em_ipt.c 6.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * net/sched/em_ipt.c IPtables matches Ematch
  4. *
  5. * (c) 2018 Eyal Birger <eyal.birger@gmail.com>
  6. */
  7. #include <linux/gfp.h>
  8. #include <linux/module.h>
  9. #include <linux/types.h>
  10. #include <linux/kernel.h>
  11. #include <linux/string.h>
  12. #include <linux/skbuff.h>
  13. #include <linux/tc_ematch/tc_em_ipt.h>
  14. #include <linux/netfilter.h>
  15. #include <linux/netfilter/x_tables.h>
  16. #include <linux/netfilter_ipv4/ip_tables.h>
  17. #include <linux/netfilter_ipv6/ip6_tables.h>
  18. #include <net/pkt_cls.h>
  19. struct em_ipt_match {
  20. const struct xt_match *match;
  21. u32 hook;
  22. u8 nfproto;
  23. u8 match_data[] __aligned(8);
  24. };
  25. struct em_ipt_xt_match {
  26. char *match_name;
  27. int (*validate_match_data)(struct nlattr **tb, u8 mrev);
  28. };
  29. static const struct nla_policy em_ipt_policy[TCA_EM_IPT_MAX + 1] = {
  30. [TCA_EM_IPT_MATCH_NAME] = { .type = NLA_STRING,
  31. .len = XT_EXTENSION_MAXNAMELEN },
  32. [TCA_EM_IPT_MATCH_REVISION] = { .type = NLA_U8 },
  33. [TCA_EM_IPT_HOOK] = { .type = NLA_U32 },
  34. [TCA_EM_IPT_NFPROTO] = { .type = NLA_U8 },
  35. [TCA_EM_IPT_MATCH_DATA] = { .type = NLA_UNSPEC },
  36. };
  37. static int check_match(struct net *net, struct em_ipt_match *im, int mdata_len)
  38. {
  39. struct xt_mtchk_param mtpar = {};
  40. union {
  41. struct ipt_entry e4;
  42. struct ip6t_entry e6;
  43. } e = {};
  44. mtpar.net = net;
  45. mtpar.table = "filter";
  46. mtpar.hook_mask = 1 << im->hook;
  47. mtpar.family = im->match->family;
  48. mtpar.match = im->match;
  49. mtpar.entryinfo = &e;
  50. mtpar.matchinfo = (void *)im->match_data;
  51. return xt_check_match(&mtpar, mdata_len, 0, 0);
  52. }
  53. static int policy_validate_match_data(struct nlattr **tb, u8 mrev)
  54. {
  55. if (mrev != 0) {
  56. pr_err("only policy match revision 0 supported");
  57. return -EINVAL;
  58. }
  59. if (nla_get_u32(tb[TCA_EM_IPT_HOOK]) != NF_INET_PRE_ROUTING) {
  60. pr_err("policy can only be matched on NF_INET_PRE_ROUTING");
  61. return -EINVAL;
  62. }
  63. return 0;
  64. }
  65. static int addrtype_validate_match_data(struct nlattr **tb, u8 mrev)
  66. {
  67. if (mrev != 1) {
  68. pr_err("only addrtype match revision 1 supported");
  69. return -EINVAL;
  70. }
  71. return 0;
  72. }
  73. static const struct em_ipt_xt_match em_ipt_xt_matches[] = {
  74. {
  75. .match_name = "policy",
  76. .validate_match_data = policy_validate_match_data
  77. },
  78. {
  79. .match_name = "addrtype",
  80. .validate_match_data = addrtype_validate_match_data
  81. },
  82. {}
  83. };
  84. static struct xt_match *get_xt_match(struct nlattr **tb)
  85. {
  86. const struct em_ipt_xt_match *m;
  87. struct nlattr *mname_attr;
  88. u8 nfproto, mrev = 0;
  89. int ret;
  90. mname_attr = tb[TCA_EM_IPT_MATCH_NAME];
  91. for (m = em_ipt_xt_matches; m->match_name; m++) {
  92. if (!nla_strcmp(mname_attr, m->match_name))
  93. break;
  94. }
  95. if (!m->match_name) {
  96. pr_err("Unsupported xt match");
  97. return ERR_PTR(-EINVAL);
  98. }
  99. if (tb[TCA_EM_IPT_MATCH_REVISION])
  100. mrev = nla_get_u8(tb[TCA_EM_IPT_MATCH_REVISION]);
  101. ret = m->validate_match_data(tb, mrev);
  102. if (ret < 0)
  103. return ERR_PTR(ret);
  104. nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]);
  105. return xt_request_find_match(nfproto, m->match_name, mrev);
  106. }
  107. static int em_ipt_change(struct net *net, void *data, int data_len,
  108. struct tcf_ematch *em)
  109. {
  110. struct nlattr *tb[TCA_EM_IPT_MAX + 1];
  111. struct em_ipt_match *im = NULL;
  112. struct xt_match *match;
  113. int mdata_len, ret;
  114. u8 nfproto;
  115. ret = nla_parse_deprecated(tb, TCA_EM_IPT_MAX, data, data_len,
  116. em_ipt_policy, NULL);
  117. if (ret < 0)
  118. return ret;
  119. if (!tb[TCA_EM_IPT_HOOK] || !tb[TCA_EM_IPT_MATCH_NAME] ||
  120. !tb[TCA_EM_IPT_MATCH_DATA] || !tb[TCA_EM_IPT_NFPROTO])
  121. return -EINVAL;
  122. nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]);
