xt_TEE.c 5.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * "TEE" target extension for Xtables
  4. * Copyright © Sebastian Claßen, 2007
  5. * Jan Engelhardt, 2007-2010
  6. *
  7. * based on ipt_ROUTE.c from Cédric de Launois
  8. * <delaunois@info.ucl.be>
  9. */
  10. #include <linux/module.h>
  11. #include <linux/skbuff.h>
  12. #include <linux/route.h>
  13. #include <linux/netfilter/x_tables.h>
  14. #include <net/net_namespace.h>
  15. #include <net/netns/generic.h>
  16. #include <net/route.h>
  17. #include <net/netfilter/ipv4/nf_dup_ipv4.h>
  18. #include <net/netfilter/ipv6/nf_dup_ipv6.h>
  19. #include <linux/netfilter/xt_TEE.h>
  20. struct xt_tee_priv {
  21. struct list_head list;
  22. struct xt_tee_tginfo *tginfo;
  23. int oif;
  24. };
  25. static unsigned int tee_net_id __read_mostly;
  26. static const union nf_inet_addr tee_zero_address;
  27. struct tee_net {
  28. struct list_head priv_list;
  29. /* lock protects the priv_list */
  30. struct mutex lock;
  31. };
  32. static unsigned int
  33. tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)
  34. {
  35. const struct xt_tee_tginfo *info = par->targinfo;
  36. int oif = info->priv ? info->priv->oif : 0;
  37. nf_dup_ipv4(xt_net(par), skb, xt_hooknum(par), &info->gw.in, oif);
  38. return XT_CONTINUE;
  39. }
  40. #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
  41. static unsigned int
  42. tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
  43. {
  44. const struct xt_tee_tginfo *info = par->targinfo;
  45. int oif = info->priv ? info->priv->oif : 0;
  46. nf_dup_ipv6(xt_net(par), skb, xt_hooknum(par), &info->gw.in6, oif);
  47. return XT_CONTINUE;
  48. }
  49. #endif
  50. static int tee_netdev_event(struct notifier_block *this, unsigned long event,
  51. void *ptr)
  52. {
  53. struct net_device *dev = netdev_notifier_info_to_dev(ptr);
  54. struct net *net = dev_net(dev);
  55. struct tee_net *tn = net_generic(net, tee_net_id);
  56. struct xt_tee_priv *priv;
  57. mutex_lock(&tn->lock);
  58. list_for_each_entry(priv, &tn->priv_list, list) {
  59. switch (event) {
  60. case NETDEV_REGISTER:
  61. if (!strcmp(dev->name, priv->tginfo->oif))
  62. priv->oif = dev->ifindex;
  63. break;
  64. case NETDEV_UNREGISTER:
  65. if (dev->ifindex == priv->oif)
  66. priv->oif = -1;
  67. break;
  68. case NETDEV_CHANGENAME:
  69. if (!strcmp(dev->name, priv->tginfo->oif))
  70. priv->oif = dev->ifindex;
  71. else if (dev->ifindex == priv->oif)
  72. priv->oif = -1;
  73. break;
  74. }
  75. }
  76. mutex_unlock(&tn->lock);
  77. return NOTIFY_DONE;
  78. }
  79. static int tee_tg_check(const struct xt_tgchk_param *par)
  80. {
  81. struct tee_net *tn = net_generic(par->net, tee_net_id);
  82. struct xt_tee_tginfo *info = par->targinfo;
  83. struct xt_tee_priv *priv;
  84. /* 0.0.0.0 and :: not allowed */
  85. if (memcmp(&info->gw, &tee_zero_address,
  86. sizeof(tee_zero_address)) == 0)
  87. return -EINVAL;
  88. if (info->oif[0]) {
  89. struct net_device *dev;
  90. if (info->oif[sizeof(info->oif)-1] != '\0')
  91. return -EINVAL;
  92. priv = kzalloc(sizeof(*priv), GFP_KERNEL);
  93. if (priv == NULL)
  94. return -ENOMEM;
  95. priv->tginfo = info;
  96. priv->oif = -1;
