1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * (C) 2015 Red Hat GmbH
4  * Author: Florian Westphal <fw@strlen.de>
5  */
6 
7 #include <linux/module.h>
8 #include <linux/static_key.h>
9 #include <linux/hash.h>
10 #include <linux/siphash.h>
11 #include <linux/if_vlan.h>
12 #include <linux/init.h>
13 #include <linux/skbuff.h>
14 #include <linux/netlink.h>
15 #include <linux/netfilter.h>
16 #include <linux/netfilter/nfnetlink.h>
17 #include <linux/netfilter/nf_tables.h>
18 #include <net/netfilter/nf_conntrack.h>
19 #include <net/netfilter/nf_tables_core.h>
20 #include <net/netfilter/nf_tables.h>
21 
22 #define NFT_TRACETYPE_LL_HSIZE		20
23 #define NFT_TRACETYPE_NETWORK_HSIZE	40
24 #define NFT_TRACETYPE_TRANSPORT_HSIZE	20
25 
26 DEFINE_STATIC_KEY_FALSE(nft_trace_enabled);
27 EXPORT_SYMBOL_GPL(nft_trace_enabled);
28 
29 static int trace_fill_header(struct sk_buff *nlskb, u16 type,
30 			     const struct sk_buff *skb,
31 			     int off, unsigned int len)
32 {
33 	struct nlattr *nla;
34 
35 	if (len == 0)
36 		return 0;
37 
38 	nla = nla_reserve(nlskb, type, len);
39 	if (!nla || skb_copy_bits(skb, off, nla_data(nla), len))
40 		return -1;
41 
42 	return 0;
43 }
44 
45 static int nf_trace_fill_ll_header(struct sk_buff *nlskb,
46 				   const struct sk_buff *skb)
47 {
48 	struct vlan_ethhdr veth;
49 	int off;
50 
51 	BUILD_BUG_ON(sizeof(veth) > NFT_TRACETYPE_LL_HSIZE);
52 
53 	off = skb_mac_header(skb) - skb->data;
54 	if (off != -ETH_HLEN)
55 		return -1;
56 
57 	if (skb_copy_bits(skb, off, &veth, ETH_HLEN))
58 		return -1;
59 
60 	veth.h_vlan_proto = skb->vlan_proto;
61 	veth.h_vlan_TCI = htons(skb_vlan_tag_get(skb));
62 	veth.h_vlan_encapsulated_proto = skb->protocol;
63 
64 	return nla_put(nlskb, NFTA_TRACE_LL_HEADER, sizeof(veth), &veth);
65 }
66 
67 static int nf_trace_fill_dev_info(struct sk_buff *nlskb,
68 				  const struct net_device *indev,
69 				  const struct net_device *outdev)
70 {
71 	if (indev) {
72 		if (nla_put_be32(nlskb, NFTA_TRACE_IIF,
73 				 htonl(indev->ifindex)))
74 			return -1;
75 
76 		if (nla_put_be16(nlskb, NFTA_TRACE_IIFTYPE,
77 				 htons(indev->type)))
78 			return -1;
79 	}
80 
81 	if (outdev) {
82 		if (nla_put_be32(nlskb, NFTA_TRACE_OIF,
83 				 htonl(outdev->ifindex)))
84 			return -1;
85 
86 		if (nla_put_be16(nlskb, NFTA_TRACE_OIFTYPE,
87 				 htons(outdev->type)))
88 			return -1;
89 	}
90 
91 	return 0;
92 }
93 
94 static int nf_trace_fill_ct_info(struct sk_buff *nlskb,
95 				 const struct sk_buff *skb)
96 {
97 	const struct nf_ct_hook *ct_hook;
98 	enum ip_conntrack_info ctinfo;
99 	const struct nf_conn *ct;
100 	u32 state;
101 
102 	ct_hook = rcu_dereference(nf_ct_hook);
103 	if (!ct_hook)
104 		return 0;
105 
106 	ct = nf_ct_get(skb, &ctinfo);
107 	if (!ct) {
108 		if (ctinfo != IP_CT_UNTRACKED) /* not seen by conntrack or invalid */
109 			return 0;
110 
111 		state = NF_CT_STATE_UNTRACKED_BIT;
112 	} else {
113 		state = NF_CT_STATE_BIT(ctinfo);
114 	}
115 
116 	if (nla_put_be32(nlskb, NFTA_TRACE_CT_STATE, htonl(state)))
117 		return -1;
118 
119 	if (ct) {
120 		u32 id = ct_hook->get_id(&ct->ct_general);
121 		u32 status = READ_ONCE(ct->status);
122 		u8 dir = CTINFO2DIR(ctinfo);
123 
124 		if (nla_put_u8(nlskb, NFTA_TRACE_CT_DIRECTION, dir))
125 			return -1;
126 
127 		if (nla_put_be32(nlskb, NFTA_TRACE_CT_ID, (__force __be32)id))
128 			return -1;
129 
130 		if (status && nla_put_be32(nlskb, NFTA_TRACE_CT_STATUS, htonl(status)))
131 			return -1;
132 	}
133 
134 	return 0;
135 }
136 
137 static int nf_trace_fill_pkt_info(struct sk_buff *nlskb,
138 				  const struct nft_pktinfo *pkt)
