Commit f6d0cbcf authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: add fib expression 

Add FIB expression, supported for ipv4, ipv6 and inet family (the latter
just dispatches to ipv4 or ipv6 one based on nfproto).

Currently supports fetching output interface index/name and the
rtm_type associated with an address.

This can be used for adding path filtering. rtm_type is useful
to e.g. enforce a strong-end host model where packets
are only accepted if daddr is configured on the interface the
packet arrived on.

The fib expression is a native nftables alternative to the
xtables addrtype and rp_filter matches.

FIB result order for oif/oifname retrieval is as follows:
 - if packet is local (skb has rtable, RTF_LOCAL set, this
   will also catch looped-back multicast packets), set oif to
   the loopback interface.
 - if fib lookup returns an error, or result points to local,
   store zero result.  This means '--local' option of -m rpfilter
   is not supported. It is possible to use 'fib type local' or add
   explicit saddr/daddr matching rules to create exceptions if this
   is really needed.
 - store result in the destination register.
   In case of multiple routes, search set for desired oif in case
   strict matching is requested.

ipv4 and ipv6 behave fib expressions are supposed to behave the same.

[ I have collapsed Arnd Bergmann's ("netfilter: nf_tables: fib warnings")

	http://patchwork.ozlabs.org/patch/688615/



  to address fallout from this patch after rebasing nf-next, that was
  posted to address compilation warnings. --pablo ]

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 25443261

include/net/netfilter/nft_fib.h

0 → 100644
+31 −0
Original line number Diff line number Diff line 
#ifndef _NFT_FIB_H_

#define _NFT_FIB_H_



struct nft_fib {

	enum nft_registers	dreg:8;

	u8			result;

	u32			flags;

};



extern const struct nla_policy nft_fib_policy[];



int nft_fib_dump(struct sk_buff *skb, const struct nft_expr *expr);

int nft_fib_init(const struct nft_ctx *ctx, const struct nft_expr *expr,

		 const struct nlattr * const tb[]);

int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,

		     const struct nft_data **data);





void nft_fib4_eval_type(const struct nft_expr *expr, struct nft_regs *regs,

			const struct nft_pktinfo *pkt);

void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,

		   const struct nft_pktinfo *pkt);



void nft_fib6_eval_type(const struct nft_expr *expr, struct nft_regs *regs,

			const struct nft_pktinfo *pkt);

void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,

		   const struct nft_pktinfo *pkt);



void nft_fib_store_result(void *reg, enum nft_fib_result r,

			  const struct nft_pktinfo *pkt, int index);

#endif

include/uapi/linux/netfilter/nf_tables.h

+36 −0
Original line number Diff line number Diff line
@@ -1109,6 +1109,42 @@ enum nft_gen_attributes { 
};

#define NFTA_GEN_MAX		(__NFTA_GEN_MAX - 1)



/*

 * enum nft_fib_attributes - nf_tables fib expression netlink attributes

 *

 * @NFTA_FIB_DREG: destination register (NLA_U32)

 * @NFTA_FIB_RESULT: desired result (NLA_U32)

 * @NFTA_FIB_FLAGS: flowi fields to initialize when querying the FIB (NLA_U32)

 *

 * The FIB expression performs a route lookup according

 * to the packet data.

 */

enum nft_fib_attributes {

	NFTA_FIB_UNSPEC,

	NFTA_FIB_DREG,

	NFTA_FIB_RESULT,

	NFTA_FIB_FLAGS,

	__NFTA_FIB_MAX

};

#define NFTA_FIB_MAX (__NFTA_FIB_MAX - 1)



enum nft_fib_result {

	NFT_FIB_RESULT_UNSPEC,

	NFT_FIB_RESULT_OIF,

	NFT_FIB_RESULT_OIFNAME,

	NFT_FIB_RESULT_ADDRTYPE,

	__NFT_FIB_RESULT_MAX

};

#define NFT_FIB_RESULT_MAX	(__NFT_FIB_RESULT_MAX - 1)



enum nft_fib_flags {

	NFTA_FIB_F_SADDR	= 1 << 0,	/* look up src */

	NFTA_FIB_F_DADDR	= 1 << 1,	/* look up dst */

	NFTA_FIB_F_MARK		= 1 << 2,	/* use skb->mark */

	NFTA_FIB_F_IIF		= 1 << 3,	/* restrict to iif */

	NFTA_FIB_F_OIF		= 1 << 4,	/* restrict to oif */

};



/**

 * enum nft_trace_attributes - nf_tables trace netlink attributes

 *

net/ipv4/netfilter/Kconfig

+8 −0
Original line number Diff line number Diff line
@@ -54,6 +54,14 @@ config NFT_DUP_IPV4 
	help

	  This module enables IPv4 packet duplication support for nf_tables.



config NFT_FIB_IPV4

	select NFT_FIB

	tristate "nf_tables fib / ip route lookup support"

	help

	  This module enables IPv4 FIB lookups, e.g. for reverse path filtering.