  97. info->priv = priv;
  98. dev = dev_get_by_name(par->net, info->oif);
  99. if (dev) {
  100. priv->oif = dev->ifindex;
  101. dev_put(dev);
  102. }
  103. mutex_lock(&tn->lock);
  104. list_add(&priv->list, &tn->priv_list);
  105. mutex_unlock(&tn->lock);
  106. } else
  107. info->priv = NULL;
  108. static_key_slow_inc(&xt_tee_enabled);
  109. return 0;
  110. }
  111. static void tee_tg_destroy(const struct xt_tgdtor_param *par)
  112. {
  113. struct tee_net *tn = net_generic(par->net, tee_net_id);
  114. struct xt_tee_tginfo *info = par->targinfo;
  115. if (info->priv) {
  116. mutex_lock(&tn->lock);
  117. list_del(&info->priv->list);
  118. mutex_unlock(&tn->lock);
  119. kfree(info->priv);
  120. }
  121. static_key_slow_dec(&xt_tee_enabled);
  122. }
  123. static struct xt_target tee_tg_reg[] __read_mostly = {
  124. {
  125. .name = "TEE",
  126. .revision = 1,
  127. .family = NFPROTO_IPV4,
  128. .target = tee_tg4,
  129. .targetsize = sizeof(struct xt_tee_tginfo),
  130. .usersize = offsetof(struct xt_tee_tginfo, priv),
  131. .checkentry = tee_tg_check,
  132. .destroy = tee_tg_destroy,
  133. .me = THIS_MODULE,
  134. },
  135. #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
  136. {
  137. .name = "TEE",
  138. .revision = 1,
  139. .family = NFPROTO_IPV6,
  140. .target = tee_tg6,
  141. .targetsize = sizeof(struct xt_tee_tginfo),
  142. .usersize = offsetof(struct xt_tee_tginfo, priv),
  143. .checkentry = tee_tg_check,
  144. .destroy = tee_tg_destroy,
  145. .me = THIS_MODULE,
  146. },
  147. #endif
  148. };
  149. static int __net_init tee_net_init(struct net *net)
  150. {
  151. struct tee_net *tn = net_generic(net, tee_net_id);
  152. INIT_LIST_HEAD(&tn->priv_list);
  153. mutex_init(&tn->lock);
  154. return 0;
  155. }
  156. static struct pernet_operations tee_net_ops = {
  157. .init = tee_net_init,
  158. .id = &tee_net_id,
  159. .size = sizeof(struct tee_net),
  160. };
  161. static struct notifier_block tee_netdev_notifier = {
  162. .notifier_call = tee_netdev_event,
  163. };
  164. static int __init tee_tg_init(void)
  165. {
  166. int ret;
  167. ret = register_pernet_subsys(&tee_net_ops);
  168. if (ret < 0)
  169. return ret;
  170. ret = xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
  171. if (ret < 0)
  172. goto cleanup_subsys;
  173. ret = register_netdevice_notifier(&tee_netdev_notifier);
  174. if (ret < 0)
  175. goto unregister_targets;
  176. return 0;
  177. unregister_targets:
  178. xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
  179. cleanup_subsys:
  180. unregister_pernet_subsys(&tee_net_ops);
  181. return ret;
  182. }
  183. static void __exit tee_tg_exit(void)
  184. {
  185. unregister_netdevice_notifier(&tee_netdev_notifier);
  186. xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
  187. unregister_pernet_subsys(&tee_net_ops);
  188. }
  189. module_init(tee_tg_init);
  190. module_exit(tee_tg_exit);
  191. MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>");
  192. MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
  193. MODULE_DESCRIPTION("Xtables: Reroute packet copy");
  194. MODULE_LICENSE("GPL");
  195. MODULE_ALIAS("ipt_TEE");
  196. MODULE_ALIAS("ip6t_TEE");