xt_HMARK.c 8.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * xt_HMARK - Netfilter module to set mark by means of hashing
  4. *
  5. * (C) 2012 by Hans Schillstrom <hans.schillstrom@ericsson.com>
  6. * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
  7. */
  8. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  9. #include <linux/module.h>
  10. #include <linux/skbuff.h>
  11. #include <linux/icmp.h>
  12. #include <linux/netfilter/x_tables.h>
  13. #include <linux/netfilter/xt_HMARK.h>
  14. #include <net/ip.h>
  15. #if IS_ENABLED(CONFIG_NF_CONNTRACK)
  16. #include <net/netfilter/nf_conntrack.h>
  17. #endif
  18. #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
  19. #include <net/ipv6.h>
  20. #include <linux/netfilter_ipv6/ip6_tables.h>
  21. #endif
  22. MODULE_LICENSE("GPL");
  23. MODULE_AUTHOR("Hans Schillstrom <hans.schillstrom@ericsson.com>");
  24. MODULE_DESCRIPTION("Xtables: packet marking using hash calculation");
  25. MODULE_ALIAS("ipt_HMARK");
  26. MODULE_ALIAS("ip6t_HMARK");
  27. struct hmark_tuple {
  28. __be32 src;
  29. __be32 dst;
  30. union hmark_ports uports;
  31. u8 proto;
  32. };
  33. static inline __be32 hmark_addr6_mask(const __be32 *addr32, const __be32 *mask)
  34. {
  35. return (addr32[0] & mask[0]) ^
  36. (addr32[1] & mask[1]) ^
  37. (addr32[2] & mask[2]) ^
  38. (addr32[3] & mask[3]);
  39. }
  40. static inline __be32
  41. hmark_addr_mask(int l3num, const __be32 *addr32, const __be32 *mask)
  42. {
  43. switch (l3num) {
  44. case AF_INET:
  45. return *addr32 & *mask;
  46. case AF_INET6:
  47. return hmark_addr6_mask(addr32, mask);
  48. }
  49. return 0;
  50. }
  51. static inline void hmark_swap_ports(union hmark_ports *uports,
  52. const struct xt_hmark_info *info)
  53. {
  54. union hmark_ports hp;
  55. u16 src, dst;
  56. hp.b32 = (uports->b32 & info->port_mask.b32) | info->port_set.b32;
  57. src = ntohs(hp.b16.src);
  58. dst = ntohs(hp.b16.dst);
  59. if (dst > src)
  60. uports->v32 = (dst << 16) | src;
  61. else
  62. uports->v32 = (src << 16) | dst;
  63. }
  64. static int
  65. hmark_ct_set_htuple(const struct sk_buff *skb, struct hmark_tuple *t,
  66. const struct xt_hmark_info *info)
  67. {
  68. #if IS_ENABLED(CONFIG_NF_CONNTRACK)
  69. enum ip_conntrack_info ctinfo;
  70. struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
  71. struct nf_conntrack_tuple *otuple;
  72. struct nf_conntrack_tuple *rtuple;
  73. if (ct == NULL)
  74. return -1;
  75. otuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
  76. rtuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
  77. t->src = hmark_addr_mask(otuple->src.l3num, otuple->src.u3.ip6,
  78. info->src_mask.ip6);
  79. t->dst = hmark_addr_mask(otuple->src.l3num, rtuple->src.u3.ip6,
  80. info->dst_mask.ip6);
  81. if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))
  82. return 0;
  83. t->proto = nf_ct_protonum(ct);
  84. if (t->proto != IPPROTO_ICMP) {
  85. t->uports.b16.src = otuple->src.u.all;
  86. t->uports.b16.dst = rtuple->src.u.all;
  87. hmark_swap_ports(&t->uports, info);
  88. }
  89. return 0;
  90. #else
  91. return -1;
  92. #endif
  93. }
  94. /* This hash function is endian independent, to ensure consistent hashing if
  95. * the cluster is composed of big and little endian systems. */
  96. static inline u32
  97. hmark_hash(struct hmark_tuple *t, const struct xt_hmark_info *info)
  98. {
  99. u32 hash;
  100. u32 src = ntohl(t->src);
  101. u32 dst = ntohl(t->dst);
  102. if (dst < src)
  103. swap(src, dst);