	  It also allows query of the FIB for the route type, e.g. local, unicast,

	  multicast or blackhole.



endif # NF_TABLES_IPV4



config NF_TABLES_ARP

net/ipv4/netfilter/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -34,6 +34,7 @@ obj-$(CONFIG_NF_TABLES_IPV4) += nf_tables_ipv4.o 
obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV4) += nft_chain_route_ipv4.o

obj-$(CONFIG_NFT_CHAIN_NAT_IPV4) += nft_chain_nat_ipv4.o

obj-$(CONFIG_NFT_REJECT_IPV4) += nft_reject_ipv4.o

obj-$(CONFIG_NFT_FIB_IPV4) += nft_fib_ipv4.o

obj-$(CONFIG_NFT_MASQ_IPV4) += nft_masq_ipv4.o

obj-$(CONFIG_NFT_REDIR_IPV4) += nft_redir_ipv4.o

obj-$(CONFIG_NFT_DUP_IPV4) += nft_dup_ipv4.o

net/ipv4/netfilter/nft_fib_ipv4.c

0 → 100644
+238 −0
Original line number Diff line number Diff line 
/*

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as

 * published by the Free Software Foundation.

 */



#include <linux/kernel.h>

#include <linux/init.h>

#include <linux/module.h>

#include <linux/netlink.h>

#include <linux/netfilter.h>

#include <linux/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables_core.h>

#include <net/netfilter/nf_tables.h>

#include <net/netfilter/nft_fib.h>



#include <net/ip_fib.h>

#include <net/route.h>



/* don't try to find route from mcast/bcast/zeronet */

static __be32 get_saddr(__be32 addr)

{

	if (ipv4_is_multicast(addr) || ipv4_is_lbcast(addr) ||

	    ipv4_is_zeronet(addr))

		return 0;

	return addr;

}



static bool fib4_is_local(const struct sk_buff *skb)

{

	const struct rtable *rt = skb_rtable(skb);



	return rt && (rt->rt_flags & RTCF_LOCAL);

}



#define DSCP_BITS     0xfc



void nft_fib4_eval_type(const struct nft_expr *expr, struct nft_regs *regs,

			const struct nft_pktinfo *pkt)

{

	const struct nft_fib *priv = nft_expr_priv(expr);

	u32 *dst = &regs->data[priv->dreg];

	const struct net_device *dev = NULL;

	const struct iphdr *iph;

	__be32 addr;



	if (priv->flags & NFTA_FIB_F_IIF)

		dev = pkt->in;

	else if (priv->flags & NFTA_FIB_F_OIF)

		dev = pkt->out;



	iph = ip_hdr(pkt->skb);

	if (priv->flags & NFTA_FIB_F_DADDR)

		addr = iph->daddr;

	else

		addr = iph->saddr;



	*dst = inet_dev_addr_type(pkt->net, dev, addr);

}

EXPORT_SYMBOL_GPL(nft_fib4_eval_type);



static int get_ifindex(const struct net_device *dev)

{

	return dev ? dev->ifindex : 0;

}



void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,

		   const struct nft_pktinfo *pkt)

{

	const struct nft_fib *priv = nft_expr_priv(expr);

	u32 *dest = &regs->data[priv->dreg];

	const struct iphdr *iph;

	struct fib_result res;

	struct flowi4 fl4 = {

		.flowi4_scope = RT_SCOPE_UNIVERSE,

		.flowi4_iif = LOOPBACK_IFINDEX,

	};

	const struct net_device *oif;

	struct net_device *found;

#ifdef CONFIG_IP_ROUTE_MULTIPATH

	int i;

#endif



	/*

	 * Do not set flowi4_oif, it restricts results (for example, asking

	 * for oif 3 will get RTN_UNICAST result even if the daddr exits

	 * on another interface.

	 *

	 * Search results for the desired outinterface instead.

