Commit | Line | Data |
---|---|---|
2874c5fd | 1 | // SPDX-License-Identifier: GPL-2.0-or-later |
ccc007e4 EB |
2 | /* |
3 | * net/sched/em_ipt.c IPtables matches Ematch | |
4 | * | |
5 | * (c) 2018 Eyal Birger <eyal.birger@gmail.com> | |
ccc007e4 EB |
6 | */ |
7 | ||
8 | #include <linux/gfp.h> | |
9 | #include <linux/module.h> | |
10 | #include <linux/types.h> | |
11 | #include <linux/kernel.h> | |
12 | #include <linux/string.h> | |
13 | #include <linux/skbuff.h> | |
14 | #include <linux/tc_ematch/tc_em_ipt.h> | |
15 | #include <linux/netfilter.h> | |
16 | #include <linux/netfilter/x_tables.h> | |
17 | #include <linux/netfilter_ipv4/ip_tables.h> | |
18 | #include <linux/netfilter_ipv6/ip6_tables.h> | |
19 | #include <net/pkt_cls.h> | |
20 | ||
21 | struct em_ipt_match { | |
22 | const struct xt_match *match; | |
23 | u32 hook; | |
ba3d24d4 | 24 | u8 nfproto; |
b90feaff | 25 | u8 match_data[] __aligned(8); |
ccc007e4 EB |
26 | }; |
27 | ||
28 | struct em_ipt_xt_match { | |
29 | char *match_name; | |
30 | int (*validate_match_data)(struct nlattr **tb, u8 mrev); | |
31 | }; | |
32 | ||
33 | static const struct nla_policy em_ipt_policy[TCA_EM_IPT_MAX + 1] = { | |
34 | [TCA_EM_IPT_MATCH_NAME] = { .type = NLA_STRING, | |
35 | .len = XT_EXTENSION_MAXNAMELEN }, | |
36 | [TCA_EM_IPT_MATCH_REVISION] = { .type = NLA_U8 }, | |
37 | [TCA_EM_IPT_HOOK] = { .type = NLA_U32 }, | |
38 | [TCA_EM_IPT_NFPROTO] = { .type = NLA_U8 }, | |
39 | [TCA_EM_IPT_MATCH_DATA] = { .type = NLA_UNSPEC }, | |
40 | }; | |
41 | ||
42 | static int check_match(struct net *net, struct em_ipt_match *im, int mdata_len) | |
43 | { | |
44 | struct xt_mtchk_param mtpar = {}; | |
45 | union { | |
46 | struct ipt_entry e4; | |
47 | struct ip6t_entry e6; | |
48 | } e = {}; | |
49 | ||
50 | mtpar.net = net; | |
51 | mtpar.table = "filter"; | |
52 | mtpar.hook_mask = 1 << im->hook; | |
53 | mtpar.family = im->match->family; | |
54 | mtpar.match = im->match; | |
55 | mtpar.entryinfo = &e; | |
56 | mtpar.matchinfo = (void *)im->match_data; | |
57 | return xt_check_match(&mtpar, mdata_len, 0, 0); | |
58 | } | |
59 | ||
60 | static int policy_validate_match_data(struct nlattr **tb, u8 mrev) | |
61 | { | |
62 | if (mrev != 0) { | |
63 | pr_err("only policy match revision 0 supported"); | |
64 | return -EINVAL; | |
65 | } | |
66 | ||
67 | if (nla_get_u32(tb[TCA_EM_IPT_HOOK]) != NF_INET_PRE_ROUTING) { | |
68 | pr_err("policy can only be matched on NF_INET_PRE_ROUTING"); | |
69 | return -EINVAL; | |
70 | } | |
71 | ||
72 | return 0; | |
73 | } | |
74 | ||
0c4231c7 NA |
75 | static int addrtype_validate_match_data(struct nlattr **tb, u8 mrev) |
76 | { | |
77 | if (mrev != 1) { | |
78 | pr_err("only addrtype match revision 1 supported"); | |
79 | return -EINVAL; | |
80 | } | |
81 | ||
82 | return 0; | |
83 | } | |
84 | ||
ccc007e4 EB |
85 | static const struct em_ipt_xt_match em_ipt_xt_matches[] = { |
86 | { | |
87 | .match_name = "policy", | |
88 | .validate_match_data = policy_validate_match_data | |
89 | }, | |
0c4231c7 NA |
90 | { |
91 | .match_name = "addrtype", | |
92 | .validate_match_data = addrtype_validate_match_data | |
93 | }, | |
ccc007e4 EB |
94 | {} |
95 | }; | |
96 | ||
97 | static struct xt_match *get_xt_match(struct nlattr **tb) | |
