2 * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * This software has been sponsored by Sophos Astaro <http://www.sophos.com>
11 #include <linux/kernel.h>
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/netlink.h>
15 #include <linux/netfilter.h>
16 #include <linux/netfilter/nfnetlink.h>
17 #include <linux/netfilter/nf_tables.h>
18 #include <linux/netfilter/nf_tables_compat.h>
19 #include <linux/netfilter/x_tables.h>
20 #include <linux/netfilter_ipv4/ip_tables.h>
21 #include <linux/netfilter_ipv6/ip6_tables.h>
22 #include <asm/uaccess.h> /* for set_fs */
23 #include <net/netfilter/nf_tables.h>
31 nft_compat_set_par(struct xt_action_param
*par
, void *xt
, const void *xt_info
)
34 par
->targinfo
= xt_info
;
38 static void nft_target_eval(const struct nft_expr
*expr
,
39 struct nft_data data
[NFT_REG_MAX
+ 1],
40 const struct nft_pktinfo
*pkt
)
42 void *info
= nft_expr_priv(expr
);
43 struct xt_target
*target
= expr
->ops
->data
;
44 struct sk_buff
*skb
= pkt
->skb
;
47 nft_compat_set_par((struct xt_action_param
*)&pkt
->xt
, target
, info
);
49 ret
= target
->target(skb
, &pkt
->xt
);
56 data
[NFT_REG_VERDICT
].verdict
= NFT_CONTINUE
;
59 data
[NFT_REG_VERDICT
].verdict
= ret
;
65 static const struct nla_policy nft_target_policy
[NFTA_TARGET_MAX
+ 1] = {
66 [NFTA_TARGET_NAME
] = { .type
= NLA_NUL_STRING
},
67 [NFTA_TARGET_REV
] = { .type
= NLA_U32
},
68 [NFTA_TARGET_INFO
] = { .type
= NLA_BINARY
},
72 nft_target_set_tgchk_param(struct xt_tgchk_param
*par
,
73 const struct nft_ctx
*ctx
,
74 struct xt_target
*target
, void *info
,
75 union nft_entry
*entry
, u8 proto
, bool inv
)
78 par
->table
= ctx
->table
->name
;
79 switch (ctx
->afi
->family
) {
81 entry
->e4
.ip
.proto
= proto
;
82 entry
->e4
.ip
.invflags
= inv
? IPT_INV_PROTO
: 0;
85 entry
->e6
.ipv6
.proto
= proto
;
86 entry
->e6
.ipv6
.invflags
= inv
? IP6T_INV_PROTO
: 0;
89 par
->entryinfo
= entry
;
92 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
93 const struct nft_base_chain
*basechain
=
94 nft_base_chain(ctx
->chain
);
95 const struct nf_hook_ops
*ops
= &basechain
->ops
;
97 par
->hook_mask
= 1 << ops
->hooknum
;
99 par
->family
= ctx
->afi
->family
;
102 static void target_compat_from_user(struct xt_target
*t
, void *in
, void *out
)
105 if (t
->compat_from_user
) {
108 t
->compat_from_user(out
, in
);
109 pad
= XT_ALIGN(t
->targetsize
) - t
->targetsize
;
111 memset(out
+ t
->targetsize
, 0, pad
);
114 memcpy(out
, in
, XT_ALIGN(t
->targetsize
));
117 static inline int nft_compat_target_offset(struct xt_target
*target
)
120 return xt_compat_target_offset(target
);
126 static const struct nla_policy nft_rule_compat_policy
[NFTA_RULE_COMPAT_MAX
+ 1] = {
127 [NFTA_RULE_COMPAT_PROTO
] = { .type
= NLA_U32
},
128 [NFTA_RULE_COMPAT_FLAGS
] = { .type
= NLA_U32
},
131 static u8
nft_parse_compat(const struct nlattr
*attr
, bool *inv
)
133 struct nlattr
