nft_meta_bridge.c

  1// SPDX-License-Identifier: GPL-2.0
  2#include <linux/kernel.h>
  3#include <linux/init.h>
  4#include <linux/module.h>
  5#include <linux/netlink.h>
  6#include <linux/netfilter.h>
  7#include <linux/netfilter/nf_tables.h>
  8#include <net/netfilter/nf_tables.h>
  9#include <net/netfilter/nft_meta.h>
 10#include <linux/if_bridge.h>
 11#include <uapi/linux/netfilter_bridge.h> /* NF_BR_PRE_ROUTING */
 12
 13#include "../br_private.h"
 14
 15static const struct net_device *
 16nft_meta_get_bridge(const struct net_device *dev)
 17{
 18	if (dev && netif_is_bridge_port(dev))
 19		return netdev_master_upper_dev_get_rcu((struct net_device *)dev);
 20
 21	return NULL;
 22}
 23
 24static void nft_meta_bridge_get_eval(const struct nft_expr *expr,
 25				     struct nft_regs *regs,
 26				     const struct nft_pktinfo *pkt)
 27{
 28	const struct nft_meta *priv = nft_expr_priv(expr);
 29	const struct net_device *in = nft_in(pkt), *out = nft_out(pkt);
 30	u32 *dest = &regs->data[priv->dreg];
 31	const struct net_device *br_dev;
 32
 33	switch (priv->key) {
 34	case NFT_META_BRI_IIFNAME:
 35		br_dev = nft_meta_get_bridge(in);
 36		break;
 37	case NFT_META_BRI_OIFNAME:
 38		br_dev = nft_meta_get_bridge(out);
 39		break;
 40	case NFT_META_BRI_IIFPVID: {
 41		u16 p_pvid;
 42
 43		br_dev = nft_meta_get_bridge(in);
 44		if (!br_dev || !br_vlan_enabled(br_dev))
 45			goto err;
 46
 47		br_vlan_get_pvid_rcu(in, &p_pvid);
 48		nft_reg_store16(dest, p_pvid);
 49		return;
 50	}
 51	case NFT_META_BRI_IIFVPROTO: {
 52		u16 p_proto;
 53
 54		br_dev = nft_meta_get_bridge(in);
 55		if (!br_dev || !br_vlan_enabled(br_dev))
 56			goto err;
 57
 58		br_vlan_get_proto(br_dev, &p_proto);
 59		nft_reg_store_be16(dest, htons(p_proto));
 60		return;
 61	}
 62	case NFT_META_BRI_IIFHWADDR:
 63		br_dev = nft_meta_get_bridge(in);
 64		if (!br_dev)
 65			goto err;
 66
 67		memcpy(dest, br_dev->dev_addr, ETH_ALEN);
 68		return;
 69	default:
 70		return nft_meta_get_eval(expr, regs, pkt);
 71	}
 72
 73	strscpy_pad((char *)dest, br_dev ? br_dev->name : "", IFNAMSIZ);
 74	return;
 75err:
 76	regs->verdict.code = NFT_BREAK;
 77}
 78
 79static int nft_meta_bridge_get_init(const struct nft_ctx *ctx,
 80				    const struct nft_expr *expr,
 81				    const struct nlattr * const tb[])
 82{
 83	struct nft_meta *priv = nft_expr_priv(expr);
 84	unsigned int len;
 85
 86	priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
 87	switch (priv->key) {
 88	case NFT_META_BRI_IIFNAME:
 89	case NFT_META_BRI_OIFNAME:
 90		len = IFNAMSIZ;
 91		break;
 92	case NFT_META_BRI_IIFPVID:
 93	case NFT_META_BRI_IIFVPROTO:
 94		len = sizeof(u16);
 95		break;
 96	case NFT_META_BRI_IIFHWADDR:
 97		len = ETH_ALEN;
 98		break;
 99	default:
100		return nft_meta_get_init(ctx, expr, tb);
101	}
102
103	priv->len = len;
104	return nft_parse_register_store(ctx, tb[NFTA_META_DREG], &priv->dreg,
105					NULL, NFT_DATA_VALUE, len);
106}
107
108static struct nft_expr_type nft_meta_bridge_type;
109static const struct nft_expr_ops nft_meta_bridge_get_ops = {
110	.type		= &nft_meta_bridge_type,
111	.size		= NFT_EXPR_SIZE(sizeof(struct nft_meta)),
112	.eval		= nft_meta_bridge_get_eval,
113	.init		= nft_meta_bridge_get_init,
114	.dump		= nft_meta_get_dump,
115	.reduce		= nft_meta_get_reduce,
116};
117
118static void nft_meta_bridge_set_eval(const struct nft_expr *expr,
119				     struct nft_regs *regs,
120				     const struct nft_pktinfo *pkt)
121{
122	const struct nft_meta *meta = nft_expr_priv(expr);
