2 * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * This software has been sponsored by Sophos Astaro <http://www.sophos.com>
11 #include <linux/kernel.h>
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/netlink.h>
15 #include <linux/netfilter.h>
16 #include <linux/netfilter/nfnetlink.h>
17 #include <linux/netfilter/nf_tables.h>
18 #include <linux/netfilter/nf_tables_compat.h>
19 #include <linux/netfilter/x_tables.h>
20 #include <linux/netfilter_ipv4/ip_tables.h>
21 #include <linux/netfilter_ipv6/ip6_tables.h>
22 #include <asm/uaccess.h> /* for set_fs */
23 #include <net/netfilter/nf_tables.h>
31 nft_compat_set_par(struct xt_action_param
*par
, void *xt
, const void *xt_info
)
34 par
->targinfo
= xt_info
;
38 static void nft_target_eval(const struct nft_expr
*expr
,
39 struct nft_data data
[NFT_REG_MAX
+ 1],
40 const struct nft_pktinfo
*pkt
)
42 void *info
= nft_expr_priv(expr
);
43 struct xt_target
*target
= expr
->ops
->data
;
44 struct sk_buff
*skb
= pkt
->skb
;
47 nft_compat_set_par((struct xt_action_param
*)&pkt
->xt
, target
, info
);
49 ret
= target
->target(skb
, &pkt
->xt
);
56 data
[NFT_REG_VERDICT
].verdict
= NFT_CONTINUE
;
59 data
[NFT_REG_VERDICT
].verdict
= ret
;
65 static const struct nla_policy nft_target_policy
[NFTA_TARGET_MAX
+ 1] = {
66 [NFTA_TARGET_NAME
] = { .type
= NLA_NUL_STRING
},
67 [NFTA_TARGET_REV
] = { .type
= NLA_U32
},
68 [NFTA_TARGET_INFO
] = { .type
= NLA_BINARY
},
72 nft_target_set_tgchk_param(struct xt_tgchk_param
*par
,
73 const struct nft_ctx
*ctx
,
74 struct xt_target
*target
, void *info
,
75 union nft_entry
*entry
, u8 proto
, bool inv
)
78 par
->table
= ctx
->table
->name
;
79 switch (ctx
->afi
->family
) {
81 entry
->e4
.ip
.proto
= proto
;
82 entry
->e4
.ip
.invflags
= inv
? IPT_INV_PROTO
: 0;
85 entry
->e6
.ipv6
.proto
= proto
;
86 entry
->e6
.ipv6
.invflags
= inv
? IP6T_INV_PROTO
: 0;
89 par
->entryinfo
= entry
;
92 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
93 const struct nft_base_chain
*basechain
=
94 nft_base_chain(ctx
->chain
);
95 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
97 par
->hook_mask
= 1 << ops
->hooknum
;
99 par
->family
= ctx
->afi
->family
;
102 static void target_compat_from_user(struct xt_target
*t
, void *in
, void *out
)
106 memcpy(out
, in
, t
->targetsize
);
107 pad
= XT_ALIGN(t
->targetsize
) - t
->targetsize
;
109 memset(out
+ t
->targetsize
, 0, pad
);
112 static const struct nla_policy nft_rule_compat_policy
[NFTA_RULE_COMPAT_MAX
+ 1] = {
113 [NFTA_RULE_COMPAT_PROTO
] = { .type
= NLA_U32
},
114 [NFTA_RULE_COMPAT_FLAGS
] = { .type
= NLA_U32
},
117 static int nft_parse_compat(const struct nlattr
*attr
, u8
*proto
, bool *inv
)
119 struct nlattr
*tb
[NFTA_RULE_COMPAT_MAX
+1];
123 err
= nla_parse_nested(tb
, NFTA_RULE_COMPAT_MAX
, attr
,
124 nft_rule_compat_policy
);
128 if (!tb
[NFTA_RULE_COMPAT_PROTO
] || !tb
[NFTA_RULE_COMPAT_FLAGS
])
131 flags
= ntohl(nla_get_be32(tb
[NFTA_RULE_COMPAT_FLAGS
]));
132 if (flags
& ~NFT_RULE_COMPAT_F_MASK
)
134 if (flags
& NFT_RULE_COMPAT_F_INV
)
137 *proto
= ntohl(nla_get_be32(tb
[NFTA_RULE_COMPAT_PROTO
]));
142 nft_target_init(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
,
143 const struct nlattr
* const tb
[])
145 void *info
= nft_expr_priv(expr
);
146 struct xt_target
*target
= expr
->ops
->data
;