98 | { | |
99 | const struct em_ipt_xt_match *m; | |
100 | struct nlattr *mname_attr; | |
101 | u8 nfproto, mrev = 0; | |
102 | int ret; | |
103 | ||
104 | mname_attr = tb[TCA_EM_IPT_MATCH_NAME]; | |
105 | for (m = em_ipt_xt_matches; m->match_name; m++) { | |
106 | if (!nla_strcmp(mname_attr, m->match_name)) | |
107 | break; | |
108 | } | |
109 | ||
110 | if (!m->match_name) { | |
111 | pr_err("Unsupported xt match"); | |
112 | return ERR_PTR(-EINVAL); | |
113 | } | |
114 | ||
115 | if (tb[TCA_EM_IPT_MATCH_REVISION]) | |
116 | mrev = nla_get_u8(tb[TCA_EM_IPT_MATCH_REVISION]); | |
117 | ||
118 | ret = m->validate_match_data(tb, mrev); | |
119 | if (ret < 0) | |
120 | return ERR_PTR(ret); | |
121 | ||
122 | nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]); | |
123 | return xt_request_find_match(nfproto, m->match_name, mrev); | |
124 | } | |
125 | ||
126 | static int em_ipt_change(struct net *net, void *data, int data_len, | |
127 | struct tcf_ematch *em) | |
128 | { | |
129 | struct nlattr *tb[TCA_EM_IPT_MAX + 1]; | |
130 | struct em_ipt_match *im = NULL; | |
131 | struct xt_match *match; | |
132 | int mdata_len, ret; | |
ba3d24d4 | 133 | u8 nfproto; |
ccc007e4 | 134 | |
8cb08174 JB |
135 | ret = nla_parse_deprecated(tb, TCA_EM_IPT_MAX, data, data_len, |
136 | em_ipt_policy, NULL); | |
ccc007e4 EB |
137 | if (ret < 0) |
138 | return ret; | |
139 | ||
140 | if (!tb[TCA_EM_IPT_HOOK] || !tb[TCA_EM_IPT_MATCH_NAME] || | |
141 | !tb[TCA_EM_IPT_MATCH_DATA] || !tb[TCA_EM_IPT_NFPROTO]) | |
142 | return -EINVAL; | |
143 | ||
ba3d24d4 NA |
144 | nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]); |
145 | switch (nfproto) { | |
146 | case NFPROTO_IPV4: | |
147 | case NFPROTO_IPV6: | |
148 | break; | |
149 | default: | |
150 | return -EINVAL; | |
151 | } | |
152 | ||
ccc007e4 EB |
153 | match = get_xt_match(tb); |
154 | if (IS_ERR(match)) { | |
155 | pr_err("unable to load match\n"); | |
156 | return PTR_ERR(match); | |
157 | } | |
158 | ||
159 | mdata_len = XT_ALIGN(nla_len(tb[TCA_EM_IPT_MATCH_DATA])); | |
160 | im = kzalloc(sizeof(*im) + mdata_len, GFP_KERNEL); | |
161 | if (!im) { | |
162 | ret = -ENOMEM; | |
163 | goto err; | |
164 | } | |
165 | ||
166 | im->match = match; | |
167 | im->hook = nla_get_u32(tb[TCA_EM_IPT_HOOK]); | |
ba3d24d4 | 168 | im->nfproto = nfproto; |
ccc007e4 EB |
169 | nla_memcpy(im->match_data, tb[TCA_EM_IPT_MATCH_DATA], mdata_len); |
170 | ||
171 | ret = check_match(net, im, mdata_len); | |
172 | if (ret) | |
173 | goto err; | |
174 | ||
175 | em->datalen = sizeof(*im) + mdata_len; | |
176 | em->data = (unsigned long)im; | |
177 | return 0; | |
178 | ||
179 | err: | |
180 | kfree(im); | |
181 | module_put(match->me); | |
182 | return ret; | |
183 | } | |
184 | ||
185 | static void em_ipt_destroy(struct tcf_ematch *em) | |
186 | { | |
187 | struct em_ipt_match *im = (void *)em->data; | |
188 | ||
189 | if (!im) | |
190 | return; | |
191 | ||
192 | if (im->match->destroy) { | |
193 | struct xt_mtdtor_param par = { | |
194 | .net = em->net, | |
195 | .match = im->match, | |
196 | .matchinfo = im->match_data, | |
197 | .family = im->match->family | |
198 | }; | |
199 | im->match->destroy(&par); | |
200 | } | |
201 | module_put(im->match->me); | |
3c9143d9 | 202 | kfree(im); |
