[linux-block.git] / net / netfilter / nft_exthdr.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
 *
 * Development of this code funded by Astaro AG (http://www.astaro.com/)
 */

#include <asm/unaligned.h>
#include <linux/kernel.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <linux/sctp.h>
#include <net/netfilter/nf_tables_core.h>
#include <net/netfilter/nf_tables.h>
#include <net/tcp.h>

struct nft_exthdr {
	u8			type;
	u8			offset;
	u8			len;
	u8			op;
	u8			dreg;
	u8			sreg;
	u8			flags;
};

static unsigned int optlen(const u8 *opt, unsigned int offset)
{
	/* Beware zero-length options: make finite progress */
	if (opt[offset] <= TCPOPT_NOP || opt[offset + 1] == 0)
		return 1;
	else
		return opt[offset + 1];
}

static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
				 struct nft_regs *regs,
				 const struct nft_pktinfo *pkt)
{
	struct nft_exthdr *priv = nft_expr_priv(expr);
	u32 *dest = &regs->data[priv->dreg];
	unsigned int offset = 0;
	int err;

	if (pkt->skb->protocol != htons(ETH_P_IPV6))
		goto err;

	err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
	if (priv->flags & NFT_EXTHDR_F_PRESENT) {
		nft_reg_store8(dest, err >= 0);
		return;
	} else if (err < 0) {
		goto err;
	}
	offset += priv->offset;

	dest[priv->len / NFT_REG32_SIZE] = 0;
	if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
		goto err;
	return;
err:
	regs->verdict.code = NFT_BREAK;
}

/* find the offset to specified option.
 *
 * If target header is found, its offset is set in *offset and return option
 * number. Otherwise, return negative error.
 *
 * If the first fragment doesn't contain the End of Options it is considered
 * invalid.
 */
static int ipv4_find_option(struct net *net, struct sk_buff *skb,
			    unsigned int *offset, int target)
{
	unsigned char optbuf[sizeof(struct ip_options) + 40];
	struct ip_options *opt = (struct ip_options *)optbuf;
	struct iphdr *iph, _iph;
	unsigned int start;
	bool found = false;
	__be32 info;
	int optlen;

	iph = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
	if (!iph)
		return -EBADMSG;
	start = sizeof(struct iphdr);

	optlen = iph->ihl * 4 - (int)sizeof(struct iphdr);
	if (optlen <= 0)
		return -ENOENT;

	memset(opt, 0, sizeof(struct ip_options));
	/* Copy the options since __ip_options_compile() modifies
	 * the options.
	 */
	if (skb_copy_bits(skb, start, opt->__data, optlen))
		return -EBADMSG;
	opt->optlen = optlen;

	if (__ip_options_compile(net, opt, NULL, &info))
		return -EBADMSG;

	switch (target) {
	case IPOPT_SSRR:
	case IPOPT_LSRR:
		if (!opt->srr)
			break;
		found = target == IPOPT_SSRR ? opt->is_strictroute :
					       !opt->is_strictroute;
		if (found)
			*offset = opt->srr + start;
		break;
	case IPOPT_RR:
		if (!opt->rr)
			break;
		*offset = opt->rr + start;
		found = true;
		break;
	case IPOPT_RA:
		if (!opt->router_alert)
			break;
		*offset = opt->router_alert + start;
		found = true;
		break;
	default:
		return -EOPNOTSUPP;
	}
	return found ? target : -ENOENT;
}

static void nft_exthdr_ipv4_eval(const struct nft_expr *expr,
				 struct nft_regs *regs,
				 const struct nft_pktinfo *pkt)
{
	struct nft_exthdr *priv = nft_expr_priv(expr);
	u32 *dest = &regs->data[priv->dreg];
	struct sk_buff *skb = pkt->skb;
	unsigned int offset;
	int err;

	if (skb->protocol != htons(ETH_P_IP))
		goto err;

	err = ipv4_find_option(nft_net(pkt), skb, &offset, priv->type);
	if (priv->flags & NFT_EXTHDR_F_PRESENT) {
		nft_reg_store8(dest, err >= 0);
		return;
	} else if (err < 0) {
		goto err;
	}
	offset += priv->offset;

	dest[priv->len / NFT_REG32_SIZE] = 0;
	if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
		goto err;
	return;
err:
	regs->verdict.code = NFT_BREAK;
}

static void *
nft_tcp_header_pointer(const struct nft_pktinfo *pkt,
		       unsigned int len, void *buffer, unsigned int *tcphdr_len)
{
	struct tcphdr *tcph;

	if (pkt->tprot != IPPROTO_TCP || pkt->fragoff)
		return NULL;

	tcph = skb_header_pointer(pkt->skb, nft_thoff(pkt), sizeof(*tcph), buffer);
	if (!tcph)
		return NULL;

	*tcphdr_len = __tcp_hdrlen(tcph);
	if (*tcphdr_len < sizeof(*tcph) || *tcphdr_len > len)
		return NULL;

	return skb_header_pointer(pkt->skb, nft_thoff(pkt), *tcphdr_len, buffer);
}

static void nft_exthdr_tcp_eval(const struct nft_expr *expr,
				struct nft_regs *regs,
				const struct nft_pktinfo *pkt)
{
	u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
	struct nft_exthdr *priv = nft_expr_priv(expr);
	unsigned int i, optl, tcphdr_len, offset;
	u32 *dest = &regs->data[priv->dreg];
	struct tcphdr *tcph;
	u8 *opt;

	tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
	if (!tcph)
		goto err;

	opt = (u8 *)tcph;
	for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
		optl = optlen(opt, i);

		if (priv->type != opt[i])
			continue;

		if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
			goto err;

		offset = i + priv->offset;
		if (priv->flags & NFT_EXTHDR_F_PRESENT) {
			*dest = 1;
		} else {
			dest[priv->len / NFT_REG32_SIZE] = 0;
			memcpy(dest, opt + offset, priv->len);
		}

		return;
	}

err:
	if (priv->flags & NFT_EXTHDR_F_PRESENT)
		*dest = 0;
	else
		regs->verdict.code = NFT_BREAK;
}

static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr,
				    struct nft_regs *regs,
				    const struct nft_pktinfo *pkt)
{
	u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
	struct nft_exthdr *priv = nft_expr_priv(expr);
	unsigned int i, optl, tcphdr_len, offset;
	struct tcphdr *tcph;
	u8 *opt;

	tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
	if (!tcph)
		goto err;

	opt = (u8 *)tcph;
	for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
		union {
			__be16 v16;
			__be32 v32;
		} old, new;

		optl = optlen(opt, i);

		if (priv->type != opt[i])
			continue;

		if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
			goto err;

		if (skb_ensure_writable(pkt->skb,
					nft_thoff(pkt) + i + priv->len))
			goto err;

		tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff,
					      &tcphdr_len);
		if (!tcph)
			goto err;

		offset = i + priv->offset;

		switch (priv->len) {
		case 2:
			old.v16 = (__force __be16)get_unaligned((u16 *)(opt + offset));
			new.v16 = (__force __be16)nft_reg_load16(
				&regs->data[priv->sreg]);

			switch (priv->type) {
			case TCPOPT_MSS:
				/* increase can cause connection to stall */
				if (ntohs(old.v16) <= ntohs(new.v16))
					return;
			break;
			}

			if (old.v16 == new.v16)
				return;

			put_unaligned(new.v16, (__be16*)(opt + offset));
			inet_proto_csum_replace2(&tcph->check, pkt->skb,
						 old.v16, new.v16, false);
			break;
		case 4:
			new.v32 = nft_reg_load_be32(&regs->data[priv->sreg]);
			old.v32 = (__force __be32)get_unaligned((u32 *)(opt + offset));

			if (old.v32 == new.v32)
				return;

			put_unaligned(new.v32, (__be32*)(opt + offset));
			inet_proto_csum_replace4(&tcph->check, pkt->skb,
						 old.v32, new.v32, false);
			break;
		default:
			WARN_ON_ONCE(1);
			break;
		}

		return;
	}
	return;
err:
	regs->verdict.code = NFT_BREAK;
}

static void nft_exthdr_tcp_strip_eval(const struct nft_expr *expr,
				      struct nft_regs *regs,
				      const struct nft_pktinfo *pkt)
{
	u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
	struct nft_exthdr *priv = nft_expr_priv(expr);
	unsigned int i, tcphdr_len, optl;
	struct tcphdr *tcph;
	u8 *opt;

	tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
	if (!tcph)
		goto err;

	if (skb_ensure_writable(pkt->skb, nft_thoff(pkt) + tcphdr_len))
		goto drop;

	opt = (u8 *)nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
	if (!opt)
		goto err;
	for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
		unsigned int j;

		optl = optlen(opt, i);
		if (priv->type != opt[i])
			continue;

		if (i + optl > tcphdr_len)
			goto drop;

		for (j = 0; j < optl; ++j) {
			u16 n = TCPOPT_NOP;
			u16 o = opt[i+j];

			if ((i + j) % 2 == 0) {
				o <<= 8;
				n <<= 8;
			}
			inet_proto_csum_replace2(&tcph->check, pkt->skb, htons(o),
						 htons(n), false);
		}
		memset(opt + i, TCPOPT_NOP, optl);
		return;
	}

	/* option not found, continue. This allows to do multiple
	 * option removals per rule.
	 */
	return;
err:
	regs->verdict.code = NFT_BREAK;
	return;
drop:
	/* can't remove, no choice but to drop */
	regs->verdict.code = NF_DROP;
}

static void nft_exthdr_sctp_eval(const struct nft_expr *expr,
				 struct nft_regs *regs,
				 const struct nft_pktinfo *pkt)
{
	unsigned int offset = nft_thoff(pkt) + sizeof(struct sctphdr);
	struct nft_exthdr *priv = nft_expr_priv(expr);
	u32 *dest = &regs->data[priv->dreg];
	const struct sctp_chunkhdr *sch;
	struct sctp_chunkhdr _sch;

	if (pkt->tprot != IPPROTO_SCTP)
		goto err;

	do {
		sch = skb_header_pointer(pkt->skb, offset, sizeof(_sch), &_sch);
		if (!sch || !sch->length)
			break;

		if (sch->type == priv->type) {
			if (priv->flags & NFT_EXTHDR_F_PRESENT) {
				nft_reg_store8(dest, true);
				return;
			}
			if (priv->offset + priv->len > ntohs(sch->length) ||
			    offset + ntohs(sch->length) > pkt->skb->len)
				break;

			dest[priv->len / NFT_REG32_SIZE] = 0;
			if (skb_copy_bits(pkt->skb, offset + priv->offset,
					  dest, priv->len) < 0)
				break;
			return;
		}
		offset += SCTP_PAD4(ntohs(sch->length));
	} while (offset < pkt->skb->len);
err:
	if (priv->flags & NFT_EXTHDR_F_PRESENT)
		nft_reg_store8(dest, false);
	else
		regs->verdict.code = NFT_BREAK;
}

static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = {
	[NFTA_EXTHDR_DREG]		= { .type = NLA_U32 },
	[NFTA_EXTHDR_TYPE]		= { .type = NLA_U8 },
	[NFTA_EXTHDR_OFFSET]		= { .type = NLA_U32 },
	[NFTA_EXTHDR_LEN]		= { .type = NLA_U32 },
	[NFTA_EXTHDR_FLAGS]		= { .type = NLA_U32 },
	[NFTA_EXTHDR_OP]		= { .type = NLA_U32 },
	[NFTA_EXTHDR_SREG]		= { .type = NLA_U32 },
};

static int nft_exthdr_init(const struct nft_ctx *ctx,
			   const struct nft_expr *expr,
			   const struct nlattr * const tb[])
{
	struct nft_exthdr *priv = nft_expr_priv(expr);
	u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
	int err;

	if (!tb[NFTA_EXTHDR_DREG] ||
	    !tb[NFTA_EXTHDR_TYPE] ||
	    !tb[NFTA_EXTHDR_OFFSET] ||
	    !tb[NFTA_EXTHDR_LEN])
		return -EINVAL;

	err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
	if (err < 0)
		return err;

	err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
	if (err < 0)
		return err;

	if (tb[NFTA_EXTHDR_FLAGS]) {
		err = nft_parse_u32_check(tb[NFTA_EXTHDR_FLAGS], U8_MAX, &flags);
		if (err < 0)
			return err;

		if (flags & ~NFT_EXTHDR_F_PRESENT)
			return -EINVAL;
	}

	if (tb[NFTA_EXTHDR_OP]) {
		err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
		if (err < 0)
			return err;
	}

