[linux-2.6-block.git] / net / sched / em_ipt.c

/*
 * net/sched/em_ipt.c IPtables matches Ematch
 *
 * (c) 2018 Eyal Birger <eyal.birger@gmail.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 */

#include <linux/gfp.h>
#include <linux/module.h>
#include <linux/types.h>
#include <linux/kernel.h>
#include <linux/string.h>
#include <linux/skbuff.h>
#include <linux/tc_ematch/tc_em_ipt.h>
#include <linux/netfilter.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <net/pkt_cls.h>

struct em_ipt_match {
	const struct xt_match *match;
	u32 hook;
	u8 match_data[0] __aligned(8);
};

struct em_ipt_xt_match {
	char *match_name;
	int (*validate_match_data)(struct nlattr **tb, u8 mrev);
};

static const struct nla_policy em_ipt_policy[TCA_EM_IPT_MAX + 1] = {
	[TCA_EM_IPT_MATCH_NAME]		= { .type = NLA_STRING,
					    .len = XT_EXTENSION_MAXNAMELEN },
	[TCA_EM_IPT_MATCH_REVISION]	= { .type = NLA_U8 },
	[TCA_EM_IPT_HOOK]		= { .type = NLA_U32 },
	[TCA_EM_IPT_NFPROTO]		= { .type = NLA_U8 },
	[TCA_EM_IPT_MATCH_DATA]		= { .type = NLA_UNSPEC },
};

static int check_match(struct net *net, struct em_ipt_match *im, int mdata_len)
{
	struct xt_mtchk_param mtpar = {};
	union {
		struct ipt_entry e4;
		struct ip6t_entry e6;
	} e = {};

	mtpar.net	= net;
	mtpar.table	= "filter";
	mtpar.hook_mask	= 1 << im->hook;
	mtpar.family	= im->match->family;
	mtpar.match	= im->match;
	mtpar.entryinfo = &e;
	mtpar.matchinfo	= (void *)im->match_data;
	return xt_check_match(&mtpar, mdata_len, 0, 0);
}

static int policy_validate_match_data(struct nlattr **tb, u8 mrev)
{
	if (mrev != 0) {
		pr_err("only policy match revision 0 supported");
		return -EINVAL;
	}

	if (nla_get_u32(tb[TCA_EM_IPT_HOOK]) != NF_INET_PRE_ROUTING) {
		pr_err("policy can only be matched on NF_INET_PRE_ROUTING");
		return -EINVAL;
	}

	return 0;
}

static const struct em_ipt_xt_match em_ipt_xt_matches[] = {
	{
		.match_name = "policy",
		.validate_match_data = policy_validate_match_data
	},
	{}
};

static struct xt_match *get_xt_match(struct nlattr **tb)
{
	const struct em_ipt_xt_match *m;
	struct nlattr *mname_attr;
	u8 nfproto, mrev = 0;
	int ret;

	mname_attr = tb[TCA_EM_IPT_MATCH_NAME];
	for (m = em_ipt_xt_matches; m->match_name; m++) {
		if (!nla_strcmp(mname_attr, m->match_name))
			break;
	}

	if (!m->match_name) {
		pr_err("Unsupported xt match");
		return ERR_PTR(-EINVAL);
	}

	if (tb[TCA_EM_IPT_MATCH_REVISION])
		mrev = nla_get_u8(tb[TCA_EM_IPT_MATCH_REVISION]);

	ret = m->validate_match_data(tb, mrev);
	if (ret < 0)
		return ERR_PTR(ret);

	nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]);
	return xt_request_find_match(nfproto, m->match_name, mrev);
}

static int em_ipt_change(struct net *net, void *data, int data_len,
			 struct tcf_ematch *em)
{
	struct nlattr *tb[TCA_EM_IPT_MAX + 1];
	struct em_ipt_match *im = NULL;
	struct xt_match *match;
	int mdata_len, ret;

	ret = nla_parse(tb, TCA_EM_IPT_MAX, data, data_len, em_ipt_policy,
			NULL);
	if (ret < 0)
		return ret;

	if (!tb[TCA_EM_IPT_HOOK] || !tb[TCA_EM_IPT_MATCH_NAME] ||
	    !tb[TCA_EM_IPT_MATCH_DATA] || !tb[TCA_EM_IPT_NFPROTO])
		return -EINVAL;

	match = get_xt_match(tb);
	if (IS_ERR(match)) {
		pr_err("unable to load match\n");
		return PTR_ERR(match);
	}

