1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * (C) 2015 Red Hat GmbH
4 * Author: Florian Westphal <fw@strlen.de>
5 */
6
7#include <linux/module.h>
8#include <linux/static_key.h>
9#include <linux/hash.h>
10#include <linux/siphash.h>
11#include <linux/if_vlan.h>
12#include <linux/init.h>
13#include <linux/skbuff.h>
14#include <linux/netlink.h>
15#include <linux/netfilter.h>
16#include <linux/netfilter/nfnetlink.h>
17#include <linux/netfilter/nf_tables.h>
18#include <net/netfilter/nf_tables_core.h>
19#include <net/netfilter/nf_tables.h>
20
21#define NFT_TRACETYPE_LL_HSIZE		20
22#define NFT_TRACETYPE_NETWORK_HSIZE	40
23#define NFT_TRACETYPE_TRANSPORT_HSIZE	20
24
25DEFINE_STATIC_KEY_FALSE(nft_trace_enabled);
26EXPORT_SYMBOL_GPL(nft_trace_enabled);
27
28static int trace_fill_header(struct sk_buff *nlskb, u16 type,
29			     const struct sk_buff *skb,
30			     int off, unsigned int len)
31{
32	struct nlattr *nla;
33
34	if (len == 0)
35		return 0;
36
37	nla = nla_reserve(nlskb, type, len);
38	if (!nla || skb_copy_bits(skb, off, nla_data(nla), len))
39		return -1;
40
41	return 0;
42}
43
44static int nf_trace_fill_ll_header(struct sk_buff *nlskb,
45				   const struct sk_buff *skb)
46{
47	struct vlan_ethhdr veth;
48	int off;
49
50	BUILD_BUG_ON(sizeof(veth) > NFT_TRACETYPE_LL_HSIZE);
51
52	off = skb_mac_header(skb) - skb->data;
53	if (off != -ETH_HLEN)
54		return -1;
55
56	if (skb_copy_bits(skb, off, &veth, ETH_HLEN))
57		return -1;
58
59	veth.h_vlan_proto = skb->vlan_proto;
60	veth.h_vlan_TCI = htons(skb_vlan_tag_get(skb));
61	veth.h_vlan_encapsulated_proto = skb->protocol;
62
63	return nla_put(nlskb, NFTA_TRACE_LL_HEADER, sizeof(veth), &veth);
64}
65
66static int nf_trace_fill_dev_info(struct sk_buff *nlskb,
67				  const struct net_device *indev,
68				  const struct net_device *outdev)
69{
70	if (indev) {
71		if (nla_put_be32(nlskb, NFTA_TRACE_IIF,
72				 htonl(indev->ifindex)))
73			return -1;
74
75		if (nla_put_be16(nlskb, NFTA_TRACE_IIFTYPE,
76				 htons(indev->type)))
77			return -1;
78	}
79
80	if (outdev) {
81		if (nla_put_be32(nlskb, NFTA_TRACE_OIF,
82				 htonl(outdev->ifindex)))
83			return -1;
84
85		if (nla_put_be16(nlskb, NFTA_TRACE_OIFTYPE,
86				 htons(outdev->type)))
87			return -1;
88	}
89
90	return 0;
91}
92
93static int nf_trace_fill_pkt_info(struct sk_buff *nlskb,
94				  const struct nft_pktinfo *pkt)
95{
96	const struct sk_buff *skb = pkt->skb;
97	int off = skb_network_offset(skb);
98	unsigned int len, nh_end;
99
100	nh_end = pkt->flags & NFT_PKTINFO_L4PROTO ? nft_thoff(pkt) : skb->len;
101	len = min_t(unsigned int, nh_end - skb_network_offset(skb),
102		    NFT_TRACETYPE_NETWORK_HSIZE);
103	if (trace_fill_header(nlskb, NFTA_TRACE_NETWORK_HEADER, skb, off, len))
104		return -1;
105
106	if (pkt->flags & NFT_PKTINFO_L4PROTO) {
107		len = min_t(unsigned int, skb->len - nft_thoff(pkt),
108			    NFT_TRACETYPE_TRANSPORT_HSIZE);
109		if (trace_fill_header(nlskb, NFTA_TRACE_TRANSPORT_HEADER, skb,
110				      nft_thoff(pkt), len))
111			return -1;
112	}
113
114	if (!skb_mac_header_was_set(skb))
115		return 0;
116
117	if (skb_vlan_tag_get(skb))
118		return nf_trace_fill_ll_header(nlskb, skb);
119
120	off = skb_mac_header(skb) - skb->data;
121	len = min_t(unsigned int, -off, NFT_TRACETYPE_LL_HSIZE);
122	return trace_fill_header(nlskb, NFTA_TRACE_LL_HEADER,
123				 skb, off, len);
124}
125
126static int nf_trace_fill_rule_info(struct sk_buff *nlskb,
127				   const struct nft_verdict *verdict,
128				   const struct nft_rule_dp *rule,
129				   const struct nft_traceinfo *info)
130{
131	if (!rule || rule->is_last)
132		return 0;
133
134	/* a continue verdict with ->type == RETURN means that this is
135	 * an implicit return (end of chain reached).
