Loading...
1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * net/sched/em_ipt.c IPtables matches Ematch
4 *
5 * (c) 2018 Eyal Birger <eyal.birger@gmail.com>
6 */
7
8#include <linux/gfp.h>
9#include <linux/module.h>
10#include <linux/types.h>
11#include <linux/kernel.h>
12#include <linux/string.h>
13#include <linux/skbuff.h>
14#include <linux/tc_ematch/tc_em_ipt.h>
15#include <linux/netfilter.h>
16#include <linux/netfilter/x_tables.h>
17#include <linux/netfilter_ipv4/ip_tables.h>
18#include <linux/netfilter_ipv6/ip6_tables.h>
19#include <net/pkt_cls.h>
20
21struct em_ipt_match {
22 const struct xt_match *match;
23 u32 hook;
24 u8 nfproto;
25 u8 match_data[0] __aligned(8);
26};
27
28struct em_ipt_xt_match {
29 char *match_name;
30 int (*validate_match_data)(struct nlattr **tb, u8 mrev);
31};
32
33static const struct nla_policy em_ipt_policy[TCA_EM_IPT_MAX + 1] = {
34 [TCA_EM_IPT_MATCH_NAME] = { .type = NLA_STRING,
35 .len = XT_EXTENSION_MAXNAMELEN },
36 [TCA_EM_IPT_MATCH_REVISION] = { .type = NLA_U8 },
37 [TCA_EM_IPT_HOOK] = { .type = NLA_U32 },
38 [TCA_EM_IPT_NFPROTO] = { .type = NLA_U8 },
39 [TCA_EM_IPT_MATCH_DATA] = { .type = NLA_UNSPEC },
40};
41
42static int check_match(struct net *net, struct em_ipt_match *im, int mdata_len)
43{
44 struct xt_mtchk_param mtpar = {};
45 union {
46 struct ipt_entry e4;
47 struct ip6t_entry e6;
48 } e = {};
49
50 mtpar.net = net;
51 mtpar.table = "filter";
52 mtpar.hook_mask = 1 << im->hook;
53 mtpar.family = im->match->family;
54 mtpar.match = im->match;
55 mtpar.entryinfo = &e;
56 mtpar.matchinfo = (void *)im->match_data;
57 return xt_check_match(&mtpar, mdata_len, 0, 0);
58}
59
60static int policy_validate_match_data(struct nlattr **tb, u8 mrev)
61{
62 if (mrev != 0) {
63 pr_err("only policy match revision 0 supported");
64 return -EINVAL;
65 }
66
67 if (nla_get_u32(tb[TCA_EM_IPT_HOOK]) != NF_INET_PRE_ROUTING) {
68 pr_err("policy can only be matched on NF_INET_PRE_ROUTING");
69 return -EINVAL;
70 }
71
72 return 0;
73}
74
75static int addrtype_validate_match_data(struct nlattr **tb, u8 mrev)
76{
77 if (mrev != 1) {
78 pr_err("only addrtype match revision 1 supported");
79 return -EINVAL;
80 }
81
82 return 0;
83}
84
85static const struct em_ipt_xt_match em_ipt_xt_matches[] = {
86 {
87 .match_name = "policy",
88 .validate_match_data = policy_validate_match_data
89 },
90 {
91 .match_name = "addrtype",
92 .validate_match_data = addrtype_validate_match_data
93 },
94 {}
95};
96
97static struct xt_match *get_xt_match(struct nlattr **tb)
98{
99 const struct em_ipt_xt_match *m;
100 struct nlattr *mname_attr;
101 u8 nfproto, mrev = 0;
102 int ret;
103
104 mname_attr = tb[TCA_EM_IPT_MATCH_NAME];
105 for (m = em_ipt_xt_matches; m->match_name; m++) {
106 if (!nla_strcmp(mname_attr, m->match_name))
107 break;
108 }
109
110 if (!m->match_name) {
111 pr_err("Unsupported xt match");
112 return ERR_PTR(-EINVAL);
113 }
114
115 if (tb[TCA_EM_IPT_MATCH_REVISION])
116 mrev = nla_get_u8(tb[TCA_EM_IPT_MATCH_REVISION]);
117
118 ret = m->validate_match_data(tb, mrev);
119 if (ret < 0)
120 return ERR_PTR(ret);
121
122 nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]);
123 return xt_request_find_match(nfproto, m->match_name, mrev);
124}
125
126static int em_ipt_change(struct net *net, void *data, int data_len,
127 struct tcf_ematch *em)
128{
