net/netfilter/nf_tables_netdev.c

   1 /*
   2  * Copyright (c) 2015 Pablo Neira Ayuso <pablo@netfilter.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8
   9 #include <linux/init.h>
  10 #include <linux/module.h>
  11 #include <linux/netdevice.h>
  12 #include <net/netfilter/nf_tables.h>
  13 #include <linux/ip.h>
  14 #include <linux/ipv6.h>
  15 #include <net/netfilter/nf_tables_ipv4.h>
  16 #include <net/netfilter/nf_tables_ipv6.h>
  17
  18 static inline void
  19 nft_netdev_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
  20                             const struct nf_hook_ops *ops, struct sk_buff *skb,
  21                             const struct nf_hook_state *state)
  22 {
  23         struct iphdr *iph, _iph;
  24         u32 len, thoff;
  25
  26         nft_set_pktinfo(pkt, ops, skb, state);
  27
  28         iph = skb_header_pointer(skb, skb_network_offset(skb), sizeof(*iph),
  29                                  &_iph);
  30         if (!iph)
  31                 return;
  32
  33         iph = ip_hdr(skb);
  34         if (iph->ihl < 5 || iph->version != 4)
  35                 return;
  36
  37         len = ntohs(iph->tot_len);
  38         thoff = iph->ihl * 4;
  39         if (skb->len < len)
  40                 return;
  41         else if (len < thoff)
  42                 return;
  43
  44         pkt->tprot = iph->protocol;
  45         pkt->xt.thoff = thoff;
  46         pkt->xt.fragoff = ntohs(iph->frag_off) & IP_OFFSET;
  47 }
  48
  49 static inline void
  50 __nft_netdev_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
  51                               const struct nf_hook_ops *ops,
  52                               struct sk_buff *skb,
  53                               const struct nf_hook_state *state)
  54 {
  55 #if IS_ENABLED(CONFIG_IPV6)
  56         struct ipv6hdr *ip6h, _ip6h;
  57         unsigned int thoff = 0;
  58         unsigned short frag_off;
  59         int protohdr;
  60         u32 pkt_len;
  61
  62         ip6h = skb_header_pointer(skb, skb_network_offset(skb), sizeof(*ip6h),
  63                                   &_ip6h);
  64         if (!ip6h)
  65                 return;
  66
  67         if (ip6h->version != 6)
  68                 return;
  69
  70         pkt_len = ntohs(ip6h->payload_len);
  71         if (pkt_len + sizeof(*ip6h) > skb->len)
  72                 return;
  73
  74         protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, NULL);
  75         if (protohdr < 0)
  76                 return;
  77
  78         pkt->tprot = protohdr;
  79         pkt->xt.thoff = thoff;
  80         pkt->xt.fragoff = frag_off;
  81 #endif
  82 }
  83
  84 static inline void nft_netdev_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
  85                                                const struct nf_hook_ops *ops,
  86                                                struct sk_buff *skb,
  87                                                const struct nf_hook_state *state)
  88 {
  89         nft_set_pktinfo(pkt, ops, skb, state);
  90         __nft_netdev_set_pktinfo_ipv6(pkt, ops, skb, state);
  91 }
  92
  93 static unsigned int
  94 nft_do_chain_netdev(const struct nf_hook_ops *ops, struct sk_buff *skb,
  95                     const struct nf_hook_state *state)
  96 {
  97         struct nft_pktinfo pkt;
  98
  99         switch (eth_hdr(skb)->h_proto) {
 100         case htons(ETH_P_IP):
 101                 nft_netdev_set_pktinfo_ipv4(&pkt, ops, skb, state);
 102                 break;
 103         case htons(ETH_P_IPV6):
 104                 nft_netdev_set_pktinfo_ipv6(&pkt, ops, skb, state);
 105                 break;
 106         default:
 107                 nft_set_pktinfo(&pkt, ops, skb, state);
 108                 break;
 109         }
 110
 111         return nft_do_chain(&pkt, ops);
 112 }
 113
 114 static struct nft_af_info nft_af_netdev __read_mostly = {
 115         .family         = NFPROTO_NETDEV,
 116         .nhooks         = NF_NETDEV_NUMHOOKS,
 117         .owner          = THIS_MODULE,
 118         .flags          = NFT_AF_NEEDS_DEV,
 119         .nops           = 1,
 120         .hooks          = {
 121                 [NF_NETDEV_INGRESS]     = nft_do_chain_netdev,
 122         },
 123 };
 124
 125 static int nf_tables_netdev_init_net(struct net *net)
 126 {
 127         net->nft.netdev = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);
 128         if (net->nft.netdev == NULL)
 129                 return -ENOMEM;
 130
 131         memcpy(net->nft.netdev, &nft_af_netdev, sizeof(nft_af_netdev));
 132
 133         if (nft_register_afinfo(net, net->nft.netdev) < 0)
 134                 goto err;
