Commit | Line | Data |
---|---|---|
af308b94 PNA |
1 | /* SPDX-License-Identifier: GPL-2.0 */ |
2 | #include <linux/kernel.h> | |
3 | #include <linux/init.h> | |
4 | #include <linux/module.h> | |
5 | #include <linux/seqlock.h> | |
6 | #include <linux/netlink.h> | |
7 | #include <linux/netfilter.h> | |
8 | #include <linux/netfilter/nf_tables.h> | |
9 | #include <net/netfilter/nf_tables.h> | |
10 | #include <net/dst_metadata.h> | |
11 | #include <net/ip_tunnels.h> | |
12 | #include <net/vxlan.h> | |
13 | #include <net/erspan.h> | |
925d8446 | 14 | #include <net/geneve.h> |
af308b94 | 15 | |
aaecfdb5 PNA |
16 | struct nft_tunnel { |
17 | enum nft_tunnel_keys key:8; | |
345023b0 | 18 | u8 dreg; |
a46c52d9 | 19 | enum nft_tunnel_mode mode:8; |
611580d2 | 20 | u8 len; |
aaecfdb5 PNA |
21 | }; |
22 | ||
23 | static void nft_tunnel_get_eval(const struct nft_expr *expr, | |
24 | struct nft_regs *regs, | |
25 | const struct nft_pktinfo *pkt) | |
26 | { | |
27 | const struct nft_tunnel *priv = nft_expr_priv(expr); | |
28 | u32 *dest = ®s->data[priv->dreg]; | |
29 | struct ip_tunnel_info *tun_info; | |
30 | ||
31 | tun_info = skb_tunnel_info(pkt->skb); | |
32 | ||
33 | switch (priv->key) { | |
34 | case NFT_TUNNEL_PATH: | |
a46c52d9 | 35 | if (!tun_info) { |
36 | nft_reg_store8(dest, false); | |
37 | return; | |
38 | } | |
39 | if (priv->mode == NFT_TUNNEL_MODE_NONE || | |
40 | (priv->mode == NFT_TUNNEL_MODE_RX && | |
41 | !(tun_info->mode & IP_TUNNEL_INFO_TX)) || | |
42 | (priv->mode == NFT_TUNNEL_MODE_TX && | |
43 | (tun_info->mode & IP_TUNNEL_INFO_TX))) | |
44 | nft_reg_store8(dest, true); | |
45 | else | |
46 | nft_reg_store8(dest, false); | |
aaecfdb5 PNA |
47 | break; |
48 | case NFT_TUNNEL_ID: | |
49 | if (!tun_info) { | |
50 | regs->verdict.code = NFT_BREAK; | |
51 | return; | |
52 | } | |
a46c52d9 | 53 | if (priv->mode == NFT_TUNNEL_MODE_NONE || |
54 | (priv->mode == NFT_TUNNEL_MODE_RX && | |
55 | !(tun_info->mode & IP_TUNNEL_INFO_TX)) || | |
56 | (priv->mode == NFT_TUNNEL_MODE_TX && | |
57 | (tun_info->mode & IP_TUNNEL_INFO_TX))) | |
58 | *dest = ntohl(tunnel_id_to_key32(tun_info->key.tun_id)); | |
59 | else | |
60 | regs->verdict.code = NFT_BREAK; | |
aaecfdb5 PNA |
61 | break; |
62 | default: | |
63 | WARN_ON(1); | |
64 | regs->verdict.code = NFT_BREAK; | |
65 | } | |
66 | } | |
67 | ||
68 | static const struct nla_policy nft_tunnel_policy[NFTA_TUNNEL_MAX + 1] = { | |
69 | [NFTA_TUNNEL_KEY] = { .type = NLA_U32 }, | |
70 | [NFTA_TUNNEL_DREG] = { .type = NLA_U32 }, | |
a46c52d9 | 71 | [NFTA_TUNNEL_MODE] = { .type = NLA_U32 }, |
aaecfdb5 PNA |
72 | }; |
73 | ||
74 | static int nft_tunnel_get_init(const struct nft_ctx *ctx, | |
75 | const struct nft_expr *expr, | |
76 | const struct nlattr * const tb[]) | |
77 | { | |
78 | struct nft_tunnel *priv = nft_expr_priv(expr); | |
79 | u32 len; | |
80 | ||
1c702bf9 | 81 | if (!tb[NFTA_TUNNEL_KEY] || |
aaecfdb5 PNA |
82 | !tb[NFTA_TUNNEL_DREG]) |
83 | return -EINVAL; | |
84 | ||
85 | priv->key = ntohl(nla_get_be32(tb[NFTA_TUNNEL_KEY])); | |
86 | switch (priv->key) { | |
87 | case NFT_TUNNEL_PATH: | |
88 | len = sizeof(u8); | |
89 | break; | |
90 | case NFT_TUNNEL_ID: | |
91 | len = sizeof(u32); | |
92 | break; | |
93 | default: | |
94 | return -EOPNOTSUPP; | |
95 | } | |
96 | ||
a46c52d9 | 97 | if (tb[NFTA_TUNNEL_MODE]) { |
98 | priv->mode = ntohl(nla_get_be32(tb[NFTA_TUNNEL_MODE])); | |
99 | if (priv->mode > NFT_TUNNEL_MODE_MAX) | |
