1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
4  *
5  * Development of this code funded by Astaro AG (http://www.astaro.com/)
6  */
7 
8 #include <linux/unaligned.h>
9 #include <linux/kernel.h>
10 #include <linux/netlink.h>
11 #include <linux/netfilter.h>
12 #include <linux/netfilter/nf_tables.h>
13 #include <linux/dccp.h>
14 #include <linux/sctp.h>
15 #include <net/netfilter/nf_tables_core.h>
16 #include <net/netfilter/nf_tables.h>
17 #include <net/tcp.h>
18 
19 struct nft_exthdr {
20 	u8			type;
21 	u8			offset;
22 	u8			len;
23 	u8			op;
24 	u8			dreg;
25 	u8			sreg;
26 	u8			flags;
27 };
28 
29 static unsigned int optlen(const u8 *opt, unsigned int offset)
30 {
31 	/* Beware zero-length options: make finite progress */
32 	if (opt[offset] <= TCPOPT_NOP || opt[offset + 1] == 0)
33 		return 1;
34 	else
35 		return opt[offset + 1];
36 }
37 
38 static int nft_skb_copy_to_reg(const struct sk_buff *skb, int offset, u32 *dest, unsigned int len)
39 {
40 	if (len % NFT_REG32_SIZE)
41 		dest[len / NFT_REG32_SIZE] = 0;
42 
43 	return skb_copy_bits(skb, offset, dest, len);
44 }
45 
46 static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
47 				 struct nft_regs *regs,
48 				 const struct nft_pktinfo *pkt)
49 {
50 	struct nft_exthdr *priv = nft_expr_priv(expr);
51 	u32 *dest = &regs->data[priv->dreg];
52 	unsigned int offset = 0;
53 	int err;
54 
55 	if (pkt->skb->protocol != htons(ETH_P_IPV6))
56 		goto err;
57 
58 	err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
59 	if (priv->flags & NFT_EXTHDR_F_PRESENT) {
60 		nft_reg_store8(dest, err >= 0);
61 		return;
62 	} else if (err < 0) {
63 		goto err;
64 	}
65 	offset += priv->offset;
66 
67 	if (nft_skb_copy_to_reg(pkt->skb, offset, dest, priv->len) < 0)
68 		goto err;
69 	return;
70 err:
71 	regs->verdict.code = NFT_BREAK;
72 }
73 
74 /* find the offset to specified option.
75  *
76  * If target header is found, its offset is set in *offset and return option
77  * number. Otherwise, return negative error.
78  *
79  * If the first fragment doesn't contain the End of Options it is considered
80  * invalid.
81  */
82 static int ipv4_find_option(struct net *net, struct sk_buff *skb,
83 			    unsigned int *offset, int target)
84 {
85 	unsigned char optbuf[sizeof(struct ip_options) + 40];
86 	struct ip_options *opt = (struct ip_options *)optbuf;
87 	struct iphdr *iph, _iph;
88 	bool found = false;
89 	__be32 info;
90 	int optlen;
91 
92 	iph = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
93 	if (!iph)
94 		return -EBADMSG;
95 
96 	optlen = iph->ihl * 4 - (int)sizeof(struct iphdr);
97 	if (optlen <= 0)
98 		return -ENOENT;
99 
100 	memset(opt, 0, sizeof(struct ip_options));
101 	/* Copy the options since __ip_options_compile() modifies
102 	 * the options.
