[linux-block.git] / net / netfilter / xt_TEE.c

/*
 *	"TEE" target extension for Xtables
 *	Copyright © Sebastian Claßen, 2007
 *	Jan Engelhardt, 2007-2010
 *
 *	based on ipt_ROUTE.c from Cédric de Launois
 *	<delaunois@info.ucl.be>
 *
 *	This program is free software; you can redistribute it and/or
 *	modify it under the terms of the GNU General Public License
 *	version 2 or later, as published by the Free Software Foundation.
 */
#include <linux/ip.h>
#include <linux/module.h>
#include <linux/percpu.h>
#include <linux/route.h>
#include <linux/skbuff.h>
#include <linux/notifier.h>
#include <net/checksum.h>
#include <net/icmp.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/ip6_route.h>
#include <net/route.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_TEE.h>

#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
#	define WITH_CONNTRACK 1
#	include <net/netfilter/nf_conntrack.h>
#endif
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
#	define WITH_IPV6 1
#endif

struct xt_tee_priv {
	struct notifier_block	notifier;
	struct xt_tee_tginfo	*tginfo;
	int			oif;
};

static const union nf_inet_addr tee_zero_address;
static DEFINE_PER_CPU(bool, tee_active);

static struct net *pick_net(struct sk_buff *skb)
{
#ifdef CONFIG_NET_NS
	const struct dst_entry *dst;

	if (skb->dev != NULL)
		return dev_net(skb->dev);
	dst = skb_dst(skb);
	if (dst != NULL && dst->dev != NULL)
		return dev_net(dst->dev);
#endif
	return &init_net;
}

static bool
tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info)
{
	const struct iphdr *iph = ip_hdr(skb);
	struct net *net = pick_net(skb);
	struct rtable *rt;
	struct flowi4 fl4;

	memset(&fl4, 0, sizeof(fl4));
	if (info->priv) {
		if (info->priv->oif == -1)
			return false;
		fl4.flowi4_oif = info->priv->oif;
	}
	fl4.daddr = info->gw.ip;
	fl4.flowi4_tos = RT_TOS(iph->tos);
	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
	rt = ip_route_output_key(net, &fl4);
	if (IS_ERR(rt))
		return false;

	skb_dst_drop(skb);
	skb_dst_set(skb, &rt->dst);
	skb->dev      = rt->dst.dev;
	skb->protocol = htons(ETH_P_IP);
	return true;
}

static unsigned int
tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct xt_tee_tginfo *info = par->targinfo;
	struct iphdr *iph;

	if (percpu_read(tee_active))
		return XT_CONTINUE;
	/*
	 * Copy the skb, and route the copy. Will later return %XT_CONTINUE for
	 * the original skb, which should continue on its way as if nothing has
	 * happened. The copy should be independently delivered to the TEE
	 * --gateway.
	 */
	skb = pskb_copy(skb, GFP_ATOMIC);
	if (skb == NULL)
		return XT_CONTINUE;

#ifdef WITH_CONNTRACK
	/* Avoid counting cloned packets towards the original connection. */
	nf_conntrack_put(skb->nfct);
	skb->nfct     = &nf_ct_untracked_get()->ct_general;
	skb->nfctinfo = IP_CT_NEW;
	nf_conntrack_get(skb->nfct);
#endif
	/*
	 * If we are in PREROUTING/INPUT, the checksum must be recalculated
	 * since the length could have changed as a result of defragmentation.
	 *
	 * We also decrease the TTL to mitigate potential TEE loops
	 * between two hosts.
	 *
	 * Set %IP_DF so that the original source is notified of a potentially
	 * decreased MTU on the clone route. IPv6 does this too.
	 */
	iph = ip_hdr(skb);
	iph->frag_off |= htons(IP_DF);
	if (par->hooknum == NF_INET_PRE_ROUTING ||
	    par->hooknum == NF_INET_LOCAL_IN)
		--iph->ttl;
	ip_send_check(iph);

	if (tee_tg_route4(skb, info)) {
		percpu_write(tee_active, true);
		ip_local_out(skb);
		percpu_write(tee_active, false);
	} else {
		kfree_skb(skb);
	}
	return XT_CONTINUE;
}