129 struct nlattr *tb[TCA_EM_IPT_MAX + 1];
130 struct em_ipt_match *im = NULL;
131 struct xt_match *match;
132 int mdata_len, ret;
133 u8 nfproto;
134
135 ret = nla_parse_deprecated(tb, TCA_EM_IPT_MAX, data, data_len,
136 em_ipt_policy, NULL);
137 if (ret < 0)
138 return ret;
139
140 if (!tb[TCA_EM_IPT_HOOK] || !tb[TCA_EM_IPT_MATCH_NAME] ||
141 !tb[TCA_EM_IPT_MATCH_DATA] || !tb[TCA_EM_IPT_NFPROTO])
142 return -EINVAL;
143
144 nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]);
145 switch (nfproto) {
146 case NFPROTO_IPV4:
147 case NFPROTO_IPV6:
148 break;
149 default:
150 return -EINVAL;
151 }
152
153 match = get_xt_match(tb);
154 if (IS_ERR(match)) {
155 pr_err("unable to load match\n");
156 return PTR_ERR(match);
157 }
158
159 mdata_len = XT_ALIGN(nla_len(tb[TCA_EM_IPT_MATCH_DATA]));
160 im = kzalloc(sizeof(*im) + mdata_len, GFP_KERNEL);
161 if (!im) {
162 ret = -ENOMEM;
163 goto err;
164 }
165
166 im->match = match;
167 im->hook = nla_get_u32(tb[TCA_EM_IPT_HOOK]);
168 im->nfproto = nfproto;
169 nla_memcpy(im->match_data, tb[TCA_EM_IPT_MATCH_DATA], mdata_len);
170
171 ret = check_match(net, im, mdata_len);
172 if (ret)
173 goto err;
174
175 em->datalen = sizeof(*im) + mdata_len;
176 em->data = (unsigned long)im;
177 return 0;
178
179err:
180 kfree(im);
181 module_put(match->me);
182 return ret;
183}
184
185static void em_ipt_destroy(struct tcf_ematch *em)
186{
187 struct em_ipt_match *im = (void *)em->data;
188
189 if (!im)
190 return;
191
192 if (im->match->destroy) {
193 struct xt_mtdtor_param par = {
194 .net = em->net,
195 .match = im->match,
196 .matchinfo = im->match_data,
197 .family = im->match->family
198 };
199 im->match->destroy(&par);
200 }
201 module_put(im->match->me);
202 kfree((void *)im);
203}
204
205static int em_ipt_match(struct sk_buff *skb, struct tcf_ematch *em,
206 struct tcf_pkt_info *info)
207{
208 const struct em_ipt_match *im = (const void *)em->data;
209 struct xt_action_param acpar = {};
210 struct net_device *indev = NULL;
211 u8 nfproto = im->match->family;
212 struct nf_hook_state state;
213 int ret;
214
215 switch (tc_skb_protocol(skb)) {
216 case htons(ETH_P_IP):
217 if (!pskb_network_may_pull(skb, sizeof(struct iphdr)))
218 return 0;
219 if (nfproto == NFPROTO_UNSPEC)
220 nfproto = NFPROTO_IPV4;
221 break;
222 case htons(ETH_P_IPV6):
223 if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr)))
224 return 0;
225 if (nfproto == NFPROTO_UNSPEC)
226 nfproto = NFPROTO_IPV6;
227 break;
228 default:
229 return 0;
230 }
231
232 rcu_read_lock();
233
234 if (skb->skb_iif)
235 indev = dev_get_by_index_rcu(em->net, skb->skb_iif);
236
237 nf_hook_state_init(&state, im->hook, nfproto,
238 indev ?: skb->dev, skb->dev, NULL, em->net, NULL);
239
240 acpar.match = im->match;
241 acpar.matchinfo = im->match_data;
242 acpar.state = &state;
243
244 ret = im->match->match(skb, &acpar);
245
246 rcu_read_unlock();
247 return ret;
248}
249
250static int em_ipt_dump(struct sk_buff *skb, struct tcf_ematch *em)
251{
252 struct em_ipt_match *im = (void *)em->data;
253
254 if (nla_put_string(skb, TCA_EM_IPT_MATCH_NAME, im->match->name) < 0)
255 return -EMSGSIZE;
256 if (nla_put_u32(skb, TCA_EM_IPT_HOOK, im->hook) < 0)
257 return -EMSGSIZE;
258 if (nla_put_u8(skb, TCA_EM_IPT_MATCH_REVISION, im->match->revision) < 0)
259 return -EMSGSIZE;
