1 /*
2 * (C) 2012-2014 by Pablo Neira Ayuso <[email protected]>
3 * (C) 2013 by Tomasz Bursztyka <[email protected]>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
9 *
10 * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
11 */
12
13 #include <string.h>
14 #include <stdio.h>
15
16 #include <sys/types.h>
17 #include <sys/socket.h>
18 #include <arpa/inet.h>
19 #include <netinet/ip6.h>
20 #include <netdb.h>
21
22 #include <xtables.h>
23
24 #include <linux/netfilter/nf_tables.h>
25 #include "nft.h"
26 #include "nft-shared.h"
27
nft_ipv6_add(struct nft_handle * h,struct nft_rule_ctx * ctx,struct nftnl_rule * r,struct iptables_command_state * cs)28 static int nft_ipv6_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
29 struct nftnl_rule *r, struct iptables_command_state *cs)
30 {
31 struct xtables_rule_match *matchp;
32 uint32_t op;
33 int ret;
34
35 if (!IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.src) ||
36 !IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.smsk) ||
37 (cs->fw6.ipv6.invflags & IPT_INV_SRCIP)) {
38 op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_SRCIP);
39 add_addr(h, r, NFT_PAYLOAD_NETWORK_HEADER,
40 offsetof(struct ip6_hdr, ip6_src),
41 &cs->fw6.ipv6.src, &cs->fw6.ipv6.smsk,
42 sizeof(struct in6_addr), op);
43 }
44
45 if (!IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.dst) ||
46 !IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.dmsk) ||
47 (cs->fw6.ipv6.invflags & IPT_INV_DSTIP)) {
48 op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_DSTIP);
49 add_addr(h, r, NFT_PAYLOAD_NETWORK_HEADER,
50 offsetof(struct ip6_hdr, ip6_dst),
51 &cs->fw6.ipv6.dst, &cs->fw6.ipv6.dmsk,
52 sizeof(struct in6_addr), op);
53 }
54
55 if (cs->fw6.ipv6.iniface[0] != '\0') {
56 op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_IN);
57 add_iface(h, r, cs->fw6.ipv6.iniface, NFT_META_IIFNAME, op);
58 }
59
60 if (cs->fw6.ipv6.outiface[0] != '\0') {
61 op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_OUT);
62 add_iface(h, r, cs->fw6.ipv6.outiface, NFT_META_OIFNAME, op);
63 }
64
65 if (cs->fw6.ipv6.proto != 0) {
66 op = nft_invflags2cmp(cs->fw6.ipv6.invflags, XT_INV_PROTO);
67 add_l4proto(h, r, cs->fw6.ipv6.proto, op);
68 }
69
70 add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags & XT_INV_PROTO);
71
72 for (matchp = cs->matches; matchp; matchp = matchp->next) {
73 ret = add_match(h, ctx, r, matchp->match->m);
74 if (ret < 0)
75 return ret;
76 }
77
78 /* Counters need to me added before the target, otherwise they are
79 * increased for each rule because of the way nf_tables works.
