forked from Qortal/Brooklyn
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
297 lines
6.7 KiB
297 lines
6.7 KiB
// SPDX-License-Identifier: GPL-2.0-or-later |
|
/* |
|
* net/sched/em_ipt.c IPtables matches Ematch |
|
* |
|
* (c) 2018 Eyal Birger <[email protected]> |
|
*/ |
|
|
|
#include <linux/gfp.h> |
|
#include <linux/module.h> |
|
#include <linux/types.h> |
|
#include <linux/kernel.h> |
|
#include <linux/string.h> |
|
#include <linux/skbuff.h> |
|
#include <linux/tc_ematch/tc_em_ipt.h> |
|
#include <linux/netfilter.h> |
|
#include <linux/netfilter/x_tables.h> |
|
#include <linux/netfilter_ipv4/ip_tables.h> |
|
#include <linux/netfilter_ipv6/ip6_tables.h> |
|
#include <net/pkt_cls.h> |
|
|
|
struct em_ipt_match { |
|
const struct xt_match *match; |
|
u32 hook; |
|
u8 nfproto; |
|
u8 match_data[] __aligned(8); |
|
}; |
|
|
|
struct em_ipt_xt_match { |
|
char *match_name; |
|
int (*validate_match_data)(struct nlattr **tb, u8 mrev); |
|
}; |
|
|
|
static const struct nla_policy em_ipt_policy[TCA_EM_IPT_MAX + 1] = { |
|
[TCA_EM_IPT_MATCH_NAME] = { .type = NLA_STRING, |
|
.len = XT_EXTENSION_MAXNAMELEN }, |
|
[TCA_EM_IPT_MATCH_REVISION] = { .type = NLA_U8 }, |
|
[TCA_EM_IPT_HOOK] = { .type = NLA_U32 }, |
|
[TCA_EM_IPT_NFPROTO] = { .type = NLA_U8 }, |
|
[TCA_EM_IPT_MATCH_DATA] = { .type = NLA_UNSPEC }, |
|
}; |
|
|
|
static int check_match(struct net *net, struct em_ipt_match *im, int mdata_len) |
|
{ |
|
struct xt_mtchk_param mtpar = {}; |
|
union { |
|
struct ipt_entry e4; |
|
struct ip6t_entry e6; |
|
} e = {}; |
|
|
|
mtpar.net = net; |
|
mtpar.table = "filter"; |
|
mtpar.hook_mask = 1 << im->hook; |
|
mtpar.family = im->match->family; |
|
mtpar.match = im->match; |
|
mtpar.entryinfo = &e; |
|
mtpar.matchinfo = (void *)im->match_data; |
|
return xt_check_match(&mtpar, mdata_len, 0, 0); |
|
} |
|
|
|
static int policy_validate_match_data(struct nlattr **tb, u8 mrev) |
|
{ |
|
if (mrev != 0) { |
|
pr_err("only policy match revision 0 supported"); |
|
return -EINVAL; |
|
} |
|
|
|
if (nla_get_u32(tb[TCA_EM_IPT_HOOK]) != NF_INET_PRE_ROUTING) { |
|
pr_err("policy can only be matched on NF_INET_PRE_ROUTING"); |
|
return -EINVAL; |
|
} |
|
|
|
return 0; |
|
} |
|
|
|
static int addrtype_validate_match_data(struct nlattr **tb, u8 mrev) |
|
{ |
|
if (mrev != 1) { |
|
pr_err("only addrtype match revision 1 supported"); |
|
return -EINVAL; |
|
} |
|
|
|
return 0; |
|
} |
|
|
|
static const struct em_ipt_xt_match em_ipt_xt_matches[] = { |
|
{ |
|
.match_name = "policy", |
|
.validate_match_data = policy_validate_match_data |
|
}, |
|
{ |
|
.match_name = "addrtype", |
|
