act_ipt.c 7.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314
  1. /*
  2. * net/sched/ipt.c iptables target interface
  3. *
  4. *TODO: Add other tables. For now we only support the ipv4 table targets
  5. *
  6. * This program is free software; you can redistribute it and/or
  7. * modify it under the terms of the GNU General Public License
  8. * as published by the Free Software Foundation; either version
  9. * 2 of the License, or (at your option) any later version.
  10. *
  11. * Copyright: Jamal Hadi Salim (2002-4)
  12. */
  13. #include <asm/uaccess.h>
  14. #include <asm/system.h>
  15. #include <asm/bitops.h>
  16. #include <linux/types.h>
  17. #include <linux/kernel.h>
  18. #include <linux/string.h>
  19. #include <linux/mm.h>
  20. #include <linux/socket.h>
  21. #include <linux/sockios.h>
  22. #include <linux/in.h>
  23. #include <linux/errno.h>
  24. #include <linux/interrupt.h>
  25. #include <linux/netdevice.h>
  26. #include <linux/skbuff.h>
  27. #include <linux/rtnetlink.h>
  28. #include <linux/module.h>
  29. #include <linux/init.h>
  30. #include <linux/proc_fs.h>
  31. #include <linux/kmod.h>
  32. #include <net/sock.h>
  33. #include <net/pkt_sched.h>
  34. #include <linux/tc_act/tc_ipt.h>
  35. #include <net/tc_act/tc_ipt.h>
  36. #include <linux/netfilter_ipv4/ip_tables.h>
  37. #define IPT_TAB_MASK 15
  38. static struct tcf_common *tcf_ipt_ht[IPT_TAB_MASK + 1];
  39. static u32 ipt_idx_gen;
  40. static DEFINE_RWLOCK(ipt_lock);
  41. static struct tcf_hashinfo ipt_hash_info = {
  42. .htab = tcf_ipt_ht,
  43. .hmask = IPT_TAB_MASK,
  44. .lock = &ipt_lock,
  45. };
  46. static int ipt_init_target(struct ipt_entry_target *t, char *table, unsigned int hook)
  47. {
  48. struct xt_target *target;
  49. int ret = 0;
  50. target = xt_request_find_target(AF_INET, t->u.user.name,
  51. t->u.user.revision);
  52. if (!target)
  53. return -ENOENT;
  54. t->u.kernel.target = target;
  55. ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
  56. table, hook, 0, 0);
  57. if (ret) {
  58. module_put(t->u.kernel.target->me);
  59. return ret;
  60. }
  61. if (t->u.kernel.target->checkentry
  62. && !t->u.kernel.target->checkentry(table, NULL,
  63. t->u.kernel.target, t->data,
  64. hook)) {
  65. module_put(t->u.kernel.target->me);
  66. ret = -EINVAL;
  67. }
  68. return ret;
  69. }
  70. static void ipt_destroy_target(struct ipt_entry_target *t)
  71. {
  72. if (t->u.kernel.target->destroy)
  73. t->u.kernel.target->destroy(t->u.kernel.target, t->data);
  74. module_put(t->u.kernel.target->me);
  75. }
  76. static int tcf_ipt_release(struct tcf_ipt *ipt, int bind)
  77. {
  78. int ret = 0;
  79. if (ipt) {
  80. if (bind)
  81. ipt->tcf_bindcnt--;
  82. ipt->tcf_refcnt--;
  83. if (ipt->tcf_bindcnt <= 0 && ipt->tcf_refcnt <= 0) {
  84. ipt_destroy_target(ipt->tcfi_t);
  85. kfree(ipt->tcfi_tname);
  86. kfree(ipt->tcfi_t);
  87. tcf_hash_destroy(&ipt->common, &ipt_hash_info);
  88. ret = ACT_P_DELETED;
  89. }
  90. }
  91. return ret;
  92. }
  93. static int tcf_ipt_init(struct rtattr *rta, struct rtattr *est,