#ifdef WITH_IPV6
static bool
tee_tg_route6(struct sk_buff *skb, const struct xt_tee_tginfo *info)
{
	const struct ipv6hdr *iph = ipv6_hdr(skb);
	struct net *net = pick_net(skb);
	struct dst_entry *dst;
	struct flowi6 fl6;

	memset(&fl6, 0, sizeof(fl6));
	if (info->priv) {
		if (info->priv->oif == -1)
			return false;
		fl6.flowi6_oif = info->priv->oif;
	}
	fl6.daddr = info->gw.in6;
	fl6.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) |
			   (iph->flow_lbl[1] << 8) | iph->flow_lbl[2];
	dst = ip6_route_output(net, NULL, &fl6);
	if (dst == NULL)
		return false;

	skb_dst_drop(skb);
	skb_dst_set(skb, dst);
	skb->dev      = dst->dev;
	skb->protocol = htons(ETH_P_IPV6);
	return true;
}

static unsigned int
tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct xt_tee_tginfo *info = par->targinfo;

	if (percpu_read(tee_active))
		return XT_CONTINUE;
	skb = pskb_copy(skb, GFP_ATOMIC);
	if (skb == NULL)
		return XT_CONTINUE;

#ifdef WITH_CONNTRACK
	nf_conntrack_put(skb->nfct);
	skb->nfct     = &nf_ct_untracked_get()->ct_general;
	skb->nfctinfo = IP_CT_NEW;
	nf_conntrack_get(skb->nfct);
#endif
	if (par->hooknum == NF_INET_PRE_ROUTING ||
	    par->hooknum == NF_INET_LOCAL_IN) {
		struct ipv6hdr *iph = ipv6_hdr(skb);
		--iph->hop_limit;
	}
	if (tee_tg_route6(skb, info)) {
		percpu_write(tee_active, true);
		ip6_local_out(skb);
		percpu_write(tee_active, false);
	} else {
		kfree_skb(skb);
	}
	return XT_CONTINUE;
}
#endif /* WITH_IPV6 */

static int tee_netdev_event(struct notifier_block *this, unsigned long event,
			    void *ptr)
{
	struct net_device *dev = ptr;
	struct xt_tee_priv *priv;

	priv = container_of(this, struct xt_tee_priv, notifier);
	switch (event) {
	case NETDEV_REGISTER:
		if (!strcmp(dev->name, priv->tginfo->oif))
			priv->oif = dev->ifindex;
		break;
	case NETDEV_UNREGISTER:
		if (dev->ifindex == priv->oif)
			priv->oif = -1;
		break;
	case NETDEV_CHANGENAME:
		if (!strcmp(dev->name, priv->tginfo->oif))
			priv->oif = dev->ifindex;
		else if (dev->ifindex == priv->oif)
			priv->oif = -1;
		break;
	}

	return NOTIFY_DONE;
}

static int tee_tg_check(const struct xt_tgchk_param *par)
{
	struct xt_tee_tginfo *info = par->targinfo;
	struct xt_tee_priv *priv;

	/* 0.0.0.0 and :: not allowed */
	if (memcmp(&info->gw, &tee_zero_address,
		   sizeof(tee_zero_address)) == 0)
		return -EINVAL;

	if (info->oif[0]) {
		if (info->oif[sizeof(info->oif)-1] != '\0')
			return -EINVAL;

		priv = kzalloc(sizeof(*priv), GFP_KERNEL);
		if (priv == NULL)
			return -ENOMEM;

		priv->tginfo  = info;
		priv->oif     = -1;
		priv->notifier.notifier_call = tee_netdev_event;
		info->priv    = priv;

		register_netdevice_notifier(&priv->notifier);
	} else
		info->priv = NULL;

	return 0;
}

static void tee_tg_destroy(const struct xt_tgdtor_param *par)
{
	struct xt_tee_tginfo *info = par->targinfo;

	if (info->priv) {
		unregister_netdevice_notifier(&info->priv->notifier);
		kfree(info->priv);
	}
}

static struct xt_target tee_tg_reg[] __read_mostly = {
	{
		.name       = "TEE",
		.revision   = 1,
		.family     = NFPROTO_IPV4,
		.target     = tee_tg4,
		.targetsize = sizeof(struct xt_tee_tginfo),
		.checkentry = tee_tg_check,
		.destroy    = tee_tg_destroy,
		.me         = THIS_MODULE,
	},
#ifdef WITH_IPV6
	{
		.name       = "TEE",
		.revision   = 1,
		.family     = NFPROTO_IPV6,
		.target     = tee_tg6,
		.targetsize = sizeof(struct xt_tee_tginfo),
		.checkentry = tee_tg_check,
		.destroy    = tee_tg_destroy,
		.me         = THIS_MODULE,
	},
#endif
};