 135
 136         return 0;
 137 err:
 138         kfree(net->nft.netdev);
 139         return -ENOMEM;
 140 }
 141
 142 static void nf_tables_netdev_exit_net(struct net *net)
 143 {
 144         nft_unregister_afinfo(net->nft.netdev);
 145         kfree(net->nft.netdev);
 146 }
 147
 148 static struct pernet_operations nf_tables_netdev_net_ops = {
 149         .init   = nf_tables_netdev_init_net,
 150         .exit   = nf_tables_netdev_exit_net,
 151 };
 152
 153 static const struct nf_chain_type nft_filter_chain_netdev = {
 154         .name           = "filter",
 155         .type           = NFT_CHAIN_T_DEFAULT,
 156         .family         = NFPROTO_NETDEV,
 157         .owner          = THIS_MODULE,
 158         .hook_mask      = (1 << NF_NETDEV_INGRESS),
 159 };
 160
 161 static void nft_netdev_event(unsigned long event, struct nft_af_info *afi,
 162                              struct net_device *dev, struct nft_table *table,
 163                              struct nft_base_chain *basechain)
 164 {
 165         switch (event) {
 166         case NETDEV_REGISTER:
 167                 if (strcmp(basechain->dev_name, dev->name) != 0)
 168                         return;
 169
 170                 BUG_ON(!(basechain->flags & NFT_BASECHAIN_DISABLED));
 171
 172                 dev_hold(dev);
 173                 basechain->ops[0].dev = dev;
 174                 basechain->flags &= ~NFT_BASECHAIN_DISABLED;
 175                 if (!(table->flags & NFT_TABLE_F_DORMANT))
 176                         nft_register_basechain(basechain, afi->nops);
 177                 break;
 178         case NETDEV_UNREGISTER:
 179                 if (strcmp(basechain->dev_name, dev->name) != 0)
 180                         return;
 181
 182                 BUG_ON(basechain->flags & NFT_BASECHAIN_DISABLED);
 183
 184                 if (!(table->flags & NFT_TABLE_F_DORMANT))
 185                         nft_unregister_basechain(basechain, afi->nops);
 186
 187                 dev_put(basechain->ops[0].dev);
 188                 basechain->ops[0].dev = NULL;
 189                 basechain->flags |= NFT_BASECHAIN_DISABLED;
 190                 break;
 191         case NETDEV_CHANGENAME:
 192                 if (dev->ifindex != basechain->ops[0].dev->ifindex)
 193                         return;
 194
 195                 strncpy(basechain->dev_name, dev->name, IFNAMSIZ);
 196                 break;
 197         }
 198 }
 199
 200 static int nf_tables_netdev_event(struct notifier_block *this,
 201                                   unsigned long event, void *ptr)
 202 {
 203         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 204         struct nft_af_info *afi;
 205         struct nft_table *table;
 206         struct nft_chain *chain;
 207
 208         nfnl_lock(NFNL_SUBSYS_NFTABLES);
 209         list_for_each_entry(afi, &dev_net(dev)->nft.af_info, list) {
 210                 if (afi->family != NFPROTO_NETDEV)
 211                         continue;
 212
 213                 list_for_each_entry(table, &afi->tables, list) {
 214                         list_for_each_entry(chain, &table->chains, list) {
 215                                 if (!(chain->flags & NFT_BASE_CHAIN))
 216                                         continue;
 217
 218                                 nft_netdev_event(event, afi, dev, table,
 219                                                  nft_base_chain(chain));
 220                         }
 221                 }
 222         }
 223         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
 224
 225         return NOTIFY_DONE;
 226 }
 227
 228 static struct notifier_block nf_tables_netdev_notifier = {
 229         .notifier_call  = nf_tables_netdev_event,
 230 };
 231
 232 static int __init nf_tables_netdev_init(void)
 233 {
 234         int ret;
 235
 236         nft_register_chain_type(&nft_filter_chain_netdev);
 237         ret = register_pernet_subsys(&nf_tables_netdev_net_ops);
 238         if (ret < 0)
 239                 nft_unregister_chain_type(&nft_filter_chain_netdev);
 240
 241         register_netdevice_notifier(&nf_tables_netdev_notifier);
 242
 243         return ret;
 244 }
 245
 246 static void __exit nf_tables_netdev_exit(void)
 247 {
 248         unregister_netdevice_notifier(&nf_tables_netdev_notifier);
 249         unregister_pernet_subsys(&nf_tables_netdev_net_ops);
 250         nft_unregister_chain_type(&nft_filter_chain_netdev);
 251 }
 252
 253 module_init(nf_tables_netdev_init);
 254 module_exit(nf_tables_netdev_exit);
 255
 256 MODULE_LICENSE("GPL");
 257 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
 258 MODULE_ALIAS_NFT_FAMILY(5); /* NFPROTO_NETDEV */