80 */
81 if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0)
82 return -1;
83
84 return add_action(r, cs, !!(cs->fw6.ipv6.flags & IP6T_F_GOTO));
85 }
86
nft_ipv6_is_same(const struct iptables_command_state * a,const struct iptables_command_state * b)87 static bool nft_ipv6_is_same(const struct iptables_command_state *a,
88 const struct iptables_command_state *b)
89 {
90 if (memcmp(a->fw6.ipv6.src.s6_addr, b->fw6.ipv6.src.s6_addr,
91 sizeof(struct in6_addr)) != 0
92 || memcmp(a->fw6.ipv6.dst.s6_addr, b->fw6.ipv6.dst.s6_addr,
93 sizeof(struct in6_addr)) != 0
94 || a->fw6.ipv6.proto != b->fw6.ipv6.proto
95 || a->fw6.ipv6.flags != b->fw6.ipv6.flags
96 || a->fw6.ipv6.invflags != b->fw6.ipv6.invflags) {
97 DEBUGP("different src/dst/proto/flags/invflags\n");
98 return false;
99 }
100
101 return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface,
102 a->fw6.ipv6.iniface_mask,
103 a->fw6.ipv6.outiface_mask,
104 b->fw6.ipv6.iniface, b->fw6.ipv6.outiface,
105 b->fw6.ipv6.iniface_mask,
106 b->fw6.ipv6.outiface_mask);
107 }
108
nft_ipv6_set_goto_flag(struct iptables_command_state * cs)109 static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs)
110 {
111 cs->fw6.ipv6.flags |= IP6T_F_GOTO;
112 }
113
nft_ipv6_print_rule(struct nft_handle * h,struct nftnl_rule * r,unsigned int num,unsigned int format)114 static void nft_ipv6_print_rule(struct nft_handle *h, struct nftnl_rule *r,
115 unsigned int num, unsigned int format)
116 {
117 struct iptables_command_state cs = {};
118
119 nft_rule_to_iptables_command_state(h, r, &cs);
120
121 print_rule_details(num, &cs.counters, cs.jumpto, cs.fw6.ipv6.proto,
122 cs.fw6.ipv6.flags, cs.fw6.ipv6.invflags, format);
123 print_fragment(cs.fw6.ipv6.flags, cs.fw6.ipv6.invflags, format, true);
124 print_ifaces(cs.fw6.ipv6.iniface, cs.fw6.ipv6.outiface,
125 cs.fw6.ipv6.invflags, format);
126 print_ipv6_addresses(&cs.fw6, format);
127
128 if (format & FMT_NOTABLE)
129 fputs(" ", stdout);
130
131 if (cs.fw6.ipv6.flags & IP6T_F_GOTO)
132 printf("[goto] ");
133
134 print_matches_and_target(&cs, format);
135
136 if (!(format & FMT_NONEWLINE))
137 fputc('\n', stdout);
138
139 xtables_clear_iptables_command_state(&cs);
140 }
141
nft_ipv6_save_rule(const struct iptables_command_state * cs,unsigned int format)142 static void nft_ipv6_save_rule(const struct iptables_command_state *cs,
143 unsigned int format)
144 {
145 save_ipv6_addr('s', &cs->fw6.ipv6.src, &cs->fw6.ipv6.smsk,
146 cs->fw6.ipv6.invflags & IP6T_INV_SRCIP);
147 save_ipv6_addr('d', &cs->fw6.ipv6.dst, &cs->fw6.ipv6.dmsk,
148 cs->fw6.ipv6.invflags & IP6T_INV_DSTIP);
149
150 save_rule_details(cs->fw6.ipv6.iniface, cs->fw6.ipv6.iniface_mask,
151 cs->fw6.ipv6.outiface, cs->fw6.ipv6.outiface_mask,
152 cs->fw6.ipv6.proto, 0, cs->fw6.ipv6.invflags);
153
154 save_matches_and_target(cs, cs->fw6.ipv6.flags & IP6T_F_GOTO,
155 &cs->fw6, format);
156 }
157
xlate_ipv6_addr(const char * selector,const struct in6_addr * addr,const struct in6_addr * mask,int invert,struct xt_xlate * xl)158 static void xlate_ipv6_addr(const char *selector, const struct in6_addr *addr,
159 const struct in6_addr *mask,
160 int invert, struct xt_xlate *xl)
161 {
162 const char *op = invert ? "!= " : "";
163 char addr_str[INET6_ADDRSTRLEN];
