr_priv(expr);
 131
 132         priv->base   = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE]));
 133         priv->offset = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET]));
 134         priv->len    = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));
 135         priv->dreg   = nft_parse_register(tb[NFTA_PAYLOAD_DREG]);
 136
 137         return nft_validate_register_store(ctx, priv->dreg, NULL,
 138                                            NFT_DATA_VALUE, priv->len);
 139 }
 140
 141 static int nft_payload_dump(struct sk_buff *skb, const struct nft_expr *expr)
 142 {
 143         const struct nft_payload *priv = nft_expr_priv(expr);
 144
 145         if (nft_dump_register(skb, NFTA_PAYLOAD_DREG, priv->dreg) ||
 146             nla_put_be32(skb, NFTA_PAYLOAD_BASE, htonl(priv->base)) ||
 147             nla_put_be32(skb, NFTA_PAYLOAD_OFFSET, htonl(priv->offset)) ||
 148             nla_put_be32(skb, NFTA_PAYLOAD_LEN, htonl(priv->len)))
 149                 goto nla_put_failure;
 150         return 0;
 151
 152 nla_put_failure:
 153         return -1;
 154 }
 155
 156 static const struct nft_expr_ops nft_payload_ops = {
 157         .type           = &nft_payload_type,
 158         .size           = NFT_EXPR_SIZE(sizeof(struct nft_payload)),
 159         .eval           = nft_payload_eval,
 160         .init           = nft_payload_init,
 161         .dump           = nft_payload_dump,
 162 };
 163
 164 const struct nft_expr_ops nft_payload_fast_ops = {
 165         .type           = &nft_payload_type,
 166         .size           = NFT_EXPR_SIZE(sizeof(struct nft_payload)),
 167         .eval           = nft_payload_eval,
 168         .init           = nft_payload_init,
 169         .dump           = nft_payload_dump,
 170 };
 171
 172 static inline void nft_csum_replace(__sum16 *sum, __wsum fsum, __wsum tsum)
 173 {
 174         *sum = csum_fold(csum_add(csum_sub(~csum_unfold(*sum), fsum), tsum));
 175         if (*sum == 0)
 176                 *sum = CSUM_MANGLED_0;
 177 }
 178
 179 static bool nft_payload_udp_checksum(struct sk_buff *skb, unsigned int thoff)
 180 {
 181         struct udphdr *uh, _uh;
 182
 183         uh = skb_header_pointer(skb, thoff, sizeof(_uh), &_uh);
 184         if (!uh)
 185                 return false;
 186
 187         return uh->check;
 188 }
 189
 190 static int nft_payload_l4csum_offset(const struct nft_pktinfo *pkt,
 191                                      struct sk_buff *skb,
 192                                      unsigned int *l4csum_offset)
 193 {
 194         switch (pkt->tprot) {
 195         case IPPROTO_TCP:
 196                 *l4csum_offset = offsetof(struct tcphdr, check);
 197                 break;
 198         case IPPROTO_UDP:
 199                 if (!nft_payload_udp_checksum(skb, pkt->xt.thoff))
 200                         return -1;
 201                 /* Fall through. */
 202         case IPPROTO_UDPLITE:
 203                 *l4csum_offset = offsetof(struct udphdr, check);
 204                 break;
 205         case IPPROTO_ICMPV6:
 206                 *l4csum_offset = offsetof(struct icmp6hdr, icmp6_cksum);
 207                 break;
 208         default:
 209                 return -1;
 210         }
 211
 212         *l4csum_offset += pkt->xt.thoff;
 213         return 0;
 214 }
 215
 216 static int nft_payload_l4csum_update(const struct nft_pktinfo *pkt,
 217                                      struct sk_buff *skb,
 218                                      __wsum fsum, __wsum tsum)
 219 {
 220         int l4csum_offset;
 221         __sum16 sum;
 222
 223         /* If we cannot determine layer 4 checksum offset or this packet doesn't
 224          * require layer 4 checksum recalculation, skip this packet.
 225          */
 226         if (nft_payload_l4csum_offset(pkt, skb, &l4csum_offset) < 0)
 227                 return 0;
 228
 229         if (skb_copy_bits(skb, l4csum_offset, &sum, sizeof(sum)) < 0)
 230                 return -1;
 231
 232         /* Checksum mangling for an arbitrary amount of bytes, based on
 233          * inet_proto_csum_replace*() functions.
