2 * (C) 2015 Red Hat GmbH
3 * Author: Florian Westphal <fw@strlen.de>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
10 #include <linux/module.h>
11 #include <linux/static_key.h>
12 #include <linux/hash.h>
13 #include <linux/jhash.h>
14 #include <linux/if_vlan.h>
15 #include <linux/init.h>
16 #include <linux/skbuff.h>
17 #include <linux/netlink.h>
18 #include <linux/netfilter.h>
19 #include <linux/netfilter/nfnetlink.h>
20 #include <linux/netfilter/nf_tables.h>
21 #include <net/netfilter/nf_tables_core.h>
22 #include <net/netfilter/nf_tables.h>
24 #define NFT_TRACETYPE_LL_HSIZE 20
25 #define NFT_TRACETYPE_NETWORK_HSIZE 40
26 #define NFT_TRACETYPE_TRANSPORT_HSIZE 20
28 DEFINE_STATIC_KEY_FALSE(nft_trace_enabled
);
29 EXPORT_SYMBOL_GPL(nft_trace_enabled
);
31 static int trace_fill_id(struct sk_buff
*nlskb
, struct sk_buff
*skb
)
35 /* using skb address as ID results in a limited number of
36 * values (and quick reuse).
38 * So we attempt to use as many skb members that will not
39 * change while skb is with netfilter.
41 id
= (__be32
)jhash_2words(hash32_ptr(skb
), skb_get_hash(skb
),
44 return nla_put_be32(nlskb
, NFTA_TRACE_ID
, id
);
47 static int trace_fill_header(struct sk_buff
*nlskb
, u16 type
,
48 const struct sk_buff
*skb
,
49 int off
, unsigned int len
)
56 nla
= nla_reserve(nlskb
, type
, len
);
57 if (!nla
|| skb_copy_bits(skb
, off
, nla_data(nla
), len
))
63 static int nf_trace_fill_ll_header(struct sk_buff
*nlskb
,
64 const struct sk_buff
*skb
)
66 struct vlan_ethhdr veth
;
69 BUILD_BUG_ON(sizeof(veth
) > NFT_TRACETYPE_LL_HSIZE
);
71 off
= skb_mac_header(skb
) - skb
->data
;
75 if (skb_copy_bits(skb
, off
, &veth
, ETH_HLEN
))
78 veth
.h_vlan_proto
= skb
->vlan_proto
;
79 veth
.h_vlan_TCI
= htons(skb_vlan_tag_get(skb
));
80 veth
.h_vlan_encapsulated_proto
= skb
->protocol
;
82 return nla_put(nlskb
, NFTA_TRACE_LL_HEADER
, sizeof(veth
), &veth
);
85 static int nf_trace_fill_dev_info(struct sk_buff
*nlskb
,
86 const struct net_device
*indev
,
87 const struct net_device
*outdev
)
90 if (nla_put_be32(nlskb
, NFTA_TRACE_IIF
,
91 htonl(indev
->ifindex
)))
94 if (nla_put_be16(nlskb
, NFTA_TRACE_IIFTYPE
,
100 if (nla_put_be32(nlskb
, NFTA_TRACE_OIF
,
101 htonl(outdev
->ifindex
)))
104 if (nla_put_be16(nlskb
, NFTA_TRACE_OIFTYPE
,
105 htons(outdev
->type
)))
112 static int nf_trace_fill_pkt_info(struct sk_buff
*nlskb
,
113 const struct nft_pktinfo
*pkt
)
115 const struct sk_buff
*skb
= pkt
->skb
;
116 int off
= skb_network_offset(skb
);
117 unsigned int len
, nh_end
;
119 nh_end
= pkt
->tprot_set
? pkt
->xt
.thoff
: skb
->len
;
120 len
= min_t(unsigned int, nh_end
- skb_network_offset(skb
),
121 NFT_TRACETYPE_NETWORK_HSIZE
);
122 if (trace_fill_header(nlskb
, NFTA_TRACE_NETWORK_HEADER
, skb
, off
, len
))
125 if (pkt
->tprot_set
) {
126 len
= min_t(unsigned int, skb
->len
- pkt
->xt
.thoff
,
127 NFT_TRACETYPE_TRANSPORT_HSIZE
);
128 if (trace_fill_header(nlskb
, NFTA_TRACE_TRANSPORT_HEADER
, skb
,
133 if (!skb_mac_header_was_set(skb
))
136 if (skb_vlan_tag_get(skb
))
137 return nf_trace_fill_ll_header(nlskb
, skb
);
139 off
= skb_mac_header(skb
) - skb
->data
;
140 len
= min_t(unsigned int, -off
, NFT_TRACETYPE_LL_HSIZE
);
141 return trace_fill_header(nlskb
, NFTA_TRACE_LL_HEADER
,
145 static int nf_trace_fill_rule_info(struct sk_buff
*nlskb
,
146 const struct nft_traceinfo
*info
)
151 /* a continue verdict with ->type == RETURN means that this is
152 * an implicit return (end of chain reached).
154 * Since no rule matched, the ->rule pointer is invalid.