139 {
140 	const struct sk_buff *skb = pkt->skb;
141 	int off = skb_network_offset(skb);
142 	unsigned int len, nh_end;
143 
144 	nh_end = pkt->flags & NFT_PKTINFO_L4PROTO ? nft_thoff(pkt) : skb->len;
145 	len = min_t(unsigned int, nh_end - skb_network_offset(skb),
146 		    NFT_TRACETYPE_NETWORK_HSIZE);
147 	if (trace_fill_header(nlskb, NFTA_TRACE_NETWORK_HEADER, skb, off, len))
148 		return -1;
149 
150 	if (pkt->flags & NFT_PKTINFO_L4PROTO) {
151 		len = min_t(unsigned int, skb->len - nft_thoff(pkt),
152 			    NFT_TRACETYPE_TRANSPORT_HSIZE);
153 		if (trace_fill_header(nlskb, NFTA_TRACE_TRANSPORT_HEADER, skb,
154 				      nft_thoff(pkt), len))
155 			return -1;
156 	}
157 
158 	if (!skb_mac_header_was_set(skb))
159 		return 0;
160 
161 	if (skb_vlan_tag_get(skb))
162 		return nf_trace_fill_ll_header(nlskb, skb);
163 
164 	off = skb_mac_header(skb) - skb->data;
165 	len = min_t(unsigned int, -off, NFT_TRACETYPE_LL_HSIZE);
166 	return trace_fill_header(nlskb, NFTA_TRACE_LL_HEADER,
167 				 skb, off, len);
168 }
169 
170 static int nf_trace_fill_rule_info(struct sk_buff *nlskb,
171 				   const struct nft_verdict *verdict,
172 				   const struct nft_rule_dp *rule,
173 				   const struct nft_traceinfo *info)
174 {
175 	if (!rule || rule->is_last)
176 		return 0;
177 
178 	/* a continue verdict with ->type == RETURN means that this is
179 	 * an implicit return (end of chain reached).
180 	 *
181 	 * Since no rule matched, the ->rule pointer is invalid.
182 	 */
183 	if (info->type == NFT_TRACETYPE_RETURN &&
184 	    verdict->code == NFT_CONTINUE)
185 		return 0;
186 
187 	return nla_put_be64(nlskb, NFTA_TRACE_RULE_HANDLE,
188 			    cpu_to_be64(rule->handle),
189 			    NFTA_TRACE_PAD);
190 }
191 
192 static bool nft_trace_have_verdict_chain(const struct nft_verdict *verdict,
193 					 struct nft_traceinfo *info)
194 {
195 	switch (info->type) {
196 	case NFT_TRACETYPE_RETURN:
197 	case NFT_TRACETYPE_RULE:
198 		break;
199 	default:
200 		return false;
201 	}
202 
203 	switch (verdict->code) {
204 	case NFT_JUMP:
205 	case NFT_GOTO:
206 		break;
207 	default:
208 		return false;
209 	}
210 
211 	return true;
212 }
213 
214 static const struct nft_chain *nft_trace_get_chain(const struct nft_rule_dp *rule,
215 						   const struct nft_traceinfo *info)
216 {
217 	const struct nft_rule_dp_last *last;
218 
219 	if (!rule)
220 		return &info->basechain->chain;
221 
222 	while (!rule->is_last)
223 		rule = nft_rule_next(rule);
224 
225 	last = (const struct nft_rule_dp_last *)rule;
226 
227 	if (WARN_ON_ONCE(!last->chain))
228 		return &info->basechain->chain;
229 
230 	return last->chain;
231 }
232 
233 void nft_trace_notify(const struct nft_pktinfo *pkt,
234 		      const struct nft_verdict *verdict,
235 		      const struct nft_rule_dp *rule,
236 		      struct nft_traceinfo *info)
237 {
238 	const struct nft_chain *chain;
239 	struct nlmsghdr *nlh;
240 	struct sk_buff *skb;
241 	unsigned int size;
242 	u32 mark = 0;
243 	u16 event;
244 
245 	if (!nfnetlink_has_listeners(nft_net(pkt), NFNLGRP_NFTRACE))
246 		return;
247 
248 	chain = nft_trace_get_chain(rule, info);
249 
250 	size = nlmsg_total_size(sizeof(struct nfgenmsg)) +
251 		nla_total_size(strlen(chain->table->name)) +
252 		nla_total_size(strlen(chain->name)) +
253 		nla_total_size_64bit(sizeof(__be64)) +	/* rule handle */
254 		nla_total_size(sizeof(__be32)) +	/* trace type */
255 		nla_total_size(0) +			/* VERDICT, nested */
256 			nla_total_size(sizeof(u32)) +	/* verdict code */
257 		nla_total_size(sizeof(u32)) +		/* ct id */
258 		nla_total_size(sizeof(u8)) +		/* ct direction */