.validate_match_data = addrtype_validate_match_data |
|
}, |
|
{} |
|
}; |
|
|
|
static struct xt_match *get_xt_match(struct nlattr **tb) |
|
{ |
|
const struct em_ipt_xt_match *m; |
|
struct nlattr *mname_attr; |
|
u8 nfproto, mrev = 0; |
|
int ret; |
|
|
|
mname_attr = tb[TCA_EM_IPT_MATCH_NAME]; |
|
for (m = em_ipt_xt_matches; m->match_name; m++) { |
|
if (!nla_strcmp(mname_attr, m->match_name)) |
|
break; |
|
} |
|
|
|
if (!m->match_name) { |
|
pr_err("Unsupported xt match"); |
|
return ERR_PTR(-EINVAL); |
|
} |
|
|
|
if (tb[TCA_EM_IPT_MATCH_REVISION]) |
|
mrev = nla_get_u8(tb[TCA_EM_IPT_MATCH_REVISION]); |
|
|
|
ret = m->validate_match_data(tb, mrev); |
|
if (ret < 0) |
|
return ERR_PTR(ret); |
|
|
|
nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]); |
|
return xt_request_find_match(nfproto, m->match_name, mrev); |
|
} |
|
|
|
static int em_ipt_change(struct net *net, void *data, int data_len, |
|
struct tcf_ematch *em) |
|
{ |
|
struct nlattr *tb[TCA_EM_IPT_MAX + 1]; |
|
struct em_ipt_match *im = NULL; |
|
struct xt_match *match; |
|
int mdata_len, ret; |
|
u8 nfproto; |
|
|
|
ret = nla_parse_deprecated(tb, TCA_EM_IPT_MAX, data, data_len, |
|
em_ipt_policy, NULL); |
|
if (ret < 0) |
|
return ret; |
|
|
|
if (!tb[TCA_EM_IPT_HOOK] || !tb[TCA_EM_IPT_MATCH_NAME] || |
|
!tb[TCA_EM_IPT_MATCH_DATA] || !tb[TCA_EM_IPT_NFPROTO]) |
|
return -EINVAL; |
|
|
|
nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]); |
|
switch (nfproto) { |
|
case NFPROTO_IPV4: |
|
case NFPROTO_IPV6: |
|
break; |
|
default: |
|
return -EINVAL; |
|
} |
|
|
|
match = get_xt_match(tb); |
|
if (IS_ERR(match)) { |
|
pr_err("unable to load match\n"); |
|
return PTR_ERR(match); |
|
} |
|
|
|
mdata_len = XT_ALIGN(nla_len(tb[TCA_EM_IPT_MATCH_DATA])); |
|
im = kzalloc(sizeof(*im) + mdata_len, GFP_KERNEL); |
|
if (!im) { |
|
ret = -ENOMEM; |
|
goto err; |
|
} |
|
|
|
im->match = match; |
|
im->hook = nla_get_u32(tb[TCA_EM_IPT_HOOK]); |
|
im->nfproto = nfproto; |
|
nla_memcpy(im->match_data, tb[TCA_EM_IPT_MATCH_DATA], mdata_len); |
|
|
|
ret = check_match(net, im, mdata_len); |
|
if (ret) |
|
goto err; |
|
|
|
em->datalen = sizeof(*im) + mdata_len; |
|
em->data = (unsigned long)im; |
|
return 0; |
|
|
|
err: |
|
kfree(im); |
|
module_put(match->me); |
|
return ret; |
|
} |
|
|
|
static void em_ipt_destroy(struct tcf_ematch *em) |
|
{ |
|
struct em_ipt_match *im = (void *)em->data; |
|
|
|
if (!im) |
|
return; |
|
|
|
if (im->match->destroy) { |
|
struct xt_mtdtor_param par = { |
|
.net = em->net, |
|
.match = im->match, |
|
.matchinfo = im->match_data, |
|
.family = im->match->family |
|
}; |
|