260 if (nla_put_u8(skb, TCA_EM_IPT_NFPROTO, im->nfproto) < 0)
261 return -EMSGSIZE;
262 if (nla_put(skb, TCA_EM_IPT_MATCH_DATA,
263 im->match->usersize ?: im->match->matchsize,
264 im->match_data) < 0)
265 return -EMSGSIZE;
266
267 return 0;
268}
269
270static struct tcf_ematch_ops em_ipt_ops = {
271 .kind = TCF_EM_IPT,
272 .change = em_ipt_change,
273 .destroy = em_ipt_destroy,
274 .match = em_ipt_match,
275 .dump = em_ipt_dump,
276 .owner = THIS_MODULE,
277 .link = LIST_HEAD_INIT(em_ipt_ops.link)
278};
279
280static int __init init_em_ipt(void)
281{
282 return tcf_em_register(&em_ipt_ops);
283}
284
285static void __exit exit_em_ipt(void)
286{
287 tcf_em_unregister(&em_ipt_ops);
288}
289
290MODULE_LICENSE("GPL");
291MODULE_AUTHOR("Eyal Birger <eyal.birger@gmail.com>");
292MODULE_DESCRIPTION("TC extended match for IPtables matches");
293
294module_init(init_em_ipt);
295module_exit(exit_em_ipt);
296
297MODULE_ALIAS_TCF_EMATCH(TCF_EM_IPT);
1/*
2 * net/sched/em_ipt.c IPtables matches Ematch
3 *
4 * (c) 2018 Eyal Birger <eyal.birger@gmail.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
12#include <linux/gfp.h>
13#include <linux/module.h>
14#include <linux/types.h>
15#include <linux/kernel.h>
16#include <linux/string.h>
17#include <linux/skbuff.h>
18#include <linux/tc_ematch/tc_em_ipt.h>
19#include <linux/netfilter.h>
20#include <linux/netfilter/x_tables.h>
21#include <linux/netfilter_ipv4/ip_tables.h>
22#include <linux/netfilter_ipv6/ip6_tables.h>
23#include <net/pkt_cls.h>
24
25struct em_ipt_match {
26 const struct xt_match *match;
27 u32 hook;
28 u8 match_data[0] __aligned(8);
29};
30
31struct em_ipt_xt_match {
32 char *match_name;
33 int (*validate_match_data)(struct nlattr **tb, u8 mrev);
34};
35
36static const struct nla_policy em_ipt_policy[TCA_EM_IPT_MAX + 1] = {
37 [TCA_EM_IPT_MATCH_NAME] = { .type = NLA_STRING,
38 .len = XT_EXTENSION_MAXNAMELEN },
39 [TCA_EM_IPT_MATCH_REVISION] = { .type = NLA_U8 },
40 [TCA_EM_IPT_HOOK] = { .type = NLA_U32 },
41 [TCA_EM_IPT_NFPROTO] = { .type = NLA_U8 },
42 [TCA_EM_IPT_MATCH_DATA] = { .type = NLA_UNSPEC },
43};
44
45static int check_match(struct net *net, struct em_ipt_match *im, int mdata_len)
46{
47 struct xt_mtchk_param mtpar = {};
48 union {
49 struct ipt_entry e4;
50 struct ip6t_entry e6;
51 } e = {};
52
53 mtpar.net = net;
54 mtpar.table = "filter";
55 mtpar.hook_mask = 1 << im->hook;
56 mtpar.family = im->match->family;
57 mtpar.match = im->match;
58 mtpar.entryinfo = &e;
59 mtpar.matchinfo = (void *)im->match_data;
60 return xt_check_match(&mtpar, mdata_len, 0, 0);
61}
62
63static int policy_validate_match_data(struct nlattr **tb, u8 mrev)
64{
65 if (mrev != 0) {
66 pr_err("only policy match revision 0 supported");
67 return -EINVAL;
68 }
69
70 if (nla_get_u32(tb[TCA_EM_IPT_HOOK]) != NF_INET_PRE_ROUTING) {
71 pr_err("policy can only be matched on NF_INET_PRE_ROUTING");
72 return -EINVAL;
73 }
74
75 return 0;
76}
77
78static const struct em_ipt_xt_match em_ipt_xt_matches[] = {
79 {
80 .match_name = "policy",
81 .validate_match_data = policy_validate_match_data
82 },
83 {}
84};
85
86static struct xt_match *get_xt_match(struct nlattr **tb)
87{
88 const struct em_ipt_xt_match *m;
89 struct nlattr *mname_attr;
90 u8 nfproto, mrev = 0;
91 int ret;
92
93 mname_attr = tb[TCA_EM_IPT_MATCH_NAME];
94 for (m = em_ipt_xt_matches; m->match_name; m++) {
