nft_fib_ipv4.c 4.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. #include <linux/kernel.h>
  3. #include <linux/init.h>
  4. #include <linux/module.h>
  5. #include <linux/netlink.h>
  6. #include <linux/netfilter.h>
  7. #include <linux/netfilter/nf_tables.h>
  8. #include <net/netfilter/nf_tables_core.h>
  9. #include <net/netfilter/nf_tables.h>
  10. #include <net/netfilter/nft_fib.h>
  11. #include <net/ip_fib.h>
  12. #include <net/route.h>
  13. /* don't try to find route from mcast/bcast/zeronet */
  14. static __be32 get_saddr(__be32 addr)
  15. {
  16. if (ipv4_is_multicast(addr) || ipv4_is_lbcast(addr) ||
  17. ipv4_is_zeronet(addr))
  18. return 0;
  19. return addr;
  20. }
  21. #define DSCP_BITS 0xfc
  22. void nft_fib4_eval_type(const struct nft_expr *expr, struct nft_regs *regs,
  23. const struct nft_pktinfo *pkt)
  24. {
  25. const struct nft_fib *priv = nft_expr_priv(expr);
  26. int noff = skb_network_offset(pkt->skb);
  27. u32 *dst = &regs->data[priv->dreg];
  28. const struct net_device *dev = NULL;
  29. struct iphdr *iph, _iph;
  30. __be32 addr;
  31. if (priv->flags & NFTA_FIB_F_IIF)
  32. dev = nft_in(pkt);
  33. else if (priv->flags & NFTA_FIB_F_OIF)
  34. dev = nft_out(pkt);
  35. iph = skb_header_pointer(pkt->skb, noff, sizeof(_iph), &_iph);
  36. if (!iph) {
  37. regs->verdict.code = NFT_BREAK;
  38. return;
  39. }
  40. if (priv->flags & NFTA_FIB_F_DADDR)
  41. addr = iph->daddr;
  42. else
  43. addr = iph->saddr;
  44. *dst = inet_dev_addr_type(nft_net(pkt), dev, addr);
  45. }
  46. EXPORT_SYMBOL_GPL(nft_fib4_eval_type);
  47. void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
  48. const struct nft_pktinfo *pkt)
  49. {
  50. const struct nft_fib *priv = nft_expr_priv(expr);
  51. int noff = skb_network_offset(pkt->skb);
  52. u32 *dest = &regs->data[priv->dreg];
  53. struct iphdr *iph, _iph;
  54. struct fib_result res;
  55. struct flowi4 fl4 = {
  56. .flowi4_scope = RT_SCOPE_UNIVERSE,
  57. .flowi4_iif = LOOPBACK_IFINDEX,
  58. };
  59. const struct net_device *oif;
  60. const struct net_device *found;
  61. /*
  62. * Do not set flowi4_oif, it restricts results (for example, asking
  63. * for oif 3 will get RTN_UNICAST result even if the daddr exits
  64. * on another interface.
  65. *
  66. * Search results for the desired outinterface instead.