im->match->destroy(&par); |
|
} |
|
module_put(im->match->me); |
|
kfree(im); |
|
} |
|
|
|
static int em_ipt_match(struct sk_buff *skb, struct tcf_ematch *em, |
|
struct tcf_pkt_info *info) |
|
{ |
|
const struct em_ipt_match *im = (const void *)em->data; |
|
struct xt_action_param acpar = {}; |
|
struct net_device *indev = NULL; |
|
u8 nfproto = im->match->family; |
|
struct nf_hook_state state; |
|
int ret; |
|
|
|
switch (skb_protocol(skb, true)) { |
|
case htons(ETH_P_IP): |
|
if (!pskb_network_may_pull(skb, sizeof(struct iphdr))) |
|
return 0; |
|
if (nfproto == NFPROTO_UNSPEC) |
|
nfproto = NFPROTO_IPV4; |
|
break; |
|
case htons(ETH_P_IPV6): |
|
if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr))) |
|
return 0; |
|
if (nfproto == NFPROTO_UNSPEC) |
|
nfproto = NFPROTO_IPV6; |
|
break; |
|
default: |
|
return 0; |
|
} |
|
|
|
rcu_read_lock(); |
|
|
|
if (skb->skb_iif) |
|
indev = dev_get_by_index_rcu(em->net, skb->skb_iif); |
|
|
|
nf_hook_state_init(&state, im->hook, nfproto, |
|
indev ?: skb->dev, skb->dev, NULL, em->net, NULL); |
|
|
|
acpar.match = im->match; |
|
acpar.matchinfo = im->match_data; |
|
acpar.state = &state; |
|
|
|
ret = im->match->match(skb, &acpar); |
|
|
|
rcu_read_unlock(); |
|
return ret; |
|
} |
|
|
|
static int em_ipt_dump(struct sk_buff *skb, struct tcf_ematch *em) |
|
{ |
|
struct em_ipt_match *im = (void *)em->data; |
|
|
|
if (nla_put_string(skb, TCA_EM_IPT_MATCH_NAME, im->match->name) < 0) |
|
return -EMSGSIZE; |
|
if (nla_put_u32(skb, TCA_EM_IPT_HOOK, im->hook) < 0) |
|
return -EMSGSIZE; |
|
if (nla_put_u8(skb, TCA_EM_IPT_MATCH_REVISION, im->match->revision) < 0) |
|
return -EMSGSIZE; |
|
if (nla_put_u8(skb, TCA_EM_IPT_NFPROTO, im->nfproto) < 0) |
|
return -EMSGSIZE; |
|
if (nla_put(skb, TCA_EM_IPT_MATCH_DATA, |
|
im->match->usersize ?: im->match->matchsize, |
|
im->match_data) < 0) |
|
return -EMSGSIZE; |
|
|
|
return 0; |
|
} |
|
|
|
static struct tcf_ematch_ops em_ipt_ops = { |
|
.kind = TCF_EM_IPT, |
|
.change = em_ipt_change, |
|
.destroy = em_ipt_destroy, |
|
.match = em_ipt_match, |
|
.dump = em_ipt_dump, |
|
.owner = THIS_MODULE, |
|
.link = LIST_HEAD_INIT(em_ipt_ops.link) |
|
}; |
|
|
|
static int __init init_em_ipt(void) |
|
{ |
|
return tcf_em_register(&em_ipt_ops); |
|
} |
|
|
|
static void __exit exit_em_ipt(void) |
|
{ |
|
tcf_em_unregister(&em_ipt_ops); |
|
} |
|
|
|
MODULE_LICENSE("GPL"); |
|
MODULE_AUTHOR("Eyal Birger <[email protected]>"); |
|
MODULE_DESCRIPTION("TC extended match for IPtables matches"); |
|
|
|
module_init(init_em_ipt); |
|
module_exit(exit_em_ipt); |
|
|
|
MODULE_ALIAS_TCF_EMATCH(TCF_EM_IPT);
|
|
|