	priv->type   = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
	priv->offset = offset;
	priv->len    = len;
	priv->flags  = flags;
	priv->op     = op;

	return nft_parse_register_store(ctx, tb[NFTA_EXTHDR_DREG],
					&priv->dreg, NULL, NFT_DATA_VALUE,
					priv->len);
}

static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx,
				   const struct nft_expr *expr,
				   const struct nlattr * const tb[])
{
	struct nft_exthdr *priv = nft_expr_priv(expr);
	u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
	int err;

	if (!tb[NFTA_EXTHDR_SREG] ||
	    !tb[NFTA_EXTHDR_TYPE] ||
	    !tb[NFTA_EXTHDR_OFFSET] ||
	    !tb[NFTA_EXTHDR_LEN])
		return -EINVAL;

	if (tb[NFTA_EXTHDR_DREG] || tb[NFTA_EXTHDR_FLAGS])
		return -EINVAL;

	err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
	if (err < 0)
		return err;

	err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
	if (err < 0)
		return err;

	if (offset < 2)
		return -EOPNOTSUPP;

	switch (len) {
	case 2: break;
	case 4: break;
	default:
		return -EOPNOTSUPP;
	}

	err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
	if (err < 0)
		return err;

	priv->type   = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
	priv->offset = offset;
	priv->len    = len;
	priv->flags  = flags;
	priv->op     = op;

	return nft_parse_register_load(tb[NFTA_EXTHDR_SREG], &priv->sreg,
				       priv->len);
}

static int nft_exthdr_tcp_strip_init(const struct nft_ctx *ctx,
				     const struct nft_expr *expr,
				     const struct nlattr * const tb[])
{
	struct nft_exthdr *priv = nft_expr_priv(expr);

	if (tb[NFTA_EXTHDR_SREG] ||
	    tb[NFTA_EXTHDR_DREG] ||
	    tb[NFTA_EXTHDR_FLAGS] ||
	    tb[NFTA_EXTHDR_OFFSET] ||
	    tb[NFTA_EXTHDR_LEN])
		return -EINVAL;

	if (!tb[NFTA_EXTHDR_TYPE])
		return -EINVAL;

	priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
	priv->op = NFT_EXTHDR_OP_TCPOPT;

	return 0;
}

static int nft_exthdr_ipv4_init(const struct nft_ctx *ctx,
				const struct nft_expr *expr,
				const struct nlattr * const tb[])
{
	struct nft_exthdr *priv = nft_expr_priv(expr);
	int err = nft_exthdr_init(ctx, expr, tb);

	if (err < 0)
		return err;

	switch (priv->type) {
	case IPOPT_SSRR:
	case IPOPT_LSRR:
	case IPOPT_RR:
	case IPOPT_RA:
		break;
	default:
		return -EOPNOTSUPP;
	}
	return 0;
}

static int nft_exthdr_dump_common(struct sk_buff *skb, const struct nft_exthdr *priv)
{
	if (nla_put_u8(skb, NFTA_EXTHDR_TYPE, priv->type))
		goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_EXTHDR_OFFSET, htonl(priv->offset)))
		goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_EXTHDR_LEN, htonl(priv->len)))
		goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_EXTHDR_FLAGS, htonl(priv->flags)))
		goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_EXTHDR_OP, htonl(priv->op)))
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -1;
}

static int nft_exthdr_dump(struct sk_buff *skb,
			   const struct nft_expr *expr, bool reset)
{
	const struct nft_exthdr *priv = nft_expr_priv(expr);

	if (nft_dump_register(skb, NFTA_EXTHDR_DREG, priv->dreg))
		return -1;

	return nft_exthdr_dump_common(skb, priv);
}

static int nft_exthdr_dump_set(struct sk_buff *skb,
			       const struct nft_expr *expr, bool reset)
{
	const struct nft_exthdr *priv = nft_expr_priv(expr);

	if (nft_dump_register(skb, NFTA_EXTHDR_SREG, priv->sreg))
		return -1;

	return nft_exthdr_dump_common(skb, priv);
}

static int nft_exthdr_dump_strip(struct sk_buff *skb,
				 const struct nft_expr *expr, bool reset)
{
	const struct nft_exthdr *priv = nft_expr_priv(expr);

	return nft_exthdr_dump_common(skb, priv);
}

static bool nft_exthdr_reduce(struct nft_regs_track *track,
			       const struct nft_expr *expr)
{
	const struct nft_exthdr *priv = nft_expr_priv(expr);
	const struct nft_exthdr *exthdr;

	if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
		nft_reg_track_update(track, expr, priv->dreg, priv->len);
		return false;
	}

	exthdr = nft_expr_priv(track->regs[priv->dreg].selector);
	if (priv->type != exthdr->type ||
	    priv->op != exthdr->op ||
	    priv->flags != exthdr->flags ||
	    priv->offset != exthdr->offset ||
	    priv->len != exthdr->len) {
		nft_reg_track_update(track, expr, priv->dreg, priv->len);
		return false;
	}

	if (!track->regs[priv->dreg].bitwise)
		return true;

	return nft_expr_reduce_bitwise(track, expr);
}

static const struct nft_expr_ops nft_exthdr_ipv6_ops = {
	.type		= &nft_exthdr_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
	.eval		= nft_exthdr_ipv6_eval,
	.init		= nft_exthdr_init,
	.dump		= nft_exthdr_dump,
	.reduce		= nft_exthdr_reduce,
};

static const struct nft_expr_ops nft_exthdr_ipv4_ops = {
	.type		= &nft_exthdr_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
	.eval		= nft_exthdr_ipv4_eval,
	.init		= nft_exthdr_ipv4_init,
	.dump		= nft_exthdr_dump,
	.reduce		= nft_exthdr_reduce,
};

static const struct nft_expr_ops nft_exthdr_tcp_ops = {
	.type		= &nft_exthdr_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
	.eval		= nft_exthdr_tcp_eval,
	.init		= nft_exthdr_init,
	.dump		= nft_exthdr_dump,
	.reduce		= nft_exthdr_reduce,
};

static const struct nft_expr_ops nft_exthdr_tcp_set_ops = {
	.type		= &nft_exthdr_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
	.eval		= nft_exthdr_tcp_set_eval,
	.init		= nft_exthdr_tcp_set_init,
	.dump		= nft_exthdr_dump_set,
	.reduce		= NFT_REDUCE_READONLY,
};