	mdata_len = XT_ALIGN(nla_len(tb[TCA_EM_IPT_MATCH_DATA]));
	im = kzalloc(sizeof(*im) + mdata_len, GFP_KERNEL);
	if (!im) {
		ret = -ENOMEM;
		goto err;
	}

	im->match = match;
	im->hook = nla_get_u32(tb[TCA_EM_IPT_HOOK]);
	nla_memcpy(im->match_data, tb[TCA_EM_IPT_MATCH_DATA], mdata_len);

	ret = check_match(net, im, mdata_len);
	if (ret)
		goto err;

	em->datalen = sizeof(*im) + mdata_len;
	em->data = (unsigned long)im;
	return 0;

err:
	kfree(im);
	module_put(match->me);
	return ret;
}

static void em_ipt_destroy(struct tcf_ematch *em)
{
	struct em_ipt_match *im = (void *)em->data;

	if (!im)
		return;

	if (im->match->destroy) {
		struct xt_mtdtor_param par = {
			.net = em->net,
			.match = im->match,
			.matchinfo = im->match_data,
			.family = im->match->family
		};
		im->match->destroy(&par);
	}
	module_put(im->match->me);
	kfree((void *)im);
}

static int em_ipt_match(struct sk_buff *skb, struct tcf_ematch *em,
			struct tcf_pkt_info *info)
{
	const struct em_ipt_match *im = (const void *)em->data;
	struct xt_action_param acpar = {};
	struct net_device *indev = NULL;
	struct nf_hook_state state;
	int ret;

	rcu_read_lock();

	if (skb->skb_iif)
		indev = dev_get_by_index_rcu(em->net, skb->skb_iif);

	nf_hook_state_init(&state, im->hook, im->match->family,
			   indev ?: skb->dev, skb->dev, NULL, em->net, NULL);

	acpar.match = im->match;
	acpar.matchinfo = im->match_data;
	acpar.state = &state;

	ret = im->match->match(skb, &acpar);

	rcu_read_unlock();
	return ret;
}

static int em_ipt_dump(struct sk_buff *skb, struct tcf_ematch *em)
{
	struct em_ipt_match *im = (void *)em->data;

	if (nla_put_string(skb, TCA_EM_IPT_MATCH_NAME, im->match->name) < 0)
		return -EMSGSIZE;
	if (nla_put_u32(skb, TCA_EM_IPT_HOOK, im->hook) < 0)
		return -EMSGSIZE;
	if (nla_put_u8(skb, TCA_EM_IPT_MATCH_REVISION, im->match->revision) < 0)
		return -EMSGSIZE;
	if (nla_put_u8(skb, TCA_EM_IPT_NFPROTO, im->match->family) < 0)
		return -EMSGSIZE;
	if (nla_put(skb, TCA_EM_IPT_MATCH_DATA,
		    im->match->usersize ?: im->match->matchsize,
		    im->match_data) < 0)
		return -EMSGSIZE;

	return 0;
}

static struct tcf_ematch_ops em_ipt_ops = {
	.kind	  = TCF_EM_IPT,
	.change	  = em_ipt_change,
	.destroy  = em_ipt_destroy,
	.match	  = em_ipt_match,
	.dump	  = em_ipt_dump,
	.owner	  = THIS_MODULE,
	.link	  = LIST_HEAD_INIT(em_ipt_ops.link)
};

static int __init init_em_ipt(void)
{
	return tcf_em_register(&em_ipt_ops);
}

static void __exit exit_em_ipt(void)
{
	tcf_em_unregister(&em_ipt_ops);
}

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Eyal Birger <eyal.birger@gmail.com>");
MODULE_DESCRIPTION("TC extended match for IPtables matches");

module_init(init_em_ipt);
module_exit(exit_em_ipt);

