nft_xfrm.c 6.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. *
  4. * Generic part shared by ipv4 and ipv6 backends.
  5. */
  6. #include <linux/kernel.h>
  7. #include <linux/init.h>
  8. #include <linux/module.h>
  9. #include <linux/netlink.h>
  10. #include <linux/netfilter.h>
  11. #include <linux/netfilter/nf_tables.h>
  12. #include <net/netfilter/nf_tables_core.h>
  13. #include <net/netfilter/nf_tables.h>
  14. #include <linux/in.h>
  15. #include <net/xfrm.h>
  16. static const struct nla_policy nft_xfrm_policy[NFTA_XFRM_MAX + 1] = {
  17. [NFTA_XFRM_KEY] = { .type = NLA_U32 },
  18. [NFTA_XFRM_DIR] = { .type = NLA_U8 },
  19. [NFTA_XFRM_SPNUM] = { .type = NLA_U32 },
  20. [NFTA_XFRM_DREG] = { .type = NLA_U32 },
  21. };
  22. struct nft_xfrm {
  23. enum nft_xfrm_keys key:8;
  24. enum nft_registers dreg:8;
  25. u8 dir;
  26. u8 spnum;
  27. };
  28. static int nft_xfrm_get_init(const struct nft_ctx *ctx,
  29. const struct nft_expr *expr,
  30. const struct nlattr * const tb[])
  31. {
  32. struct nft_xfrm *priv = nft_expr_priv(expr);
  33. unsigned int len = 0;
  34. u32 spnum = 0;
  35. u8 dir;
  36. if (!tb[NFTA_XFRM_KEY] || !tb[NFTA_XFRM_DIR] || !tb[NFTA_XFRM_DREG])
  37. return -EINVAL;
  38. switch (ctx->family) {
  39. case NFPROTO_IPV4:
  40. case NFPROTO_IPV6:
  41. case NFPROTO_INET:
  42. break;
  43. default:
  44. return -EOPNOTSUPP;
  45. }
  46. priv->key = ntohl(nla_get_u32(tb[NFTA_XFRM_KEY]));
  47. switch (priv->key) {
  48. case NFT_XFRM_KEY_REQID:
  49. case NFT_XFRM_KEY_SPI:
  50. len = sizeof(u32);
  51. break;
  52. case NFT_XFRM_KEY_DADDR_IP4:
  53. case NFT_XFRM_KEY_SADDR_IP4:
  54. len = sizeof(struct in_addr);
  55. break;
  56. case NFT_XFRM_KEY_DADDR_IP6:
  57. case NFT_XFRM_KEY_SADDR_IP6:
  58. len = sizeof(struct in6_addr);
  59. break;
  60. default:
  61. return -EINVAL;
  62. }
  63. dir = nla_get_u8(tb[NFTA_XFRM_DIR]);
  64. switch (dir) {
  65. case XFRM_POLICY_IN:
  66. case XFRM_POLICY_OUT:
  67. priv->dir = dir;
  68. break;
  69. default:
  70. return -EINVAL;
  71. }
  72. if (tb[NFTA_XFRM_SPNUM])
  73. spnum = ntohl(nla_get_be32(tb[NFTA_XFRM_SPNUM]));
  74. if (spnum >= XFRM_MAX_DEPTH)
  75. return -ERANGE;
  76. priv->spnum = spnum;
  77. priv->dreg = nft_parse_register(tb[NFTA_XFRM_DREG]);
  78. return nft_validate_register_store(ctx, priv->dreg, NULL,
  79. NFT_DATA_VALUE, len);
  80. }
  81. /* Return true if key asks for daddr/saddr and current
  82. * state does have a valid address (BEET, TUNNEL).
  83. */
  84. static bool xfrm_state_addr_ok(enum nft_xfrm_keys k, u8 family, u8 mode)
  85. {
  86. switch (k) {
  87. case NFT_XFRM_KEY_DADDR_IP4:
  88. case NFT_XFRM_KEY_SADDR_IP4:
  89. if (family == NFPROTO_IPV4)
  90. break;
  91. return false;
  92. case NFT_XFRM_KEY_DADDR_IP6:
  93. case NFT_XFRM_KEY_SADDR_IP6:
  94. if (family == NFPROTO_IPV6)
  95. break;
  96. return false;
  97. default:
  98. return true;
  99. }
  100. return mode == XFRM_MODE_BEET || mode == XFRM_MODE_TUNNEL;
  101. }
  102. static void nft_xfrm_state_get_key(const struct nft_xfrm *priv,
  103. struct nft_regs *regs,
  104. const struct xfrm_state *state)
  105. {
  106. u32 *dest = &regs->data[priv->dreg];
  107. if (!xfrm_state_addr_ok(priv->key,
  108. state->props.family,
  109. state->props.mode)) {
  110. regs->verdict.code = NFT_BREAK;
  111. return;
  112. }
  113. switch (priv->key) {
  114. case NFT_XFRM_KEY_UNSPEC:
  115. case __NFT_XFRM_KEY_MAX:
  116. WARN_ON_ONCE(1);
  117. break;
  118. case NFT_XFRM_KEY_DADDR_IP4:
  119. *dest = state->id.daddr.a4;
  120. return;
  121. case NFT_XFRM_KEY_DADDR_IP6:
  122. memcpy(dest, &state->id.daddr.in6, sizeof(struct in6_addr));
  123. return;
  124. case NFT_XFRM_KEY_SADDR_IP4:
  125. *dest = state->props.saddr.a4;
  126. return;
  127. case NFT_XFRM_KEY_SADDR_IP6:
  128. memcpy(dest, &state->props.saddr.in6, sizeof(struct in6_addr));
  129. return;
  130. case NFT_XFRM_KEY_REQID:
