1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * (C) 2015 Red Hat GmbH
4 * Author: Florian Westphal <fw@strlen.de>
5 */
6
7 #include <linux/module.h>
8 #include <linux/static_key.h>
9 #include <linux/hash.h>
10 #include <linux/siphash.h>
11 #include <linux/if_vlan.h>
12 #include <linux/init.h>
13 #include <linux/skbuff.h>
14 #include <linux/netlink.h>
15 #include <linux/netfilter.h>
16 #include <linux/netfilter/nfnetlink.h>
17 #include <linux/netfilter/nf_tables.h>
18 #include <net/netfilter/nf_tables_core.h>
19 #include <net/netfilter/nf_tables.h>
20
21 #define NFT_TRACETYPE_LL_HSIZE 20
22 #define NFT_TRACETYPE_NETWORK_HSIZE 40
23 #define NFT_TRACETYPE_TRANSPORT_HSIZE 20
24
25 DEFINE_STATIC_KEY_FALSE(nft_trace_enabled);
26 EXPORT_SYMBOL_GPL(nft_trace_enabled);
27
trace_fill_header(struct sk_buff * nlskb,u16 type,const struct sk_buff * skb,int off,unsigned int len)28 static int trace_fill_header(struct sk_buff *nlskb, u16 type,
29 const struct sk_buff *skb,
30 int off, unsigned int len)
31 {
32 struct nlattr *nla;
33
34 if (len == 0)
35 return 0;
36
37 nla = nla_reserve(nlskb, type, len);
38 if (!nla || skb_copy_bits(skb, off, nla_data(nla), len))
39 return -1;
40
41 return 0;
42 }
43
nf_trace_fill_ll_header(struct sk_buff * nlskb,const struct sk_buff * skb)44 static int nf_trace_fill_ll_header(struct sk_buff *nlskb,
45 const struct sk_buff *skb)
46 {
47 struct vlan_ethhdr veth;
48 int off;
49
50 BUILD_BUG_ON(sizeof(veth) > NFT_TRACETYPE_LL_HSIZE);
51
52 off = skb_mac_header(skb) - skb->data;
53 if (off != -ETH_HLEN)
54 return -1;
55
56 if (skb_copy_bits(skb, off, &veth, ETH_HLEN))
57 return -1;
58
59 veth.h_vlan_proto = skb->vlan_proto;
60 veth.h_vlan_TCI = htons(skb_vlan_tag_get(skb));
61 veth.h_vlan_encapsulated_proto = skb->protocol;
62
63 return nla_put(nlskb, NFTA_TRACE_LL_HEADER, sizeof(veth), &veth);
64 }
65
nf_trace_fill_dev_info(struct sk_buff * nlskb,const struct net_device * indev,const struct net_device * outdev)66 static int nf_trace_fill_dev_info(struct sk_buff *nlskb,
67 const struct net_device *indev,
68 const struct net_device *outdev)
69 {
70 if (indev) {
71 if (nla_put_be32(nlskb, NFTA_TRACE_IIF,
72 htonl(indev->ifindex)))
73 return -1;
74
75 if (nla_put_be16(nlskb, NFTA_TRACE_IIFTYPE,
76 htons(indev->type)))
77 return -1;
78 }
79
80 if (outdev) {
81 if (nla_put_be32(nlskb, NFTA_TRACE_OIF,
82 htonl(outdev->ifindex)))
83 return -1;
84
85 if (nla_put_be16(nlskb, NFTA_TRACE_OIFTYPE,
86 htons(outdev->type)))
87 return -1;
88 }
89
90 return 0;
91 }
92
nf_trace_fill_pkt_info(struct sk_buff * nlskb,const struct nft_pktinfo * pkt)93 static int nf_trace_fill_pkt_info(struct sk_buff *nlskb,
94 const struct nft_pktinfo *pkt)
95 {
96 const struct sk_buff *skb = pkt->skb;
97 int off = skb_network_offset(skb);
98 unsigned int len, nh_end;
99
100 nh_end = pkt->flags & NFT_PKTINFO_L4PROTO ? nft_thoff(pkt) : skb->len;
101 len = min_t(unsigned int, nh_end - skb_network_offset(skb),