123	u32 *sreg = &regs->data[meta->sreg];
124	struct sk_buff *skb = pkt->skb;
125	u8 value8;
126
127	switch (meta->key) {
128	case NFT_META_BRI_BROUTE:
129		value8 = nft_reg_load8(sreg);
130		BR_INPUT_SKB_CB(skb)->br_netfilter_broute = !!value8;
131		break;
132	default:
133		nft_meta_set_eval(expr, regs, pkt);
134	}
135}
136
137static int nft_meta_bridge_set_init(const struct nft_ctx *ctx,
138				    const struct nft_expr *expr,
139				    const struct nlattr * const tb[])
140{
141	struct nft_meta *priv = nft_expr_priv(expr);
142	unsigned int len;
143	int err;
144
145	priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
146	switch (priv->key) {
147	case NFT_META_BRI_BROUTE:
148		len = sizeof(u8);
149		break;
150	default:
151		return nft_meta_set_init(ctx, expr, tb);
152	}
153
154	priv->len = len;
155	err = nft_parse_register_load(ctx, tb[NFTA_META_SREG], &priv->sreg, len);
156	if (err < 0)
157		return err;
158
159	return 0;
160}
161
162static bool nft_meta_bridge_set_reduce(struct nft_regs_track *track,
163				       const struct nft_expr *expr)
164{
165	int i;
166
167	for (i = 0; i < NFT_REG32_NUM; i++) {
168		if (!track->regs[i].selector)
169			continue;
170
171		if (track->regs[i].selector->ops != &nft_meta_bridge_get_ops)
172			continue;
173
174		__nft_reg_track_cancel(track, i);
175	}
176
177	return false;
178}
179
180static int nft_meta_bridge_set_validate(const struct nft_ctx *ctx,
181					const struct nft_expr *expr)
182{
183	struct nft_meta *priv = nft_expr_priv(expr);
184	unsigned int hooks;
185
186	switch (priv->key) {
187	case NFT_META_BRI_BROUTE:
188	case NFT_META_BRI_IIFHWADDR:
189		hooks = 1 << NF_BR_PRE_ROUTING;
190		break;
191	default:
192		return nft_meta_set_validate(ctx, expr);
193	}
194
195	return nft_chain_validate_hooks(ctx->chain, hooks);
196}
197
198static const struct nft_expr_ops nft_meta_bridge_set_ops = {
199	.type		= &nft_meta_bridge_type,
200	.size		= NFT_EXPR_SIZE(sizeof(struct nft_meta)),
201	.eval		= nft_meta_bridge_set_eval,
202	.init		= nft_meta_bridge_set_init,
203	.destroy	= nft_meta_set_destroy,
204	.dump		= nft_meta_set_dump,
205	.reduce		= nft_meta_bridge_set_reduce,
206	.validate	= nft_meta_bridge_set_validate,
207};
208
209static const struct nft_expr_ops *
210nft_meta_bridge_select_ops(const struct nft_ctx *ctx,
211			   const struct nlattr * const tb[])
212{
213	if (tb[NFTA_META_KEY] == NULL)
214		return ERR_PTR(-EINVAL);
215
216	if (tb[NFTA_META_DREG] && tb[NFTA_META_SREG])
217		return ERR_PTR(-EINVAL);
218
219	if (tb[NFTA_META_DREG])
220		return &nft_meta_bridge_get_ops;
221
222	if (tb[NFTA_META_SREG])
223		return &nft_meta_bridge_set_ops;
224
225	return ERR_PTR(-EINVAL);
226}
227
228static struct nft_expr_type nft_meta_bridge_type __read_mostly = {
229	.family         = NFPROTO_BRIDGE,
230	.name           = "meta",
231	.select_ops     = nft_meta_bridge_select_ops,
232	.policy         = nft_meta_policy,
233	.maxattr        = NFTA_META_MAX,
234	.owner          = THIS_MODULE,
235};
236
237static int __init nft_meta_bridge_module_init(void)
238{
239	return nft_register_expr(&nft_meta_bridge_type);
240}
241
242static void __exit nft_meta_bridge_module_exit(void)
243{
244	nft_unregister_expr(&nft_meta_bridge_type);
245}
246
247module_init(nft_meta_bridge_module_init);
248module_exit(nft_meta_bridge_module_exit);
249
250MODULE_LICENSE("GPL");
251MODULE_AUTHOR("wenxu <wenxu@ucloud.cn>");
252MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "meta");
253MODULE_DESCRIPTION("Support for bridge dedicated meta key");