static const struct nft_expr_ops nft_exthdr_tcp_strip_ops = {
	.type		= &nft_exthdr_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
	.eval		= nft_exthdr_tcp_strip_eval,
	.init		= nft_exthdr_tcp_strip_init,
	.dump		= nft_exthdr_dump_strip,
	.reduce		= NFT_REDUCE_READONLY,
};

static const struct nft_expr_ops nft_exthdr_sctp_ops = {
	.type		= &nft_exthdr_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
	.eval		= nft_exthdr_sctp_eval,
	.init		= nft_exthdr_init,
	.dump		= nft_exthdr_dump,
	.reduce		= nft_exthdr_reduce,
};

static const struct nft_expr_ops *
nft_exthdr_select_ops(const struct nft_ctx *ctx,
		      const struct nlattr * const tb[])
{
	u32 op;

	if (!tb[NFTA_EXTHDR_OP])
		return &nft_exthdr_ipv6_ops;

	if (tb[NFTA_EXTHDR_SREG] && tb[NFTA_EXTHDR_DREG])
		return ERR_PTR(-EOPNOTSUPP);

	op = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OP]));
	switch (op) {
	case NFT_EXTHDR_OP_TCPOPT:
		if (tb[NFTA_EXTHDR_SREG])
			return &nft_exthdr_tcp_set_ops;
		if (tb[NFTA_EXTHDR_DREG])
			return &nft_exthdr_tcp_ops;
		return &nft_exthdr_tcp_strip_ops;
	case NFT_EXTHDR_OP_IPV6:
		if (tb[NFTA_EXTHDR_DREG])
			return &nft_exthdr_ipv6_ops;
		break;
	case NFT_EXTHDR_OP_IPV4:
		if (ctx->family != NFPROTO_IPV6) {
			if (tb[NFTA_EXTHDR_DREG])
				return &nft_exthdr_ipv4_ops;
		}
		break;
	case NFT_EXTHDR_OP_SCTP:
		if (tb[NFTA_EXTHDR_DREG])
			return &nft_exthdr_sctp_ops;
		break;
	}