103 	 */
104 	if (skb_copy_bits(skb, sizeof(struct iphdr), opt->__data, optlen))
105 		return -EBADMSG;
106 	opt->optlen = optlen;
107 
108 	if (__ip_options_compile(net, opt, NULL, &info))
109 		return -EBADMSG;
110 
111 	switch (target) {
112 	case IPOPT_SSRR:
113 	case IPOPT_LSRR:
114 		if (!opt->srr)
115 			break;
116 		found = target == IPOPT_SSRR ? opt->is_strictroute :
117 					       !opt->is_strictroute;
118 		if (found)
119 			*offset = opt->srr;
120 		break;
121 	case IPOPT_RR:
122 		if (!opt->rr)
123 			break;
124 		*offset = opt->rr;
125 		found = true;
126 		break;
127 	case IPOPT_RA:
128 		if (!opt->router_alert)
129 			break;
130 		*offset = opt->router_alert;
131 		found = true;
132 		break;
133 	default:
134 		return -EOPNOTSUPP;
135 	}
136 	return found ? target : -ENOENT;
137 }
138 
139 static void nft_exthdr_ipv4_eval(const struct nft_expr *expr,
140 				 struct nft_regs *regs,
141 				 const struct nft_pktinfo *pkt)
142 {
143 	struct nft_exthdr *priv = nft_expr_priv(expr);
144 	u32 *dest = &regs->data[priv->dreg];
145 	struct sk_buff *skb = pkt->skb;
146 	unsigned int offset;
147 	int err;
148 
149 	if (skb->protocol != htons(ETH_P_IP))
150 		goto err;
151 
152 	err = ipv4_find_option(nft_net(pkt), skb, &offset, priv->type);
153 	if (priv->flags & NFT_EXTHDR_F_PRESENT) {
154 		nft_reg_store8(dest, err >= 0);
155 		return;
156 	} else if (err < 0) {
157 		goto err;
158 	}
159 	offset += priv->offset;
160 
161 	if (nft_skb_copy_to_reg(pkt->skb, offset, dest, priv->len) < 0)
162 		goto err;
163 	return;
164 err:
165 	regs->verdict.code = NFT_BREAK;
166 }
167 
168 static void *
169 nft_tcp_header_pointer(const struct nft_pktinfo *pkt,
170 		       unsigned int len, void *buffer, unsigned int *tcphdr_len)
171 {
172 	struct tcphdr *tcph;
173 
174 	if (pkt->tprot != IPPROTO_TCP || pkt->fragoff)
175 		return NULL;
176 
177 	tcph = skb_header_pointer(pkt->skb, nft_thoff(pkt), sizeof(*tcph), buffer);
178 	if (!tcph)
179 		return NULL;
180 
181 	*tcphdr_len = __tcp_hdrlen(tcph);
182 	if (*tcphdr_len < sizeof(*tcph) || *tcphdr_len > len)
183 		return NULL;
184 
185 	return skb_header_pointer(pkt->skb, nft_thoff(pkt), *tcphdr_len, buffer);
186 }
187 
188 static void nft_exthdr_tcp_eval(const struct nft_expr *expr,
189 				struct nft_regs *regs,
190 				const struct nft_pktinfo *pkt)
191 {
192 	u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
193 	struct nft_exthdr *priv = nft_expr_priv(expr);
194 	unsigned int i, optl, tcphdr_len, offset;
195 	u32 *dest = &regs->data[priv->dreg];
196 	struct tcphdr *tcph;
197 	u8 *opt;
198 
199 	tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
200 	if (!tcph)
201 		goto err;
202 
203 	opt = (u8 *)tcph;
204 	for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
205 		optl = optlen(opt, i);
206 
207 		if (priv->type != opt[i])
208 			continue;
209 
210 		if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
211 			goto err;
212 
213 		offset = i + priv->offset;
214 		if (priv->flags & NFT_EXTHDR_F_PRESENT) {
215 			nft_reg_store8(dest, 1);
216 		} else {
217 			if (priv->len % NFT_REG32_SIZE)
218 				dest[priv->len / NFT_REG32_SIZE] = 0;
219 			memcpy(dest, opt + offset, priv->len);
220 		}
221 
222 		return;
223 	}
224 
225 err:
226 	if (priv->flags & NFT_EXTHDR_F_PRESENT)
227 		*dest = 0;
228 	else
229 		regs->verdict.code = NFT_BREAK;
230 }
231 