102 NFT_TRACETYPE_NETWORK_HSIZE);
103 if (trace_fill_header(nlskb, NFTA_TRACE_NETWORK_HEADER, skb, off, len))
104 return -1;
105
106 if (pkt->flags & NFT_PKTINFO_L4PROTO) {
107 len = min_t(unsigned int, skb->len - nft_thoff(pkt),
108 NFT_TRACETYPE_TRANSPORT_HSIZE);
109 if (trace_fill_header(nlskb, NFTA_TRACE_TRANSPORT_HEADER, skb,
110 nft_thoff(pkt), len))
111 return -1;
112 }
113
114 if (!skb_mac_header_was_set(skb))
115 return 0;
116
117 if (skb_vlan_tag_get(skb))
118 return nf_trace_fill_ll_header(nlskb, skb);
119
120 off = skb_mac_header(skb) - skb->data;
121 len = min_t(unsigned int, -off, NFT_TRACETYPE_LL_HSIZE);
122 return trace_fill_header(nlskb, NFTA_TRACE_LL_HEADER,
123 skb, off, len);
124 }
125
nf_trace_fill_rule_info(struct sk_buff * nlskb,const struct nft_traceinfo * info)126 static int nf_trace_fill_rule_info(struct sk_buff *nlskb,
127 const struct nft_traceinfo *info)
128 {
129 if (!info->rule || info->rule->is_last)
130 return 0;
131
132 /* a continue verdict with ->type == RETURN means that this is
133 * an implicit return (end of chain reached).
134 *
135 * Since no rule matched, the ->rule pointer is invalid.
136 */
137 if (info->type == NFT_TRACETYPE_RETURN &&
138 info->verdict->code == NFT_CONTINUE)
139 return 0;
140
141 return nla_put_be64(nlskb, NFTA_TRACE_RULE_HANDLE,
142 cpu_to_be64(info->rule->handle),
143 NFTA_TRACE_PAD);
144 }
145
nft_trace_have_verdict_chain(struct nft_traceinfo * info)146 static bool nft_trace_have_verdict_chain(struct nft_traceinfo *info)
147 {
148 switch (info->type) {
149 case NFT_TRACETYPE_RETURN:
150 case NFT_TRACETYPE_RULE:
151 break;
152 default:
153 return false;
154 }
155
156 switch (info->verdict->code) {
157 case NFT_JUMP:
158 case NFT_GOTO:
159 break;
160 default:
161 return false;
162 }
163
164 return true;
165 }
166
nft_trace_notify(struct nft_traceinfo * info)167 void nft_trace_notify(struct nft_traceinfo *info)
168 {
169 const struct nft_pktinfo *pkt = info->pkt;
170 struct nlmsghdr *nlh;
171 struct sk_buff *skb;
172 unsigned int size;
173 u32 mark = 0;
174 u16 event;
175
176 if (!nfnetlink_has_listeners(nft_net(pkt), NFNLGRP_NFTRACE))
177 return;
178
179 size = nlmsg_total_size(sizeof(struct nfgenmsg)) +
180 nla_total_size(strlen(info->chain->table->name)) +
181 nla_total_size(strlen(info->chain->name)) +
182 nla_total_size_64bit(sizeof(__be64)) + /* rule handle */
183 nla_total_size(sizeof(__be32)) + /* trace type */
184 nla_total_size(0) + /* VERDICT, nested */
185 nla_total_size(sizeof(u32)) + /* verdict code */
186 nla_total_size(sizeof(u32)) + /* id */
187 nla_total_size(NFT_TRACETYPE_LL_HSIZE) +
188 nla_total_size(NFT_TRACETYPE_NETWORK_HSIZE) +
189 nla_total_size(NFT_TRACETYPE_TRANSPORT_HSIZE) +
190 nla_total_size(sizeof(u32)) + /* iif */
191 nla_total_size(sizeof(__be16)) + /* iiftype */
192 nla_total_size(sizeof(u32)) + /* oif */
193 nla_total_size(sizeof(__be16)) + /* oiftype */
194 nla_total_size(sizeof(u32)) + /* mark */