100 | return -EOPNOTSUPP; | |
101 | } else { | |
102 | priv->mode = NFT_TUNNEL_MODE_NONE; | |
103 | } | |
104 | ||
611580d2 | 105 | priv->len = len; |
345023b0 PNA |
106 | return nft_parse_register_store(ctx, tb[NFTA_TUNNEL_DREG], &priv->dreg, |
107 | NULL, NFT_DATA_VALUE, len); | |
aaecfdb5 PNA |
108 | } |
109 | ||
110 | static int nft_tunnel_get_dump(struct sk_buff *skb, | |
7d34aa3e | 111 | const struct nft_expr *expr, bool reset) |
aaecfdb5 PNA |
112 | { |
113 | const struct nft_tunnel *priv = nft_expr_priv(expr); | |
114 | ||
115 | if (nla_put_be32(skb, NFTA_TUNNEL_KEY, htonl(priv->key))) | |
116 | goto nla_put_failure; | |
117 | if (nft_dump_register(skb, NFTA_TUNNEL_DREG, priv->dreg)) | |
118 | goto nla_put_failure; | |
a46c52d9 | 119 | if (nla_put_be32(skb, NFTA_TUNNEL_MODE, htonl(priv->mode))) |
120 | goto nla_put_failure; | |
aaecfdb5 PNA |
121 | return 0; |
122 | ||
123 | nla_put_failure: | |
124 | return -1; | |
125 | } | |
126 | ||
611580d2 PNA |
127 | static bool nft_tunnel_get_reduce(struct nft_regs_track *track, |
128 | const struct nft_expr *expr) | |
129 | { | |
130 | const struct nft_tunnel *priv = nft_expr_priv(expr); | |
131 | const struct nft_tunnel *tunnel; | |
132 | ||
133 | if (!nft_reg_track_cmp(track, expr, priv->dreg)) { | |
134 | nft_reg_track_update(track, expr, priv->dreg, priv->len); | |
135 | return false; | |
136 | } | |
137 | ||
138 | tunnel = nft_expr_priv(track->regs[priv->dreg].selector); | |
139 | if (priv->key != tunnel->key || | |
140 | priv->dreg != tunnel->dreg || | |
141 | priv->mode != tunnel->mode) { | |
142 | nft_reg_track_update(track, expr, priv->dreg, priv->len); | |
143 | return false; | |
144 | } | |
145 | ||
146 | if (!track->regs[priv->dreg].bitwise) | |
147 | return true; | |
148 | ||
149 | return false; | |
150 | } | |
151 | ||
aaecfdb5 PNA |
152 | static struct nft_expr_type nft_tunnel_type; |
153 | static const struct nft_expr_ops nft_tunnel_get_ops = { | |
154 | .type = &nft_tunnel_type, | |
155 | .size = NFT_EXPR_SIZE(sizeof(struct nft_tunnel)), | |
156 | .eval = nft_tunnel_get_eval, | |
157 | .init = nft_tunnel_get_init, | |
158 | .dump = nft_tunnel_get_dump, | |
611580d2 | 159 | .reduce = nft_tunnel_get_reduce, |
aaecfdb5 PNA |
160 | }; |
161 | ||
162 | static struct nft_expr_type nft_tunnel_type __read_mostly = { | |
163 | .name = "tunnel", | |
01e4092d | 164 | .family = NFPROTO_NETDEV, |
aaecfdb5 PNA |
165 | .ops = &nft_tunnel_get_ops, |
166 | .policy = nft_tunnel_policy, | |
167 | .maxattr = NFTA_TUNNEL_MAX, | |
168 | .owner = THIS_MODULE, | |
169 | }; | |
170 | ||
af308b94 PNA |
171 | struct nft_tunnel_opts { |
172 | union { | |
173 | struct vxlan_metadata vxlan; | |
174 | struct erspan_metadata erspan; | |
925d8446 | 175 | u8 data[IP_TUNNEL_OPTS_MAX]; |
af308b94 PNA |
176 | } u; |
177 | u32 len; | |
483f3fdc | 178 | __be16 flags; |
af308b94 PNA |
179 | }; |
180 | ||
181 | struct nft_tunnel_obj { | |
182 | struct metadata_dst *md; | |
183 | struct nft_tunnel_opts opts; | |
184 | }; | |
185 | ||
186 | static const struct nla_policy nft_tunnel_ip_policy[NFTA_TUNNEL_KEY_IP_MAX + 1] = { | |
187 | [NFTA_TUNNEL_KEY_IP_SRC] = { .type = NLA_U32 }, | |
188 | [NFTA_TUNNEL_KEY_IP_DST] = { .type = NLA_U32 }, | |
189 | }; | |
190 | ||
191 | static int nft_tunnel_obj_ip_init(const struct nft_ctx *ctx, | |
192 | const struct nlattr *attr, | |
193 | struct ip_tunnel_info *info) | |
194 | { | |
195 | struct nlattr *tb[NFTA_TUNNEL_KEY_IP_MAX + 1]; | |