232 static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr,
233 				    struct nft_regs *regs,
234 				    const struct nft_pktinfo *pkt)
235 {
236 	u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
237 	struct nft_exthdr *priv = nft_expr_priv(expr);
238 	unsigned int i, optl, tcphdr_len, offset;
239 	struct tcphdr *tcph;
240 	u8 *opt;
241 
242 	tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
243 	if (!tcph)
244 		goto err;
245 
246 	if (skb_ensure_writable(pkt->skb, nft_thoff(pkt) + tcphdr_len))
247 		goto err;
248 
249 	tcph = (struct tcphdr *)(pkt->skb->data + nft_thoff(pkt));
250 	opt = (u8 *)tcph;
251 
252 	for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
253 		union {
254 			__be16 v16;
255 			__be32 v32;
256 		} old, new;
257 
258 		optl = optlen(opt, i);
259 
260 		if (priv->type != opt[i])
261 			continue;
262 
263 		if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
264 			goto err;
265 
266 		offset = i + priv->offset;
267 
268 		switch (priv->len) {
269 		case 2:
270 			old.v16 = (__force __be16)get_unaligned((u16 *)(opt + offset));
271 			new.v16 = (__force __be16)nft_reg_load16(
272 				&regs->data[priv->sreg]);
273 
274 			switch (priv->type) {
275 			case TCPOPT_MSS:
276 				/* increase can cause connection to stall */
277 				if (ntohs(old.v16) <= ntohs(new.v16))
278 					return;
279 			break;
280 			}
281 
282 			if (old.v16 == new.v16)
283 				return;
284 
285 			put_unaligned(new.v16, (__be16*)(opt + offset));
286 			inet_proto_csum_replace2(&tcph->check, pkt->skb,
287 						 old.v16, new.v16, false);
288 			break;
289 		case 4:
290 			new.v32 = nft_reg_load_be32(&regs->data[priv->sreg]);
291 			old.v32 = (__force __be32)get_unaligned((u32 *)(opt + offset));
292 
293 			if (old.v32 == new.v32)
294 				return;
295 
296 			put_unaligned(new.v32, (__be32*)(opt + offset));
297 			inet_proto_csum_replace4(&tcph->check, pkt->skb,
298 						 old.v32, new.v32, false);
299 			break;
300 		default:
301 			WARN_ON_ONCE(1);
302 			break;
303 		}
304 
305 		return;
306 	}
307 	return;
308 err:
309 	regs->verdict.code = NFT_BREAK;
310 }
311 
312 static void nft_exthdr_tcp_strip_eval(const struct nft_expr *expr,
313 				      struct nft_regs *regs,
314 				      const struct nft_pktinfo *pkt)
315 {
316 	u8 buff[sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE];
317 	struct nft_exthdr *priv = nft_expr_priv(expr);
318 	unsigned int i, tcphdr_len, optl;
319 	struct tcphdr *tcph;
320 	u8 *opt;
321 
322 	tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
323 	if (!tcph)
324 		goto err;
325 
326 	if (skb_ensure_writable(pkt->skb, nft_thoff(pkt) + tcphdr_len))
327 		goto drop;
328 
329 	tcph = (struct tcphdr *)(pkt->skb->data + nft_thoff(pkt));
330 	opt = (u8 *)tcph;
331 
332 	for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
333 		unsigned int j;
334 
335 		optl = optlen(opt, i);
336 		if (priv->type != opt[i])
337 			continue;
338 
339 		if (i + optl > tcphdr_len)
340 			goto drop;
341 
342 		for (j = 0; j < optl; ++j) {
343 			u16 n = TCPOPT_NOP;
344 			u16 o = opt[i+j];
345 
346 			if ((i + j) % 2 == 0) {
347 				o <<= 8;
348 				n <<= 8;
349 			}
350 			inet_proto_csum_replace2(&tcph->check, pkt->skb, htons(o),
351 						 htons(n), false);
352 		}
353 		memset(opt + i, TCPOPT_NOP, optl);
354 		return;
355 	}
356 
357 	/* option not found, continue. This allows to do multiple
358 	 * option removals per rule.