static int __init tee_tg_init(void)
{
	return xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
}

static void __exit tee_tg_exit(void)
{
	xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
}

module_init(tee_tg_init);
module_exit(tee_tg_exit);
MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>");
MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
MODULE_DESCRIPTION("Xtables: Reroute packet copy");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_TEE");
MODULE_ALIAS("ip6t_TEE");
Commit	Line	Data
e281b198 JE	1	/*
	2	* "TEE" target extension for Xtables
	3	* Copyright © Sebastian Claßen, 2007
	4	* Jan Engelhardt, 2007-2010
	5	*
	6	* based on ipt_ROUTE.c from Cédric de Launois
	7	* <delaunois@info.ucl.be>
	8	*
	9	* This program is free software; you can redistribute it and/or
	10	* modify it under the terms of the GNU General Public License
	11	* version 2 or later, as published by the Free Software Foundation.
	12	*/
	13	#include <linux/ip.h>
	14	#include <linux/module.h>
cd58bcd9	15	#include <linux/percpu.h>
e281b198 JE	16	#include <linux/route.h>
e281b198 JE	17	#include <linux/skbuff.h>
22265a5c	18	#include <linux/notifier.h>
e281b198 JE	19	#include <net/checksum.h>
	20	#include <net/icmp.h>
	21	#include <net/ip.h>
	22	#include <net/ipv6.h>
	23	#include <net/ip6_route.h>
	24	#include <net/route.h>
	25	#include <linux/netfilter/x_tables.h>
	26	#include <linux/netfilter/xt_TEE.h>
	27
	28	#if defined(CONFIG_NF_CONNTRACK) \|\| defined(CONFIG_NF_CONNTRACK_MODULE)
	29	# define WITH_CONNTRACK 1
	30	# include <net/netfilter/nf_conntrack.h>
	31	#endif
	32	#if defined(CONFIG_IPV6) \|\| defined(CONFIG_IPV6_MODULE)
	33	# define WITH_IPV6 1
	34	#endif
	35
22265a5c PM	36	struct xt_tee_priv {
	37	struct notifier_block notifier;
	38	struct xt_tee_tginfo *tginfo;
	39	int oif;
	40	};
	41
e281b198	42	static const union nf_inet_addr tee_zero_address;
cd58bcd9	43	static DEFINE_PER_CPU(bool, tee_active);
e281b198 JE	44
	45	static struct net pick_net(struct sk_buff skb)
	46	{
	47	#ifdef CONFIG_NET_NS
	48	const struct dst_entry *dst;
	49
	50	if (skb->dev != NULL)
	51	return dev_net(skb->dev);
	52	dst = skb_dst(skb);
	53	if (dst != NULL && dst->dev != NULL)
	54	return dev_net(dst->dev);
	55	#endif
	56	return &init_net;
	57	}
	58
e281b198 JE	59	static bool
	60	tee_tg_route4(struct sk_buff skb, const struct xt_tee_tginfo info)
	61	{
	62	const struct iphdr *iph = ip_hdr(skb);
	63	struct net *net = pick_net(skb);
	64	struct rtable *rt;
9d6ec938	65	struct flowi4 fl4;
e281b198	66
9d6ec938	67	memset(&fl4, 0, sizeof(fl4));
22265a5c PM	68	if (info->priv) {
	69	if (info->priv->oif == -1)
	70	return false;
9d6ec938	71	fl4.flowi4_oif = info->priv->oif;
22265a5c	72	}
9d6ec938 DM	73	fl4.daddr = info->gw.ip;
	74	fl4.flowi4_tos = RT_TOS(iph->tos);
	75	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
	76	rt = ip_route_output_key(net, &fl4);
b23dd4fe	77	if (IS_ERR(rt))
e281b198 JE	78	return false;
e281b198 JE	79
50636af7	80	skb_dst_drop(skb);
d8d1f30b CG	81	skb_dst_set(skb, &rt->dst);
d8d1f30b CG	82	skb->dev = rt->dst.dev;
e281b198 JE	83	skb->protocol = htons(ETH_P_IP);
	84	return true;
	85	}
	86
	87	static unsigned int
4b560b44	88	tee_tg4(struct sk_buff skb, const struct xt_action_param par)
e281b198 JE	89	{
	90	const struct xt_tee_tginfo *info = par->targinfo;