  94. struct tc_action *a, int ovr, int bind)
  95. {
  96. struct rtattr *tb[TCA_IPT_MAX];
  97. struct tcf_ipt *ipt;
  98. struct tcf_common *pc;
  99. struct ipt_entry_target *td, *t;
  100. char *tname;
  101. int ret = 0, err;
  102. u32 hook = 0;
  103. u32 index = 0;
  104. if (rta == NULL || rtattr_parse_nested(tb, TCA_IPT_MAX, rta) < 0)
  105. return -EINVAL;
  106. if (tb[TCA_IPT_HOOK-1] == NULL ||
  107. RTA_PAYLOAD(tb[TCA_IPT_HOOK-1]) < sizeof(u32))
  108. return -EINVAL;
  109. if (tb[TCA_IPT_TARG-1] == NULL ||
  110. RTA_PAYLOAD(tb[TCA_IPT_TARG-1]) < sizeof(*t))
  111. return -EINVAL;
  112. td = (struct ipt_entry_target *)RTA_DATA(tb[TCA_IPT_TARG-1]);
  113. if (RTA_PAYLOAD(tb[TCA_IPT_TARG-1]) < td->u.target_size)
  114. return -EINVAL;
  115. if (tb[TCA_IPT_INDEX-1] != NULL &&
  116. RTA_PAYLOAD(tb[TCA_IPT_INDEX-1]) >= sizeof(u32))
  117. index = *(u32 *)RTA_DATA(tb[TCA_IPT_INDEX-1]);
  118. pc = tcf_hash_check(index, a, bind, &ipt_hash_info);
  119. if (!pc) {
  120. pc = tcf_hash_create(index, est, a, sizeof(*ipt), bind,
  121. &ipt_idx_gen, &ipt_hash_info);
  122. if (unlikely(!pc))
  123. return -ENOMEM;
  124. ret = ACT_P_CREATED;
  125. } else {
  126. if (!ovr) {
  127. tcf_ipt_release(to_ipt(pc), bind);
  128. return -EEXIST;
  129. }
  130. }
  131. ipt = to_ipt(pc);
  132. hook = *(u32 *)RTA_DATA(tb[TCA_IPT_HOOK-1]);
  133. err = -ENOMEM;
  134. tname = kmalloc(IFNAMSIZ, GFP_KERNEL);
  135. if (unlikely(!tname))
  136. goto err1;
  137. if (tb[TCA_IPT_TABLE - 1] == NULL ||
  138. rtattr_strlcpy(tname, tb[TCA_IPT_TABLE-1], IFNAMSIZ) >= IFNAMSIZ)
  139. strcpy(tname, "mangle");
  140. t = kmemdup(td, td->u.target_size, GFP_KERNEL);
  141. if (unlikely(!t))
  142. goto err2;
  143. if ((err = ipt_init_target(t, tname, hook)) < 0)
  144. goto err3;
  145. spin_lock_bh(&ipt->tcf_lock);
  146. if (ret != ACT_P_CREATED) {
  147. ipt_destroy_target(ipt->tcfi_t);
  148. kfree(ipt->tcfi_tname);
  149. kfree(ipt->tcfi_t);
  150. }
  151. ipt->tcfi_tname = tname;
  152. ipt->tcfi_t = t;
  153. ipt->tcfi_hook = hook;
  154. spin_unlock_bh(&ipt->tcf_lock);
  155. if (ret == ACT_P_CREATED)
  156. tcf_hash_insert(pc, &ipt_hash_info);
  157. return ret;
  158. err3:
  159. kfree(t);
  160. err2:
  161. kfree(tname);
  162. err1:
  163. kfree(pc);
  164. return err;
  165. }
  166. static int tcf_ipt_cleanup(struct tc_action *a, int bind)
  167. {
  168. struct tcf_ipt *ipt = a->priv;
  169. return tcf_ipt_release(ipt, bind);
  170. }
  171. static int tcf_ipt(struct sk_buff *skb, struct tc_action *a,
  172. struct tcf_result *res)
  173. {
  174. int ret = 0, result = 0;
  175. struct tcf_ipt *ipt = a->priv;
  176. if (skb_cloned(skb)) {
  177. if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
  178. return TC_ACT_UNSPEC;
  179. }
  180. spin_lock(&ipt->tcf_lock);
  181. ipt->tcf_tm.lastuse = jiffies;
  182. ipt->tcf_bstats.bytes += skb->len;
  183. ipt->tcf_bstats.packets++;
  184. /* yes, we have to worry about both in and out dev
  185. worry later - danger - this API seems to have changed