359 	 */
360 	return;
361 err:
362 	regs->verdict.code = NFT_BREAK;
363 	return;
364 drop:
365 	/* can't remove, no choice but to drop */
366 	regs->verdict.code = NF_DROP;
367 }
368 
369 static void nft_exthdr_sctp_eval(const struct nft_expr *expr,
370 				 struct nft_regs *regs,
371 				 const struct nft_pktinfo *pkt)
372 {
373 	unsigned int offset = nft_thoff(pkt) + sizeof(struct sctphdr);
374 	struct nft_exthdr *priv = nft_expr_priv(expr);
375 	u32 *dest = &regs->data[priv->dreg];
376 	const struct sctp_chunkhdr *sch;
377 	struct sctp_chunkhdr _sch;
378 
379 	if (pkt->tprot != IPPROTO_SCTP)
380 		goto err;
381 
382 	do {
383 		sch = skb_header_pointer(pkt->skb, offset, sizeof(_sch), &_sch);
384 		if (!sch || !sch->length)
385 			break;
386 
387 		if (sch->type == priv->type) {
388 			if (priv->flags & NFT_EXTHDR_F_PRESENT) {
389 				nft_reg_store8(dest, true);
390 				return;
391 			}
392 			if (priv->offset + priv->len > ntohs(sch->length) ||
393 			    offset + ntohs(sch->length) > pkt->skb->len)
394 				break;
395 
396 			if (nft_skb_copy_to_reg(pkt->skb, offset + priv->offset,
397 						dest, priv->len) < 0)
398 				break;
399 			return;
400 		}
401 		offset += SCTP_PAD4(ntohs(sch->length));
402 	} while (offset < pkt->skb->len);
403 err:
404 	if (priv->flags & NFT_EXTHDR_F_PRESENT)
405 		nft_reg_store8(dest, false);
406 	else
407 		regs->verdict.code = NFT_BREAK;
408 }
409 
410 static void nft_exthdr_dccp_eval(const struct nft_expr *expr,
411 				 struct nft_regs *regs,
412 				 const struct nft_pktinfo *pkt)
413 {
414 	struct nft_exthdr *priv = nft_expr_priv(expr);
415 	unsigned int thoff, dataoff, optoff, optlen, i;
416 	u32 *dest = &regs->data[priv->dreg];
417 	const struct dccp_hdr *dh;
418 	struct dccp_hdr _dh;
419 
420 	if (pkt->tprot != IPPROTO_DCCP || pkt->fragoff)
421 		goto err;
422 
423 	thoff = nft_thoff(pkt);
424 
425 	dh = skb_header_pointer(pkt->skb, thoff, sizeof(_dh), &_dh);
426 	if (!dh)
427 		goto err;
428 
429 	dataoff = dh->dccph_doff * sizeof(u32);
430 	optoff = __dccp_hdr_len(dh);
431 	if (dataoff <= optoff)
432 		goto err;
433 
434 	optlen = dataoff - optoff;
435 
436 	for (i = 0; i < optlen; ) {
437 		/* Options 0 (DCCPO_PADDING) - 31 (DCCPO_MAX_RESERVED) are 1B in
438 		 * the length; the remaining options are at least 2B long.  In
439 		 * all cases, the first byte contains the option type.  In
440 		 * multi-byte options, the second byte contains the option
441 		 * length, which must be at least two: 1 for the type plus 1 for
442 		 * the length plus 0-253 for any following option data.  We
443 		 * aren't interested in the option data, only the type and the
444 		 * length, so we don't need to read more than two bytes at a
445 		 * time.
446 		 */
447 		unsigned int buflen = optlen - i;
448 		u8 buf[2], *bufp;
449 		u8 type, len;
450 
451 		if (buflen > sizeof(buf))
452 			buflen = sizeof(buf);
453 
454 		bufp = skb_header_pointer(pkt->skb, thoff + optoff + i, buflen,
455 					  &buf);
456 		if (!bufp)
457 			goto err;
458 
459 		type = bufp[0];
460 
461 		if (type == priv->type) {
462 			nft_reg_store8(dest, 1);
463 			return;
464 		}
465 
466 		if (type <= DCCPO_MAX_RESERVED) {
467 			i++;
468 			continue;
469 		}
470 
471 		if (buflen < 2)
472 			goto err;
473 
474 		len = bufp[1];
475 
476 		if (len < 2)
477 			goto err;
478 
479 		i += len;
480 	}
481 
482 err:
483 	*dest = 0;
484 }
485 
486 static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = {
487 	[NFTA_EXTHDR_DREG]		= { .type = NLA_U32 },
488 	[NFTA_EXTHDR_TYPE]		= { .type = NLA_U8 },
489 	[NFTA_EXTHDR_OFFSET]		= { .type = NLA_U32 },
490 	[NFTA_EXTHDR_LEN]		= NLA_POLICY_MAX(NLA_BE32, 255),
491 	[NFTA_EXTHDR_FLAGS]		= { .type = NLA_U32 },
492 	[NFTA_EXTHDR_OP]		= NLA_POLICY_MAX(NLA_BE32, 255),
493 	[NFTA_EXTHDR_SREG]		= { .type = NLA_U32 },
494 };
495 
496 static int nft_exthdr_init(const struct nft_ctx *ctx,
497 			   const struct nft_expr *expr,
498 			   const struct nlattr * const tb[])
499 {
500 	struct nft_exthdr *priv = nft_expr_priv(expr);
501 	u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
502 	int err;
503 
504 	if (!tb[NFTA_EXTHDR_DREG] ||
505 	    !tb[NFTA_EXTHDR_TYPE] ||
506 	    !tb[NFTA_EXTHDR_OFFSET] ||
507 	    !tb[NFTA_EXTHDR_LEN])
508 		return -EINVAL;
509 
510 	err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
511 	if (err < 0)
512 		return err;
513 
514 	err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
515 	if (err < 0)
516 		return err;
517 
518 	if (tb[NFTA_EXTHDR_FLAGS]) {
519 		err = nft_parse_u32_check(tb[NFTA_EXTHDR_FLAGS], U8_MAX, &flags);
520 		if (err < 0)
521 			return err;
522 
523 		if (flags & ~NFT_EXTHDR_F_PRESENT)
524 			return -EINVAL;
525 	}
526 
527 	if (tb[NFTA_EXTHDR_OP]) {
528 		err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
529 		if (err < 0)
530 			return err;
531 	}
532 
533 	priv->type   = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
534 	priv->offset = offset;
535 	priv->len    = len;
536 	priv->flags  = flags;
537 	priv->op     = op;
538 
539 	return nft_parse_register_store(ctx, tb[NFTA_EXTHDR_DREG],
540 					&priv->dreg, NULL, NFT_DATA_VALUE,
541 					priv->len);
542 }
543 
544 static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx,
545 				   const struct nft_expr *expr,
546 				   const struct nlattr * const tb[])
547 {
548 	struct nft_exthdr *priv = nft_expr_priv(expr);
549 	u32 offset, len, flags = 0, op = NFT_EXTHDR_OP_IPV6;
550 	int err;
551 
552 	if (!tb[NFTA_EXTHDR_SREG] ||
553 	    !tb[NFTA_EXTHDR_TYPE] ||
554 	    !tb[NFTA_EXTHDR_OFFSET] ||
555 	    !tb[NFTA_EXTHDR_LEN])
556 		return -EINVAL;
557 
558 	if (tb[NFTA_EXTHDR_DREG] || tb[NFTA_EXTHDR_FLAGS])
559 		return -EINVAL;
560 
561 	err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
562 	if (err < 0)
563 		return err;
564 
565 	err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
566 	if (err < 0)
567 		return err;
568 
569 	if (offset < 2)
570 		return -EOPNOTSUPP;
571 
572 	switch (len) {
573 	case 2: break;
574 	case 4: break;
575 	default:
576 		return -EOPNOTSUPP;
577 	}
578 
579 	err = nft_parse_u32_check(tb[NFTA_EXTHDR_OP], U8_MAX, &op);
580 	if (err < 0)
581 		return err;
582 
583 	priv->type   = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
584 	priv->offset = offset;
585 	priv->len    = len;
586 	priv->flags  = flags;
587 	priv->op     = op;
588 
589 	return nft_parse_register_load(ctx, tb[NFTA_EXTHDR_SREG], &priv->sreg,
590 				       priv->len);
591 }
592 
593 static int nft_exthdr_tcp_strip_init(const struct nft_ctx *ctx,
594 				     const struct nft_expr *expr,
595 				     const struct nlattr * const tb[])
596 {
597 	struct nft_exthdr *priv = nft_expr_priv(expr);
598 
599 	if (tb[NFTA_EXTHDR_SREG] ||
600 	    tb[NFTA_EXTHDR_DREG] ||
601 	    tb[NFTA_EXTHDR_FLAGS] ||
602 	    tb[NFTA_EXTHDR_OFFSET] ||
603 	    tb[NFTA_EXTHDR_LEN])
604 		return -EINVAL;
605 
606 	if (!tb[NFTA_EXTHDR_TYPE])