147 struct xt_tgchk_param par
;
148 size_t size
= XT_ALIGN(nla_len(tb
[NFTA_TARGET_INFO
]));
151 union nft_entry e
= {};
154 target_compat_from_user(target
, nla_data(tb
[NFTA_TARGET_INFO
]), info
);
156 if (ctx
->nla
[NFTA_RULE_COMPAT
]) {
157 ret
= nft_parse_compat(ctx
->nla
[NFTA_RULE_COMPAT
], &proto
, &inv
);
162 nft_target_set_tgchk_param(&par
, ctx
, target
, info
, &e
, proto
, inv
);
164 ret
= xt_check_target(&par
, size
, proto
, inv
);
168 /* The standard target cannot be used */
169 if (target
->target
== NULL
) {
176 module_put(target
->me
);
181 nft_target_destroy(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
)
183 struct xt_target
*target
= expr
->ops
->data
;
184 void *info
= nft_expr_priv(expr
);
185 struct xt_tgdtor_param par
;
190 par
.family
= ctx
->afi
->family
;
191 if (par
.target
->destroy
!= NULL
)
192 par
.target
->destroy(&par
);
194 module_put(target
->me
);
197 static int nft_target_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
199 const struct xt_target
*target
= expr
->ops
->data
;
200 void *info
= nft_expr_priv(expr
);
202 if (nla_put_string(skb
, NFTA_TARGET_NAME
, target
->name
) ||
203 nla_put_be32(skb
, NFTA_TARGET_REV
, htonl(target
->revision
)) ||
204 nla_put(skb
, NFTA_TARGET_INFO
, XT_ALIGN(target
->targetsize
), info
))
205 goto nla_put_failure
;
213 static int nft_target_validate(const struct nft_ctx
*ctx
,
214 const struct nft_expr
*expr
,
215 const struct nft_data
**data
)
217 struct xt_target
*target
= expr
->ops
->data
;
218 unsigned int hook_mask
= 0;
220 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
221 const struct nft_base_chain
*basechain
=
222 nft_base_chain(ctx
->chain
);
223 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
225 hook_mask
= 1 << ops
->hooknum
;
226 if (hook_mask
& target
->hooks
)
229 /* This target is being called from an invalid chain */
235 static void nft_match_eval(const struct nft_expr
*expr
,
236 struct nft_data data
[NFT_REG_MAX
+ 1],
237 const struct nft_pktinfo
*pkt
)
239 void *info
= nft_expr_priv(expr
);
240 struct xt_match
*match
= expr
->ops
->data
;
241 struct sk_buff
*skb
= pkt
->skb
;
244 nft_compat_set_par((struct xt_action_param
*)&pkt
->xt
, match
, info
);
246 ret
= match
->match(skb
, (struct xt_action_param
*)&pkt
->xt
);
248 if (pkt
->xt
.hotdrop
) {
249 data
[NFT_REG_VERDICT
].verdict
= NF_DROP
;
255 data
[NFT_REG_VERDICT
].verdict
= NFT_CONTINUE
;
258 data
[NFT_REG_VERDICT
].verdict
= NFT_BREAK
;
263 static const struct nla_policy nft_match_policy
[NFTA_MATCH_MAX
+ 1] = {
264 [NFTA_MATCH_NAME
] = { .type
= NLA_NUL_STRING
},
265 [NFTA_MATCH_REV
] = { .type
= NLA_U32
},
266 [NFTA_MATCH_INFO
] = { .type
= NLA_BINARY
},
269 /* struct xt_mtchk_param and xt_tgchk_param look very similar */
271 nft_match_set_mtchk_param(struct xt_mtchk_param
*par
, const struct nft_ctx
*ctx
,
272 struct xt_match
*match
, void *info
,
273 union nft_entry
*entry
, u8 proto
, bool inv
)
275 par
->net
= &init_net
;
276 par
->table
= ctx
->table
->name
;
277 switch (ctx
->afi
->family
) {
279 entry
->e4
.ip
.proto
= proto
;
280 entry
->e4
.ip
.invflags
= inv
? IPT_INV_PROTO
: 0;
283 entry
->e6
.ipv6
.proto
= proto
;
284 entry
->e6
.ipv6
.invflags
= inv
? IP6T_INV_PROTO
: 0;
287 par
->entryinfo
= entry
;
289 par
->matchinfo
= info
;