	 */

	if (priv->flags & NFTA_FIB_F_OIF)

		oif = pkt->out;

	else if (priv->flags & NFTA_FIB_F_IIF)

		oif = pkt->in;

	else

		oif = NULL;



	if (pkt->hook == NF_INET_PRE_ROUTING && fib4_is_local(pkt->skb)) {

		nft_fib_store_result(dest, priv->result, pkt, LOOPBACK_IFINDEX);

		return;

	}



	iph = ip_hdr(pkt->skb);

	if (ipv4_is_multicast(iph->daddr) &&

	    ipv4_is_zeronet(iph->saddr) &&

	    ipv4_is_local_multicast(iph->daddr)) {

		nft_fib_store_result(dest, priv->result, pkt,

				     get_ifindex(pkt->skb->dev));

		return;

	}



	if (priv->flags & NFTA_FIB_F_MARK)

		fl4.flowi4_mark = pkt->skb->mark;



	fl4.flowi4_tos = iph->tos & DSCP_BITS;



	if (priv->flags & NFTA_FIB_F_DADDR) {

		fl4.daddr = iph->daddr;

		fl4.saddr = get_saddr(iph->saddr);

	} else {

		fl4.daddr = iph->saddr;

		fl4.saddr = get_saddr(iph->daddr);

	}



	if (fib_lookup(pkt->net, &fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE))

		return;



	switch (res.type) {

	case RTN_UNICAST:

		break;

	case RTN_LOCAL:	/* should not appear here, see fib4_is_local() above */

		return;

	default:

		break;

	}



       if (!oif) {

               found = FIB_RES_DEV(res);

               goto ok;

       }



#ifdef CONFIG_IP_ROUTE_MULTIPATH

	for (i = 0; i < res.fi->fib_nhs; i++) {

		struct fib_nh *nh = &res.fi->fib_nh[i];



		if (nh->nh_dev == oif) {

			found = nh->nh_dev;

			goto ok;

		}

	}

	return;

#else

	found = FIB_RES_DEV(res);

	if (found != oif)

		return;

#endif

ok:

	switch (priv->result) {

	case NFT_FIB_RESULT_OIF:

		*dest = found->ifindex;

		break;

	case NFT_FIB_RESULT_OIFNAME:

		strncpy((char *)dest, found->name, IFNAMSIZ);

		break;

	default:

		WARN_ON_ONCE(1);

		break;

	}

}

EXPORT_SYMBOL_GPL(nft_fib4_eval);



static struct nft_expr_type nft_fib4_type;



static const struct nft_expr_ops nft_fib4_type_ops = {

	.type		= &nft_fib4_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_fib)),

	.eval		= nft_fib4_eval_type,

	.init		= nft_fib_init,

	.dump		= nft_fib_dump,

	.validate	= nft_fib_validate,

};



static const struct nft_expr_ops nft_fib4_ops = {

	.type		= &nft_fib4_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_fib)),

	.eval		= nft_fib4_eval,

	.init		= nft_fib_init,

	.dump		= nft_fib_dump,

	.validate	= nft_fib_validate,

};



static const struct nft_expr_ops *

nft_fib4_select_ops(const struct nft_ctx *ctx,

		    const struct nlattr * const tb[])

{

	enum nft_fib_result result;



	if (!tb[NFTA_FIB_RESULT])

		return ERR_PTR(-EINVAL);



	result = htonl(nla_get_be32(tb[NFTA_FIB_RESULT]));



	switch (result) {

	case NFT_FIB_RESULT_OIF:

		return &nft_fib4_ops;

	case NFT_FIB_RESULT_OIFNAME:

		return &nft_fib4_ops;

	case NFT_FIB_RESULT_ADDRTYPE:

		return &nft_fib4_type_ops;

	default:

		return ERR_PTR(-EOPNOTSUPP);

	}

}



static struct nft_expr_type nft_fib4_type __read_mostly = {

	.name		= "fib",

	.select_ops	= &nft_fib4_select_ops,

	.policy		= nft_fib_policy,

	.maxattr	= NFTA_FIB_MAX,

	.family		= NFPROTO_IPV4,

	.owner		= THIS_MODULE,

};



static int __init nft_fib4_module_init(void)

{

	return nft_register_expr(&nft_fib4_type);

}



static void __exit nft_fib4_module_exit(void)

{

	nft_unregister_expr(&nft_fib4_type);

}



module_init(nft_fib4_module_init);

module_exit(nft_fib4_module_exit);

MODULE_LICENSE("GPL");

MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");

MODULE_ALIAS_NFT_AF_EXPR(2, "fib");

CRA Git | Maintained and supported by SUSTech CRA and CCSE