195 nla_total_size(sizeof(u32)) + /* nfproto */
196 nla_total_size(sizeof(u32)); /* policy */
197
198 if (nft_trace_have_verdict_chain(info))
199 size += nla_total_size(strlen(info->verdict->chain->name)); /* jump target */
200
201 skb = nlmsg_new(size, GFP_ATOMIC);
202 if (!skb)
203 return;
204
205 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_TRACE);
206 nlh = nfnl_msg_put(skb, 0, 0, event, 0, info->basechain->type->family,
207 NFNETLINK_V0, 0);
208 if (!nlh)
209 goto nla_put_failure;
210
211 if (nla_put_be32(skb, NFTA_TRACE_NFPROTO, htonl(nft_pf(pkt))))
212 goto nla_put_failure;
213
214 if (nla_put_be32(skb, NFTA_TRACE_TYPE, htonl(info->type)))
215 goto nla_put_failure;
216
217 if (nla_put_u32(skb, NFTA_TRACE_ID, info->skbid))
218 goto nla_put_failure;
219
220 if (nla_put_string(skb, NFTA_TRACE_CHAIN, info->chain->name))
221 goto nla_put_failure;
222
223 if (nla_put_string(skb, NFTA_TRACE_TABLE, info->chain->table->name))
224 goto nla_put_failure;
225
226 if (nf_trace_fill_rule_info(skb, info))
227 goto nla_put_failure;
228
229 switch (info->type) {
230 case NFT_TRACETYPE_UNSPEC:
231 case __NFT_TRACETYPE_MAX:
232 break;
233 case NFT_TRACETYPE_RETURN:
234 case NFT_TRACETYPE_RULE:
235 if (nft_verdict_dump(skb, NFTA_TRACE_VERDICT, info->verdict))
236 goto nla_put_failure;
237
238 /* pkt->skb undefined iff NF_STOLEN, disable dump */
239 if (info->verdict->code == NF_STOLEN)
240 info->packet_dumped = true;
241 else
242 mark = pkt->skb->mark;
243
244 break;
245 case NFT_TRACETYPE_POLICY:
246 mark = pkt->skb->mark;
247
248 if (nla_put_be32(skb, NFTA_TRACE_POLICY,
249 htonl(info->basechain->policy)))
250 goto nla_put_failure;
251 break;
252 }
253
254 if (mark && nla_put_be32(skb, NFTA_TRACE_MARK, htonl(mark)))
255 goto nla_put_failure;
256
257 if (!info->packet_dumped) {
258 if (nf_trace_fill_dev_info(skb, nft_in(pkt), nft_out(pkt)))
259 goto nla_put_failure;
260
261 if (nf_trace_fill_pkt_info(skb, pkt))
262 goto nla_put_failure;
263 info->packet_dumped = true;
264 }
265
266 nlmsg_end(skb, nlh);
267 nfnetlink_send(skb, nft_net(pkt), 0, NFNLGRP_NFTRACE, 0, GFP_ATOMIC);
268 return;
269
270 nla_put_failure:
271 WARN_ON_ONCE(1);
272 kfree_skb(skb);
273 }
274
nft_trace_init(struct nft_traceinfo * info,const struct nft_pktinfo * pkt,const struct nft_verdict * verdict,const struct nft_chain * chain)275 void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt,
276 const struct nft_verdict *verdict,
277 const struct nft_chain *chain)
278 {
279 static siphash_key_t trace_key __read_mostly;
280 struct sk_buff *skb = pkt->skb;
281
282 info->basechain = nft_base_chain(chain);
283 info->trace = true;
284 info->nf_trace = pkt->skb->nf_trace;
285 info->packet_dumped = false;
286 info->pkt = pkt;
287 info->verdict = verdict;
288
289 net_get_random_once(&trace_key, sizeof(trace_key));
290
291 info->skbid = (u32)siphash_3u32(hash32_ptr(skb),
292 skb_get_hash(skb),
293 skb->skb_iif,
294 &trace_key);
295 }
296