 234          */
 235         if (skb->ip_summed != CHECKSUM_PARTIAL) {
 236                 nft_csum_replace(&sum, fsum, tsum);
 237                 if (skb->ip_summed == CHECKSUM_COMPLETE) {
 238                         skb->csum = ~csum_add(csum_sub(~(skb->csum), fsum),
 239                                               tsum);
 240                 }
 241         } else {
 242                 sum = ~csum_fold(csum_add(csum_sub(csum_unfold(sum), fsum),
 243                                           tsum));
 244         }
 245
 246         if (!skb_make_writable(skb, l4csum_offset + sizeof(sum)) ||
 247             skb_store_bits(skb, l4csum_offset, &sum, sizeof(sum)) < 0)
 248                 return -1;
 249
 250         return 0;
 251 }
 252
 253 static void nft_payload_set_eval(const struct nft_expr *expr,
 254                                  struct nft_regs *regs,
 255                                  const struct nft_pktinfo *pkt)
 256 {
 257         const struct nft_payload_set *priv = nft_expr_priv(expr);
 258         struct sk_buff *skb = pkt->skb;
 259         const u32 *src = &regs->data[priv->sreg];
 260         int offset, csum_offset;
 261         __wsum fsum, tsum;
 262         __sum16 sum;
 263
 264         switch (priv->base) {
 265         case NFT_PAYLOAD_LL_HEADER:
 266                 if (!skb_mac_header_was_set(skb))
 267                         goto err;
 268                 offset = skb_mac_header(skb) - skb->data;
 269                 break;
 270         case NFT_PAYLOAD_NETWORK_HEADER:
 271                 offset = skb_network_offset(skb);
 272                 break;
 273         case NFT_PAYLOAD_TRANSPORT_HEADER:
 274                 if (!pkt->tprot_set)
 275                         goto err;
 276                 offset = pkt->xt.thoff;
 277                 break;
 278         default:
 279                 BUG();
 280         }
 281
 282         csum_offset = offset + priv->csum_offset;
 283         offset += priv->offset;
 284
 285         if (priv->csum_type == NFT_PAYLOAD_CSUM_INET &&
 286             (priv->base != NFT_PAYLOAD_TRANSPORT_HEADER ||
 287              skb->ip_summed != CHECKSUM_PARTIAL)) {
 288                 if (skb_copy_bits(skb, csum_offset, &sum, sizeof(sum)) < 0)
 289                         goto err;
 290
 291                 fsum = skb_checksum(skb, offset, priv->len, 0);
 292                 tsum = csum_partial(src, priv->len, 0);
 293                 nft_csum_replace(&sum, fsum, tsum);
 294
 295                 if (!skb_make_writable(skb, csum_offset + sizeof(sum)) ||
 296                     skb_store_bits(skb, csum_offset, &sum, sizeof(sum)) < 0)
 297                         goto err;
 298
 299                 if (priv->csum_flags &&
 300                     nft_payload_l4csum_update(pkt, skb, fsum, tsum) < 0)
 301                         goto err;
 302         }
 303
 304         if (!skb_make_writable(skb, max(offset + priv->len, 0)) ||
 305             skb_store_bits(skb, offset, src, priv->len) < 0)
 306                 goto err;
 307
 308         return;
 309 err:
 310         regs->verdict.code = NFT_BREAK;
 311 }
 312
 313 static int nft_payload_set_init(const struct nft_ctx *ctx,
 314                                 const struct nft_expr *expr,
 315                                 const struct nlattr * const tb[])
 316 {
 317         struct nft_payload_set *priv = nft_expr_priv(expr);
 318
 319         priv->base        = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE]));
 320         priv->offset      = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET]));
 321         priv->len         = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));
 322         priv->sreg        = nft_parse_register(tb[NFTA_PAYLOAD_SREG]);
 323
 324         if (tb[NFTA_PAYLOAD_CSUM_TYPE])
 325                 priv->csum_type =
 326                         ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_TYPE]));