	91	struct iphdr *iph;
	92
cd58bcd9 JE	93	if (percpu_read(tee_active))
cd58bcd9 JE	94	return XT_CONTINUE;
e281b198 JE	95	/*
	96	* Copy the skb, and route the copy. Will later return %XT_CONTINUE for
	97	* the original skb, which should continue on its way as if nothing has
	98	* happened. The copy should be independently delivered to the TEE
	99	* --gateway.
	100	*/
	101	skb = pskb_copy(skb, GFP_ATOMIC);
	102	if (skb == NULL)
	103	return XT_CONTINUE;
	104
	105	#ifdef WITH_CONNTRACK
	106	/* Avoid counting cloned packets towards the original connection. */
	107	nf_conntrack_put(skb->nfct);
5bfddbd4	108	skb->nfct = &nf_ct_untracked_get()->ct_general;
e281b198 JE	109	skb->nfctinfo = IP_CT_NEW;
	110	nf_conntrack_get(skb->nfct);
	111	#endif
	112	/*
	113	* If we are in PREROUTING/INPUT, the checksum must be recalculated
	114	* since the length could have changed as a result of defragmentation.
	115	*
	116	* We also decrease the TTL to mitigate potential TEE loops
	117	* between two hosts.
	118	*
	119	* Set %IP_DF so that the original source is notified of a potentially
	120	* decreased MTU on the clone route. IPv6 does this too.
	121	*/
	122	iph = ip_hdr(skb);
	123	iph->frag_off \|= htons(IP_DF);
	124	if (par->hooknum == NF_INET_PRE_ROUTING \|\|
	125	par->hooknum == NF_INET_LOCAL_IN)
	126	--iph->ttl;
	127	ip_send_check(iph);
	128
cd58bcd9 JE	129	if (tee_tg_route4(skb, info)) {
	130	percpu_write(tee_active, true);
	131	ip_local_out(skb);
	132	percpu_write(tee_active, false);
	133	} else {
e281b198	134	kfree_skb(skb);
cd58bcd9	135	}
e281b198 JE	136	return XT_CONTINUE;
	137	}
	138
	139	#ifdef WITH_IPV6
	140	static bool
	141	tee_tg_route6(struct sk_buff skb, const struct xt_tee_tginfo info)
	142	{
	143	const struct ipv6hdr *iph = ipv6_hdr(skb);
	144	struct net *net = pick_net(skb);
	145	struct dst_entry *dst;
4c9483b2	146	struct flowi6 fl6;
e281b198	147
4c9483b2	148	memset(&fl6, 0, sizeof(fl6));
22265a5c PM	149	if (info->priv) {
	150	if (info->priv->oif == -1)
	151	return false;
4c9483b2	152	fl6.flowi6_oif = info->priv->oif;
22265a5c	153	}
4c9483b2 DM	154	fl6.daddr = info->gw.in6;
4c9483b2 DM	155	fl6.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) \|
5811662b	156	(iph->flow_lbl[1] << 8) \| iph->flow_lbl[2];
4c9483b2	157	dst = ip6_route_output(net, NULL, &fl6);
e281b198 JE	158	if (dst == NULL)
	159	return false;
	160
50636af7	161	skb_dst_drop(skb);
e281b198 JE	162	skb_dst_set(skb, dst);
	163	skb->dev = dst->dev;
	164	skb->protocol = htons(ETH_P_IPV6);
	165	return true;
	166	}
	167
	168	static unsigned int
4b560b44	169	tee_tg6(struct sk_buff skb, const struct xt_action_param par)
e281b198 JE	170	{
	171	const struct xt_tee_tginfo *info = par->targinfo;
	172
cd58bcd9 JE	173	if (percpu_read(tee_active))
cd58bcd9 JE	174	return XT_CONTINUE;
e281b198 JE	175	skb = pskb_copy(skb, GFP_ATOMIC);
	176	if (skb == NULL)
	177	return XT_CONTINUE;
	178
	179	#ifdef WITH_CONNTRACK
	180	nf_conntrack_put(skb->nfct);
5bfddbd4	181	skb->nfct = &nf_ct_untracked_get()->ct_general;
e281b198 JE	182	skb->nfctinfo = IP_CT_NEW;
	183	nf_conntrack_get(skb->nfct);
	184	#endif
	185	if (par->hooknum == NF_INET_PRE_ROUTING \|\|
	186	par->hooknum == NF_INET_LOCAL_IN) {
	187	struct ipv6hdr *iph = ipv6_hdr(skb);
	188	--iph->hop_limit;
	189	}
