Commit 33d5a7b1 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: extend tracing infrastructure 



nft monitor mode can then decode and display this trace data.

Parts of LL/Network/Transport headers are provided as separate
attributes.

Otherwise, printing IP address data becomes virtually impossible
for userspace since in the case of the netdev family we really don't
want userspace to have to know all the possible link layer types
and/or sizes just to display/print an ip address.

We also don't want userspace to have to follow ipv6 header chains
to get the s/dport info, the kernel already did this work for us.

To avoid bloating nft_do_chain all data required for tracing is
encapsulated in nft_traceinfo.

The structure is initialized unconditionally(!) for each nft_do_chain
invocation.

This unconditionall call will be moved under a static key in a
followup patch.

With lots of help from Patrick McHardy and Pablo Neira.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Acked-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 7ec3f7b4

include/net/netfilter/nf_tables.h

+32 −0
Original line number Diff line number Diff line
@@ -888,6 +888,38 @@ void nft_unregister_chain_type(const struct nf_chain_type *); 
int nft_register_expr(struct nft_expr_type *);

void nft_unregister_expr(struct nft_expr_type *);



int nft_verdict_dump(struct sk_buff *skb, int type,

		     const struct nft_verdict *v);



/**

 *	struct nft_traceinfo - nft tracing information and state

 *

 *	@pkt: pktinfo currently processed

 *	@basechain: base chain currently processed

 *	@chain: chain currently processed

 *	@rule:  rule that was evaluated

 *	@verdict: verdict given by rule

 *	@type: event type (enum nft_trace_types)

 *	@packet_dumped: packet headers sent in a previous traceinfo message

 *	@trace: other struct members are initialised

 */

struct nft_traceinfo {

	const struct nft_pktinfo	*pkt;

	const struct nft_base_chain	*basechain;

	const struct nft_chain		*chain;

	const struct nft_rule		*rule;

	const struct nft_verdict	*verdict;

	enum nft_trace_types		type;

	bool				packet_dumped;

	bool				trace;

};



void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt,

		    const struct nft_verdict *verdict,

		    const struct nft_chain *basechain);



void nft_trace_notify(struct nft_traceinfo *info);



#define nft_dereference(p)					\

	nfnl_dereference(p, NFNL_SUBSYS_NFTABLES)

include/uapi/linux/netfilter/nf_tables.h

+52 −0
Original line number Diff line number Diff line
@@ -83,6 +83,7 @@ enum nft_verdicts { 
 * @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes)

 * @NFT_MSG_NEWGEN: announce a new generation, only for events (enum nft_gen_attributes)

 * @NFT_MSG_GETGEN: get the rule-set generation (enum nft_gen_attributes)

 * @NFT_MSG_TRACE: trace event (enum nft_trace_attributes)

 */

enum nf_tables_msg_types {

	NFT_MSG_NEWTABLE,
@@ -102,6 +103,7 @@ enum nf_tables_msg_types { 
	NFT_MSG_DELSETELEM,

	NFT_MSG_NEWGEN,

	NFT_MSG_GETGEN,

	NFT_MSG_TRACE,

	NFT_MSG_MAX,

};
@@ -987,4 +989,54 @@ enum nft_gen_attributes { 
};

#define NFTA_GEN_MAX		(__NFTA_GEN_MAX - 1)



/**

 * enum nft_trace_attributes - nf_tables trace netlink attributes

 *

 * @NFTA_TRACE_TABLE: name of the table (NLA_STRING)

 * @NFTA_TRACE_CHAIN: name of the chain (NLA_STRING)

 * @NFTA_TRACE_RULE_HANDLE: numeric handle of the rule (NLA_U64)

 * @NFTA_TRACE_TYPE: type of the event (NLA_U32: nft_trace_types)

 * @NFTA_TRACE_VERDICT: verdict returned by hook (NLA_NESTED: nft_verdicts)

 * @NFTA_TRACE_ID: pseudo-id, same for each skb traced (NLA_U32)

 * @NFTA_TRACE_LL_HEADER: linklayer header (NLA_BINARY)

 * @NFTA_TRACE_NETWORK_HEADER: network header (NLA_BINARY)

 * @NFTA_TRACE_TRANSPORT_HEADER: transport header (NLA_BINARY)

 * @NFTA_TRACE_IIF: indev ifindex (NLA_U32)

 * @NFTA_TRACE_IIFTYPE: netdev->type of indev (NLA_U16)