136	 *
137	 * Since no rule matched, the ->rule pointer is invalid.
138	 */
139	if (info->type == NFT_TRACETYPE_RETURN &&
140	    verdict->code == NFT_CONTINUE)
141		return 0;
142
143	return nla_put_be64(nlskb, NFTA_TRACE_RULE_HANDLE,
144			    cpu_to_be64(rule->handle),
145			    NFTA_TRACE_PAD);
146}
147
148static bool nft_trace_have_verdict_chain(const struct nft_verdict *verdict,
149					 struct nft_traceinfo *info)
150{
151	switch (info->type) {
152	case NFT_TRACETYPE_RETURN:
153	case NFT_TRACETYPE_RULE:
154		break;
155	default:
156		return false;
157	}
158
159	switch (verdict->code) {
160	case NFT_JUMP:
161	case NFT_GOTO:
162		break;
163	default:
164		return false;
165	}
166
167	return true;
168}
169
170static const struct nft_chain *nft_trace_get_chain(const struct nft_rule_dp *rule,
171						   const struct nft_traceinfo *info)
172{
173	const struct nft_rule_dp_last *last;
174
175	if (!rule)
176		return &info->basechain->chain;
177
178	while (!rule->is_last)
179		rule = nft_rule_next(rule);
180
181	last = (const struct nft_rule_dp_last *)rule;
182
183	if (WARN_ON_ONCE(!last->chain))
184		return &info->basechain->chain;
185
186	return last->chain;
187}
188
189void nft_trace_notify(const struct nft_pktinfo *pkt,
190		      const struct nft_verdict *verdict,
191		      const struct nft_rule_dp *rule,
192		      struct nft_traceinfo *info)
193{
194	const struct nft_chain *chain;
195	struct nlmsghdr *nlh;
196	struct sk_buff *skb;
197	unsigned int size;
198	u32 mark = 0;
199	u16 event;
200
201	if (!nfnetlink_has_listeners(nft_net(pkt), NFNLGRP_NFTRACE))
202		return;
203
204	chain = nft_trace_get_chain(rule, info);
205
206	size = nlmsg_total_size(sizeof(struct nfgenmsg)) +
207		nla_total_size(strlen(chain->table->name)) +
208		nla_total_size(strlen(chain->name)) +
209		nla_total_size_64bit(sizeof(__be64)) +	/* rule handle */
210		nla_total_size(sizeof(__be32)) +	/* trace type */
211		nla_total_size(0) +			/* VERDICT, nested */
212			nla_total_size(sizeof(u32)) +	/* verdict code */
213		nla_total_size(sizeof(u32)) +		/* id */
214		nla_total_size(NFT_TRACETYPE_LL_HSIZE) +
215		nla_total_size(NFT_TRACETYPE_NETWORK_HSIZE) +
216		nla_total_size(NFT_TRACETYPE_TRANSPORT_HSIZE) +
217		nla_total_size(sizeof(u32)) +		/* iif */
218		nla_total_size(sizeof(__be16)) +	/* iiftype */
219		nla_total_size(sizeof(u32)) +		/* oif */
220		nla_total_size(sizeof(__be16)) +	/* oiftype */
221		nla_total_size(sizeof(u32)) +		/* mark */
222		nla_total_size(sizeof(u32)) +		/* nfproto */
223		nla_total_size(sizeof(u32));		/* policy */
224
225	if (nft_trace_have_verdict_chain(verdict, info))