*tb
[NFTA_RULE_COMPAT_MAX
+1];
137 err
= nla_parse_nested(tb
, NFTA_RULE_COMPAT_MAX
, attr
,
138 nft_rule_compat_policy
);
142 if (!tb
[NFTA_RULE_COMPAT_PROTO
] || !tb
[NFTA_RULE_COMPAT_FLAGS
])
145 flags
= ntohl(nla_get_be32(tb
[NFTA_RULE_COMPAT_FLAGS
]));
146 if (flags
& ~NFT_RULE_COMPAT_F_MASK
)
148 if (flags
& NFT_RULE_COMPAT_F_INV
)
151 return ntohl(nla_get_be32(tb
[NFTA_RULE_COMPAT_PROTO
]));
155 nft_target_init(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
,
156 const struct nlattr
* const tb
[])
158 void *info
= nft_expr_priv(expr
);
159 struct xt_target
*target
= expr
->ops
->data
;
160 struct xt_tgchk_param par
;
161 size_t size
= XT_ALIGN(nla_len(tb
[NFTA_TARGET_INFO
]));
164 union nft_entry e
= {};
167 target_compat_from_user(target
, nla_data(tb
[NFTA_TARGET_INFO
]), info
);
169 if (ctx
->nla
[NFTA_RULE_COMPAT
])
170 proto
= nft_parse_compat(ctx
->nla
[NFTA_RULE_COMPAT
], &inv
);
172 nft_target_set_tgchk_param(&par
, ctx
, target
, info
, &e
, proto
, inv
);
174 ret
= xt_check_target(&par
, size
, proto
, inv
);
178 /* The standard target cannot be used */
179 if (target
->target
== NULL
) {
186 module_put(target
->me
);
191 nft_target_destroy(const struct nft_expr
*expr
)
193 struct xt_target
*target
= expr
->ops
->data
;
195 module_put(target
->me
);
199 target_dump_info(struct sk_buff
*skb
, const struct xt_target
*t
, const void *in
)
204 if (t
->compat_to_user
) {
208 out
= kmalloc(XT_ALIGN(t
->targetsize
), GFP_ATOMIC
);
212 /* We want to reuse existing compat_to_user */
215 t
->compat_to_user(out
, in
);
217 ret
= nla_put(skb
, NFTA_TARGET_INFO
, XT_ALIGN(t
->targetsize
), out
);
221 ret
= nla_put(skb
, NFTA_TARGET_INFO
, XT_ALIGN(t
->targetsize
), in
);
226 static int nft_target_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
228 const struct xt_target
*target
= expr
->ops
->data
;
229 void *info
= nft_expr_priv(expr
);
231 if (nla_put_string(skb
, NFTA_TARGET_NAME
, target
->name
) ||
232 nla_put_be32(skb
, NFTA_TARGET_REV
, htonl(target
->revision
)) ||
233 target_dump_info(skb
, target
, info
))
234 goto nla_put_failure
;
242 static int nft_target_validate(const struct nft_ctx
*ctx
,
243 const struct nft_expr
*expr
,
244 const struct nft_data
**data
)
246 struct xt_target
*target
= expr
->ops
->data
;
247 unsigned int hook_mask
= 0;
249 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
250 const struct nft_base_chain
*basechain
=
251 nft_base_chain(ctx
->chain
);
252 const struct nf_hook_ops
*ops
= &basechain
->ops
;
254 hook_mask
= 1 << ops
->hooknum
;
255 if (hook_mask
& target
->hooks
)
258 /* This target is being called from an invalid chain */
264 static void nft_match_eval(const struct nft_expr
*expr
,
265 struct nft_data data
[NFT_REG_MAX
+ 1],
266 const struct nft_pktinfo
*pkt
)
268 void *info
= nft_expr_priv(expr
);
269 struct xt_match
*match
= expr
->ops
->data
;
270 struct sk_buff
