2 * Copyright (c) 2016 Anders K. Pedersen <akp@cohaesio.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
9 #include <linux/kernel.h>
10 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/netlink.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter/nf_tables.h>
16 #include <net/ip6_route.h>
17 #include <net/route.h>
18 #include <net/netfilter/nf_tables.h>
19 #include <net/netfilter/nf_tables_core.h>
22 enum nft_rt_keys key
:8;
23 enum nft_registers dreg
:8;
26 static u16
get_tcpmss(const struct nft_pktinfo
*pkt
, const struct dst_entry
*skbdst
)
28 u32 minlen
= sizeof(struct ipv6hdr
), mtu
= dst_mtu(skbdst
);
29 const struct sk_buff
*skb
= pkt
->skb
;
30 const struct nf_afinfo
*ai
;
33 memset(&fl
, 0, sizeof(fl
));
35 switch (nft_pf(pkt
)) {
37 fl
.u
.ip4
.daddr
= ip_hdr(skb
)->saddr
;
38 minlen
= sizeof(struct iphdr
) + sizeof(struct tcphdr
);
41 fl
.u
.ip6
.daddr
= ipv6_hdr(skb
)->saddr
;
42 minlen
= sizeof(struct ipv6hdr
) + sizeof(struct tcphdr
);
46 ai
= nf_get_afinfo(nft_pf(pkt
));
48 struct dst_entry
*dst
= NULL
;
50 ai
->route(nft_net(pkt
), &dst
, &fl
, false);
52 mtu
= min(mtu
, dst_mtu(dst
));
57 if (mtu
<= minlen
|| mtu
> 0xffff)
58 return TCP_MSS_DEFAULT
;
63 static void nft_rt_get_eval(const struct nft_expr
*expr
,
64 struct nft_regs
*regs
,
65 const struct nft_pktinfo
*pkt
)
67 const struct nft_rt
*priv
= nft_expr_priv(expr
);
68 const struct sk_buff
*skb
= pkt
->skb
;
69 u32
*dest
= ®s
->data
[priv
->dreg
];
70 const struct dst_entry
*dst
;
77 #ifdef CONFIG_IP_ROUTE_CLASSID
79 *dest
= dst
->tclassid
;
83 if (nft_pf(pkt
) != NFPROTO_IPV4
)
86 *dest
= (__force u32
)rt_nexthop((const struct rtable
*)dst
,
90 if (nft_pf(pkt
) != NFPROTO_IPV6
)
93 memcpy(dest
, rt6_nexthop((struct rt6_info
*)dst
,
94 &ipv6_hdr(skb
)->daddr
),
95 sizeof(struct in6_addr
));
98 nft_reg_store16(dest
, get_tcpmss(pkt
, dst
));
107 regs
->verdict
.code
= NFT_BREAK
;
110 static const struct nla_policy nft_rt_policy
[NFTA_RT_MAX
+ 1] = {
111 [NFTA_RT_DREG
] = { .type
= NLA_U32
},
112 [NFTA_RT_KEY
] = { .type
= NLA_U32
},
115 static int nft_rt_get_init(const struct nft_ctx
*ctx
,
116 const struct nft_expr
*expr
,
117 const struct nlattr
* const tb
[])
119 struct nft_rt
*priv
= nft_expr_priv(expr
);
122 if (tb
[NFTA_RT_KEY
] == NULL
||
123 tb
[NFTA_RT_DREG
] == NULL
)
126 priv
->key
= ntohl(nla_get_be32(tb
[NFTA_RT_KEY
]));
128 #ifdef CONFIG_IP_ROUTE_CLASSID
131 case NFT_RT_NEXTHOP4
:
134 case NFT_RT_NEXTHOP6
:
135 len
= sizeof(struct in6_addr
);
144 priv
->dreg
= nft_parse_register(tb
[NFTA_RT_DREG
]);
145 return nft_validate_register_store(ctx
, priv
->dreg
, NULL
,
146 NFT_DATA_VALUE
, len
);
149 static int nft_rt_get_dump(struct sk_buff
*skb
,
150 const struct nft_expr
*expr
)
152 const struct nft_rt
*priv
= nft_expr_priv(expr
);
154 if (nla_put_be32(skb
, NFTA_RT_KEY
, htonl(priv
->key
)))
155 goto nla_put_failure
;
156 if (nft_dump_register(skb
, NFTA_RT_DREG
, priv
->dreg
))
157 goto nla_put_failure
;
164 static int nft_rt_validate(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
,
165 const struct nft_data
**data
)
167 const struct nft_rt
*priv
= nft_expr_priv(expr
);
171 case NFT_RT_NEXTHOP4
:
172 case NFT_RT_NEXTHOP6
:
176 hooks
= (1 << NF_INET_FORWARD
) |
177 (1 << NF_INET_LOCAL_OUT
) |
178 (1 << NF_INET_POST_ROUTING
);
184 return nft_chain_validate_hooks(ctx
->chain
, hooks
);
187 static struct nft_expr_type nft_rt_type
;
188 static const struct nft_expr_ops nft_rt_get_ops
= {
189 .type
= &nft_rt_type
,
190 .size
= NFT_EXPR_SIZE(sizeof(struct nft_rt
)),
191 .eval
= nft_rt_get_eval
,
192 .init
= nft_rt_get_init
,
193 .dump
= nft_rt_get_dump
,
194 .validate
= nft_rt_validate
,
197 static struct nft_expr_type nft_rt_type __read_mostly
= {
199 .ops
= &nft_rt_get_ops
,
200 .policy
= nft_rt_policy
,
201 .maxattr
= NFTA_RT_MAX
,
202 .owner
= THIS_MODULE
,
205 static int __init
nft_rt_module_init(void)
207 return nft_register_expr(&nft_rt_type
);
210 static void __exit
nft_rt_module_exit(void)
212 nft_unregister_expr(&nft_rt_type
);
215 module_init(nft_rt_module_init
);
216 module_exit(nft_rt_module_exit
);
218 MODULE_LICENSE("GPL");
219 MODULE_AUTHOR("Anders K. Pedersen <akp@cohaesio.com>");
220 MODULE_ALIAS_NFT_EXPR("rt");