MODULE_ALIAS_TCF_EMATCH(TCF_EM_IPT);
Commit	Line	Data
ccc007e4 EB	1	/*
	2	* net/sched/em_ipt.c IPtables matches Ematch
	3	*
	4	* (c) 2018 Eyal Birger <eyal.birger@gmail.com>
	5	*
	6	* This program is free software; you can redistribute it and/or
	7	* modify it under the terms of the GNU General Public License
	8	* as published by the Free Software Foundation; either version
	9	* 2 of the License, or (at your option) any later version.
	10	*/
	11
	12	#include <linux/gfp.h>
	13	#include <linux/module.h>
	14	#include <linux/types.h>
	15	#include <linux/kernel.h>
	16	#include <linux/string.h>
	17	#include <linux/skbuff.h>
	18	#include <linux/tc_ematch/tc_em_ipt.h>
	19	#include <linux/netfilter.h>
	20	#include <linux/netfilter/x_tables.h>
	21	#include <linux/netfilter_ipv4/ip_tables.h>
	22	#include <linux/netfilter_ipv6/ip6_tables.h>
	23	#include <net/pkt_cls.h>
	24
	25	struct em_ipt_match {
	26	const struct xt_match *match;
	27	u32 hook;
	28	u8 match_data[0] __aligned(8);
	29	};
	30
	31	struct em_ipt_xt_match {
	32	char *match_name;
	33	int (validate_match_data)(struct nlattr *tb, u8 mrev);
	34	};
	35
	36	static const struct nla_policy em_ipt_policy[TCA_EM_IPT_MAX + 1] = {
	37	[TCA_EM_IPT_MATCH_NAME] = { .type = NLA_STRING,
	38	.len = XT_EXTENSION_MAXNAMELEN },
	39	[TCA_EM_IPT_MATCH_REVISION] = { .type = NLA_U8 },
	40	[TCA_EM_IPT_HOOK] = { .type = NLA_U32 },
	41	[TCA_EM_IPT_NFPROTO] = { .type = NLA_U8 },
	42	[TCA_EM_IPT_MATCH_DATA] = { .type = NLA_UNSPEC },
	43	};
	44
	45	static int check_match(struct net net, struct em_ipt_match im, int mdata_len)
	46	{
	47	struct xt_mtchk_param mtpar = {};
	48	union {
	49	struct ipt_entry e4;
	50	struct ip6t_entry e6;
	51	} e = {};
	52
	53	mtpar.net = net;
	54	mtpar.table = "filter";
	55	mtpar.hook_mask = 1 << im->hook;
	56	mtpar.family = im->match->family;
	57	mtpar.match = im->match;
	58	mtpar.entryinfo = &e;
	59	mtpar.matchinfo = (void *)im->match_data;
	60	return xt_check_match(&mtpar, mdata_len, 0, 0);
	61	}
	62
	63	static int policy_validate_match_data(struct nlattr **tb, u8 mrev)
	64	{
65	if (mrev != 0) {
66	pr_err("only policy match revision 0 supported");
67	return -EINVAL;
68	}
69
70	if (nla_get_u32(tb[TCA_EM_IPT_HOOK]) != NF_INET_PRE_ROUTING) {
71	pr_err("policy can only be matched on NF_INET_PRE_ROUTING");
72	return -EINVAL;
73	}
74
75	return 0;
76	}
77
78	static const struct em_ipt_xt_match em_ipt_xt_matches[] = {
79	{
80	.match_name = "policy",
81	.validate_match_data = policy_validate_match_data
82	},
83	{}
84	};
85
86	static struct xt_match get_xt_match(struct nlattr *tb)
87	{
88	const struct em_ipt_xt_match *m;
89	struct nlattr *mname_attr;
90	u8 nfproto, mrev = 0;
91	int ret;
92
93	mname_attr = tb[TCA_EM_IPT_MATCH_NAME];
94	for (m = em_ipt_xt_matches; m->match_name; m++) {
95	if (!nla_strcmp(mname_attr, m->match_name))
96	break;
97	}
98
99	if (!m->match_name) {
100	pr_err("Unsupported xt match");
101	return ERR_PTR(-EINVAL);
102	}
103
104	if (tb[TCA_EM_IPT_MATCH_REVISION])
105	mrev = nla_get_u8(tb[TCA_EM_IPT_MATCH_REVISION]);
106
107	ret = m->validate_match_data(tb, mrev);
108	if (ret < 0)
109	return ERR_PTR(ret);
110
111	nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]);
112	return xt_request_find_match(nfproto, m->match_name, mrev);
113	}
114
115	static int em_ipt_change(struct net net, void data, int data_len,
116	struct tcf_ematch *em)
117	{
118	struct nlattr *tb[TCA_EM_IPT_MAX + 1];
119	struct em_ipt_match *im = NULL;
120	struct xt_match *match;