  131. *dest = state->props.reqid;
  132. return;
  133. case NFT_XFRM_KEY_SPI:
  134. *dest = state->id.spi;
  135. return;
  136. }
  137. regs->verdict.code = NFT_BREAK;
  138. }
  139. static void nft_xfrm_get_eval_in(const struct nft_xfrm *priv,
  140. struct nft_regs *regs,
  141. const struct nft_pktinfo *pkt)
  142. {
  143. const struct sec_path *sp = skb_sec_path(pkt->skb);
  144. const struct xfrm_state *state;
  145. if (sp == NULL || sp->len <= priv->spnum) {
  146. regs->verdict.code = NFT_BREAK;
  147. return;
  148. }
  149. state = sp->xvec[priv->spnum];
  150. nft_xfrm_state_get_key(priv, regs, state);
  151. }
  152. static void nft_xfrm_get_eval_out(const struct nft_xfrm *priv,
  153. struct nft_regs *regs,
  154. const struct nft_pktinfo *pkt)
  155. {
  156. const struct dst_entry *dst = skb_dst(pkt->skb);
  157. int i;
  158. for (i = 0; dst && dst->xfrm;
  159. dst = ((const struct xfrm_dst *)dst)->child, i++) {
  160. if (i < priv->spnum)
  161. continue;
  162. nft_xfrm_state_get_key(priv, regs, dst->xfrm);
  163. return;
  164. }
  165. regs->verdict.code = NFT_BREAK;
  166. }
  167. static void nft_xfrm_get_eval(const struct nft_expr *expr,
  168. struct nft_regs *regs,
  169. const struct nft_pktinfo *pkt)
  170. {
  171. const struct nft_xfrm *priv = nft_expr_priv(expr);
  172. switch (priv->dir) {
  173. case XFRM_POLICY_IN:
  174. nft_xfrm_get_eval_in(priv, regs, pkt);
  175. break;
  176. case XFRM_POLICY_OUT:
  177. nft_xfrm_get_eval_out(priv, regs, pkt);
  178. break;
  179. default:
  180. WARN_ON_ONCE(1);
  181. regs->verdict.code = NFT_BREAK;
  182. break;
  183. }
  184. }
  185. static int nft_xfrm_get_dump(struct sk_buff *skb,
  186. const struct nft_expr *expr)
  187. {
  188. const struct nft_xfrm *priv = nft_expr_priv(expr);
  189. if (nft_dump_register(skb, NFTA_XFRM_DREG, priv->dreg))
  190. return -1;
  191. if (nla_put_be32(skb, NFTA_XFRM_KEY, htonl(priv->key)))
  192. return -1;
  193. if (nla_put_u8(skb, NFTA_XFRM_DIR, priv->dir))
  194. return -1;
  195. if (nla_put_be32(skb, NFTA_XFRM_SPNUM, htonl(priv->spnum)))
  196. return -1;
  197. return 0;
  198. }
  199. static int nft_xfrm_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
  200. const struct nft_data **data)
  201. {
  202. const struct nft_xfrm *priv = nft_expr_priv(expr);
  203. unsigned int hooks;
  204. switch (priv->dir) {
  205. case XFRM_POLICY_IN:
  206. hooks = (1 << NF_INET_FORWARD) |
  207. (1 << NF_INET_LOCAL_IN) |
  208. (1 << NF_INET_PRE_ROUTING);
  209. break;
  210. case XFRM_POLICY_OUT:
  211. hooks = (1 << NF_INET_FORWARD) |
  212. (1 << NF_INET_LOCAL_OUT) |
  213. (1 << NF_INET_POST_ROUTING);
  214. break;
  215. default:
  216. WARN_ON_ONCE(1);
  217. return -EINVAL;
  218. }
  219. return nft_chain_validate_hooks(ctx->chain, hooks);
  220. }
  221. static struct nft_expr_type nft_xfrm_type;
  222. static const struct nft_expr_ops nft_xfrm_get_ops = {
  223. .type = &nft_xfrm_type,
  224. .size = NFT_EXPR_SIZE(sizeof(struct nft_xfrm)),
  225. .eval = nft_xfrm_get_eval,
  226. .init = nft_xfrm_get_init,
  227. .dump = nft_xfrm_get_dump,
  228. .validate = nft_xfrm_validate,
  229. };
  230. static struct nft_expr_type nft_xfrm_type __read_mostly = {
  231. .name = "xfrm",
  232. .ops = &nft_xfrm_get_ops,
  233. .policy = nft_xfrm_policy,
  234. .maxattr = NFTA_XFRM_MAX,
  235. .owner = THIS_MODULE,
  236. };
  237. static int __init nft_xfrm_module_init(void)
  238. {
  239. return nft_register_expr(&nft_xfrm_type);
  240. }
  241. static void __exit nft_xfrm_module_exit(void)
  242. {
  243. nft_unregister_expr(&nft_xfrm_type);
  244. }
  245. module_init(nft_xfrm_module_init);
  246. module_exit(nft_xfrm_module_exit);
  247. MODULE_LICENSE("GPL");
  248. MODULE_DESCRIPTION("nf_tables: xfrm/IPSec matching");
  249. MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
  250. MODULE_AUTHOR("Máté Eckl <ecklm94@gmail.com>");
  251. MODULE_ALIAS_NFT_EXPR("xfrm");