290 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
291 const struct nft_base_chain
*basechain
=
292 nft_base_chain(ctx
->chain
);
293 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
295 par
->hook_mask
= 1 << ops
->hooknum
;
297 par
->family
= ctx
->afi
->family
;
300 static void match_compat_from_user(struct xt_match
*m
, void *in
, void *out
)
304 memcpy(out
, in
, m
->matchsize
);
305 pad
= XT_ALIGN(m
->matchsize
) - m
->matchsize
;
307 memset(out
+ m
->matchsize
, 0, pad
);
311 nft_match_init(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
,
312 const struct nlattr
* const tb
[])
314 void *info
= nft_expr_priv(expr
);
315 struct xt_match
*match
= expr
->ops
->data
;
316 struct xt_mtchk_param par
;
317 size_t size
= XT_ALIGN(nla_len(tb
[NFTA_MATCH_INFO
]));
320 union nft_entry e
= {};
323 match_compat_from_user(match
, nla_data(tb
[NFTA_MATCH_INFO
]), info
);
325 if (ctx
->nla
[NFTA_RULE_COMPAT
]) {
326 ret
= nft_parse_compat(ctx
->nla
[NFTA_RULE_COMPAT
], &proto
, &inv
);
331 nft_match_set_mtchk_param(&par
, ctx
, match
, info
, &e
, proto
, inv
);
333 ret
= xt_check_match(&par
, size
, proto
, inv
);
339 module_put(match
->me
);
344 nft_match_destroy(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
)
346 struct xt_match
*match
= expr
->ops
->data
;
347 void *info
= nft_expr_priv(expr
);
348 struct xt_mtdtor_param par
;
352 par
.matchinfo
= info
;
353 par
.family
= ctx
->afi
->family
;
354 if (par
.match
->destroy
!= NULL
)
355 par
.match
->destroy(&par
);
357 module_put(match
->me
);
360 static int nft_match_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
362 void *info
= nft_expr_priv(expr
);
363 struct xt_match
*match
= expr
->ops
->data
;
365 if (nla_put_string(skb
, NFTA_MATCH_NAME
, match
->name
) ||
366 nla_put_be32(skb
, NFTA_MATCH_REV
, htonl(match
->revision
)) ||
367 nla_put(skb
, NFTA_MATCH_INFO
, XT_ALIGN(match
->matchsize
), info
))
368 goto nla_put_failure
;
376 static int nft_match_validate(const struct nft_ctx
*ctx
,
377 const struct nft_expr
*expr
,
378 const struct nft_data
**data
)
380 struct xt_match
*match
= expr
->ops
->data
;
381 unsigned int hook_mask
= 0;
383 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
384 const struct nft_base_chain
*basechain
=
385 nft_base_chain(ctx
->chain
);
386 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
388 hook_mask
= 1 << ops
->hooknum
;
389 if (hook_mask
& match
->hooks
)
392 /* This match is being called from an invalid chain */
399 nfnl_compat_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, u32 type
,
400 int event
, u16 family
, const char *name
,
403 struct nlmsghdr
*nlh
;
404 struct nfgenmsg
*nfmsg
;
405 unsigned int flags
= portid
? NLM_F_MULTI
: 0;
407 event
|= NFNL_SUBSYS_NFT_COMPAT
<< 8;
408 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(*nfmsg
), flags
);
412 nfmsg
= nlmsg_data(nlh
);
413 nfmsg
->nfgen_family
= family
;
414 nfmsg
->version
= NFNETLINK_V0
;
417 if (nla_put_string(skb
, NFTA_COMPAT_NAME
, name
) ||
418 nla_put_be32(skb
, NFTA_COMPAT_REV
, htonl(rev
)) ||
419 nla_put_be32(skb
, NFTA_COMPAT_TYPE
, htonl(target
)))
420 goto nla_put_failure
;
427 nlmsg_cancel(skb
, nlh
);
432 nfnl_compat_get(struct sock
*nfnl
, struct sk_buff
*skb
,
433 const struct nlmsghdr
*nlh
, const struct nlattr
* const tb
[])
436 struct nfgenmsg
*nfmsg