*skb
= pkt
->skb
;
273 nft_compat_set_par((struct xt_action_param
*)&pkt
->xt
, match
, info
);
275 ret
= match
->match(skb
, (struct xt_action_param
*)&pkt
->xt
);
277 if (pkt
->xt
.hotdrop
) {
278 data
[NFT_REG_VERDICT
].verdict
= NF_DROP
;
284 data
[NFT_REG_VERDICT
].verdict
= NFT_CONTINUE
;
287 data
[NFT_REG_VERDICT
].verdict
= NFT_BREAK
;
292 static const struct nla_policy nft_match_policy
[NFTA_MATCH_MAX
+ 1] = {
293 [NFTA_MATCH_NAME
] = { .type
= NLA_NUL_STRING
},
294 [NFTA_MATCH_REV
] = { .type
= NLA_U32
},
295 [NFTA_MATCH_INFO
] = { .type
= NLA_BINARY
},
298 /* struct xt_mtchk_param and xt_tgchk_param look very similar */
300 nft_match_set_mtchk_param(struct xt_mtchk_param
*par
, const struct nft_ctx
*ctx
,
301 struct xt_match
*match
, void *info
,
302 union nft_entry
*entry
, u8 proto
, bool inv
)
304 par
->net
= &init_net
;
305 par
->table
= ctx
->table
->name
;
306 switch (ctx
->afi
->family
) {
308 entry
->e4
.ip
.proto
= proto
;
309 entry
->e4
.ip
.invflags
= inv
? IPT_INV_PROTO
: 0;
312 entry
->e6
.ipv6
.proto
= proto
;
313 entry
->e6
.ipv6
.invflags
= inv
? IP6T_INV_PROTO
: 0;
316 par
->entryinfo
= entry
;
318 par
->matchinfo
= info
;
319 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
320 const struct nft_base_chain
*basechain
=
321 nft_base_chain(ctx
->chain
);
322 const struct nf_hook_ops
*ops
= &basechain
->ops
;
324 par
->hook_mask
= 1 << ops
->hooknum
;
326 par
->family
= ctx
->afi
->family
;
329 static void match_compat_from_user(struct xt_match
*m
, void *in
, void *out
)
332 if (m
->compat_from_user
) {
335 m
->compat_from_user(out
, in
);
336 pad
= XT_ALIGN(m
->matchsize
) - m
->matchsize
;
338 memset(out
+ m
->matchsize
, 0, pad
);
341 memcpy(out
, in
, XT_ALIGN(m
->matchsize
));
345 nft_match_init(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
,
346 const struct nlattr
* const tb
[])
348 void *info
= nft_expr_priv(expr
);
349 struct xt_match
*match
= expr
->ops
->data
;
350 struct xt_mtchk_param par
;
351 size_t size
= XT_ALIGN(nla_len(tb
[NFTA_MATCH_INFO
]));
354 union nft_entry e
= {};
357 match_compat_from_user(match
, nla_data(tb
[NFTA_MATCH_INFO
]), info
);
359 if (ctx
->nla
[NFTA_RULE_COMPAT
])
360 proto
= nft_parse_compat(ctx
->nla
[NFTA_RULE_COMPAT
], &inv
);
362 nft_match_set_mtchk_param(&par
, ctx
, match
, info
, &e
, proto
, inv
);
364 ret
= xt_check_match(&par
, size
, proto
, inv
);
370 module_put(match
->me
);
375 nft_match_destroy(const struct nft_expr
*expr
)
377 struct xt_match
*match
= expr
->ops
->data
;
379 module_put(match
->me
);
383 match_dump_info(struct sk_buff
*skb
, const struct xt_match
*m
, const void *in
)
388 if (m
->compat_to_user
) {
392 out
= kmalloc(XT_ALIGN(m
->matchsize
), GFP_ATOMIC
);
396 /* We want to reuse existing compat_to_user */
399 m
->compat_to_user(out
, in
);
401 ret
= nla_put(skb
, NFTA_MATCH_INFO
, XT_ALIGN(m
->matchsize
), out