607 		return -EINVAL;
608 
609 	priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
610 	priv->op = NFT_EXTHDR_OP_TCPOPT;
611 
612 	return 0;
613 }
614 
615 static int nft_exthdr_ipv4_init(const struct nft_ctx *ctx,
616 				const struct nft_expr *expr,
617 				const struct nlattr * const tb[])
618 {
619 	struct nft_exthdr *priv = nft_expr_priv(expr);
620 	int err = nft_exthdr_init(ctx, expr, tb);
621 
622 	if (err < 0)
623 		return err;
624 
625 	switch (priv->type) {
626 	case IPOPT_SSRR:
627 	case IPOPT_LSRR:
628 	case IPOPT_RR:
629 	case IPOPT_RA:
630 		break;
631 	default:
632 		return -EOPNOTSUPP;
633 	}
634 	return 0;
635 }
636 
637 static int nft_exthdr_dccp_init(const struct nft_ctx *ctx,
638 				const struct nft_expr *expr,
639 				const struct nlattr * const tb[])
640 {
641 	struct nft_exthdr *priv = nft_expr_priv(expr);
642 	int err = nft_exthdr_init(ctx, expr, tb);
643 
644 	if (err < 0)
645 		return err;
646 
647 	if (!(priv->flags & NFT_EXTHDR_F_PRESENT))
648 		return -EOPNOTSUPP;
649 
650 	return 0;
651 }
652 
653 static int nft_exthdr_dump_common(struct sk_buff *skb, const struct nft_exthdr *priv)
654 {
655 	if (nla_put_u8(skb, NFTA_EXTHDR_TYPE, priv->type))
656 		goto nla_put_failure;
657 	if (nla_put_be32(skb, NFTA_EXTHDR_OFFSET, htonl(priv->offset)))
658 		goto nla_put_failure;
659 	if (nla_put_be32(skb, NFTA_EXTHDR_LEN, htonl(priv->len)))
660 		goto nla_put_failure;
661 	if (nla_put_be32(skb, NFTA_EXTHDR_FLAGS, htonl(priv->flags)))
662 		goto nla_put_failure;
663 	if (nla_put_be32(skb, NFTA_EXTHDR_OP, htonl(priv->op)))
664 		goto nla_put_failure;
665 	return 0;
666 
667 nla_put_failure:
668 	return -1;
669 }
670 
671 static int nft_exthdr_dump(struct sk_buff *skb,
672 			   const struct nft_expr *expr, bool reset)
673 {
674 	const struct nft_exthdr *priv = nft_expr_priv(expr);
675 
676 	if (nft_dump_register(skb, NFTA_EXTHDR_DREG, priv->dreg))
677 		return -1;
678 
679 	return nft_exthdr_dump_common(skb, priv);
680 }
681 
682 static int nft_exthdr_dump_set(struct sk_buff *skb,
683 			       const struct nft_expr *expr, bool reset)
684 {
685 	const struct nft_exthdr *priv = nft_expr_priv(expr);
686 
687 	if (nft_dump_register(skb, NFTA_EXTHDR_SREG, priv->sreg))
688 		return -1;
689 
690 	return nft_exthdr_dump_common(skb, priv);
691 }
692 
693 static int nft_exthdr_dump_strip(struct sk_buff *skb,
694 				 const struct nft_expr *expr, bool reset)
695 {
696 	const struct nft_exthdr *priv = nft_expr_priv(expr);
697 
698 	return nft_exthdr_dump_common(skb, priv);
699 }
700 
701 static bool nft_exthdr_reduce(struct nft_regs_track *track,
702 			       const struct nft_expr *expr)
703 {
704 	const struct nft_exthdr *priv = nft_expr_priv(expr);
705 	const struct nft_exthdr *exthdr;
706 
707 	if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
708 		nft_reg_track_update(track, expr, priv->dreg, priv->len);
709 		return false;
710 	}
711 
712 	exthdr = nft_expr_priv(track->regs[priv->dreg].selector);
713 	if (priv->type != exthdr->type ||
714 	    priv->op != exthdr->op ||
715 	    priv->flags != exthdr->flags ||
716 	    priv->offset != exthdr->offset ||
717 	    priv->len != exthdr->len) {
718 		nft_reg_track_update(track, expr, priv->dreg, priv->len);
719 		return false;
720 	}
721 
722 	if (!track->regs[priv->dreg].bitwise)
723 		return true;
724 
725 	return nft_expr_reduce_bitwise(track, expr);
726 }
727 
728 static const struct nft_expr_ops nft_exthdr_ipv6_ops = {