	return ERR_PTR(-EOPNOTSUPP);
}

struct nft_expr_type nft_exthdr_type __read_mostly = {
	.name		= "exthdr",
	.select_ops	= nft_exthdr_select_ops,
	.policy		= nft_exthdr_policy,
	.maxattr	= NFTA_EXTHDR_MAX,
	.owner		= THIS_MODULE,
};
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
96518518 PM	2	/*
	3	* Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
	4	*
96518518 PM	5	* Development of this code funded by Astaro AG (http://www.astaro.com/)
	6	*/
	7
99d1712b	8	#include <asm/unaligned.h>
96518518	9	#include <linux/kernel.h>
96518518 PM	10	#include <linux/netlink.h>
	11	#include <linux/netfilter.h>
	12	#include <linux/netfilter/nf_tables.h>
133dc203	13	#include <linux/sctp.h>
d0103158	14	#include <net/netfilter/nf_tables_core.h>
96518518	15	#include <net/netfilter/nf_tables.h>
935b7f64	16	#include <net/tcp.h>
96518518 PM	17
	18	struct nft_exthdr {
	19	u8 type;
	20	u8 offset;
	21	u8 len;
935b7f64	22	u8 op;
345023b0	23	u8 dreg;
4f16d25c	24	u8 sreg;
c078ca3b	25	u8 flags;
96518518 PM	26	};
96518518 PM	27
935b7f64 MM	28	static unsigned int optlen(const u8 *opt, unsigned int offset)
	29	{
	30	/* Beware zero-length options: make finite progress */
	31	if (opt[offset] <= TCPOPT_NOP \|\| opt[offset + 1] == 0)
	32	return 1;
	33	else
	34	return opt[offset + 1];
	35	}
	36
	37	static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
	38	struct nft_regs *regs,
	39	const struct nft_pktinfo *pkt)
96518518 PM	40	{
96518518 PM	41	struct nft_exthdr *priv = nft_expr_priv(expr);
49499c3e	42	u32 *dest = &regs->data[priv->dreg];
540436c8	43	unsigned int offset = 0;
96518518 PM	44	int err;
96518518 PM	45
cdd73cc5 PNA	46	if (pkt->skb->protocol != htons(ETH_P_IPV6))
	47	goto err;
	48
96518518	49	err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
c078ca3b	50	if (priv->flags & NFT_EXTHDR_F_PRESENT) {
b4283366	51	nft_reg_store8(dest, err >= 0);
c078ca3b PS	52	return;
c078ca3b PS	53	} else if (err < 0) {
96518518	54	goto err;
c078ca3b	55	}
96518518 PM	56	offset += priv->offset;
96518518 PM	57
49499c3e	58	dest[priv->len / NFT_REG32_SIZE] = 0;
fad136ea	59	if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
96518518 PM	60	goto err;
	61	return;
	62	err:
a55e22e9	63	regs->verdict.code = NFT_BREAK;
96518518 PM	64	}
96518518 PM	65
dbb5281a SS	66	/* find the offset to specified option.
	67	*
	68	* If target header is found, its offset is set in *offset and return option
	69	* number. Otherwise, return negative error.
	70	*
	71	* If the first fragment doesn't contain the End of Options it is considered
	72	* invalid.
	73	*/
	74	static int ipv4_find_option(struct net net, struct sk_buff skb,
	75	unsigned int *offset, int target)
	76	{
	77	unsigned char optbuf[sizeof(struct ip_options) + 40];
	78	struct ip_options opt = (struct ip_options )optbuf;
	79	struct iphdr *iph, _iph;
	80	unsigned int start;
	81	bool found = false;
	82	__be32 info;
	83	int optlen;
	84
	85	iph = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
	86	if (!iph)
	87	return -EBADMSG;
	88	start = sizeof(struct iphdr);
	89
	90	optlen = iph->ihl * 4 - (int)sizeof(struct iphdr);
	91	if (optlen <= 0)
	92	return -ENOENT;
	93
	94	memset(opt, 0, sizeof(struct ip_options));
	95	/* Copy the options since __ip_options_compile() modifies
	96	* the options.
	97	*/
	98	if (skb_copy_bits(skb, start, opt->__data, optlen))
	99	return -EBADMSG;
	100	opt->optlen = optlen;
	101
	102	if (__ip_options_compile(net, opt, NULL, &info))
	103	return -EBADMSG;
	104
	105	switch (target) {
	106	case IPOPT_SSRR:
	107	case IPOPT_LSRR:
	108	if (!opt->srr)
	109	break;
	110	found = target == IPOPT_SSRR ? opt->is_strictroute :
	111	!opt->is_strictroute;
	112	if (found)
	113	*offset = opt->srr + start;
	114	break;
	115	case IPOPT_RR:
	116	if (!opt->rr)
	117	break;
	118	*offset = opt->rr + start;
	119	found = true;
	120	break;
	121	case IPOPT_RA:
	122	if (!opt->router_alert)
	123	break;
	124	*offset = opt->router_alert + start;
	125	found = true;
	126	break;
	127	default:
	128	return -EOPNOTSUPP;
	129	}
130	return found ? target : -ENOENT;
131	}
132
133	static void nft_exthdr_ipv4_eval(const struct nft_expr *expr,
134	struct nft_regs *regs,
135	const struct nft_pktinfo *pkt)
136	{
137	struct nft_exthdr *priv = nft_expr_priv(expr);
138	u32 *dest = &regs->data[priv->dreg];
139	struct sk_buff *skb = pkt->skb;
140	unsigned int offset;
141	int err;
142
143	if (skb->protocol != htons(ETH_P_IP))
144	goto err;
145
146	err = ipv4_find_option(nft_net(pkt), skb, &offset, priv->type);
147	if (priv->flags & NFT_EXTHDR_F_PRESENT) {
b4283366	148	nft_reg_store8(dest, err >= 0);
dbb5281a SS	149	return;
	150	} else if (err < 0) {
	151	goto err;
	152	}
	153	offset += priv->offset;
	154
	155	dest[priv->len / NFT_REG32_SIZE] = 0;
	156	if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
	157	goto err;
	158	return;
	159	err:
	160	regs->verdict.code = NFT_BREAK;
	161	}
	162
a1817700 FW	163	static void *
	164	nft_tcp_header_pointer(const struct nft_pktinfo *pkt,
	165	unsigned int len, void buffer, unsigned int tcphdr_len)
	166	{
	167	struct tcphdr *tcph;
	168
a9e8503d	169	if (pkt->tprot != IPPROTO_TCP \|\| pkt->fragoff)
a1817700 FW	170	return NULL;
a1817700 FW	171
2d7b4ace	172	tcph = skb_header_pointer(pkt->skb, nft_thoff(pkt), sizeof(*tcph), buffer);
a1817700 FW	173	if (!tcph)
	174	return NULL;
	175
	176	*tcphdr_len = __tcp_hdrlen(tcph);
	177	if (tcphdr_len < sizeof(tcph) \|\| *tcphdr_len > len)
	178	return NULL;
	179
2d7b4ace	180	return skb_header_pointer(pkt->skb, nft_thoff(pkt), *tcphdr_len, buffer);
a1817700 FW	181	}
a1817700 FW	182