121	int mdata_len, ret;
122
123	ret = nla_parse(tb, TCA_EM_IPT_MAX, data, data_len, em_ipt_policy,
124	NULL);
125	if (ret < 0)
126	return ret;
127
128	if (!tb[TCA_EM_IPT_HOOK] \|\| !tb[TCA_EM_IPT_MATCH_NAME] \|\|
129	!tb[TCA_EM_IPT_MATCH_DATA] \|\| !tb[TCA_EM_IPT_NFPROTO])
130	return -EINVAL;
131
132	match = get_xt_match(tb);
133	if (IS_ERR(match)) {
134	pr_err("unable to load match\n");
135	return PTR_ERR(match);
136	}
137
138	mdata_len = XT_ALIGN(nla_len(tb[TCA_EM_IPT_MATCH_DATA]));
139	im = kzalloc(sizeof(*im) + mdata_len, GFP_KERNEL);
140	if (!im) {
141	ret = -ENOMEM;
142	goto err;
143	}
144
145	im->match = match;
146	im->hook = nla_get_u32(tb[TCA_EM_IPT_HOOK]);
147	nla_memcpy(im->match_data, tb[TCA_EM_IPT_MATCH_DATA], mdata_len);
148
149	ret = check_match(net, im, mdata_len);
150	if (ret)
151	goto err;
152
153	em->datalen = sizeof(*im) + mdata_len;
154	em->data = (unsigned long)im;
155	return 0;
156
157	err:
158	kfree(im);
159	module_put(match->me);
160	return ret;
161	}
162
163	static void em_ipt_destroy(struct tcf_ematch *em)
164	{
165	struct em_ipt_match im = (void )em->data;
166
167	if (!im)
168	return;
169
170	if (im->match->destroy) {
171	struct xt_mtdtor_param par = {
172	.net = em->net,
173	.match = im->match,
174	.matchinfo = im->match_data,
175	.family = im->match->family
176	};
177	im->match->destroy(&par);
178	}
179	module_put(im->match->me);
180	kfree((void *)im);
181	}
182
183	static int em_ipt_match(struct sk_buff skb, struct tcf_ematch em,
184	struct tcf_pkt_info *info)
185	{
186	const struct em_ipt_match im = (const void )em->data;
187	struct xt_action_param acpar = {};
188	struct net_device *indev = NULL;
189	struct nf_hook_state state;
190	int ret;
191
192	rcu_read_lock();
193
194	if (skb->skb_iif)
195	indev = dev_get_by_index_rcu(em->net, skb->skb_iif);
196
197	nf_hook_state_init(&state, im->hook, im->match->family,
198	indev ?: skb->dev, skb->dev, NULL, em->net, NULL);
199
200	acpar.match = im->match;
201	acpar.matchinfo = im->match_data;
202	acpar.state = &state;
203
204	ret = im->match->match(skb, &acpar);
205
206	rcu_read_unlock();
207	return ret;
208	}
209
210	static int em_ipt_dump(struct sk_buff skb, struct tcf_ematch em)
211	{
212	struct em_ipt_match im = (void )em->data;
213
214	if (nla_put_string(skb, TCA_EM_IPT_MATCH_NAME, im->match->name) < 0)
215	return -EMSGSIZE;
216	if (nla_put_u32(skb, TCA_EM_IPT_HOOK, im->hook) < 0)
217	return -EMSGSIZE;
218	if (nla_put_u8(skb, TCA_EM_IPT_MATCH_REVISION, im->match->revision) < 0)
219	return -EMSGSIZE;
220	if (nla_put_u8(skb, TCA_EM_IPT_NFPROTO, im->match->family) < 0)
221	return -EMSGSIZE;
222	if (nla_put(skb, TCA_EM_IPT_MATCH_DATA,
223	im->match->usersize ?: im->match->matchsize,
224	im->match_data) < 0)
225	return -EMSGSIZE;
226
227	return 0;
228	}
229
230	static struct tcf_ematch_ops em_ipt_ops = {
231	.kind = TCF_EM_IPT,
232	.change = em_ipt_change,
233	.destroy = em_ipt_destroy,
234	.match = em_ipt_match,
235	.dump = em_ipt_dump,
236	.owner = THIS_MODULE,
237	.link = LIST_HEAD_INIT(em_ipt_ops.link)
238	};
239
240	static int __init init_em_ipt(void)
241	{
242	return tcf_em_register(&em_ipt_ops);
243	}
244
245	static void __exit exit_em_ipt(void)
246	{
247	tcf_em_unregister(&em_ipt_ops);
248	}
249
250	MODULE_LICENSE("GPL");
251	MODULE_AUTHOR("Eyal Birger <eyal.birger@gmail.com>");
252	MODULE_DESCRIPTION("TC extended match for IPtables matches");
253
254	module_init(init_em_ipt);
255	module_exit(exit_em_ipt);
256
257	MODULE_ALIAS_TCF_EMATCH(TCF_EM_IPT);