 327         if (tb[NFTA_PAYLOAD_CSUM_OFFSET])
 328                 priv->csum_offset =
 329                         ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_OFFSET]));
 330         if (tb[NFTA_PAYLOAD_CSUM_FLAGS]) {
 331                 u32 flags;
 332
 333                 flags = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_FLAGS]));
 334                 if (flags & ~NFT_PAYLOAD_L4CSUM_PSEUDOHDR)
 335                         return -EINVAL;
 336
 337                 priv->csum_flags = flags;
 338         }
 339
 340         switch (priv->csum_type) {
 341         case NFT_PAYLOAD_CSUM_NONE:
 342         case NFT_PAYLOAD_CSUM_INET:
 343                 break;
 344         default:
 345                 return -EOPNOTSUPP;
 346         }
 347
 348         return nft_validate_register_load(priv->sreg, priv->len);
 349 }
 350
 351 static int nft_payload_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
 352 {
 353         const struct nft_payload_set *priv = nft_expr_priv(expr);
 354
 355         if (nft_dump_register(skb, NFTA_PAYLOAD_SREG, priv->sreg) ||
 356             nla_put_be32(skb, NFTA_PAYLOAD_BASE, htonl(priv->base)) ||
 357             nla_put_be32(skb, NFTA_PAYLOAD_OFFSET, htonl(priv->offset)) ||
 358             nla_put_be32(skb, NFTA_PAYLOAD_LEN, htonl(priv->len)) ||
 359             nla_put_be32(skb, NFTA_PAYLOAD_CSUM_TYPE, htonl(priv->csum_type)) ||
 360             nla_put_be32(skb, NFTA_PAYLOAD_CSUM_OFFSET,
 361                          htonl(priv->csum_offset)) ||
 362             nla_put_be32(skb, NFTA_PAYLOAD_CSUM_FLAGS, htonl(priv->csum_flags)))
 363                 goto nla_put_failure;
 364         return 0;
 365
 366 nla_put_failure:
 367         return -1;
 368 }
 369
 370 static const struct nft_expr_ops nft_payload_set_ops = {
 371         .type           = &nft_payload_type,
 372         .size           = NFT_EXPR_SIZE(sizeof(struct nft_payload_set)),
 373         .eval           = nft_payload_set_eval,
 374         .init           = nft_payload_set_init,
 375         .dump           = nft_payload_set_dump,
 376 };
 377
 378 static const struct nft_expr_ops *
 379 nft_payload_select_ops(const struct nft_ctx *ctx,
 380                        const struct nlattr * const tb[])
 381 {
 382         enum nft_payload_bases base;
 383         unsigned int offset, len;
 384
 385         if (tb[NFTA_PAYLOAD_BASE] == NULL ||
 386             tb[NFTA_PAYLOAD_OFFSET] == NULL ||
 387             tb[NFTA_PAYLOAD_LEN] == NULL)
 388                 return ERR_PTR(-EINVAL);
 389
 390         base = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE]));
 391         switch (base) {
 392         case NFT_PAYLOAD_LL_HEADER:
 393         case NFT_PAYLOAD_NETWORK_HEADER:
 394         case NFT_PAYLOAD_TRANSPORT_HEADER:
 395                 break;
 396         default:
 397                 return ERR_PTR(-EOPNOTSUPP);
 398         }
 399
 400         if (tb[NFTA_PAYLOAD_SREG] != NULL) {
 401                 if (tb[NFTA_PAYLOAD_DREG] != NULL)
 402                         return ERR_PTR(-EINVAL);
 403                 return &nft_payload_set_ops;
 404         }
 405
 406         if (tb[NFTA_PAYLOAD_DREG] == NULL)
 407                 return ERR_PTR(-EINVAL);
 408
 409         offset = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET]));
 410         len    = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));
 411
 412         if (len <= 4 && is_power_of_2(len) && IS_ALIGNED(offset, len) &&
 413             base != NFT_PAYLOAD_LL_HEADER)
 414                 return &nft_payload_fast_ops;
 415         else
 416                 return &nft_payload_ops;
 417 }
 418
 419 struct nft_expr_type nft_payload_type __read_mostly = {
 420         .name           = "payload",
 421         .select_ops     = nft_payload_select_ops,
 422         .policy         = nft_payload_policy,
 423         .maxattr        = NFTA_PAYLOAD_MAX,
 424         .owner          = THIS_MODULE,
 425 };