226		size += nla_total_size(strlen(verdict->chain->name)); /* jump target */
227
228	skb = nlmsg_new(size, GFP_ATOMIC);
229	if (!skb)
230		return;
231
232	event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_TRACE);
233	nlh = nfnl_msg_put(skb, 0, 0, event, 0, info->basechain->type->family,
234			   NFNETLINK_V0, 0);
235	if (!nlh)
236		goto nla_put_failure;
237
238	if (nla_put_be32(skb, NFTA_TRACE_NFPROTO, htonl(nft_pf(pkt))))
239		goto nla_put_failure;
240
241	if (nla_put_be32(skb, NFTA_TRACE_TYPE, htonl(info->type)))
242		goto nla_put_failure;
243
244	if (nla_put_u32(skb, NFTA_TRACE_ID, info->skbid))
245		goto nla_put_failure;
246
247	if (nla_put_string(skb, NFTA_TRACE_CHAIN, chain->name))
248		goto nla_put_failure;
249
250	if (nla_put_string(skb, NFTA_TRACE_TABLE, chain->table->name))
251		goto nla_put_failure;
252
253	if (nf_trace_fill_rule_info(skb, verdict, rule, info))
254		goto nla_put_failure;
255
256	switch (info->type) {
257	case NFT_TRACETYPE_UNSPEC:
258	case __NFT_TRACETYPE_MAX:
259		break;
260	case NFT_TRACETYPE_RETURN:
261	case NFT_TRACETYPE_RULE: {
262		unsigned int v;
263
264		if (nft_verdict_dump(skb, NFTA_TRACE_VERDICT, verdict))
265			goto nla_put_failure;
266
267		/* pkt->skb undefined iff NF_STOLEN, disable dump */
268		v = verdict->code & NF_VERDICT_MASK;
269		if (v == NF_STOLEN)
270			info->packet_dumped = true;
271		else
272			mark = pkt->skb->mark;
273
274		break;
275	}
276	case NFT_TRACETYPE_POLICY:
277		mark = pkt->skb->mark;
278
279		if (nla_put_be32(skb, NFTA_TRACE_POLICY,
280				 htonl(info->basechain->policy)))
281			goto nla_put_failure;
282		break;
283	}
284
285	if (mark && nla_put_be32(skb, NFTA_TRACE_MARK, htonl(mark)))
286		goto nla_put_failure;
287
288	if (!info->packet_dumped) {
289		if (nf_trace_fill_dev_info(skb, nft_in(pkt), nft_out(pkt)))
290			goto nla_put_failure;
291
292		if (nf_trace_fill_pkt_info(skb, pkt))
293			goto nla_put_failure;
294		info->packet_dumped = true;
295	}
296
297	nlmsg_end(skb, nlh);
298	nfnetlink_send(skb, nft_net(pkt), 0, NFNLGRP_NFTRACE, 0, GFP_ATOMIC);
299	return;
300
301 nla_put_failure:
302	WARN_ON_ONCE(1);
303	kfree_skb(skb);
304}
305
306void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt,
307		    const struct nft_chain *chain)
308{
309	static siphash_key_t trace_key __read_mostly;
310	struct sk_buff *skb = pkt->skb;
311
312	info->basechain = nft_base_chain(chain);
313	info->trace = true;
314	info->nf_trace = pkt->skb->nf_trace;
315	info->packet_dumped = false;
316
317	net_get_random_once(&trace_key, sizeof(trace_key));
318
319	info->skbid = (u32)siphash_3u32(hash32_ptr(skb),
320					skb_get_hash(skb),
321					skb->skb_iif,
322					&trace_key);
323}
324