196 | int err; | |
197 | ||
8cb08174 JB |
198 | err = nla_parse_nested_deprecated(tb, NFTA_TUNNEL_KEY_IP_MAX, attr, |
199 | nft_tunnel_ip_policy, NULL); | |
af308b94 PNA |
200 | if (err < 0) |
201 | return err; | |
202 | ||
203 | if (!tb[NFTA_TUNNEL_KEY_IP_DST]) | |
204 | return -EINVAL; | |
205 | ||
206 | if (tb[NFTA_TUNNEL_KEY_IP_SRC]) | |
207 | info->key.u.ipv4.src = nla_get_be32(tb[NFTA_TUNNEL_KEY_IP_SRC]); | |
208 | if (tb[NFTA_TUNNEL_KEY_IP_DST]) | |
209 | info->key.u.ipv4.dst = nla_get_be32(tb[NFTA_TUNNEL_KEY_IP_DST]); | |
210 | ||
211 | return 0; | |
212 | } | |
213 | ||
214 | static const struct nla_policy nft_tunnel_ip6_policy[NFTA_TUNNEL_KEY_IP6_MAX + 1] = { | |
215 | [NFTA_TUNNEL_KEY_IP6_SRC] = { .len = sizeof(struct in6_addr), }, | |
216 | [NFTA_TUNNEL_KEY_IP6_DST] = { .len = sizeof(struct in6_addr), }, | |
217 | [NFTA_TUNNEL_KEY_IP6_FLOWLABEL] = { .type = NLA_U32, } | |
218 | }; | |
219 | ||
220 | static int nft_tunnel_obj_ip6_init(const struct nft_ctx *ctx, | |
221 | const struct nlattr *attr, | |
222 | struct ip_tunnel_info *info) | |
223 | { | |
224 | struct nlattr *tb[NFTA_TUNNEL_KEY_IP6_MAX + 1]; | |
225 | int err; | |
226 | ||
8cb08174 JB |
227 | err = nla_parse_nested_deprecated(tb, NFTA_TUNNEL_KEY_IP6_MAX, attr, |
228 | nft_tunnel_ip6_policy, NULL); | |
af308b94 PNA |
229 | if (err < 0) |
230 | return err; | |
231 | ||
232 | if (!tb[NFTA_TUNNEL_KEY_IP6_DST]) | |
233 | return -EINVAL; | |
234 | ||
235 | if (tb[NFTA_TUNNEL_KEY_IP6_SRC]) { | |
236 | memcpy(&info->key.u.ipv6.src, | |
237 | nla_data(tb[NFTA_TUNNEL_KEY_IP6_SRC]), | |
238 | sizeof(struct in6_addr)); | |
239 | } | |
240 | if (tb[NFTA_TUNNEL_KEY_IP6_DST]) { | |
241 | memcpy(&info->key.u.ipv6.dst, | |
242 | nla_data(tb[NFTA_TUNNEL_KEY_IP6_DST]), | |
243 | sizeof(struct in6_addr)); | |
244 | } | |
245 | if (tb[NFTA_TUNNEL_KEY_IP6_FLOWLABEL]) | |
246 | info->key.label = nla_get_be32(tb[NFTA_TUNNEL_KEY_IP6_FLOWLABEL]); | |
247 | ||
248 | info->mode |= IP_TUNNEL_INFO_IPV6; | |
249 | ||
250 | return 0; | |
251 | } | |
252 | ||
253 | static const struct nla_policy nft_tunnel_opts_vxlan_policy[NFTA_TUNNEL_KEY_VXLAN_MAX + 1] = { | |
254 | [NFTA_TUNNEL_KEY_VXLAN_GBP] = { .type = NLA_U32 }, | |
255 | }; | |
256 | ||
257 | static int nft_tunnel_obj_vxlan_init(const struct nlattr *attr, | |
258 | struct nft_tunnel_opts *opts) | |
259 | { | |
260 | struct nlattr *tb[NFTA_TUNNEL_KEY_VXLAN_MAX + 1]; | |
261 | int err; | |
262 | ||
8cb08174 JB |
263 | err = nla_parse_nested_deprecated(tb, NFTA_TUNNEL_KEY_VXLAN_MAX, attr, |
264 | nft_tunnel_opts_vxlan_policy, NULL); | |
af308b94 PNA |
265 | if (err < 0) |
266 | return err; | |
267 | ||
268 | if (!tb[NFTA_TUNNEL_KEY_VXLAN_GBP]) | |
269 | return -EINVAL; | |
270 | ||
271 | opts->u.vxlan.gbp = ntohl(nla_get_be32(tb[NFTA_TUNNEL_KEY_VXLAN_GBP])); | |
272 | ||
273 | opts->len = sizeof(struct vxlan_metadata); | |
274 | opts->flags = TUNNEL_VXLAN_OPT; | |
275 | ||
276 | return 0; | |
277 | } | |
278 | ||
279 | static const struct nla_policy nft_tunnel_opts_erspan_policy[NFTA_TUNNEL_KEY_ERSPAN_MAX + 1] = { | |
0705f95c | 280 | [NFTA_TUNNEL_KEY_ERSPAN_VERSION] = { .type = NLA_U32 }, |
af308b94 | 281 | [NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX] = { .type = NLA_U32 }, |
0705f95c | 282 | [NFTA_TUNNEL_KEY_ERSPAN_V2_DIR] = { .type = NLA_U8 }, |
af308b94 PNA |
283 | [NFTA_TUNNEL_KEY_ERSPAN_V2_HWID] = { .type = NLA_U8 }, |
284 | }; | |
285 | ||