 * @NFTA_TRACE_OIF: outdev ifindex (NLA_U32)

 * @NFTA_TRACE_OIFTYPE: netdev->type of outdev (NLA_U16)

 * @NFTA_TRACE_MARK: nfmark (NLA_U32)

 * @NFTA_TRACE_NFPROTO: nf protocol processed (NLA_U32)

 * @NFTA_TRACE_POLICY: policy that decided fate of packet (NLA_U32)

 */

enum nft_trace_attibutes {

	NFTA_TRACE_UNSPEC,

	NFTA_TRACE_TABLE,

	NFTA_TRACE_CHAIN,

	NFTA_TRACE_RULE_HANDLE,

	NFTA_TRACE_TYPE,

	NFTA_TRACE_VERDICT,

	NFTA_TRACE_ID,

	NFTA_TRACE_LL_HEADER,

	NFTA_TRACE_NETWORK_HEADER,

	NFTA_TRACE_TRANSPORT_HEADER,

	NFTA_TRACE_IIF,

	NFTA_TRACE_IIFTYPE,

	NFTA_TRACE_OIF,

	NFTA_TRACE_OIFTYPE,

	NFTA_TRACE_MARK,

	NFTA_TRACE_NFPROTO,

	NFTA_TRACE_POLICY,

	__NFTA_TRACE_MAX

};

#define NFTA_TRACE_MAX (__NFTA_TRACE_MAX - 1)



enum nft_trace_types {

	NFT_TRACETYPE_UNSPEC,

	NFT_TRACETYPE_POLICY,

	NFT_TRACETYPE_RETURN,

	NFT_TRACETYPE_RULE,

	__NFT_TRACETYPE_MAX

};

#define NFT_TRACETYPE_MAX (__NFT_TRACETYPE_MAX - 1)

#endif /* _LINUX_NF_TABLES_H */

include/uapi/linux/netfilter/nfnetlink.h

+2 −0
Original line number Diff line number Diff line
@@ -22,6 +22,8 @@ enum nfnetlink_groups { 
#define NFNLGRP_NFTABLES                NFNLGRP_NFTABLES

	NFNLGRP_ACCT_QUOTA,

#define NFNLGRP_ACCT_QUOTA		NFNLGRP_ACCT_QUOTA

	NFNLGRP_NFTRACE,

#define NFNLGRP_NFTRACE			NFNLGRP_NFTRACE

	__NFNLGRP_MAX,

};

#define NFNLGRP_MAX	(__NFNLGRP_MAX - 1)

net/netfilter/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -67,7 +67,7 @@ obj-$(CONFIG_NF_NAT_TFTP) += nf_nat_tftp.o 
obj-$(CONFIG_NETFILTER_SYNPROXY) += nf_synproxy_core.o



# nf_tables

nf_tables-objs += nf_tables_core.o nf_tables_api.o

nf_tables-objs += nf_tables_core.o nf_tables_api.o nf_tables_trace.o

nf_tables-objs += nft_immediate.o nft_cmp.o nft_lookup.o nft_dynset.o

nf_tables-objs += nft_bitwise.o nft_byteorder.o nft_payload.o

net/netfilter/nf_tables_api.c

+6 −6
Original line number Diff line number Diff line
@@ -4446,22 +4446,22 @@ static void nft_verdict_uninit(const struct nft_data *data) 
	}

}



static int nft_verdict_dump(struct sk_buff *skb, const struct nft_data *data)

int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)

{

	struct nlattr *nest;



	nest = nla_nest_start(skb, NFTA_DATA_VERDICT);

	nest = nla_nest_start(skb, type);

	if (!nest)

		goto nla_put_failure;



	if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(data->verdict.code)))

	if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))

		goto nla_put_failure;



	switch (data->verdict.code) {

	switch (v->code) {

	case NFT_JUMP:

	case NFT_GOTO:

		if (nla_put_string(skb, NFTA_VERDICT_CHAIN,

				   data->verdict.chain->name))

				   v->chain->name))

			goto nla_put_failure;

	}

	nla_nest_end(skb, nest);
@@ -4572,7 +4572,7 @@ int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, 
		err = nft_value_dump(skb, data, len);

		break;

	case NFT_DATA_VERDICT:

		err = nft_verdict_dump(skb, data);

		err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);

		break;

	default:

		err = -EINVAL;

CRA Git | Maintained and supported by SUSTech CRA and CCSE