729 	.type		= &nft_exthdr_type,
730 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
731 	.eval		= nft_exthdr_ipv6_eval,
732 	.init		= nft_exthdr_init,
733 	.dump		= nft_exthdr_dump,
734 	.reduce		= nft_exthdr_reduce,
735 };
736 
737 static const struct nft_expr_ops nft_exthdr_ipv4_ops = {
738 	.type		= &nft_exthdr_type,
739 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
740 	.eval		= nft_exthdr_ipv4_eval,
741 	.init		= nft_exthdr_ipv4_init,
742 	.dump		= nft_exthdr_dump,
743 	.reduce		= nft_exthdr_reduce,
744 };
745 
746 static const struct nft_expr_ops nft_exthdr_tcp_ops = {
747 	.type		= &nft_exthdr_type,
748 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
749 	.eval		= nft_exthdr_tcp_eval,
750 	.init		= nft_exthdr_init,
751 	.dump		= nft_exthdr_dump,
752 	.reduce		= nft_exthdr_reduce,
753 };
754 
755 static const struct nft_expr_ops nft_exthdr_tcp_set_ops = {
756 	.type		= &nft_exthdr_type,
757 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
758 	.eval		= nft_exthdr_tcp_set_eval,
759 	.init		= nft_exthdr_tcp_set_init,
760 	.dump		= nft_exthdr_dump_set,
761 	.reduce		= NFT_REDUCE_READONLY,
762 };
763 
764 static const struct nft_expr_ops nft_exthdr_tcp_strip_ops = {
765 	.type		= &nft_exthdr_type,
766 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
767 	.eval		= nft_exthdr_tcp_strip_eval,
768 	.init		= nft_exthdr_tcp_strip_init,
769 	.dump		= nft_exthdr_dump_strip,
770 	.reduce		= NFT_REDUCE_READONLY,
771 };
772 
773 static const struct nft_expr_ops nft_exthdr_sctp_ops = {
774 	.type		= &nft_exthdr_type,
775 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
776 	.eval		= nft_exthdr_sctp_eval,
777 	.init		= nft_exthdr_init,
778 	.dump		= nft_exthdr_dump,
779 	.reduce		= nft_exthdr_reduce,
780 };
781 
782 static const struct nft_expr_ops nft_exthdr_dccp_ops = {
783 	.type		= &nft_exthdr_type,
784 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
785 	.eval		= nft_exthdr_dccp_eval,
786 	.init		= nft_exthdr_dccp_init,
787 	.dump		= nft_exthdr_dump,
788 	.reduce		= nft_exthdr_reduce,
789 };
790 
791 static const struct nft_expr_ops *
792 nft_exthdr_select_ops(const struct nft_ctx *ctx,
793 		      const struct nlattr * const tb[])
794 {
795 	u32 op;
796 
797 	if (!tb[NFTA_EXTHDR_OP])
798 		return &nft_exthdr_ipv6_ops;
799 
800 	if (tb[NFTA_EXTHDR_SREG] && tb[NFTA_EXTHDR_DREG])
801 		return ERR_PTR(-EOPNOTSUPP);
802 
803 	op = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OP]));
804 	switch (op) {
805 	case NFT_EXTHDR_OP_TCPOPT:
806 		if (tb[NFTA_EXTHDR_SREG])
807 			return &nft_exthdr_tcp_set_ops;
808 		if (tb[NFTA_EXTHDR_DREG])
809 			return &nft_exthdr_tcp_ops;
810 		return &nft_exthdr_tcp_strip_ops;
811 	case NFT_EXTHDR_OP_IPV6:
812 		if (tb[NFTA_EXTHDR_DREG])
813 			return &nft_exthdr_ipv6_ops;
814 		break;
815 	case NFT_EXTHDR_OP_IPV4:
816 		if (ctx->family != NFPROTO_IPV6) {
817 			if (tb[NFTA_EXTHDR_DREG])
818 				return &nft_exthdr_ipv4_ops;
819 		}
820 		break;
821 	case NFT_EXTHDR_OP_SCTP:
822 		if (tb[NFTA_EXTHDR_DREG])
823 			return &nft_exthdr_sctp_ops;
824 		break;
825 	case NFT_EXTHDR_OP_DCCP:
826 		if (tb[NFTA_EXTHDR_DREG])
827 			return &nft_exthdr_dccp_ops;
828 		break;
829 	}
830 
831 	return ERR_PTR(-EOPNOTSUPP);
832 }
833 
834 struct nft_expr_type nft_exthdr_type __read_mostly = {
835 	.name		= "exthdr",
836 	.select_ops	= nft_exthdr_select_ops,
837 	.policy		= nft_exthdr_policy,
838 	.maxattr	= NFTA_EXTHDR_MAX,
839 	.owner		= THIS_MODULE,
840 };
841