286 | static int nft_tunnel_obj_erspan_init(const struct nlattr *attr, | |
287 | struct nft_tunnel_opts *opts) | |
288 | { | |
289 | struct nlattr *tb[NFTA_TUNNEL_KEY_ERSPAN_MAX + 1]; | |
290 | uint8_t hwid, dir; | |
291 | int err, version; | |
292 | ||
8cb08174 JB |
293 | err = nla_parse_nested_deprecated(tb, NFTA_TUNNEL_KEY_ERSPAN_MAX, |
294 | attr, nft_tunnel_opts_erspan_policy, | |
295 | NULL); | |
af308b94 PNA |
296 | if (err < 0) |
297 | return err; | |
298 | ||
9ec22d7c FW |
299 | if (!tb[NFTA_TUNNEL_KEY_ERSPAN_VERSION]) |
300 | return -EINVAL; | |
301 | ||
af308b94 PNA |
302 | version = ntohl(nla_get_be32(tb[NFTA_TUNNEL_KEY_ERSPAN_VERSION])); |
303 | switch (version) { | |
304 | case ERSPAN_VERSION: | |
305 | if (!tb[NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX]) | |
306 | return -EINVAL; | |
307 | ||
308 | opts->u.erspan.u.index = | |
309 | nla_get_be32(tb[NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX]); | |
310 | break; | |
311 | case ERSPAN_VERSION2: | |
312 | if (!tb[NFTA_TUNNEL_KEY_ERSPAN_V2_DIR] || | |
313 | !tb[NFTA_TUNNEL_KEY_ERSPAN_V2_HWID]) | |
314 | return -EINVAL; | |
315 | ||
316 | hwid = nla_get_u8(tb[NFTA_TUNNEL_KEY_ERSPAN_V2_HWID]); | |
317 | dir = nla_get_u8(tb[NFTA_TUNNEL_KEY_ERSPAN_V2_DIR]); | |
318 | ||
319 | set_hwid(&opts->u.erspan.u.md2, hwid); | |
320 | opts->u.erspan.u.md2.dir = dir; | |
321 | break; | |
322 | default: | |
323 | return -EOPNOTSUPP; | |
324 | } | |
325 | opts->u.erspan.version = version; | |
326 | ||
327 | opts->len = sizeof(struct erspan_metadata); | |
328 | opts->flags = TUNNEL_ERSPAN_OPT; | |
329 | ||
330 | return 0; | |
331 | } | |
332 | ||
925d8446 XL |
333 | static const struct nla_policy nft_tunnel_opts_geneve_policy[NFTA_TUNNEL_KEY_GENEVE_MAX + 1] = { |
334 | [NFTA_TUNNEL_KEY_GENEVE_CLASS] = { .type = NLA_U16 }, | |
335 | [NFTA_TUNNEL_KEY_GENEVE_TYPE] = { .type = NLA_U8 }, | |
336 | [NFTA_TUNNEL_KEY_GENEVE_DATA] = { .type = NLA_BINARY, .len = 128 }, | |
337 | }; | |
338 | ||
339 | static int nft_tunnel_obj_geneve_init(const struct nlattr *attr, | |
340 | struct nft_tunnel_opts *opts) | |
341 | { | |
342 | struct geneve_opt *opt = (struct geneve_opt *)opts->u.data + opts->len; | |
343 | struct nlattr *tb[NFTA_TUNNEL_KEY_GENEVE_MAX + 1]; | |
344 | int err, data_len; | |
345 | ||
346 | err = nla_parse_nested(tb, NFTA_TUNNEL_KEY_GENEVE_MAX, attr, | |
347 | nft_tunnel_opts_geneve_policy, NULL); | |
348 | if (err < 0) | |
349 | return err; | |
350 | ||
351 | if (!tb[NFTA_TUNNEL_KEY_GENEVE_CLASS] || | |
352 | !tb[NFTA_TUNNEL_KEY_GENEVE_TYPE] || | |
353 | !tb[NFTA_TUNNEL_KEY_GENEVE_DATA]) | |
354 | return -EINVAL; | |
355 | ||
356 | attr = tb[NFTA_TUNNEL_KEY_GENEVE_DATA]; | |
357 | data_len = nla_len(attr); | |
358 | if (data_len % 4) | |
359 | return -EINVAL; | |
360 | ||
361 | opts->len += sizeof(*opt) + data_len; | |
362 | if (opts->len > IP_TUNNEL_OPTS_MAX) | |
363 | return -EINVAL; | |
364 | ||
365 | memcpy(opt->opt_data, nla_data(attr), data_len); | |
366 | opt->length = data_len / 4; | |
367 | opt->opt_class = nla_get_be16(tb[NFTA_TUNNEL_KEY_GENEVE_CLASS]); | |
368 | opt->type = nla_get_u8(tb[NFTA_TUNNEL_KEY_GENEVE_TYPE]); | |
369 | opts->flags = TUNNEL_GENEVE_OPT; | |
370 | ||
371 | return 0; | |
372 | } | |
373 | ||
af308b94 | 374 | static const struct nla_policy nft_tunnel_opts_policy[NFTA_TUNNEL_KEY_OPTS_MAX + 1] = { |
925d8446 XL |
375 | [NFTA_TUNNEL_KEY_OPTS_UNSPEC] = { |
376 | .strict_start_type = NFTA_TUNNEL_KEY_OPTS_GENEVE }, | |