);
405 ret
= nla_put(skb
, NFTA_MATCH_INFO
, XT_ALIGN(m
->matchsize
), in
);
410 static inline int nft_compat_match_offset(struct xt_match
*match
)
413 return xt_compat_match_offset(match
);
419 static int nft_match_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
421 void *info
= nft_expr_priv(expr
);
422 struct xt_match
*match
= expr
->ops
->data
;
424 if (nla_put_string(skb
, NFTA_MATCH_NAME
, match
->name
) ||
425 nla_put_be32(skb
, NFTA_MATCH_REV
, htonl(match
->revision
)) ||
426 match_dump_info(skb
, match
, info
))
427 goto nla_put_failure
;
435 static int nft_match_validate(const struct nft_ctx
*ctx
,
436 const struct nft_expr
*expr
,
437 const struct nft_data
**data
)
439 struct xt_match
*match
= expr
->ops
->data
;
440 unsigned int hook_mask
= 0;
442 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
443 const struct nft_base_chain
*basechain
=
444 nft_base_chain(ctx
->chain
);
445 const struct nf_hook_ops
*ops
= &basechain
->ops
;
447 hook_mask
= 1 << ops
->hooknum
;
448 if (hook_mask
& match
->hooks
)
451 /* This match is being called from an invalid chain */
458 nfnl_compat_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, u32 type
,
459 int event
, u16 family
, const char *name
,
462 struct nlmsghdr
*nlh
;
463 struct nfgenmsg
*nfmsg
;
464 unsigned int flags
= portid
? NLM_F_MULTI
: 0;
466 event
|= NFNL_SUBSYS_NFT_COMPAT
<< 8;
467 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(*nfmsg
), flags
);
471 nfmsg
= nlmsg_data(nlh
);
472 nfmsg
->nfgen_family
= family
;
473 nfmsg
->version
= NFNETLINK_V0
;
476 if (nla_put_string(skb
, NFTA_COMPAT_NAME
, name
) ||
477 nla_put_be32(skb
, NFTA_COMPAT_REV
, htonl(rev
)) ||
478 nla_put_be32(skb
, NFTA_COMPAT_TYPE
, htonl(target
)))
479 goto nla_put_failure
;
486 nlmsg_cancel(skb
, nlh
);
491 nfnl_compat_get(struct sock
*nfnl
, struct sk_buff
*skb
,
492 const struct nlmsghdr
*nlh
, const struct nlattr
* const tb
[])
495 struct nfgenmsg
*nfmsg
;
499 struct sk_buff
*skb2
;
501 if (tb
[NFTA_COMPAT_NAME
] == NULL
||
502 tb
[NFTA_COMPAT_REV
] == NULL
||
503 tb
[NFTA_COMPAT_TYPE
] == NULL
)
506 name
= nla_data(tb
[NFTA_COMPAT_NAME
]);
507 rev
= ntohl(nla_get_be32(tb
[NFTA_COMPAT_REV
]));
508 target
= ntohl(nla_get_be32(tb
[NFTA_COMPAT_TYPE
]));
510 nfmsg
= nlmsg_data(nlh
);
512 switch(nfmsg
->nfgen_family
) {
520 pr_err("nft_compat: unsupported protocol %d\n",
521 nfmsg
->nfgen_family
);
525 try_then_request_module(xt_find_revision(nfmsg
->nfgen_family
, name
,
532 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
536 /* include the best revision for this extension in the message */
537 if (nfnl_compat_fill_info(skb2
, NETLINK_CB(skb
).portid
,
539 NFNL_MSG_TYPE(nlh
->nlmsg_type
),
542 name
, ret
, target
) <= 0) {
547 ret
= netlink_unicast(nfnl
, skb2
, NETLINK_CB(skb
).portid
,
552 return ret
== -EAGAIN
? -ENOBUFS
: ret
;
555 static const struct nla_policy nfnl_compat_policy_get