164 int cidr;
165
166 if (!invert && IN6_IS_ADDR_UNSPECIFIED(addr) && IN6_IS_ADDR_UNSPECIFIED(mask))
167 return;
168
169 inet_ntop(AF_INET6, addr, addr_str, INET6_ADDRSTRLEN);
170 cidr = xtables_ip6mask_to_cidr(mask);
171 switch (cidr) {
172 case -1:
173 xt_xlate_add(xl, "%s & %s %s %s ", selector,
174 xtables_ip6addr_to_numeric(mask),
175 invert ? "!=" : "==", addr_str);
176 break;
177 case 128:
178 xt_xlate_add(xl, "%s %s%s ", selector, op, addr_str);
179 break;
180 default:
181 xt_xlate_add(xl, "%s %s%s/%d ", selector, op, addr_str, cidr);
182 }
183 }
184
nft_ipv6_xlate(const struct iptables_command_state * cs,struct xt_xlate * xl)185 static int nft_ipv6_xlate(const struct iptables_command_state *cs,
186 struct xt_xlate *xl)
187 {
188 const char *comment;
189 int ret;
190
191 xlate_ifname(xl, "iifname", cs->fw6.ipv6.iniface,
192 cs->fw6.ipv6.invflags & IP6T_INV_VIA_IN);
193 xlate_ifname(xl, "oifname", cs->fw6.ipv6.outiface,
194 cs->fw6.ipv6.invflags & IP6T_INV_VIA_OUT);
195
196 if (cs->fw6.ipv6.proto != 0) {
197 const struct protoent *pent =
198 getprotobynumber(cs->fw6.ipv6.proto);
199 char protonum[sizeof("65535")];
200 const char *name = protonum;
201
202 snprintf(protonum, sizeof(protonum), "%u",
203 cs->fw6.ipv6.proto);
204
205 if (!pent || !xlate_find_match(cs, pent->p_name)) {
206 if (pent)
207 name = pent->p_name;
208 xt_xlate_add(xl, "meta l4proto %s%s ",
209 cs->fw6.ipv6.invflags & IP6T_INV_PROTO ?
210 "!= " : "", name);
211 }
212
213 }
214
215 xlate_ipv6_addr("ip6 saddr", &cs->fw6.ipv6.src, &cs->fw6.ipv6.smsk,
216 cs->fw6.ipv6.invflags & IP6T_INV_SRCIP, xl);
217 xlate_ipv6_addr("ip6 daddr", &cs->fw6.ipv6.dst, &cs->fw6.ipv6.dmsk,
218 cs->fw6.ipv6.invflags & IP6T_INV_DSTIP, xl);
219
220 ret = xlate_matches(cs, xl);
221 if (!ret)
222 return ret;
223
224 /* Always add counters per rule, as in iptables */
225 xt_xlate_add(xl, "counter");
226 ret = xlate_action(cs, !!(cs->fw6.ipv6.flags & IP6T_F_GOTO), xl);
227
228 comment = xt_xlate_get_comment(xl);
229 if (comment)
230 xt_xlate_add(xl, " comment %s", comment);
231
232 return ret;
233 }
234
235 static int
nft_ipv6_add_entry(struct nft_handle * h,const char * chain,const char * table,struct iptables_command_state * cs,struct xtables_args * args,bool verbose,bool append,int rulenum)236 nft_ipv6_add_entry(struct nft_handle *h,
237 const char *chain, const char *table,
238 struct iptables_command_state *cs,
239 struct xtables_args *args, bool verbose,
240 bool append, int rulenum)
241 {
242 unsigned int i, j;
243 int ret = 1;
244
245 for (i = 0; i < args->s.naddrs; i++) {
246 memcpy(&cs->fw6.ipv6.src,
247 &args->s.addr.v6[i], sizeof(struct in6_addr));
248 memcpy(&cs->fw6.ipv6.smsk,
249 &args->s.mask.v6[i], sizeof(struct in6_addr));
250 for (j = 0; j < args->d.naddrs; j++) {
251 memcpy(&cs->fw6.ipv6.dst,
252 &args->d.addr.v6[j], sizeof(struct in6_addr));
253 memcpy(&cs->fw6.ipv6.dmsk,
254 &args->d.mask.v6[j], sizeof(struct in6_addr));
255 if (append) {
256 ret = nft_cmd_rule_append(h, chain, table,
257 cs, verbose);
258 } else {
259 ret = nft_cmd_rule_insert(h, chain, table,
260 cs, rulenum, verbose);
261 }
262 }
263 }
264
265 return ret;
266 }
267
268 static int