af308b94 PNA |
377 | [NFTA_TUNNEL_KEY_OPTS_VXLAN] = { .type = NLA_NESTED, }, |
378 | [NFTA_TUNNEL_KEY_OPTS_ERSPAN] = { .type = NLA_NESTED, }, | |
925d8446 | 379 | [NFTA_TUNNEL_KEY_OPTS_GENEVE] = { .type = NLA_NESTED, }, |
af308b94 PNA |
380 | }; |
381 | ||
382 | static int nft_tunnel_obj_opts_init(const struct nft_ctx *ctx, | |
383 | const struct nlattr *attr, | |
384 | struct ip_tunnel_info *info, | |
385 | struct nft_tunnel_opts *opts) | |
386 | { | |
925d8446 | 387 | struct nlattr *nla; |
ffb3d9a3 FW |
388 | __be16 type = 0; |
389 | int err, rem; | |
af308b94 | 390 | |
925d8446 XL |
391 | err = nla_validate_nested_deprecated(attr, NFTA_TUNNEL_KEY_OPTS_MAX, |
392 | nft_tunnel_opts_policy, NULL); | |
af308b94 PNA |
393 | if (err < 0) |
394 | return err; | |
395 | ||
925d8446 XL |
396 | nla_for_each_attr(nla, nla_data(attr), nla_len(attr), rem) { |
397 | switch (nla_type(nla)) { | |
398 | case NFTA_TUNNEL_KEY_OPTS_VXLAN: | |
399 | if (type) | |
400 | return -EINVAL; | |
401 | err = nft_tunnel_obj_vxlan_init(nla, opts); | |
402 | if (err) | |
403 | return err; | |
404 | type = TUNNEL_VXLAN_OPT; | |
405 | break; | |
406 | case NFTA_TUNNEL_KEY_OPTS_ERSPAN: | |
407 | if (type) | |
408 | return -EINVAL; | |
409 | err = nft_tunnel_obj_erspan_init(nla, opts); | |
410 | if (err) | |
411 | return err; | |
412 | type = TUNNEL_ERSPAN_OPT; | |
413 | break; | |
414 | case NFTA_TUNNEL_KEY_OPTS_GENEVE: | |
415 | if (type && type != TUNNEL_GENEVE_OPT) | |
416 | return -EINVAL; | |
417 | err = nft_tunnel_obj_geneve_init(nla, opts); | |
418 | if (err) | |
419 | return err; | |
420 | type = TUNNEL_GENEVE_OPT; | |
421 | break; | |
422 | default: | |
423 | return -EOPNOTSUPP; | |
424 | } | |
af308b94 PNA |
425 | } |
426 | ||
427 | return err; | |
428 | } | |
429 | ||
430 | static const struct nla_policy nft_tunnel_key_policy[NFTA_TUNNEL_KEY_MAX + 1] = { | |
431 | [NFTA_TUNNEL_KEY_IP] = { .type = NLA_NESTED, }, | |
432 | [NFTA_TUNNEL_KEY_IP6] = { .type = NLA_NESTED, }, | |
433 | [NFTA_TUNNEL_KEY_ID] = { .type = NLA_U32, }, | |
434 | [NFTA_TUNNEL_KEY_FLAGS] = { .type = NLA_U32, }, | |
435 | [NFTA_TUNNEL_KEY_TOS] = { .type = NLA_U8, }, | |
436 | [NFTA_TUNNEL_KEY_TTL] = { .type = NLA_U8, }, | |
88a63771 JK |
437 | [NFTA_TUNNEL_KEY_SPORT] = { .type = NLA_U16, }, |
438 | [NFTA_TUNNEL_KEY_DPORT] = { .type = NLA_U16, }, | |
af308b94 PNA |
439 | [NFTA_TUNNEL_KEY_OPTS] = { .type = NLA_NESTED, }, |
440 | }; | |
441 | ||
442 | static int nft_tunnel_obj_init(const struct nft_ctx *ctx, | |
443 | const struct nlattr * const tb[], | |
444 | struct nft_object *obj) | |
445 | { | |
446 | struct nft_tunnel_obj *priv = nft_obj_data(obj); | |
447 | struct ip_tunnel_info info; | |
448 | struct metadata_dst *md; | |
449 | int err; | |
450 | ||
451 | if (!tb[NFTA_TUNNEL_KEY_ID]) | |
452 | return -EINVAL; | |
453 | ||
454 | memset(&info, 0, sizeof(info)); | |
455 | info.mode = IP_TUNNEL_INFO_TX; | |
456 | info.key.tun_id = key32_to_tunnel_id(nla_get_be32(tb[NFTA_TUNNEL_KEY_ID])); | |
457 | info.key.tun_flags = TUNNEL_KEY | TUNNEL_CSUM | TUNNEL_NOCACHE; | |
458 | ||
459 | if (tb[NFTA_TUNNEL_KEY_IP]) { | |
460 | err = nft_tunnel_obj_ip_init(ctx, tb[NFTA_TUNNEL_KEY_IP], &info); | |
461 | if (err < 0) | |
462 | return err; | |
463 | } else if (tb[NFTA_TUNNEL_KEY_IP6]) { | |
464 | err = nft_tunnel_obj_ip6_init(ctx, tb[NFTA_TUNNEL_KEY_IP6], &info); | |
465 | if (err < 0) | |
466 | return err; | |