[NFTA_COMPAT_MAX
+1] = {
556 [NFTA_COMPAT_NAME
] = { .type
= NLA_NUL_STRING
,
557 .len
= NFT_COMPAT_NAME_MAX
-1 },
558 [NFTA_COMPAT_REV
] = { .type
= NLA_U32
},
559 [NFTA_COMPAT_TYPE
] = { .type
= NLA_U32
},
562 static const struct nfnl_callback nfnl_nft_compat_cb
[NFNL_MSG_COMPAT_MAX
] = {
563 [NFNL_MSG_COMPAT_GET
] = { .call
= nfnl_compat_get
,
564 .attr_count
= NFTA_COMPAT_MAX
,
565 .policy
= nfnl_compat_policy_get
},
568 static const struct nfnetlink_subsystem nfnl_compat_subsys
= {
569 .name
= "nft-compat",
570 .subsys_id
= NFNL_SUBSYS_NFT_COMPAT
,
571 .cb_count
= NFNL_MSG_COMPAT_MAX
,
572 .cb
= nfnl_nft_compat_cb
,
575 static LIST_HEAD(nft_match_list
);
578 struct list_head head
;
579 struct nft_expr_ops ops
;
582 static struct nft_expr_type nft_match_type
;
584 static const struct nft_expr_ops
*
585 nft_match_select_ops(const struct nft_ctx
*ctx
,
586 const struct nlattr
* const tb
[])
588 struct nft_xt
*nft_match
;
589 struct xt_match
*match
;
593 if (tb
[NFTA_MATCH_NAME
] == NULL
||
594 tb
[NFTA_MATCH_REV
] == NULL
||
595 tb
[NFTA_MATCH_INFO
] == NULL
)
596 return ERR_PTR(-EINVAL
);
598 mt_name
= nla_data(tb
[NFTA_MATCH_NAME
]);
599 rev
= ntohl(nla_get_be32(tb
[NFTA_MATCH_REV
]));
600 family
= ctx
->afi
->family
;
602 /* Re-use the existing match if it's already loaded. */
603 list_for_each_entry(nft_match
, &nft_match_list
, head
) {
604 struct xt_match
*match
= nft_match
->ops
.data
;
606 if (strcmp(match
->name
, mt_name
) == 0 &&
607 match
->revision
== rev
&& match
->family
== family
)
608 return &nft_match
->ops
;
611 match
= xt_request_find_match(family
, mt_name
, rev
);
613 return ERR_PTR(-ENOENT
);
615 /* This is the first time we use this match, allocate operations */
616 nft_match
= kzalloc(sizeof(struct nft_xt
), GFP_KERNEL
);
617 if (nft_match
== NULL
)
618 return ERR_PTR(-ENOMEM
);
620 nft_match
->ops
.type
= &nft_match_type
;
621 nft_match
->ops
.size
= NFT_EXPR_SIZE(XT_ALIGN(match
->matchsize
) +
622 nft_compat_match_offset(match
));
623 nft_match
->ops
.eval
= nft_match_eval
;
624 nft_match
->ops
.init
= nft_match_init
;
625 nft_match
->ops
.destroy
= nft_match_destroy
;
626 nft_match
->ops
.dump
= nft_match_dump
;
627 nft_match
->ops
.validate
= nft_match_validate
;
628 nft_match
->ops
.data
= match
;
630 list_add(&nft_match
->head
, &nft_match_list
);
632 return &nft_match
->ops
;
635 static void nft_match_release(void)
637 struct nft_xt
*nft_match
, *tmp
;
639 list_for_each_entry_safe(nft_match
, tmp
, &nft_match_list
, head
)
643 static struct nft_expr_type nft_match_type __read_mostly
= {
645 .select_ops
= nft_match_select_ops
,
646 .policy
= nft_match_policy
,
647 .maxattr
= NFTA_MATCH_MAX
,
648 .owner
= THIS_MODULE
,
651 static LIST_HEAD(nft_target_list
);
653 static struct nft_expr_type nft_target_type
;
655 static const struct nft_expr_ops
*
656 nft_target_select_ops(const struct nft_ctx