935b7f64 MM	183	static void nft_exthdr_tcp_eval(const struct nft_expr *expr,
	184	struct nft_regs *regs,
	185	const struct nft_pktinfo *pkt)
	186	{
	187	u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
	188	struct nft_exthdr *priv = nft_expr_priv(expr);
	189	unsigned int i, optl, tcphdr_len, offset;
	190	u32 *dest = &regs->data[priv->dreg];
	191	struct tcphdr *tcph;
	192	u8 *opt;
	193
a1817700	194	tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
935b7f64 MM	195	if (!tcph)
	196	goto err;
	197
	198	opt = (u8 *)tcph;
	199	for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
	200	optl = optlen(opt, i);
	201
	202	if (priv->type != opt[i])
	203	continue;
	204
	205	if (i + optl > tcphdr_len \|\| priv->len + priv->offset > optl)
	206	goto err;
	207
	208	offset = i + priv->offset;
3c1fece8 PS	209	if (priv->flags & NFT_EXTHDR_F_PRESENT) {
	210	*dest = 1;
	211	} else {
	212	dest[priv->len / NFT_REG32_SIZE] = 0;
	213	memcpy(dest, opt + offset, priv->len);
	214	}
935b7f64 MM	215
	216	return;
	217	}
	218
	219	err:
3c1fece8 PS	220	if (priv->flags & NFT_EXTHDR_F_PRESENT)
	221	*dest = 0;
	222	else
	223	regs->verdict.code = NFT_BREAK;
935b7f64 MM	224	}
935b7f64 MM	225
99d1712b FW	226	static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr,
	227	struct nft_regs *regs,
	228	const struct nft_pktinfo *pkt)
	229	{
	230	u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
	231	struct nft_exthdr *priv = nft_expr_priv(expr);
	232	unsigned int i, optl, tcphdr_len, offset;
	233	struct tcphdr *tcph;
	234	u8 *opt;
99d1712b FW	235
	236	tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
	237	if (!tcph)
962e5a40	238	goto err;
99d1712b FW	239
	240	opt = (u8 *)tcph;
	241	for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
	242	union {
99d1712b FW	243	__be16 v16;
	244	__be32 v32;
	245	} old, new;
	246
	247	optl = optlen(opt, i);
	248
	249	if (priv->type != opt[i])
	250	continue;
	251
	252	if (i + optl > tcphdr_len \|\| priv->len + priv->offset > optl)
962e5a40	253	goto err;
99d1712b	254
7418ee4c	255	if (skb_ensure_writable(pkt->skb,
2d7b4ace	256	nft_thoff(pkt) + i + priv->len))
962e5a40	257	goto err;
99d1712b FW	258
	259	tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff,
	260	&tcphdr_len);
	261	if (!tcph)
962e5a40	262	goto err;
99d1712b	263
99d1712b FW	264	offset = i + priv->offset;
	265
	266	switch (priv->len) {
	267	case 2:
ffb3d9a3	268	old.v16 = (__force __be16)get_unaligned((u16 *)(opt + offset));
2e34328b SM	269	new.v16 = (__force __be16)nft_reg_load16(
2e34328b SM	270	&regs->data[priv->sreg]);
99d1712b FW	271
	272	switch (priv->type) {
	273	case TCPOPT_MSS:
	274	/* increase can cause connection to stall */
	275	if (ntohs(old.v16) <= ntohs(new.v16))
	276	return;
	277	break;
	278	}
	279
	280	if (old.v16 == new.v16)
	281	return;
	282
ffb3d9a3	283	put_unaligned(new.v16, (__be16*)(opt + offset));
99d1712b FW	284	inet_proto_csum_replace2(&tcph->check, pkt->skb,
	285	old.v16, new.v16, false);
	286	break;
	287	case 4:
ffb3d9a3 FW	288	new.v32 = nft_reg_load_be32(&regs->data[priv->sreg]);
ffb3d9a3 FW	289	old.v32 = (__force __be32)get_unaligned((u32 *)(opt + offset));
99d1712b FW	290
	291	if (old.v32 == new.v32)
	292	return;
	293
ffb3d9a3	294	put_unaligned(new.v32, (__be32*)(opt + offset));
99d1712b FW	295	inet_proto_csum_replace4(&tcph->check, pkt->skb,
	296	old.v32, new.v32, false);
	297	break;
	298	default:
	299	WARN_ON_ONCE(1);
	300	break;
	301	}
	302
	303	return;
	304	}
962e5a40 PNA	305	return;
	306	err:
	307	regs->verdict.code = NFT_BREAK;
99d1712b FW	308	}
99d1712b FW	309
7890cbea FW	310	static void nft_exthdr_tcp_strip_eval(const struct nft_expr *expr,
	311	struct nft_regs *regs,
	312	const struct nft_pktinfo *pkt)
	313	{
	314	u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
	315	struct nft_exthdr *priv = nft_expr_priv(expr);
	316	unsigned int i, tcphdr_len, optl;
	317	struct tcphdr *tcph;
	318	u8 *opt;
	319
	320	tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
	321	if (!tcph)
	322	goto err;
	323
	324	if (skb_ensure_writable(pkt->skb, nft_thoff(pkt) + tcphdr_len))
	325	goto drop;
	326
	327	opt = (u8 *)nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
	328	if (!opt)
	329	goto err;
	330	for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
	331	unsigned int j;
	332
	333	optl = optlen(opt, i);
	334	if (priv->type != opt[i])
	335	continue;
	336
	337	if (i + optl > tcphdr_len)
	338	goto drop;
	339
	340	for (j = 0; j < optl; ++j) {
	341	u16 n = TCPOPT_NOP;
	342	u16 o = opt[i+j];
	343
	344	if ((i + j) % 2 == 0) {
	345	o <<= 8;
	346	n <<= 8;
	347	}
	348	inet_proto_csum_replace2(&tcph->check, pkt->skb, htons(o),
	349	htons(n), false);
	350	}
	351	memset(opt + i, TCPOPT_NOP, optl);
	352	return;
	353	}
	354
	355	/* option not found, continue. This allows to do multiple
	356	* option removals per rule.
	357	*/
	358	return;
	359	err:
	360	regs->verdict.code = NFT_BREAK;
	361	return;
	362	drop:
	363	/* can't remove, no choice but to drop */
	364	regs->verdict.code = NF_DROP;
	365	}
	366
133dc203 PS	367	static void nft_exthdr_sctp_eval(const struct nft_expr *expr,
	368	struct nft_regs *regs,
	369	const struct nft_pktinfo *pkt)
	370	{
2d7b4ace	371	unsigned int offset = nft_thoff(pkt) + sizeof(struct sctphdr);
133dc203 PS	372	struct nft_exthdr *priv = nft_expr_priv(expr);
	373	u32 *dest = &regs->data[priv->dreg];
	374	const struct sctp_chunkhdr *sch;
	375	struct sctp_chunkhdr _sch;
	376
5acc44f3 PS	377	if (pkt->tprot != IPPROTO_SCTP)
	378	goto err;
	379
133dc203 PS	380	do {
	381	sch = skb_header_pointer(pkt->skb, offset, sizeof(_sch), &_sch);
	382	if (!sch \|\| !sch->length)
	383	break;
	384