467 | } else { | |
468 | return -EINVAL; | |
469 | } | |
470 | ||
471 | if (tb[NFTA_TUNNEL_KEY_SPORT]) { | |
483f3fdc | 472 | info.key.tp_src = nla_get_be16(tb[NFTA_TUNNEL_KEY_SPORT]); |
af308b94 PNA |
473 | } |
474 | if (tb[NFTA_TUNNEL_KEY_DPORT]) { | |
483f3fdc | 475 | info.key.tp_dst = nla_get_be16(tb[NFTA_TUNNEL_KEY_DPORT]); |
af308b94 PNA |
476 | } |
477 | ||
478 | if (tb[NFTA_TUNNEL_KEY_FLAGS]) { | |
479 | u32 tun_flags; | |
480 | ||
481 | tun_flags = ntohl(nla_get_be32(tb[NFTA_TUNNEL_KEY_FLAGS])); | |
482 | if (tun_flags & ~NFT_TUNNEL_F_MASK) | |
483 | return -EOPNOTSUPP; | |
484 | ||
485 | if (tun_flags & NFT_TUNNEL_F_ZERO_CSUM_TX) | |
486 | info.key.tun_flags &= ~TUNNEL_CSUM; | |
487 | if (tun_flags & NFT_TUNNEL_F_DONT_FRAGMENT) | |
488 | info.key.tun_flags |= TUNNEL_DONT_FRAGMENT; | |
489 | if (tun_flags & NFT_TUNNEL_F_SEQ_NUMBER) | |
490 | info.key.tun_flags |= TUNNEL_SEQ; | |
491 | } | |
492 | if (tb[NFTA_TUNNEL_KEY_TOS]) | |
493 | info.key.tos = nla_get_u8(tb[NFTA_TUNNEL_KEY_TOS]); | |
494 | if (tb[NFTA_TUNNEL_KEY_TTL]) | |
495 | info.key.ttl = nla_get_u8(tb[NFTA_TUNNEL_KEY_TTL]); | |
496 | else | |
497 | info.key.ttl = U8_MAX; | |
498 | ||
499 | if (tb[NFTA_TUNNEL_KEY_OPTS]) { | |
500 | err = nft_tunnel_obj_opts_init(ctx, tb[NFTA_TUNNEL_KEY_OPTS], | |
501 | &info, &priv->opts); | |
502 | if (err < 0) | |
503 | return err; | |
504 | } | |
505 | ||
506 | md = metadata_dst_alloc(priv->opts.len, METADATA_IP_TUNNEL, GFP_KERNEL); | |
507 | if (!md) | |
508 | return -ENOMEM; | |
509 | ||
510 | memcpy(&md->u.tun_info, &info, sizeof(info)); | |
3e511d56 | 511 | #ifdef CONFIG_DST_CACHE |
512 | err = dst_cache_init(&md->u.tun_info.dst_cache, GFP_KERNEL); | |
513 | if (err < 0) { | |
514 | metadata_dst_free(md); | |
515 | return err; | |
516 | } | |
517 | #endif | |
af308b94 PNA |
518 | ip_tunnel_info_opts_set(&md->u.tun_info, &priv->opts.u, priv->opts.len, |
519 | priv->opts.flags); | |
520 | priv->md = md; | |
521 | ||
522 | return 0; | |
523 | } | |
524 | ||
525 | static inline void nft_tunnel_obj_eval(struct nft_object *obj, | |
526 | struct nft_regs *regs, | |
527 | const struct nft_pktinfo *pkt) | |
528 | { | |
529 | struct nft_tunnel_obj *priv = nft_obj_data(obj); | |
530 | struct sk_buff *skb = pkt->skb; | |
531 | ||
532 | skb_dst_drop(skb); | |
533 | dst_hold((struct dst_entry *) priv->md); | |
534 | skb_dst_set(skb, (struct dst_entry *) priv->md); | |
535 | } | |
536 | ||
537 | static int nft_tunnel_ip_dump(struct sk_buff *skb, struct ip_tunnel_info *info) | |
538 | { | |
539 | struct nlattr *nest; | |
540 | ||
541 | if (info->mode & IP_TUNNEL_INFO_IPV6) { | |
ae0be8de | 542 | nest = nla_nest_start_noflag(skb, NFTA_TUNNEL_KEY_IP6); |
af308b94 PNA |
543 | if (!nest) |
544 | return -1; | |
545 | ||
7e039984 XL |
546 | if (nla_put_in6_addr(skb, NFTA_TUNNEL_KEY_IP6_SRC, |
547 | &info->key.u.ipv6.src) < 0 || | |
548 | nla_put_in6_addr(skb, NFTA_TUNNEL_KEY_IP6_DST, | |
549 | &info->key.u.ipv6.dst) < 0 || | |
550 | nla_put_be32(skb, NFTA_TUNNEL_KEY_IP6_FLOWLABEL, | |
551 | info->key.label)) { | |
552 | nla_nest_cancel(skb, nest); | |
af308b94 | 553 | return -1; |
7e039984 | 554 | } |
af308b94 PNA |
555 | |
556 | nla_nest_end(skb, nest); | |
557 | } else { | |
ae0be8de | 558 | nest = nla_nest_start_noflag(skb, NFTA_TUNNEL_KEY_IP); |
af308b94 PNA |
559 | if (!nest) |
560 | return -1; | |
561 | ||
7e039984 XL |
562 | if (nla_put_in_addr(skb, NFTA_TUNNEL_KEY_IP_SRC, |