156 if (info
->type
== NFT_TRACETYPE_RETURN
&&
157 info
->verdict
->code
== NFT_CONTINUE
)
160 return nla_put_be64(nlskb
, NFTA_TRACE_RULE_HANDLE
,
161 cpu_to_be64(info
->rule
->handle
),
165 static bool nft_trace_have_verdict_chain(struct nft_traceinfo
*info
)
167 switch (info
->type
) {
168 case NFT_TRACETYPE_RETURN
:
169 case NFT_TRACETYPE_RULE
:
175 switch (info
->verdict
->code
) {
186 void nft_trace_notify(struct nft_traceinfo
*info
)
188 const struct nft_pktinfo
*pkt
= info
->pkt
;
189 struct nfgenmsg
*nfmsg
;
190 struct nlmsghdr
*nlh
;
195 if (!nfnetlink_has_listeners(nft_net(pkt
), NFNLGRP_NFTRACE
))
198 size
= nlmsg_total_size(sizeof(struct nfgenmsg
)) +
199 nla_total_size(strlen(info
->chain
->table
->name
)) +
200 nla_total_size(strlen(info
->chain
->name
)) +
201 nla_total_size_64bit(sizeof(__be64
)) + /* rule handle */
202 nla_total_size(sizeof(__be32
)) + /* trace type */
203 nla_total_size(0) + /* VERDICT, nested */
204 nla_total_size(sizeof(u32
)) + /* verdict code */
205 nla_total_size(sizeof(u32
)) + /* id */
206 nla_total_size(NFT_TRACETYPE_LL_HSIZE
) +
207 nla_total_size(NFT_TRACETYPE_NETWORK_HSIZE
) +
208 nla_total_size(NFT_TRACETYPE_TRANSPORT_HSIZE
) +
209 nla_total_size(sizeof(u32
)) + /* iif */
210 nla_total_size(sizeof(__be16
)) + /* iiftype */
211 nla_total_size(sizeof(u32
)) + /* oif */
212 nla_total_size(sizeof(__be16
)) + /* oiftype */
213 nla_total_size(sizeof(u32
)) + /* mark */
214 nla_total_size(sizeof(u32
)) + /* nfproto */
215 nla_total_size(sizeof(u32
)); /* policy */
217 if (nft_trace_have_verdict_chain(info
))
218 size
+= nla_total_size(strlen(info
->verdict
->chain
->name
)); /* jump target */
220 skb
= nlmsg_new(size
, GFP_ATOMIC
);
224 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, NFT_MSG_TRACE
);
225 nlh
= nlmsg_put(skb
, 0, 0, event
, sizeof(struct nfgenmsg
), 0);
227 goto nla_put_failure
;
229 nfmsg
= nlmsg_data(nlh
);
230 nfmsg
->nfgen_family
= info
->basechain
->type
->family
;
231 nfmsg
->version
= NFNETLINK_V0
;
234 if (nla_put_be32(skb
, NFTA_TRACE_NFPROTO
, htonl(nft_pf(pkt
))))
235 goto nla_put_failure
;
237 if (nla_put_be32(skb
, NFTA_TRACE_TYPE
, htonl(info
->type
)))
238 goto nla_put_failure
;
240 if (trace_fill_id(skb
, pkt
->skb
))
241 goto nla_put_failure
;
243 if (nla_put_string(skb
, NFTA_TRACE_CHAIN
, info
->chain
->name
))
244 goto nla_put_failure
;
246 if (nla_put_string(skb
, NFTA_TRACE_TABLE
, info
->chain
->table
->name
))
247 goto nla_put_failure
;
249 if (nf_trace_fill_rule_info(skb
, info
))
250 goto nla_put_failure
;
252 switch (info
->type
) {
253 case NFT_TRACETYPE_UNSPEC
:
254 case __NFT_TRACETYPE_MAX
:
256 case NFT_TRACETYPE_RETURN
:
257 case NFT_TRACETYPE_RULE
:
258 if (nft_verdict_dump(skb
, NFTA_TRACE_VERDICT
, info
->verdict
))
259 goto nla_put_failure
;
261 case NFT_TRACETYPE_POLICY
:
262 if (nla_put_be32(skb
, NFTA_TRACE_POLICY
,
263 htonl(info
->basechain
->policy
)))
264 goto nla_put_failure
;
268 if (pkt
->skb
->mark
&&
269 nla_put_be32(skb
, NFTA_TRACE_MARK
, htonl(pkt
->skb
->mark
)))
270 goto nla_put_failure
;
272 if (!info
->packet_dumped
) {
273 if (nf_trace_fill_dev_info(skb
, nft_in(pkt
), nft_out(pkt
)))
274 goto nla_put_failure
;
276 if (nf_trace_fill_pkt_info(skb
, pkt
))
277 goto nla_put_failure
;
278 info
->packet_dumped
= true;
282 nfnetlink_send(skb
, nft_net(pkt
), 0, NFNLGRP_NFTRACE
, 0, GFP_ATOMIC
);
290 void nft_trace_init(struct nft_traceinfo
*info
, const struct nft_pktinfo
*pkt
,
291 const struct nft_verdict
*verdict
,
292 const struct nft_chain
*chain
)
294 info
->basechain
= nft_base_chain(chain
);
296 info
->packet_dumped
= false;
298 info
->verdict
= verdict
;