	385	if (sch->type == priv->type) {
	386	if (priv->flags & NFT_EXTHDR_F_PRESENT) {
	387	nft_reg_store8(dest, true);
	388	return;
	389	}
	390	if (priv->offset + priv->len > ntohs(sch->length) \|\|
	391	offset + ntohs(sch->length) > pkt->skb->len)
	392	break;
	393
	394	dest[priv->len / NFT_REG32_SIZE] = 0;
cf6b5ffd PS	395	if (skb_copy_bits(pkt->skb, offset + priv->offset,
	396	dest, priv->len) < 0)
	397	break;
133dc203 PS	398	return;
	399	}
	400	offset += SCTP_PAD4(ntohs(sch->length));
	401	} while (offset < pkt->skb->len);
5acc44f3	402	err:
133dc203 PS	403	if (priv->flags & NFT_EXTHDR_F_PRESENT)
	404	nft_reg_store8(dest, false);
	405	else
	406	regs->verdict.code = NFT_BREAK;
	407	}
	408
96518518 PM	409	static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = {
	410	[NFTA_EXTHDR_DREG] = { .type = NLA_U32 },
	411	[NFTA_EXTHDR_TYPE] = { .type = NLA_U8 },
	412	[NFTA_EXTHDR_OFFSET] = { .type = NLA_U32 },
	413	[NFTA_EXTHDR_LEN] = { .type = NLA_U32 },
c078ca3b	414	[NFTA_EXTHDR_FLAGS] = { .type = NLA_U32 },
f5b5702a FW	415	[NFTA_EXTHDR_OP] = { .type = NLA_U32 },
f5b5702a FW	416	[NFTA_EXTHDR_SREG] = { .type = NLA_U32 },
96518518 PM	417	};
	418
	419	static int nft_exthdr_init(const struct nft_ctx *ctx,
	420	const struct nft_expr *expr,
	421	const struct nlattr * const tb[])
	422	{
	423	struct nft_exthdr *priv = nft_expr_priv(expr);
935b7f64	424	u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
21a9e0f1	425	int err;
96518518	426
935b7f64 MM	427	if (!tb[NFTA_EXTHDR_DREG] \|\|
	428	!tb[NFTA_EXTHDR_TYPE] \|\|
	429	!tb[NFTA_EXTHDR_OFFSET] \|\|
	430	!tb[NFTA_EXTHDR_LEN])
96518518 PM	431	return -EINVAL;
96518518 PM	432
36b701fa LGL	433	err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
	434	if (err < 0)
	435	return err;
4da449ae	436
36b701fa LGL	437	err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
	438	if (err < 0)
	439	return err;
4da449ae	440
c078ca3b PS	441	if (tb[NFTA_EXTHDR_FLAGS]) {
	442	err = nft_parse_u32_check(tb[NFTA_EXTHDR_FLAGS], U8_MAX, &flags);
	443	if (err < 0)
	444	return err;
	445
	446	if (flags & ~NFT_EXTHDR_F_PRESENT)
	447	return -EINVAL;
	448	}
	449
935b7f64 MM	450	if (tb[NFTA_EXTHDR_OP]) {
	451	err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
	452	if (err < 0)
	453	return err;
	454	}
	455
96518518	456	priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
4da449ae LGL	457	priv->offset = offset;
4da449ae LGL	458	priv->len = len;
c078ca3b	459	priv->flags = flags;
935b7f64	460	priv->op = op;
96518518	461
345023b0 PNA	462	return nft_parse_register_store(ctx, tb[NFTA_EXTHDR_DREG],
	463	&priv->dreg, NULL, NFT_DATA_VALUE,
	464	priv->len);
96518518 PM	465	}
96518518 PM	466
99d1712b FW	467	static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx,
	468	const struct nft_expr *expr,
	469	const struct nlattr * const tb[])
	470	{
	471	struct nft_exthdr *priv = nft_expr_priv(expr);
	472	u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
	473	int err;
	474
	475	if (!tb[NFTA_EXTHDR_SREG] \|\|
	476	!tb[NFTA_EXTHDR_TYPE] \|\|
	477	!tb[NFTA_EXTHDR_OFFSET] \|\|
	478	!tb[NFTA_EXTHDR_LEN])
	479	return -EINVAL;
	480
	481	if (tb[NFTA_EXTHDR_DREG] \|\| tb[NFTA_EXTHDR_FLAGS])
	482	return -EINVAL;
	483
	484	err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
	485	if (err < 0)
	486	return err;
	487
	488	err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
	489	if (err < 0)
	490	return err;
	491
	492	if (offset < 2)
	493	return -EOPNOTSUPP;
	494
	495	switch (len) {
	496	case 2: break;
	497	case 4: break;
	498	default:
	499	return -EOPNOTSUPP;
	500	}
	501
	502	err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
	503	if (err < 0)
	504	return err;
	505
	506	priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
	507	priv->offset = offset;
	508	priv->len = len;
99d1712b FW	509	priv->flags = flags;
	510	priv->op = op;
	511
4f16d25c PNA	512	return nft_parse_register_load(tb[NFTA_EXTHDR_SREG], &priv->sreg,
4f16d25c PNA	513	priv->len);
99d1712b FW	514	}
99d1712b FW	515
7890cbea FW	516	static int nft_exthdr_tcp_strip_init(const struct nft_ctx *ctx,
	517	const struct nft_expr *expr,
	518	const struct nlattr * const tb[])
	519	{
	520	struct nft_exthdr *priv = nft_expr_priv(expr);
	521
	522	if (tb[NFTA_EXTHDR_SREG] \|\|
	523	tb[NFTA_EXTHDR_DREG] \|\|
	524	tb[NFTA_EXTHDR_FLAGS] \|\|
	525	tb[NFTA_EXTHDR_OFFSET] \|\|
	526	tb[NFTA_EXTHDR_LEN])
	527	return -EINVAL;
	528
	529	if (!tb[NFTA_EXTHDR_TYPE])
	530	return -EINVAL;
	531
	532	priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
	533	priv->op = NFT_EXTHDR_OP_TCPOPT;
	534
	535	return 0;
	536	}
	537
dbb5281a SS	538	static int nft_exthdr_ipv4_init(const struct nft_ctx *ctx,
	539	const struct nft_expr *expr,
	540	const struct nlattr * const tb[])
	541	{
	542	struct nft_exthdr *priv = nft_expr_priv(expr);
	543	int err = nft_exthdr_init(ctx, expr, tb);
	544
	545	if (err < 0)
	546	return err;
	547
	548	switch (priv->type) {
	549	case IPOPT_SSRR:
	550	case IPOPT_LSRR:
	551	case IPOPT_RR:
	552	case IPOPT_RA:
	553	break;
	554	default:
	555	return -EOPNOTSUPP;
	556	}
	557	return 0;
	558	}
	559
5e7d695a	560	static int nft_exthdr_dump_common(struct sk_buff skb, const struct nft_exthdr priv)
96518518	561	{
96518518 PM	562	if (nla_put_u8(skb, NFTA_EXTHDR_TYPE, priv->type))
	563	goto nla_put_failure;
	564	if (nla_put_be32(skb, NFTA_EXTHDR_OFFSET, htonl(priv->offset)))
	565	goto nla_put_failure;
	566	if (nla_put_be32(skb, NFTA_EXTHDR_LEN, htonl(priv->len)))
	567	goto nla_put_failure;
c078ca3b PS	568	if (nla_put_be32(skb, NFTA_EXTHDR_FLAGS, htonl(priv->flags)))
c078ca3b PS	569	goto nla_put_failure;
