// SPDX-License-Identifier: GPL-2.0-or-later

/* seitan - Syscall Expressive Interpreter, Transformer and Notifier
 *
 * demo/iptables.hjson - Example for iptables-nft: fetch ruleset, add rules
 *
 * Copyright (c) 2024 Red Hat GmbH
 * Author: Stefano Brivio <sbrivio@redhat.com>
 *
 * Example of stand-alone usage:
 *
 *   ./seitan-cooker \
 *       -i demo/iptables.hjson -g demo/iptables.gluten -f demo/iptables.bpf
 *   ./seitan-eater \
 *       -i demo/iptables.bpf -- /sbin/iptables -t mangle -A FORWARD -j LOG
 *   # blocks
 *
 *   ./seitan -p $(pgrep seitan-eater) -i demo/iptables.gluten
 *   # as root or with CAP_NET_ADMIN: adds rule on behalf of caller
 *
 *   ./seitan-eater \
 *       -i demo/iptables.bpf -- /sbin/iptables -t mangle -D FORWARD -j LOG
 *   # blocks
 *
 *   ./seitan -p $(pgrep seitan-eater) -i demo/iptables.gluten
 *   # as root or with CAP_NET_ADMIN: deletes rule on behalf of caller
 */

[
  /* When the target process tries to open a netlink socket for netfilter, open
   * one on behalf of the caller, owned by us, and replace it in the caller.
   *
   * For netlink operations, there's always a double permission check:
   * both opener of the socket and sender of the messages need to have matching
   * capabilities, see netlink_ns_capable() in net/netlink/af_netlink.c.
   *
   * This block takes care of the first part.
   */
  {
    "match": {
      "socket": {
        "family"	: "netlink",
        "type"		: "raw",
        "protocol"	: "nl_netfilter"
      }
      /* socket(2) doesn't point to memory, so we can safely let any unrelated
       * system calls proceed, directly in the caller, without replaying it
       * ourselves.
       */
    },
    "call": {
      "socket": {
        "family"	: "netlink",
        "type"		: "raw",
        "flags"		: 0,
        "protocol"	: "nl_netfilter"
      },
      "ret": "fd"
    },
    "fd": {
      "src": { "get": "fd" },
      "close_on_exec": true,
      "return": true
    }
  },

  /* Second part: send messages on behalf of the target process.
   *
   * First, the ones iptables needs to check for nftables compatibility, and to
   * fetch tables, chains, rules and sets, including their generation (version)
   * identifier.
   *
   * These are simple messages, without batches, using sendto().
   */
  {
    "match": {
      "sendto": {
        "fd": {
          "set": "fd"
        },
        "buf": {
          "set": "buf",
          "value": {
            "netlink": {
              "type": {
                "in": [
                  "nf_compat_get",
                  "nf_getgen",
                  "nf_gettable",
                  "nf_getchain",
                  "nf_getrule",
                  "nf_getset"
                ]
              }
            }
          }
        },
        "len" : { "set": "len" },
        "addr": { "set": "addr" }
      }
    },
    "call": {
      "sendto": {
          "fd": { "get": "fd" },
          "buf": { "get": "buf" },
          "len": { "get": "len" },
          "addr": { "get": "addr" },
          "flags": 0
      },
      "ret": "rc"
    },
    "return": { "value": "rc", "error": "rc" }
  },

  /* sendto(2) points to memory, so we need to match on any unrelated sendto()
   * call and replay it ourselves, but pretending we're the original process
   * (see "context" below). Otherwise, a thread of the target process can fool
   * us into sending other messages with our capability set.
   */
  {
    "match": {
      "sendto": {
        "fd": { "set": "fd" },
        "buf": { "set": "buf" },
        "len": { "set": "len" },
        "addr": { "set": "addr" },
        "flags": { "set": "flags" }
      }
    },
    "call": {
      "sendto": {
        "fd": { "get": "fd" },
        "buf": { "get": "buf" },
        "len": { "get": "len" },
        "addr": { "get": "addr" },
        "flags": { "get": "flags" }
      },
      "context": { "uid": "caller", "gid": "caller" }
    }
  },

  /* Now deal with the actual rule insertion or deletion: those are batched
   * messages, using sendmsg(). Replay the message and relay return code and any
   * error back.
   */
  {
    "match": {
      "sendmsg": {
        "fd": { "set": "fd" },
        "msg": {
          "iov": {
            "set": "buf",
            "value": {
              "netlink": {
                "type": { "in": [ "nf_newrule", "nf_delrule" ] }
              }
            }
          }
        }
      }
    },
    "call": {
      "sendmsg": {
        "fd": { "get": "fd" },
        "msg": {
          "name": {
            "family": "netlink",
            "pid": 0,
            "groups": 0
          },
          "iovlen": 1,
          "iov": { "get": "buf" }
        },
        "flags": 0
      },
      "ret": "rc"
    },
    "return": { "value": "rc", "error": "rc" }
  },

  /* Same as sendto(2): sendmsg(2) points to memory. Replay any unrelated system
   * call with the credentials from the target process.
   */
  {
    "match": {
      "sendmsg": {
        "fd": { "set": "fd" },
        "msg": {
          "name": { "set": "name" },
          "namelen": { "set": "namelen" },
          "iov": { "set": "buf" },
          "control": { "set": "control" },
          "controllen": { "set": "controllen" }
        },
        "flags": { "set": "flags" }
      }
    },
    "call": {
      "sendmsg": {
        "fd": { "get": "fd" },
        "msg": {
          "name": { "get": "name" },
          "namelen": { "get": "namelen" },
          "iov": { "get": "buf" },
          "iovlen": 1,
          "control": { "get": "control" },
          "controllen": { "get": "controllen" }
        },
        "flags": { "get": "flags" }
      },
      "context": { "uid": "caller", "gid": "caller" }
    }
  }
]