563 | info->key.u.ipv4.src) < 0 || | |
564 | nla_put_in_addr(skb, NFTA_TUNNEL_KEY_IP_DST, | |
565 | info->key.u.ipv4.dst) < 0) { | |
566 | nla_nest_cancel(skb, nest); | |
af308b94 | 567 | return -1; |
7e039984 | 568 | } |
af308b94 PNA |
569 | |
570 | nla_nest_end(skb, nest); | |
571 | } | |
572 | ||
573 | return 0; | |
574 | } | |
575 | ||
576 | static int nft_tunnel_opts_dump(struct sk_buff *skb, | |
577 | struct nft_tunnel_obj *priv) | |
578 | { | |
579 | struct nft_tunnel_opts *opts = &priv->opts; | |
73239bd9 | 580 | struct nlattr *nest, *inner; |
af308b94 | 581 | |
ae0be8de | 582 | nest = nla_nest_start_noflag(skb, NFTA_TUNNEL_KEY_OPTS); |
af308b94 PNA |
583 | if (!nest) |
584 | return -1; | |
585 | ||
586 | if (opts->flags & TUNNEL_VXLAN_OPT) { | |
73239bd9 XL |
587 | inner = nla_nest_start_noflag(skb, NFTA_TUNNEL_KEY_OPTS_VXLAN); |
588 | if (!inner) | |
7e039984 | 589 | goto failure; |
af308b94 PNA |
590 | if (nla_put_be32(skb, NFTA_TUNNEL_KEY_VXLAN_GBP, |
591 | htonl(opts->u.vxlan.gbp))) | |
7e039984 | 592 | goto inner_failure; |
73239bd9 | 593 | nla_nest_end(skb, inner); |
af308b94 | 594 | } else if (opts->flags & TUNNEL_ERSPAN_OPT) { |
73239bd9 XL |
595 | inner = nla_nest_start_noflag(skb, NFTA_TUNNEL_KEY_OPTS_ERSPAN); |
596 | if (!inner) | |
7e039984 | 597 | goto failure; |
2149f36d XL |
598 | if (nla_put_be32(skb, NFTA_TUNNEL_KEY_ERSPAN_VERSION, |
599 | htonl(opts->u.erspan.version))) | |
7e039984 | 600 | goto inner_failure; |
af308b94 PNA |
601 | switch (opts->u.erspan.version) { |
602 | case ERSPAN_VERSION: | |
603 | if (nla_put_be32(skb, NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX, | |
604 | opts->u.erspan.u.index)) | |
7e039984 | 605 | goto inner_failure; |
af308b94 PNA |
606 | break; |
607 | case ERSPAN_VERSION2: | |
608 | if (nla_put_u8(skb, NFTA_TUNNEL_KEY_ERSPAN_V2_HWID, | |
609 | get_hwid(&opts->u.erspan.u.md2)) || | |
610 | nla_put_u8(skb, NFTA_TUNNEL_KEY_ERSPAN_V2_DIR, | |
611 | opts->u.erspan.u.md2.dir)) | |
7e039984 | 612 | goto inner_failure; |
af308b94 PNA |
613 | break; |
614 | } | |
73239bd9 | 615 | nla_nest_end(skb, inner); |
925d8446 XL |
616 | } else if (opts->flags & TUNNEL_GENEVE_OPT) { |
617 | struct geneve_opt *opt; | |
618 | int offset = 0; | |
619 | ||
620 | inner = nla_nest_start_noflag(skb, NFTA_TUNNEL_KEY_OPTS_GENEVE); | |
621 | if (!inner) | |
622 | goto failure; | |
623 | while (opts->len > offset) { | |
624 | opt = (struct geneve_opt *)opts->u.data + offset; | |
625 | if (nla_put_be16(skb, NFTA_TUNNEL_KEY_GENEVE_CLASS, | |
626 | opt->opt_class) || | |
627 | nla_put_u8(skb, NFTA_TUNNEL_KEY_GENEVE_TYPE, | |
628 | opt->type) || | |
629 | nla_put(skb, NFTA_TUNNEL_KEY_GENEVE_DATA, | |
630 | opt->length * 4, opt->opt_data)) | |
631 | goto inner_failure; | |
632 | offset += sizeof(*opt) + opt->length * 4; | |
633 | } | |
634 | nla_nest_end(skb, inner); | |
af308b94 PNA |
635 | } |
636 | nla_nest_end(skb, nest); | |
af308b94 | 637 | return 0; |
7e039984 XL |
638 | |
639 | inner_failure: | |
640 | nla_nest_cancel(skb, inner); | |
641 | failure: | |
642 | nla_nest_cancel(skb, nest); | |
643 | return -1; | |
af308b94 PNA |
644 | } |
645 | ||
646 | static int nft_tunnel_ports_dump(struct sk_buff *skb, | |
647 | struct ip_tunnel_info *info) | |
648 | { | |
cf3e204a XL |
649 | if (nla_put_be16(skb, NFTA_TUNNEL_KEY_SPORT, info->key.tp_src) < 0 || |
650 | nla_put_be16(skb, NFTA_TUNNEL_KEY_DPORT, info->key.tp_dst) < 0) | |
af308b94 PNA |
651 | return -1; |