935b7f64 MM	570	if (nla_put_be32(skb, NFTA_EXTHDR_OP, htonl(priv->op)))
935b7f64 MM	571	goto nla_put_failure;
96518518 PM	572	return 0;
	573
	574	nla_put_failure:
	575	return -1;
	576	}
	577
7d34aa3e PS	578	static int nft_exthdr_dump(struct sk_buff *skb,
7d34aa3e PS	579	const struct nft_expr *expr, bool reset)
5e7d695a FW	580	{
	581	const struct nft_exthdr *priv = nft_expr_priv(expr);
	582
	583	if (nft_dump_register(skb, NFTA_EXTHDR_DREG, priv->dreg))
	584	return -1;
	585
	586	return nft_exthdr_dump_common(skb, priv);
	587	}
	588
7d34aa3e PS	589	static int nft_exthdr_dump_set(struct sk_buff *skb,
7d34aa3e PS	590	const struct nft_expr *expr, bool reset)
99d1712b FW	591	{
	592	const struct nft_exthdr *priv = nft_expr_priv(expr);
	593
	594	if (nft_dump_register(skb, NFTA_EXTHDR_SREG, priv->sreg))
	595	return -1;
	596
	597	return nft_exthdr_dump_common(skb, priv);
	598	}
	599
7d34aa3e PS	600	static int nft_exthdr_dump_strip(struct sk_buff *skb,
7d34aa3e PS	601	const struct nft_expr *expr, bool reset)
7890cbea FW	602	{
	603	const struct nft_exthdr *priv = nft_expr_priv(expr);
	604
	605	return nft_exthdr_dump_common(skb, priv);
	606	}
	607
e86dbdb9 FW	608	static bool nft_exthdr_reduce(struct nft_regs_track *track,
	609	const struct nft_expr *expr)
	610	{
	611	const struct nft_exthdr *priv = nft_expr_priv(expr);
	612	const struct nft_exthdr *exthdr;
	613
	614	if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
	615	nft_reg_track_update(track, expr, priv->dreg, priv->len);
	616	return false;
	617	}
	618
	619	exthdr = nft_expr_priv(track->regs[priv->dreg].selector);
	620	if (priv->type != exthdr->type \|\|
	621	priv->op != exthdr->op \|\|
	622	priv->flags != exthdr->flags \|\|
	623	priv->offset != exthdr->offset \|\|
	624	priv->len != exthdr->len) {
	625	nft_reg_track_update(track, expr, priv->dreg, priv->len);
	626	return false;
	627	}
	628
	629	if (!track->regs[priv->dreg].bitwise)
	630	return true;
	631
	632	return nft_expr_reduce_bitwise(track, expr);
	633	}
	634
935b7f64 MM	635	static const struct nft_expr_ops nft_exthdr_ipv6_ops = {
	636	.type = &nft_exthdr_type,
	637	.size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
	638	.eval = nft_exthdr_ipv6_eval,
	639	.init = nft_exthdr_init,
	640	.dump = nft_exthdr_dump,
e86dbdb9	641	.reduce = nft_exthdr_reduce,
935b7f64 MM	642	};
935b7f64 MM	643
dbb5281a SS	644	static const struct nft_expr_ops nft_exthdr_ipv4_ops = {
	645	.type = &nft_exthdr_type,
	646	.size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
	647	.eval = nft_exthdr_ipv4_eval,
	648	.init = nft_exthdr_ipv4_init,
	649	.dump = nft_exthdr_dump,
e86dbdb9	650	.reduce = nft_exthdr_reduce,
dbb5281a SS	651	};
dbb5281a SS	652
935b7f64	653	static const struct nft_expr_ops nft_exthdr_tcp_ops = {
ef1f7df9	654	.type = &nft_exthdr_type,
96518518	655	.size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
935b7f64	656	.eval = nft_exthdr_tcp_eval,
96518518 PM	657	.init = nft_exthdr_init,
96518518 PM	658	.dump = nft_exthdr_dump,
e86dbdb9	659	.reduce = nft_exthdr_reduce,
ef1f7df9 PM	660	};
ef1f7df9 PM	661
99d1712b FW	662	static const struct nft_expr_ops nft_exthdr_tcp_set_ops = {
	663	.type = &nft_exthdr_type,
	664	.size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
	665	.eval = nft_exthdr_tcp_set_eval,
	666	.init = nft_exthdr_tcp_set_init,
	667	.dump = nft_exthdr_dump_set,
e86dbdb9	668	.reduce = NFT_REDUCE_READONLY,
99d1712b FW	669	};
99d1712b FW	670
7890cbea FW	671	static const struct nft_expr_ops nft_exthdr_tcp_strip_ops = {
	672	.type = &nft_exthdr_type,
	673	.size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
	674	.eval = nft_exthdr_tcp_strip_eval,
	675	.init = nft_exthdr_tcp_strip_init,
	676	.dump = nft_exthdr_dump_strip,
e86dbdb9	677	.reduce = NFT_REDUCE_READONLY,
7890cbea FW	678	};
7890cbea FW	679
133dc203 PS	680	static const struct nft_expr_ops nft_exthdr_sctp_ops = {
	681	.type = &nft_exthdr_type,
	682	.size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
	683	.eval = nft_exthdr_sctp_eval,
	684	.init = nft_exthdr_init,
	685	.dump = nft_exthdr_dump,
e86dbdb9	686	.reduce = nft_exthdr_reduce,
133dc203 PS	687	};
133dc203 PS	688
935b7f64 MM	689	static const struct nft_expr_ops *
	690	nft_exthdr_select_ops(const struct nft_ctx *ctx,
	691	const struct nlattr * const tb[])
	692	{
	693	u32 op;
	694
	695	if (!tb[NFTA_EXTHDR_OP])
	696	return &nft_exthdr_ipv6_ops;
	697
99d1712b FW	698	if (tb[NFTA_EXTHDR_SREG] && tb[NFTA_EXTHDR_DREG])
	699	return ERR_PTR(-EOPNOTSUPP);
	700
5fd02ebe	701	op = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OP]));
935b7f64 MM	702	switch (op) {
935b7f64 MM	703	case NFT_EXTHDR_OP_TCPOPT:
99d1712b FW	704	if (tb[NFTA_EXTHDR_SREG])
	705	return &nft_exthdr_tcp_set_ops;
	706	if (tb[NFTA_EXTHDR_DREG])
	707	return &nft_exthdr_tcp_ops;
7890cbea	708	return &nft_exthdr_tcp_strip_ops;
935b7f64	709	case NFT_EXTHDR_OP_IPV6:
99d1712b FW	710	if (tb[NFTA_EXTHDR_DREG])
	711	return &nft_exthdr_ipv6_ops;
	712	break;
dbb5281a SS	713	case NFT_EXTHDR_OP_IPV4:
	714	if (ctx->family != NFPROTO_IPV6) {
	715	if (tb[NFTA_EXTHDR_DREG])
	716	return &nft_exthdr_ipv4_ops;
	717	}
	718	break;
133dc203 PS	719	case NFT_EXTHDR_OP_SCTP:
	720	if (tb[NFTA_EXTHDR_DREG])
	721	return &nft_exthdr_sctp_ops;
	722	break;
935b7f64 MM	723	}
	724
	725	return ERR_PTR(-EOPNOTSUPP);
	726	}
	727
d0103158	728	struct nft_expr_type nft_exthdr_type __read_mostly = {
ef1f7df9	729	.name = "exthdr",
d4ef3835	730	.select_ops = nft_exthdr_select_ops,
96518518 PM	731	.policy = nft_exthdr_policy,
96518518 PM	732	.maxattr = NFTA_EXTHDR_MAX,
ef1f7df9	733	.owner = THIS_MODULE,
96518518	734	};