  104. hash = jhash_3words(src, dst, t->uports.v32, info->hashrnd);
  105. hash = hash ^ (t->proto & info->proto_mask);
  106. return reciprocal_scale(hash, info->hmodulus) + info->hoffset;
  107. }
  108. static void
  109. hmark_set_tuple_ports(const struct sk_buff *skb, unsigned int nhoff,
  110. struct hmark_tuple *t, const struct xt_hmark_info *info)
  111. {
  112. int protoff;
  113. protoff = proto_ports_offset(t->proto);
  114. if (protoff < 0)
  115. return;
  116. nhoff += protoff;
  117. if (skb_copy_bits(skb, nhoff, &t->uports, sizeof(t->uports)) < 0)
  118. return;
  119. hmark_swap_ports(&t->uports, info);
  120. }
  121. #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
  122. static int get_inner6_hdr(const struct sk_buff *skb, int *offset)
  123. {
  124. struct icmp6hdr *icmp6h, _ih6;
  125. icmp6h = skb_header_pointer(skb, *offset, sizeof(_ih6), &_ih6);
  126. if (icmp6h == NULL)
  127. return 0;
  128. if (icmp6h->icmp6_type && icmp6h->icmp6_type < 128) {
  129. *offset += sizeof(struct icmp6hdr);
  130. return 1;
  131. }
  132. return 0;
  133. }
  134. static int
  135. hmark_pkt_set_htuple_ipv6(const struct sk_buff *skb, struct hmark_tuple *t,
  136. const struct xt_hmark_info *info)
  137. {
  138. struct ipv6hdr *ip6, _ip6;
  139. int flag = IP6_FH_F_AUTH;
  140. unsigned int nhoff = 0;
  141. u16 fragoff = 0;
  142. int nexthdr;
  143. ip6 = (struct ipv6hdr *) (skb->data + skb_network_offset(skb));
  144. nexthdr = ipv6_find_hdr(skb, &nhoff, -1, &fragoff, &flag);
  145. if (nexthdr < 0)
  146. return 0;
  147. /* No need to check for icmp errors on fragments */
  148. if ((flag & IP6_FH_F_FRAG) || (nexthdr != IPPROTO_ICMPV6))
  149. goto noicmp;
  150. /* Use inner header in case of ICMP errors */
  151. if (get_inner6_hdr(skb, &nhoff)) {
  152. ip6 = skb_header_pointer(skb, nhoff, sizeof(_ip6), &_ip6);
  153. if (ip6 == NULL)
  154. return -1;
  155. /* If AH present, use SPI like in ESP. */
  156. flag = IP6_FH_F_AUTH;
  157. nexthdr = ipv6_find_hdr(skb, &nhoff, -1, &fragoff, &flag);
  158. if (nexthdr < 0)
  159. return -1;
  160. }
  161. noicmp:
  162. t->src = hmark_addr6_mask(ip6->saddr.s6_addr32, info->src_mask.ip6);
  163. t->dst = hmark_addr6_mask(ip6->daddr.s6_addr32, info->dst_mask.ip6);
  164. if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))
  165. return 0;
  166. t->proto = nexthdr;
  167. if (t->proto == IPPROTO_ICMPV6)
  168. return 0;
  169. if (flag & IP6_FH_F_FRAG)
  170. return 0;
  171. hmark_set_tuple_ports(skb, nhoff, t, info);
  172. return 0;
  173. }
  174. static unsigned int
  175. hmark_tg_v6(struct sk_buff *skb, const struct xt_action_param *par)
  176. {
  177. const struct xt_hmark_info *info = par->targinfo;
  178. struct hmark_tuple t;
  179. memset(&t, 0, sizeof(struct hmark_tuple));
  180. if (info->flags & XT_HMARK_FLAG(XT_HMARK_CT)) {
  181. if (hmark_ct_set_htuple(skb, &t, info) < 0)
  182. return XT_CONTINUE;
  183. } else {
  184. if (hmark_pkt_set_htuple_ipv6(skb, &t, info) < 0)
  185. return XT_CONTINUE;
  186. }
  187. skb->mark = hmark_hash(&t, info);
  188. return XT_CONTINUE;
  189. }
  190. #endif
  191. static int get_inner_hdr(const struct sk_buff *skb, int iphsz, int *nhoff)
  192. {
  193. const struct icmphdr *icmph;
  194. struct icmphdr _ih;
  195. /* Not enough header? */
  196. icmph = skb_header_pointer(skb, *nhoff + iphsz, sizeof(_ih), &_ih);
  197. if (icmph == NULL || icmph->type > NR_ICMP_TYPES)
  198. return 0;
  199. /* Error message? */
  200. if (!icmp_is_err(icmph->type))