*ctx
,
657 const struct nlattr
* const tb
[])
659 struct nft_xt
*nft_target
;
660 struct xt_target
*target
;
664 if (tb
[NFTA_TARGET_NAME
] == NULL
||
665 tb
[NFTA_TARGET_REV
] == NULL
||
666 tb
[NFTA_TARGET_INFO
] == NULL
)
667 return ERR_PTR(-EINVAL
);
669 tg_name
= nla_data(tb
[NFTA_TARGET_NAME
]);
670 rev
= ntohl(nla_get_be32(tb
[NFTA_TARGET_REV
]));
671 family
= ctx
->afi
->family
;
673 /* Re-use the existing target if it's already loaded. */
674 list_for_each_entry(nft_target
, &nft_match_list
, head
) {
675 struct xt_target
*target
= nft_target
->ops
.data
;
677 if (strcmp(target
->name
, tg_name
) == 0 &&
678 target
->revision
== rev
&& target
->family
== family
)
679 return &nft_target
->ops
;
682 target
= xt_request_find_target(family
, tg_name
, rev
);
684 return ERR_PTR(-ENOENT
);
686 /* This is the first time we use this target, allocate operations */
687 nft_target
= kzalloc(sizeof(struct nft_xt
), GFP_KERNEL
);
688 if (nft_target
== NULL
)
689 return ERR_PTR(-ENOMEM
);
691 nft_target
->ops
.type
= &nft_target_type
;
692 nft_target
->ops
.size
= NFT_EXPR_SIZE(XT_ALIGN(target
->targetsize
) +
693 nft_compat_target_offset(target
));
694 nft_target
->ops
.eval
= nft_target_eval
;
695 nft_target
->ops
.init
= nft_target_init
;
696 nft_target
->ops
.destroy
= nft_target_destroy
;
697 nft_target
->ops
.dump
= nft_target_dump
;
698 nft_target
->ops
.validate
= nft_target_validate
;
699 nft_target
->ops
.data
= target
;
701 list_add(&nft_target
->head
, &nft_target_list
);
703 return &nft_target
->ops
;
706 static void nft_target_release(void)
708 struct nft_xt
*nft_target
, *tmp
;
710 list_for_each_entry_safe(nft_target
, tmp
, &nft_target_list
, head
)
714 static struct nft_expr_type nft_target_type __read_mostly
= {
716 .select_ops
= nft_target_select_ops
,
717 .policy
= nft_target_policy
,
718 .maxattr
= NFTA_TARGET_MAX
,
719 .owner
= THIS_MODULE
,
722 static int __init
nft_compat_module_init(void)
726 ret
= nft_register_expr(&nft_match_type
);
730 ret
= nft_register_expr(&nft_target_type
);
734 ret
= nfnetlink_subsys_register(&nfnl_compat_subsys
);
736 pr_err("nft_compat: cannot register with nfnetlink.\n");
740 pr_info("nf_tables_compat: (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>\n");
745 nft_unregister_expr(&nft_target_type
);
747 nft_unregister_expr(&nft_match_type
);
751 static void __exit
nft_compat_module_exit(void)
753 nfnetlink_subsys_unregister(&nfnl_compat_subsys
);
754 nft_unregister_expr(&nft_target_type
);
755 nft_unregister_expr(&nft_match_type
);
757 nft_target_release();
760 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT
);
762 module_init(nft_compat_module_init
);
763 module_exit(nft_compat_module_exit
);
765 MODULE_LICENSE("GPL");
766 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
767 MODULE_ALIAS_NFT_EXPR("match");
768 MODULE_ALIAS_NFT_EXPR("target");