  67. */
  68. if (priv->flags & NFTA_FIB_F_OIF)
  69. oif = nft_out(pkt);
  70. else if (priv->flags & NFTA_FIB_F_IIF)
  71. oif = nft_in(pkt);
  72. else
  73. oif = NULL;
  74. if (nft_hook(pkt) == NF_INET_PRE_ROUTING &&
  75. nft_fib_is_loopback(pkt->skb, nft_in(pkt))) {
  76. nft_fib_store_result(dest, priv, nft_in(pkt));
  77. return;
  78. }
  79. iph = skb_header_pointer(pkt->skb, noff, sizeof(_iph), &_iph);
  80. if (!iph) {
  81. regs->verdict.code = NFT_BREAK;
  82. return;
  83. }
  84. if (ipv4_is_zeronet(iph->saddr)) {
  85. if (ipv4_is_lbcast(iph->daddr) ||
  86. ipv4_is_local_multicast(iph->daddr)) {
  87. nft_fib_store_result(dest, priv, pkt->skb->dev);
  88. return;
  89. }
  90. }
  91. if (priv->flags & NFTA_FIB_F_MARK)
  92. fl4.flowi4_mark = pkt->skb->mark;
  93. fl4.flowi4_tos = iph->tos & DSCP_BITS;
  94. if (priv->flags & NFTA_FIB_F_DADDR) {
  95. fl4.daddr = iph->daddr;
  96. fl4.saddr = get_saddr(iph->saddr);
  97. } else {
  98. fl4.daddr = iph->saddr;
  99. fl4.saddr = get_saddr(iph->daddr);
  100. }
  101. *dest = 0;
  102. if (fib_lookup(nft_net(pkt), &fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE))
  103. return;
  104. switch (res.type) {
  105. case RTN_UNICAST:
  106. break;
  107. case RTN_LOCAL: /* Should not see RTN_LOCAL here */
  108. return;
  109. default:
  110. break;
  111. }
  112. if (!oif) {
  113. found = FIB_RES_DEV(res);
  114. } else {
  115. if (!fib_info_nh_uses_dev(res.fi, oif))
  116. return;
  117. found = oif;
  118. }
  119. nft_fib_store_result(dest, priv, found);
  120. }
  121. EXPORT_SYMBOL_GPL(nft_fib4_eval);
  122. static struct nft_expr_type nft_fib4_type;
  123. static const struct nft_expr_ops nft_fib4_type_ops = {
  124. .type = &nft_fib4_type,
  125. .size = NFT_EXPR_SIZE(sizeof(struct nft_fib)),
  126. .eval = nft_fib4_eval_type,
  127. .init = nft_fib_init,
  128. .dump = nft_fib_dump,
  129. .validate = nft_fib_validate,
  130. };
  131. static const struct nft_expr_ops nft_fib4_ops = {
  132. .type = &nft_fib4_type,
  133. .size = NFT_EXPR_SIZE(sizeof(struct nft_fib)),
  134. .eval = nft_fib4_eval,
  135. .init = nft_fib_init,
  136. .dump = nft_fib_dump,
  137. .validate = nft_fib_validate,
  138. };
  139. static const struct nft_expr_ops *
  140. nft_fib4_select_ops(const struct nft_ctx *ctx,
  141. const struct nlattr * const tb[])
  142. {
  143. enum nft_fib_result result;
  144. if (!tb[NFTA_FIB_RESULT])
  145. return ERR_PTR(-EINVAL);
  146. result = ntohl(nla_get_be32(tb[NFTA_FIB_RESULT]));
  147. switch (result) {
  148. case NFT_FIB_RESULT_OIF:
  149. return &nft_fib4_ops;
  150. case NFT_FIB_RESULT_OIFNAME:
  151. return &nft_fib4_ops;
  152. case NFT_FIB_RESULT_ADDRTYPE:
  153. return &nft_fib4_type_ops;
  154. default:
  155. return ERR_PTR(-EOPNOTSUPP);
  156. }
  157. }
  158. static struct nft_expr_type nft_fib4_type __read_mostly = {
  159. .name = "fib",
  160. .select_ops = nft_fib4_select_ops,
  161. .policy = nft_fib_policy,
  162. .maxattr = NFTA_FIB_MAX,
  163. .family = NFPROTO_IPV4,
  164. .owner = THIS_MODULE,
  165. };
  166. static int __init nft_fib4_module_init(void)
  167. {
  168. return nft_register_expr(&nft_fib4_type);
  169. }
  170. static void __exit nft_fib4_module_exit(void)
  171. {
  172. nft_unregister_expr(&nft_fib4_type);
  173. }
  174. module_init(nft_fib4_module_init);
  175. module_exit(nft_fib4_module_exit);
  176. MODULE_LICENSE("GPL");
  177. MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
  178. MODULE_ALIAS_NFT_AF_EXPR(2, "fib");
  179. MODULE_DESCRIPTION("nftables fib / ip route lookup support");