  201. return 0;
  202. *nhoff += iphsz + sizeof(_ih);
  203. return 1;
  204. }
  205. static int
  206. hmark_pkt_set_htuple_ipv4(const struct sk_buff *skb, struct hmark_tuple *t,
  207. const struct xt_hmark_info *info)
  208. {
  209. struct iphdr *ip, _ip;
  210. int nhoff = skb_network_offset(skb);
  211. ip = (struct iphdr *) (skb->data + nhoff);
  212. if (ip->protocol == IPPROTO_ICMP) {
  213. /* Use inner header in case of ICMP errors */
  214. if (get_inner_hdr(skb, ip->ihl * 4, &nhoff)) {
  215. ip = skb_header_pointer(skb, nhoff, sizeof(_ip), &_ip);
  216. if (ip == NULL)
  217. return -1;
  218. }
  219. }
  220. t->src = ip->saddr & info->src_mask.ip;
  221. t->dst = ip->daddr & info->dst_mask.ip;
  222. if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))
  223. return 0;
  224. t->proto = ip->protocol;
  225. /* ICMP has no ports, skip */
  226. if (t->proto == IPPROTO_ICMP)
  227. return 0;
  228. /* follow-up fragments don't contain ports, skip all fragments */
  229. if (ip_is_fragment(ip))
  230. return 0;
  231. hmark_set_tuple_ports(skb, (ip->ihl * 4) + nhoff, t, info);
  232. return 0;
  233. }
  234. static unsigned int
  235. hmark_tg_v4(struct sk_buff *skb, const struct xt_action_param *par)
  236. {
  237. const struct xt_hmark_info *info = par->targinfo;
  238. struct hmark_tuple t;
  239. memset(&t, 0, sizeof(struct hmark_tuple));
  240. if (info->flags & XT_HMARK_FLAG(XT_HMARK_CT)) {
  241. if (hmark_ct_set_htuple(skb, &t, info) < 0)
  242. return XT_CONTINUE;
  243. } else {
  244. if (hmark_pkt_set_htuple_ipv4(skb, &t, info) < 0)
  245. return XT_CONTINUE;
  246. }
  247. skb->mark = hmark_hash(&t, info);
  248. return XT_CONTINUE;
  249. }
  250. static int hmark_tg_check(const struct xt_tgchk_param *par)
  251. {
  252. const struct xt_hmark_info *info = par->targinfo;
  253. const char *errmsg = "proto mask must be zero with L3 mode";
  254. if (!info->hmodulus)
  255. return -EINVAL;
  256. if (info->proto_mask &&
  257. (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3)))
  258. goto err;
  259. if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPI_MASK) &&
  260. (info->flags & (XT_HMARK_FLAG(XT_HMARK_SPORT_MASK) |
  261. XT_HMARK_FLAG(XT_HMARK_DPORT_MASK))))
  262. return -EINVAL;
  263. if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPI) &&
  264. (info->flags & (XT_HMARK_FLAG(XT_HMARK_SPORT) |
  265. XT_HMARK_FLAG(XT_HMARK_DPORT)))) {
  266. errmsg = "spi-set and port-set can't be combined";
  267. goto err;
  268. }
  269. return 0;
  270. err:
  271. pr_info_ratelimited("%s\n", errmsg);
  272. return -EINVAL;
  273. }
  274. static struct xt_target hmark_tg_reg[] __read_mostly = {
  275. {
  276. .name = "HMARK",
  277. .family = NFPROTO_IPV4,
  278. .target = hmark_tg_v4,
  279. .targetsize = sizeof(struct xt_hmark_info),
  280. .checkentry = hmark_tg_check,
  281. .me = THIS_MODULE,
  282. },
  283. #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
  284. {
  285. .name = "HMARK",
  286. .family = NFPROTO_IPV6,
  287. .target = hmark_tg_v6,
  288. .targetsize = sizeof(struct xt_hmark_info),
  289. .checkentry = hmark_tg_check,
  290. .me = THIS_MODULE,
  291. },
  292. #endif
  293. };
  294. static int __init hmark_tg_init(void)
  295. {
  296. return xt_register_targets(hmark_tg_reg, ARRAY_SIZE(hmark_tg_reg));
  297. }
  298. static void __exit hmark_tg_exit(void)
  299. {
  300. xt_unregister_targets(hmark_tg_reg, ARRAY_SIZE(hmark_tg_reg));
  301. }
  302. module_init(hmark_tg_init);
  303. module_exit(hmark_tg_exit);