ccc007e4 EB |
203 | } |
204 | ||
205 | static int em_ipt_match(struct sk_buff *skb, struct tcf_ematch *em, | |
206 | struct tcf_pkt_info *info) | |
207 | { | |
208 | const struct em_ipt_match *im = (const void *)em->data; | |
209 | struct xt_action_param acpar = {}; | |
210 | struct net_device *indev = NULL; | |
f4c1c40c | 211 | u8 nfproto = im->match->family; |
ccc007e4 EB |
212 | struct nf_hook_state state; |
213 | int ret; | |
214 | ||
d7bf2ebe | 215 | switch (skb_protocol(skb, true)) { |
9e10edd7 NA |
216 | case htons(ETH_P_IP): |
217 | if (!pskb_network_may_pull(skb, sizeof(struct iphdr))) | |
218 | return 0; | |
f4c1c40c NA |
219 | if (nfproto == NFPROTO_UNSPEC) |
220 | nfproto = NFPROTO_IPV4; | |
9e10edd7 NA |
221 | break; |
222 | case htons(ETH_P_IPV6): | |
223 | if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr))) | |
224 | return 0; | |
f4c1c40c NA |
225 | if (nfproto == NFPROTO_UNSPEC) |
226 | nfproto = NFPROTO_IPV6; | |
9e10edd7 NA |
227 | break; |
228 | default: | |
229 | return 0; | |
230 | } | |
231 | ||
ccc007e4 EB |
232 | rcu_read_lock(); |
233 | ||
234 | if (skb->skb_iif) | |
235 | indev = dev_get_by_index_rcu(em->net, skb->skb_iif); | |
236 | ||
f4c1c40c | 237 | nf_hook_state_init(&state, im->hook, nfproto, |
ccc007e4 EB |
238 | indev ?: skb->dev, skb->dev, NULL, em->net, NULL); |
239 | ||
240 | acpar.match = im->match; | |
241 | acpar.matchinfo = im->match_data; | |
242 | acpar.state = &state; | |
243 | ||
244 | ret = im->match->match(skb, &acpar); | |
245 | ||
246 | rcu_read_unlock(); | |
247 | return ret; | |
248 | } | |
249 | ||
250 | static int em_ipt_dump(struct sk_buff *skb, struct tcf_ematch *em) | |
251 | { | |
252 | struct em_ipt_match *im = (void *)em->data; | |
253 | ||
254 | if (nla_put_string(skb, TCA_EM_IPT_MATCH_NAME, im->match->name) < 0) | |
255 | return -EMSGSIZE; | |
256 | if (nla_put_u32(skb, TCA_EM_IPT_HOOK, im->hook) < 0) | |
257 | return -EMSGSIZE; | |
258 | if (nla_put_u8(skb, TCA_EM_IPT_MATCH_REVISION, im->match->revision) < 0) | |
259 | return -EMSGSIZE; | |
ba3d24d4 | 260 | if (nla_put_u8(skb, TCA_EM_IPT_NFPROTO, im->nfproto) < 0) |
ccc007e4 EB |
261 | return -EMSGSIZE; |
262 | if (nla_put(skb, TCA_EM_IPT_MATCH_DATA, | |
263 | im->match->usersize ?: im->match->matchsize, | |
264 | im->match_data) < 0) | |
265 | return -EMSGSIZE; | |
266 | ||
267 | return 0; | |
268 | } | |
269 | ||
270 | static struct tcf_ematch_ops em_ipt_ops = { | |
271 | .kind = TCF_EM_IPT, | |
272 | .change = em_ipt_change, | |
273 | .destroy = em_ipt_destroy, | |
274 | .match = em_ipt_match, | |
275 | .dump = em_ipt_dump, | |
276 | .owner = THIS_MODULE, | |
277 | .link = LIST_HEAD_INIT(em_ipt_ops.link) | |
278 | }; | |
279 | ||
280 | static int __init init_em_ipt(void) | |
281 | { | |
282 | return tcf_em_register(&em_ipt_ops); | |
283 | } | |
284 | ||
285 | static void __exit exit_em_ipt(void) | |
286 | { | |
287 | tcf_em_unregister(&em_ipt_ops); | |
288 | } | |
289 | ||
290 | MODULE_LICENSE("GPL"); | |
291 | MODULE_AUTHOR("Eyal Birger <eyal.birger@gmail.com>"); | |
292 | MODULE_DESCRIPTION("TC extended match for IPtables matches"); | |
293 | ||
294 | module_init(init_em_ipt); | |
295 | module_exit(exit_em_ipt); | |
296 | ||
297 | MODULE_ALIAS_TCF_EMATCH(TCF_EM_IPT); |