  186. from earlier kernels */
  187. /* iptables targets take a double skb pointer in case the skb
  188. * needs to be replaced. We don't own the skb, so this must not
  189. * happen. The pskb_expand_head above should make sure of this */
  190. ret = ipt->tcfi_t->u.kernel.target->target(&skb, skb->dev, NULL,
  191. ipt->tcfi_hook,
  192. ipt->tcfi_t->u.kernel.target,
  193. ipt->tcfi_t->data);
  194. switch (ret) {
  195. case NF_ACCEPT:
  196. result = TC_ACT_OK;
  197. break;
  198. case NF_DROP:
  199. result = TC_ACT_SHOT;
  200. ipt->tcf_qstats.drops++;
  201. break;
  202. case IPT_CONTINUE:
  203. result = TC_ACT_PIPE;
  204. break;
  205. default:
  206. if (net_ratelimit())
  207. printk("Bogus netfilter code %d assume ACCEPT\n", ret);
  208. result = TC_POLICE_OK;
  209. break;
  210. }
  211. spin_unlock(&ipt->tcf_lock);
  212. return result;
  213. }
  214. static int tcf_ipt_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
  215. {
  216. unsigned char *b = skb->tail;
  217. struct tcf_ipt *ipt = a->priv;
  218. struct ipt_entry_target *t;
  219. struct tcf_t tm;
  220. struct tc_cnt c;
  221. /* for simple targets kernel size == user size
  222. ** user name = target name
  223. ** for foolproof you need to not assume this
  224. */
  225. t = kmemdup(ipt->tcfi_t, ipt->tcfi_t->u.user.target_size, GFP_ATOMIC);
  226. if (unlikely(!t))
  227. goto rtattr_failure;
  228. c.bindcnt = ipt->tcf_bindcnt - bind;
  229. c.refcnt = ipt->tcf_refcnt - ref;
  230. strcpy(t->u.user.name, ipt->tcfi_t->u.kernel.target->name);
  231. RTA_PUT(skb, TCA_IPT_TARG, ipt->tcfi_t->u.user.target_size, t);
  232. RTA_PUT(skb, TCA_IPT_INDEX, 4, &ipt->tcf_index);
  233. RTA_PUT(skb, TCA_IPT_HOOK, 4, &ipt->tcfi_hook);
  234. RTA_PUT(skb, TCA_IPT_CNT, sizeof(struct tc_cnt), &c);
  235. RTA_PUT(skb, TCA_IPT_TABLE, IFNAMSIZ, ipt->tcfi_tname);
  236. tm.install = jiffies_to_clock_t(jiffies - ipt->tcf_tm.install);
  237. tm.lastuse = jiffies_to_clock_t(jiffies - ipt->tcf_tm.lastuse);
  238. tm.expires = jiffies_to_clock_t(ipt->tcf_tm.expires);
  239. RTA_PUT(skb, TCA_IPT_TM, sizeof (tm), &tm);
  240. kfree(t);
  241. return skb->len;
  242. rtattr_failure:
  243. skb_trim(skb, b - skb->data);
  244. kfree(t);
  245. return -1;
  246. }
  247. static struct tc_action_ops act_ipt_ops = {
  248. .kind = "ipt",
  249. .hinfo = &ipt_hash_info,
  250. .type = TCA_ACT_IPT,
  251. .capab = TCA_CAP_NONE,
  252. .owner = THIS_MODULE,
  253. .act = tcf_ipt,
  254. .dump = tcf_ipt_dump,
  255. .cleanup = tcf_ipt_cleanup,
  256. .lookup = tcf_hash_search,
  257. .init = tcf_ipt_init,
  258. .walk = tcf_generic_walker
  259. };
  260. MODULE_AUTHOR("Jamal Hadi Salim(2002-4)");
  261. MODULE_DESCRIPTION("Iptables target actions");
  262. MODULE_LICENSE("GPL");
  263. static int __init ipt_init_module(void)
  264. {
  265. return tcf_register_action(&act_ipt_ops);
  266. }
  267. static void __exit ipt_cleanup_module(void)
  268. {
  269. tcf_unregister_action(&act_ipt_ops);
  270. }
  271. module_init(ipt_init_module);
  272. module_exit(ipt_cleanup_module);