259 		nla_total_size(sizeof(u32)) +		/* ct state */
260 		nla_total_size(sizeof(u32)) +		/* ct status */
261 		nla_total_size(sizeof(u32)) +		/* trace id */
262 		nla_total_size(NFT_TRACETYPE_LL_HSIZE) +
263 		nla_total_size(NFT_TRACETYPE_NETWORK_HSIZE) +
264 		nla_total_size(NFT_TRACETYPE_TRANSPORT_HSIZE) +
265 		nla_total_size(sizeof(u32)) +		/* iif */
266 		nla_total_size(sizeof(__be16)) +	/* iiftype */
267 		nla_total_size(sizeof(u32)) +		/* oif */
268 		nla_total_size(sizeof(__be16)) +	/* oiftype */
269 		nla_total_size(sizeof(u32)) +		/* mark */
270 		nla_total_size(sizeof(u32)) +		/* nfproto */
271 		nla_total_size(sizeof(u32));		/* policy */
272 
273 	if (nft_trace_have_verdict_chain(verdict, info))
274 		size += nla_total_size(strlen(verdict->chain->name)); /* jump target */
275 
276 	skb = nlmsg_new(size, GFP_ATOMIC);
277 	if (!skb)
278 		return;
279 
280 	event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_TRACE);
281 	nlh = nfnl_msg_put(skb, 0, 0, event, 0, info->basechain->type->family,
282 			   NFNETLINK_V0, 0);
283 	if (!nlh)
284 		goto nla_put_failure;
285 
286 	if (nla_put_be32(skb, NFTA_TRACE_NFPROTO, htonl(nft_pf(pkt))))
287 		goto nla_put_failure;
288 
289 	if (nla_put_be32(skb, NFTA_TRACE_TYPE, htonl(info->type)))
290 		goto nla_put_failure;
291 
292 	if (nla_put_u32(skb, NFTA_TRACE_ID, info->skbid))
293 		goto nla_put_failure;
294 
295 	if (nla_put_string(skb, NFTA_TRACE_CHAIN, chain->name))
296 		goto nla_put_failure;
297 
298 	if (nla_put_string(skb, NFTA_TRACE_TABLE, chain->table->name))
299 		goto nla_put_failure;
300 
301 	if (nf_trace_fill_rule_info(skb, verdict, rule, info))
302 		goto nla_put_failure;
303 
304 	switch (info->type) {
305 	case NFT_TRACETYPE_UNSPEC:
306 	case __NFT_TRACETYPE_MAX:
307 		break;
308 	case NFT_TRACETYPE_RETURN:
309 	case NFT_TRACETYPE_RULE: {
310 		unsigned int v;
311 
312 		if (nft_verdict_dump(skb, NFTA_TRACE_VERDICT, verdict))
313 			goto nla_put_failure;
314 
315 		/* pkt->skb undefined iff NF_STOLEN, disable dump */
316 		v = verdict->code & NF_VERDICT_MASK;
317 		if (v == NF_STOLEN)
318 			info->packet_dumped = true;
319 		else
320 			mark = pkt->skb->mark;
321 
322 		break;
323 	}
324 	case NFT_TRACETYPE_POLICY:
325 		mark = pkt->skb->mark;
326 
327 		if (nla_put_be32(skb, NFTA_TRACE_POLICY,
328 				 htonl(info->basechain->policy)))
329 			goto nla_put_failure;
330 		break;
331 	}
332 
333 	if (mark && nla_put_be32(skb, NFTA_TRACE_MARK, htonl(mark)))
334 		goto nla_put_failure;
335 
336 	if (!info->packet_dumped) {
337 		if (nf_trace_fill_dev_info(skb, nft_in(pkt), nft_out(pkt)))
338 			goto nla_put_failure;
339 
340 		if (nf_trace_fill_pkt_info(skb, pkt))
341 			goto nla_put_failure;
342 
343 		if (nf_trace_fill_ct_info(skb, pkt->skb))
344 			goto nla_put_failure;
345 
346 		info->packet_dumped = true;
347 	}
348 
349 	nlmsg_end(skb, nlh);
350 	nfnetlink_send(skb, nft_net(pkt), 0, NFNLGRP_NFTRACE, 0, GFP_ATOMIC);
351 	return;
352 
353  nla_put_failure:
354 	WARN_ON_ONCE(1);
355 	kfree_skb(skb);
356 }
357 
358 void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt,
359 		    const struct nft_chain *chain)
360 {
361 	static siphash_key_t trace_key __read_mostly;
362 	struct sk_buff *skb = pkt->skb;
363 
364 	info->basechain = nft_base_chain(chain);
365 	info->trace = true;
366 	info->nf_trace = pkt->skb->nf_trace;
367 	info->packet_dumped = false;
368 
369 	net_get_random_once(&trace_key, sizeof(trace_key));
370 
371 	info->skbid = (u32)siphash_3u32(hash32_ptr(skb),
372 					skb_get_hash_net(nft_net(pkt), skb),
373 					skb->skb_iif,
374 					&trace_key);
375 }
376