cd58bcd9 JE	190	if (tee_tg_route6(skb, info)) {
	191	percpu_write(tee_active, true);
	192	ip6_local_out(skb);
	193	percpu_write(tee_active, false);
	194	} else {
e281b198	195	kfree_skb(skb);
cd58bcd9	196	}
e281b198 JE	197	return XT_CONTINUE;
	198	}
	199	#endif /* WITH_IPV6 */
	200
22265a5c PM	201	static int tee_netdev_event(struct notifier_block *this, unsigned long event,
	202	void *ptr)
	203	{
	204	struct net_device *dev = ptr;
	205	struct xt_tee_priv *priv;
	206
	207	priv = container_of(this, struct xt_tee_priv, notifier);
	208	switch (event) {
	209	case NETDEV_REGISTER:
	210	if (!strcmp(dev->name, priv->tginfo->oif))
	211	priv->oif = dev->ifindex;
	212	break;
	213	case NETDEV_UNREGISTER:
	214	if (dev->ifindex == priv->oif)
	215	priv->oif = -1;
	216	break;
	217	case NETDEV_CHANGENAME:
	218	if (!strcmp(dev->name, priv->tginfo->oif))
	219	priv->oif = dev->ifindex;
	220	else if (dev->ifindex == priv->oif)
	221	priv->oif = -1;
	222	break;
	223	}
	224
	225	return NOTIFY_DONE;
	226	}
	227
e281b198 JE	228	static int tee_tg_check(const struct xt_tgchk_param *par)
e281b198 JE	229	{
22265a5c PM	230	struct xt_tee_tginfo *info = par->targinfo;
22265a5c PM	231	struct xt_tee_priv *priv;
e281b198	232
e281b198	233	/* 0.0.0.0 and :: not allowed */
22265a5c PM	234	if (memcmp(&info->gw, &tee_zero_address,
	235	sizeof(tee_zero_address)) == 0)
	236	return -EINVAL;
	237
	238	if (info->oif[0]) {
	239	if (info->oif[sizeof(info->oif)-1] != '\0')
	240	return -EINVAL;
	241
	242	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
	243	if (priv == NULL)
	244	return -ENOMEM;
	245
	246	priv->tginfo = info;
	247	priv->oif = -1;
	248	priv->notifier.notifier_call = tee_netdev_event;
	249	info->priv = priv;
	250
	251	register_netdevice_notifier(&priv->notifier);
	252	} else
	253	info->priv = NULL;
	254
	255	return 0;
	256	}
	257
	258	static void tee_tg_destroy(const struct xt_tgdtor_param *par)
	259	{
	260	struct xt_tee_tginfo *info = par->targinfo;
	261
	262	if (info->priv) {
	263	unregister_netdevice_notifier(&info->priv->notifier);
	264	kfree(info->priv);
	265	}
e281b198 JE	266	}
	267
	268	static struct xt_target tee_tg_reg[] __read_mostly = {
	269	{
	270	.name = "TEE",
	271	.revision = 1,
	272	.family = NFPROTO_IPV4,
	273	.target = tee_tg4,
	274	.targetsize = sizeof(struct xt_tee_tginfo),
	275	.checkentry = tee_tg_check,
22265a5c	276	.destroy = tee_tg_destroy,
e281b198 JE	277	.me = THIS_MODULE,
	278	},
	279	#ifdef WITH_IPV6
	280	{
	281	.name = "TEE",
	282	.revision = 1,
	283	.family = NFPROTO_IPV6,
	284	.target = tee_tg6,
	285	.targetsize = sizeof(struct xt_tee_tginfo),
	286	.checkentry = tee_tg_check,
22265a5c	287	.destroy = tee_tg_destroy,
e281b198 JE	288	.me = THIS_MODULE,
	289	},
	290	#endif
	291	};
	292
	293	static int __init tee_tg_init(void)
	294	{
	295	return xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
	296	}
	297
	298	static void __exit tee_tg_exit(void)
	299	{
	300	xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
	301	}
	302
	303	module_init(tee_tg_init);
	304	module_exit(tee_tg_exit);
	305	MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>");
	306	MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
	307	MODULE_DESCRIPTION("Xtables: Reroute packet copy");
	308	MODULE_LICENSE("GPL");
	309	MODULE_ALIAS("ipt_TEE");
	310	MODULE_ALIAS("ip6t_TEE");