;
440 struct sk_buff
*skb2
;
442 if (tb
[NFTA_COMPAT_NAME
] == NULL
||
443 tb
[NFTA_COMPAT_REV
] == NULL
||
444 tb
[NFTA_COMPAT_TYPE
] == NULL
)
447 name
= nla_data(tb
[NFTA_COMPAT_NAME
]);
448 rev
= ntohl(nla_get_be32(tb
[NFTA_COMPAT_REV
]));
449 target
= ntohl(nla_get_be32(tb
[NFTA_COMPAT_TYPE
]));
451 nfmsg
= nlmsg_data(nlh
);
453 switch(nfmsg
->nfgen_family
) {
461 pr_err("nft_compat: unsupported protocol %d\n",
462 nfmsg
->nfgen_family
);
466 try_then_request_module(xt_find_revision(nfmsg
->nfgen_family
, name
,
473 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
477 /* include the best revision for this extension in the message */
478 if (nfnl_compat_fill_info(skb2
, NETLINK_CB(skb
).portid
,
480 NFNL_MSG_TYPE(nlh
->nlmsg_type
),
483 name
, ret
, target
) <= 0) {
488 ret
= netlink_unicast(nfnl
, skb2
, NETLINK_CB(skb
).portid
,
493 return ret
== -EAGAIN
? -ENOBUFS
: ret
;
496 static const struct nla_policy nfnl_compat_policy_get
[NFTA_COMPAT_MAX
+1] = {
497 [NFTA_COMPAT_NAME
] = { .type
= NLA_NUL_STRING
,
498 .len
= NFT_COMPAT_NAME_MAX
-1 },
499 [NFTA_COMPAT_REV
] = { .type
= NLA_U32
},
500 [NFTA_COMPAT_TYPE
] = { .type
= NLA_U32
},
503 static const struct nfnl_callback nfnl_nft_compat_cb
[NFNL_MSG_COMPAT_MAX
] = {
504 [NFNL_MSG_COMPAT_GET
] = { .call
= nfnl_compat_get
,
505 .attr_count
= NFTA_COMPAT_MAX
,
506 .policy
= nfnl_compat_policy_get
},
509 static const struct nfnetlink_subsystem nfnl_compat_subsys
= {
510 .name
= "nft-compat",
511 .subsys_id
= NFNL_SUBSYS_NFT_COMPAT
,
512 .cb_count
= NFNL_MSG_COMPAT_MAX
,
513 .cb
= nfnl_nft_compat_cb
,
516 static LIST_HEAD(nft_match_list
);
519 struct list_head head
;
520 struct nft_expr_ops ops
;
523 static struct nft_expr_type nft_match_type
;
525 static const struct nft_expr_ops
*
526 nft_match_select_ops(const struct nft_ctx
*ctx
,
527 const struct nlattr
* const tb
[])
529 struct nft_xt
*nft_match
;
530 struct xt_match
*match
;
534 if (tb
[NFTA_MATCH_NAME
] == NULL
||
535 tb
[NFTA_MATCH_REV
] == NULL
||
536 tb
[NFTA_MATCH_INFO
] == NULL
)
537 return ERR_PTR(-EINVAL
);
539 mt_name
= nla_data(tb
[NFTA_MATCH_NAME
]);
540 rev
= ntohl(nla_get_be32(tb
[NFTA_MATCH_REV
]));
541 family
= ctx
->afi
->family
;
543 /* Re-use the existing match if it's already loaded. */
544 list_for_each_entry(nft_match
, &nft_match_list
, head
) {
545 struct xt_match
*match
= nft_match
->ops
.data
;
547 if (strcmp(match
->name
, mt_name
) == 0 &&
548 match
->revision
== rev
&& match
->family
== family
)
549 return &nft_match
->ops
;
552 match
= xt_request_find_match(family
, mt_name
, rev
);
554 return ERR_PTR(-ENOENT
);
556 /* This is the first time we use this match, allocate operations */
557 nft_match
= kzalloc(sizeof(struct nft_xt
), GFP_KERNEL
);
558 if (nft_match
== NULL
)
559 return ERR_PTR(-ENOMEM
);
561 nft_match
->ops
.type
= &nft_match_type
;
562 nft_match
->ops
.size
= NFT_EXPR_SIZE(XT_ALIGN(match
->matchsize
));
563 nft_match
->ops
.eval
= nft_match_eval
;
564 nft_match
->ops
.init
= nft_match_init
;
565 nft_match
->ops
.destroy
= nft_match_destroy
;
566 nft_match
->ops
.dump
= nft_match_dump
;
567 nft_match
->ops
.validate
= nft_match_validate
;
568 nft_match
->ops
.data
= match
;
570 list_add(&nft_match
->head
, &nft_match_list
);
572 return &nft_match
->ops
;
575 static void nft_match_release(void)
