Merge tag 'acpi-5.6-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael...

[linux.git] / net / netfilter / nft_exthdr.c

diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index a7aa6c5250a4e68941690023defbcec4fe61fb66..a5e8469859e395422728fe6fa37ff9284f3f4c7d 100644 (file)
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -59,6 +59,103 @@ static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
        regs->verdict.code = NFT_BREAK;
 }
 
+/* find the offset to specified option.
+ *
+ * If target header is found, its offset is set in *offset and return option
+ * number. Otherwise, return negative error.
+ *
+ * If the first fragment doesn't contain the End of Options it is considered
+ * invalid.
+ */
+static int ipv4_find_option(struct net *net, struct sk_buff *skb,
+                           unsigned int *offset, int target)
+{
+       unsigned char optbuf[sizeof(struct ip_options) + 40];
+       struct ip_options *opt = (struct ip_options *)optbuf;
+       struct iphdr *iph, _iph;
+       unsigned int start;
+       bool found = false;
+       __be32 info;
+       int optlen;
+
+       iph = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
+       if (!iph)
+               return -EBADMSG;
+       start = sizeof(struct iphdr);
+
+       optlen = iph->ihl * 4 - (int)sizeof(struct iphdr);
+       if (optlen <= 0)
+               return -ENOENT;
+
+       memset(opt, 0, sizeof(struct ip_options));
+       /* Copy the options since __ip_options_compile() modifies
+        * the options.
+        */
+       if (skb_copy_bits(skb, start, opt->__data, optlen))
+               return -EBADMSG;
+       opt->optlen = optlen;
+
+       if (__ip_options_compile(net, opt, NULL, &info))
+               return -EBADMSG;
+
+       switch (target) {
+       case IPOPT_SSRR:
+       case IPOPT_LSRR:
+               if (!opt->srr)
+                       break;
+               found = target == IPOPT_SSRR ? opt->is_strictroute :
+                                              !opt->is_strictroute;
+               if (found)
+                       *offset = opt->srr + start;
+               break;
+       case IPOPT_RR:
+               if (!opt->rr)
+                       break;
+               *offset = opt->rr + start;
+               found = true;
+               break;
+       case IPOPT_RA:
+               if (!opt->router_alert)
+                       break;
+               *offset = opt->router_alert + start;
+               found = true;
+               break;
+       default:
+               return -EOPNOTSUPP;
+       }
+       return found ? target : -ENOENT;
+}
+
+static void nft_exthdr_ipv4_eval(const struct nft_expr *expr,
+                                struct nft_regs *regs,
+                                const struct nft_pktinfo *pkt)
+{
+       struct nft_exthdr *priv = nft_expr_priv(expr);
+       u32 *dest = &regs->data[priv->dreg];
+       struct sk_buff *skb = pkt->skb;
+       unsigned int offset;
+       int err;
+
+       if (skb->protocol != htons(ETH_P_IP))
+               goto err;
+
+       err = ipv4_find_option(nft_net(pkt), skb, &offset, priv->type);
+       if (priv->flags & NFT_EXTHDR_F_PRESENT) {
+               *dest = (err >= 0);
+               return;
+       } else if (err < 0) {
+               goto err;
+       }
+       offset += priv->offset;
+
+       dest[priv->len / NFT_REG32_SIZE] = 0;
+       if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
+               goto err;
+       return;
+err:
+       regs->verdict.code = NFT_BREAK;
+}
+
 static void *
 nft_tcp_header_pointer(const struct nft_pktinfo *pkt,
                       unsigned int len, void *buffer, unsigned int *tcphdr_len)
@@ -153,7 +250,8 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr,
                if (i + optl > tcphdr_len || priv->len + priv->offset > optl)
                        return;
 
-               if (!skb_make_writable(pkt->skb, pkt->xt.thoff + i + priv->len))
+               if (skb_ensure_writable(pkt->skb,
+                                       pkt->xt.thoff + i + priv->len))
                        return;
 
                tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff,
@@ -311,6 +409,28 @@ static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx,
        return nft_validate_register_load(priv->sreg, priv->len);
 }
 
+static int nft_exthdr_ipv4_init(const struct nft_ctx *ctx,
+                               const struct nft_expr *expr,
+                               const struct nlattr * const tb[])
+{
+       struct nft_exthdr *priv = nft_expr_priv(expr);
+       int err = nft_exthdr_init(ctx, expr, tb);
+
+       if (err < 0)
+               return err;
+
+       switch (priv->type) {
+       case IPOPT_SSRR:
+       case IPOPT_LSRR:
+       case IPOPT_RR:
+       case IPOPT_RA:
+               break;
+       default:
+               return -EOPNOTSUPP;
+       }
+       return 0;
+}
+
 static int nft_exthdr_dump_common(struct sk_buff *skb, const struct nft_exthdr *priv)
 {
        if (nla_put_u8(skb, NFTA_EXTHDR_TYPE, priv->type))
@@ -357,6 +477,14 @@ static const struct nft_expr_ops nft_exthdr_ipv6_ops = {
        .dump           = nft_exthdr_dump,
 };
 
+static const struct nft_expr_ops nft_exthdr_ipv4_ops = {
+       .type           = &nft_exthdr_type,
+       .size           = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
+       .eval           = nft_exthdr_ipv4_eval,
+       .init           = nft_exthdr_ipv4_init,
+       .dump           = nft_exthdr_dump,
+};
+
 static const struct nft_expr_ops nft_exthdr_tcp_ops = {
        .type           = &nft_exthdr_type,
        .size           = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
@@ -397,6 +525,12 @@ nft_exthdr_select_ops(const struct nft_ctx *ctx,
                if (tb[NFTA_EXTHDR_DREG])
                        return &nft_exthdr_ipv6_ops;
                break;
+       case NFT_EXTHDR_OP_IPV4:
+               if (ctx->family != NFPROTO_IPV6) {
+                       if (tb[NFTA_EXTHDR_DREG])
+                               return &nft_exthdr_ipv4_ops;
+               }
+               break;
        }
 
        return ERR_PTR(-EOPNOTSUPP);