  123. switch (nfproto) {
  124. case NFPROTO_IPV4:
  125. case NFPROTO_IPV6:
  126. break;
  127. default:
  128. return -EINVAL;
  129. }
  130. match = get_xt_match(tb);
  131. if (IS_ERR(match)) {
  132. pr_err("unable to load match\n");
  133. return PTR_ERR(match);
  134. }
  135. mdata_len = XT_ALIGN(nla_len(tb[TCA_EM_IPT_MATCH_DATA]));
  136. im = kzalloc(sizeof(*im) + mdata_len, GFP_KERNEL);
  137. if (!im) {
  138. ret = -ENOMEM;
  139. goto err;
  140. }
  141. im->match = match;
  142. im->hook = nla_get_u32(tb[TCA_EM_IPT_HOOK]);
  143. im->nfproto = nfproto;
  144. nla_memcpy(im->match_data, tb[TCA_EM_IPT_MATCH_DATA], mdata_len);
  145. ret = check_match(net, im, mdata_len);
  146. if (ret)
  147. goto err;
  148. em->datalen = sizeof(*im) + mdata_len;
  149. em->data = (unsigned long)im;
  150. return 0;
  151. err:
  152. kfree(im);
  153. module_put(match->me);
  154. return ret;
  155. }
  156. static void em_ipt_destroy(struct tcf_ematch *em)
  157. {
  158. struct em_ipt_match *im = (void *)em->data;
  159. if (!im)
  160. return;
  161. if (im->match->destroy) {
  162. struct xt_mtdtor_param par = {
  163. .net = em->net,
  164. .match = im->match,
  165. .matchinfo = im->match_data,
  166. .family = im->match->family
  167. };
  168. im->match->destroy(&par);
  169. }
  170. module_put(im->match->me);
  171. kfree(im);
  172. }
  173. static int em_ipt_match(struct sk_buff *skb, struct tcf_ematch *em,
  174. struct tcf_pkt_info *info)
  175. {
  176. const struct em_ipt_match *im = (const void *)em->data;
  177. struct xt_action_param acpar = {};
  178. struct net_device *indev = NULL;
  179. u8 nfproto = im->match->family;
  180. struct nf_hook_state state;
  181. int ret;
  182. switch (skb_protocol(skb, true)) {
  183. case htons(ETH_P_IP):
  184. if (!pskb_network_may_pull(skb, sizeof(struct iphdr)))
  185. return 0;
  186. if (nfproto == NFPROTO_UNSPEC)
  187. nfproto = NFPROTO_IPV4;
  188. break;
  189. case htons(ETH_P_IPV6):
  190. if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr)))
  191. return 0;
  192. if (nfproto == NFPROTO_UNSPEC)
  193. nfproto = NFPROTO_IPV6;
  194. break;
  195. default:
  196. return 0;
  197. }
  198. rcu_read_lock();
  199. if (skb->skb_iif)
  200. indev = dev_get_by_index_rcu(em->net, skb->skb_iif);
  201. nf_hook_state_init(&state, im->hook, nfproto,
  202. indev ?: skb->dev, skb->dev, NULL, em->net, NULL);
  203. acpar.match = im->match;
  204. acpar.matchinfo = im->match_data;
  205. acpar.state = &state;
  206. ret = im->match->match(skb, &acpar);
  207. rcu_read_unlock();
  208. return ret;
  209. }
  210. static int em_ipt_dump(struct sk_buff *skb, struct tcf_ematch *em)
  211. {
  212. struct em_ipt_match *im = (void *)em->data;
  213. if (nla_put_string(skb, TCA_EM_IPT_MATCH_NAME, im->match->name) < 0)
  214. return -EMSGSIZE;
  215. if (nla_put_u32(skb, TCA_EM_IPT_HOOK, im->hook) < 0)
  216. return -EMSGSIZE;
  217. if (nla_put_u8(skb, TCA_EM_IPT_MATCH_REVISION, im->match->revision) < 0)
  218. return -EMSGSIZE;
  219. if (nla_put_u8(skb, TCA_EM_IPT_NFPROTO, im->nfproto) < 0)
  220. return -EMSGSIZE;
  221. if (nla_put(skb, TCA_EM_IPT_MATCH_DATA,
  222. im->match->usersize ?: im->match->matchsize,
  223. im->match_data) < 0)
  224. return -EMSGSIZE;
  225. return 0;
  226. }
  227. static struct tcf_ematch_ops em_ipt_ops = {
  228. .kind = TCF_EM_IPT,
  229. .change = em_ipt_change,
  230. .destroy = em_ipt_destroy,
  231. .match = em_ipt_match,
  232. .dump = em_ipt_dump,
  233. .owner = THIS_MODULE,
  234. .link = LIST_HEAD_INIT(em_ipt_ops.link)
  235. };
  236. static int __init init_em_ipt(void)
  237. {
  238. return tcf_em_register(&em_ipt_ops);
  239. }
  240. static void __exit exit_em_ipt(void)
  241. {
  242. tcf_em_unregister(&em_ipt_ops);
  243. }
  244. MODULE_LICENSE("GPL");
  245. MODULE_AUTHOR("Eyal Birger <eyal.birger@gmail.com>");
  246. MODULE_DESCRIPTION("TC extended match for IPtables matches");
  247. module_init(init_em_ipt);
  248. module_exit(exit_em_ipt);
  249. MODULE_ALIAS_TCF_EMATCH(TCF_EM_IPT);