652 | ||
653 | return 0; | |
654 | } | |
655 | ||
656 | static int nft_tunnel_flags_dump(struct sk_buff *skb, | |
657 | struct ip_tunnel_info *info) | |
658 | { | |
659 | u32 flags = 0; | |
660 | ||
661 | if (info->key.tun_flags & TUNNEL_DONT_FRAGMENT) | |
662 | flags |= NFT_TUNNEL_F_DONT_FRAGMENT; | |
663 | if (!(info->key.tun_flags & TUNNEL_CSUM)) | |
664 | flags |= NFT_TUNNEL_F_ZERO_CSUM_TX; | |
665 | if (info->key.tun_flags & TUNNEL_SEQ) | |
666 | flags |= NFT_TUNNEL_F_SEQ_NUMBER; | |
667 | ||
668 | if (nla_put_be32(skb, NFTA_TUNNEL_KEY_FLAGS, htonl(flags)) < 0) | |
669 | return -1; | |
670 | ||
671 | return 0; | |
672 | } | |
673 | ||
674 | static int nft_tunnel_obj_dump(struct sk_buff *skb, | |
675 | struct nft_object *obj, bool reset) | |
676 | { | |
677 | struct nft_tunnel_obj *priv = nft_obj_data(obj); | |
678 | struct ip_tunnel_info *info = &priv->md->u.tun_info; | |
679 | ||
680 | if (nla_put_be32(skb, NFTA_TUNNEL_KEY_ID, | |
681 | tunnel_id_to_key32(info->key.tun_id)) || | |
682 | nft_tunnel_ip_dump(skb, info) < 0 || | |
683 | nft_tunnel_ports_dump(skb, info) < 0 || | |
684 | nft_tunnel_flags_dump(skb, info) < 0 || | |
685 | nla_put_u8(skb, NFTA_TUNNEL_KEY_TOS, info->key.tos) || | |
686 | nla_put_u8(skb, NFTA_TUNNEL_KEY_TTL, info->key.ttl) || | |
687 | nft_tunnel_opts_dump(skb, priv) < 0) | |
688 | goto nla_put_failure; | |
689 | ||
690 | return 0; | |
691 | ||
692 | nla_put_failure: | |
693 | return -1; | |
694 | } | |
695 | ||
696 | static void nft_tunnel_obj_destroy(const struct nft_ctx *ctx, | |
697 | struct nft_object *obj) | |
698 | { | |
699 | struct nft_tunnel_obj *priv = nft_obj_data(obj); | |
700 | ||
701 | metadata_dst_free(priv->md); | |
702 | } | |
703 | ||
704 | static struct nft_object_type nft_tunnel_obj_type; | |
705 | static const struct nft_object_ops nft_tunnel_obj_ops = { | |
706 | .type = &nft_tunnel_obj_type, | |
707 | .size = sizeof(struct nft_tunnel_obj), | |
708 | .eval = nft_tunnel_obj_eval, | |
709 | .init = nft_tunnel_obj_init, | |
710 | .destroy = nft_tunnel_obj_destroy, | |
711 | .dump = nft_tunnel_obj_dump, | |
712 | }; | |
713 | ||
714 | static struct nft_object_type nft_tunnel_obj_type __read_mostly = { | |
715 | .type = NFT_OBJECT_TUNNEL, | |
716 | .ops = &nft_tunnel_obj_ops, | |
717 | .maxattr = NFTA_TUNNEL_KEY_MAX, | |
718 | .policy = nft_tunnel_key_policy, | |
719 | .owner = THIS_MODULE, | |
720 | }; | |
721 | ||
722 | static int __init nft_tunnel_module_init(void) | |
723 | { | |
aaecfdb5 PNA |
724 | int err; |
725 | ||
726 | err = nft_register_expr(&nft_tunnel_type); | |
727 | if (err < 0) | |
728 | return err; | |
729 | ||
730 | err = nft_register_obj(&nft_tunnel_obj_type); | |
731 | if (err < 0) | |
732 | nft_unregister_expr(&nft_tunnel_type); | |
733 | ||
734 | return err; | |
af308b94 PNA |
735 | } |
736 | ||
737 | static void __exit nft_tunnel_module_exit(void) | |
738 | { | |
739 | nft_unregister_obj(&nft_tunnel_obj_type); | |
aaecfdb5 | 740 | nft_unregister_expr(&nft_tunnel_type); |
af308b94 PNA |
741 | } |
742 | ||
743 | module_init(nft_tunnel_module_init); | |
744 | module_exit(nft_tunnel_module_exit); | |
745 | ||
746 | MODULE_LICENSE("GPL"); | |
747 | MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); | |
aaecfdb5 | 748 | MODULE_ALIAS_NFT_EXPR("tunnel"); |
af308b94 | 749 | MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_TUNNEL); |
4cacc395 | 750 | MODULE_DESCRIPTION("nftables tunnel expression support"); |