nft_ipv6_delete_entry(struct nft_handle * h,const char * chain,const char * table,struct iptables_command_state * cs,struct xtables_args * args,bool verbose)269 nft_ipv6_delete_entry(struct nft_handle *h,
270 const char *chain, const char *table,
271 struct iptables_command_state *cs,
272 struct xtables_args *args, bool verbose)
273 {
274 unsigned int i, j;
275 int ret = 1;
276
277 for (i = 0; i < args->s.naddrs; i++) {
278 memcpy(&cs->fw6.ipv6.src,
279 &args->s.addr.v6[i], sizeof(struct in6_addr));
280 memcpy(&cs->fw6.ipv6.smsk,
281 &args->s.mask.v6[i], sizeof(struct in6_addr));
282 for (j = 0; j < args->d.naddrs; j++) {
283 memcpy(&cs->fw6.ipv6.dst,
284 &args->d.addr.v6[j], sizeof(struct in6_addr));
285 memcpy(&cs->fw6.ipv6.dmsk,
286 &args->d.mask.v6[j], sizeof(struct in6_addr));
287 ret = nft_cmd_rule_delete(h, chain, table, cs, verbose);
288 }
289 }
290
291 return ret;
292 }
293
294 static int
nft_ipv6_check_entry(struct nft_handle * h,const char * chain,const char * table,struct iptables_command_state * cs,struct xtables_args * args,bool verbose)295 nft_ipv6_check_entry(struct nft_handle *h,
296 const char *chain, const char *table,
297 struct iptables_command_state *cs,
298 struct xtables_args *args, bool verbose)
299 {
300 unsigned int i, j;
301 int ret = 1;
302
303 for (i = 0; i < args->s.naddrs; i++) {
304 memcpy(&cs->fw6.ipv6.src,
305 &args->s.addr.v6[i], sizeof(struct in6_addr));
306 memcpy(&cs->fw6.ipv6.smsk,
307 &args->s.mask.v6[i], sizeof(struct in6_addr));
308 for (j = 0; j < args->d.naddrs; j++) {
309 memcpy(&cs->fw6.ipv6.dst,
310 &args->d.addr.v6[j], sizeof(struct in6_addr));
311 memcpy(&cs->fw6.ipv6.dmsk,
312 &args->d.mask.v6[j], sizeof(struct in6_addr));
313 ret = nft_cmd_rule_check(h, chain, table, cs, verbose);
314 }
315 }
316
317 return ret;
318 }
319
320 static int
nft_ipv6_replace_entry(struct nft_handle * h,const char * chain,const char * table,struct iptables_command_state * cs,struct xtables_args * args,bool verbose,int rulenum)321 nft_ipv6_replace_entry(struct nft_handle *h,
322 const char *chain, const char *table,
323 struct iptables_command_state *cs,
324 struct xtables_args *args, bool verbose,
325 int rulenum)
326 {
327 memcpy(&cs->fw6.ipv6.src, args->s.addr.v6, sizeof(struct in6_addr));
328 memcpy(&cs->fw6.ipv6.dst, args->d.addr.v6, sizeof(struct in6_addr));
329 memcpy(&cs->fw6.ipv6.smsk, args->s.mask.v6, sizeof(struct in6_addr));
330 memcpy(&cs->fw6.ipv6.dmsk, args->d.mask.v6, sizeof(struct in6_addr));
331
332 return nft_cmd_rule_replace(h, chain, table, cs, rulenum, verbose);
333 }
334
335 struct nft_family_ops nft_family_ops_ipv6 = {
336 .add = nft_ipv6_add,
337 .is_same = nft_ipv6_is_same,
338 .set_goto_flag = nft_ipv6_set_goto_flag,
339 .print_header = print_header,
340 .print_rule = nft_ipv6_print_rule,
341 .save_rule = nft_ipv6_save_rule,
342 .save_chain = nft_ipv46_save_chain,
343 .rule_parse = &nft_ruleparse_ops_ipv6,
344 .cmd_parse = {
345 .proto_parse = ipv6_proto_parse,
346 .post_parse = ipv6_post_parse,
347 },
348 .rule_to_cs = nft_rule_to_iptables_command_state,
349 .clear_cs = xtables_clear_iptables_command_state,
350 .xlate = nft_ipv6_xlate,
351 .add_entry = nft_ipv6_add_entry,
352 .delete_entry = nft_ipv6_delete_entry,
353 .check_entry = nft_ipv6_check_entry,
354 .replace_entry = nft_ipv6_replace_entry,
355 };
356