577 struct nft_xt
*nft_match
, *tmp
;
579 list_for_each_entry_safe(nft_match
, tmp
, &nft_match_list
, head
)
583 static struct nft_expr_type nft_match_type __read_mostly
= {
585 .select_ops
= nft_match_select_ops
,
586 .policy
= nft_match_policy
,
587 .maxattr
= NFTA_MATCH_MAX
,
588 .owner
= THIS_MODULE
,
591 static LIST_HEAD(nft_target_list
);
593 static struct nft_expr_type nft_target_type
;
595 static const struct nft_expr_ops
*
596 nft_target_select_ops(const struct nft_ctx
*ctx
,
597 const struct nlattr
* const tb
[])
599 struct nft_xt
*nft_target
;
600 struct xt_target
*target
;
604 if (tb
[NFTA_TARGET_NAME
] == NULL
||
605 tb
[NFTA_TARGET_REV
] == NULL
||
606 tb
[NFTA_TARGET_INFO
] == NULL
)
607 return ERR_PTR(-EINVAL
);
609 tg_name
= nla_data(tb
[NFTA_TARGET_NAME
]);
610 rev
= ntohl(nla_get_be32(tb
[NFTA_TARGET_REV
]));
611 family
= ctx
->afi
->family
;
613 /* Re-use the existing target if it's already loaded. */
614 list_for_each_entry(nft_target
, &nft_match_list
, head
) {
615 struct xt_target
*target
= nft_target
->ops
.data
;
617 if (strcmp(target
->name
, tg_name
) == 0 &&
618 target
->revision
== rev
&& target
->family
== family
)
619 return &nft_target
->ops
;
622 target
= xt_request_find_target(family
, tg_name
, rev
);
624 return ERR_PTR(-ENOENT
);
626 /* This is the first time we use this target, allocate operations */
627 nft_target
= kzalloc(sizeof(struct nft_xt
), GFP_KERNEL
);
628 if (nft_target
== NULL
)
629 return ERR_PTR(-ENOMEM
);
631 nft_target
->ops
.type
= &nft_target_type
;
632 nft_target
->ops
.size
= NFT_EXPR_SIZE(XT_ALIGN(target
->targetsize
));
633 nft_target
->ops
.eval
= nft_target_eval
;
634 nft_target
->ops
.init
= nft_target_init
;
635 nft_target
->ops
.destroy
= nft_target_destroy
;
636 nft_target
->ops
.dump
= nft_target_dump
;
637 nft_target
->ops
.validate
= nft_target_validate
;
638 nft_target
->ops
.data
= target
;
640 list_add(&nft_target
->head
, &nft_target_list
);
642 return &nft_target
->ops
;
645 static void nft_target_release(void)
647 struct nft_xt
*nft_target
, *tmp
;
649 list_for_each_entry_safe(nft_target
, tmp
, &nft_target_list
, head
)
653 static struct nft_expr_type nft_target_type __read_mostly
= {
655 .select_ops
= nft_target_select_ops
,
656 .policy
= nft_target_policy
,
657 .maxattr
= NFTA_TARGET_MAX
,
658 .owner
= THIS_MODULE
,
661 static int __init
nft_compat_module_init(void)
665 ret
= nft_register_expr(&nft_match_type
);
669 ret
= nft_register_expr(&nft_target_type
);
673 ret
= nfnetlink_subsys_register(&nfnl_compat_subsys
);
675 pr_err("nft_compat: cannot register with nfnetlink.\n");
679 pr_info("nf_tables_compat: (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>\n");
684 nft_unregister_expr(&nft_target_type
);
686 nft_unregister_expr(&nft_match_type
);
690 static void __exit
nft_compat_module_exit(void)
692 nfnetlink_subsys_unregister(&nfnl_compat_subsys
);
693 nft_unregister_expr(&nft_target_type
);
694 nft_unregister_expr(&nft_match_type
);
696 nft_target_release();
699 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT
);
701 module_init(nft_compat_module_init
);
702 module_exit(nft_compat_module_exit
);
704 MODULE_LICENSE("GPL");
705 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
706 MODULE_ALIAS_NFT_EXPR("match");
707 MODULE_ALIAS_NFT_EXPR("target");