95 if (!nla_strcmp(mname_attr, m->match_name))
96 break;
97 }
98
99 if (!m->match_name) {
100 pr_err("Unsupported xt match");
101 return ERR_PTR(-EINVAL);
102 }
103
104 if (tb[TCA_EM_IPT_MATCH_REVISION])
105 mrev = nla_get_u8(tb[TCA_EM_IPT_MATCH_REVISION]);
106
107 ret = m->validate_match_data(tb, mrev);
108 if (ret < 0)
109 return ERR_PTR(ret);
110
111 nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]);
112 return xt_request_find_match(nfproto, m->match_name, mrev);
113}
114
115static int em_ipt_change(struct net *net, void *data, int data_len,
116 struct tcf_ematch *em)
117{
118 struct nlattr *tb[TCA_EM_IPT_MAX + 1];
119 struct em_ipt_match *im = NULL;
120 struct xt_match *match;
121 int mdata_len, ret;
122
123 ret = nla_parse(tb, TCA_EM_IPT_MAX, data, data_len, em_ipt_policy,
124 NULL);
125 if (ret < 0)
126 return ret;
127
128 if (!tb[TCA_EM_IPT_HOOK] || !tb[TCA_EM_IPT_MATCH_NAME] ||
129 !tb[TCA_EM_IPT_MATCH_DATA] || !tb[TCA_EM_IPT_NFPROTO])
130 return -EINVAL;
131
132 match = get_xt_match(tb);
133 if (IS_ERR(match)) {
134 pr_err("unable to load match\n");
135 return PTR_ERR(match);
136 }
137
138 mdata_len = XT_ALIGN(nla_len(tb[TCA_EM_IPT_MATCH_DATA]));
139 im = kzalloc(sizeof(*im) + mdata_len, GFP_KERNEL);
140 if (!im) {
141 ret = -ENOMEM;
142 goto err;
143 }
144
145 im->match = match;
146 im->hook = nla_get_u32(tb[TCA_EM_IPT_HOOK]);
147 nla_memcpy(im->match_data, tb[TCA_EM_IPT_MATCH_DATA], mdata_len);
148
149 ret = check_match(net, im, mdata_len);
150 if (ret)
151 goto err;
152
153 em->datalen = sizeof(*im) + mdata_len;
154 em->data = (unsigned long)im;
155 return 0;
156
157err:
158 kfree(im);
159 module_put(match->me);
160 return ret;
161}
162
163static void em_ipt_destroy(struct tcf_ematch *em)
164{
165 struct em_ipt_match *im = (void *)em->data;
166
167 if (!im)
168 return;
169
170 if (im->match->destroy) {
171 struct xt_mtdtor_param par = {
172 .net = em->net,
173 .match = im->match,
174 .matchinfo = im->match_data,
175 .family = im->match->family
176 };
177 im->match->destroy(&par);
178 }
179 module_put(im->match->me);
180 kfree((void *)im);
181}
182
183static int em_ipt_match(struct sk_buff *skb, struct tcf_ematch *em,
184 struct tcf_pkt_info *info)
185{
186 const struct em_ipt_match *im = (const void *)em->data;
187 struct xt_action_param acpar = {};
188 struct net_device *indev = NULL;
189 struct nf_hook_state state;
190 int ret;
191
192 rcu_read_lock();
193
194 if (skb->skb_iif)
195 indev = dev_get_by_index_rcu(em->net, skb->skb_iif);
196
197 nf_hook_state_init(&state, im->hook, im->match->family,
198 indev ?: skb->dev, skb->dev, NULL, em->net, NULL);
199
200 acpar.match = im->match;
201 acpar.matchinfo = im->match_data;
202 acpar.state = &state;
203
204 ret = im->match->match(skb, &acpar);
205
206 rcu_read_unlock();
207 return ret;
208}
209
210static int em_ipt_dump(struct sk_buff *skb, struct tcf_ematch *em)
211{
212 struct em_ipt_match *im = (void *)em->data;
213
214 if (nla_put_string(skb, TCA_EM_IPT_MATCH_NAME, im->match->name) < 0)
215 return -EMSGSIZE;
216 if (nla_put_u32(skb, TCA_EM_IPT_HOOK, im->hook) < 0)
217 return -EMSGSIZE;
218 if (nla_put_u8(skb, TCA_EM_IPT_MATCH_REVISION, im->match->revision) < 0)
219 return -EMSGSIZE;
220 if (nla_put_u8(skb, TCA_EM_IPT_NFPROTO, im->match->family) < 0)
221 return -EMSGSIZE;
222 if (nla_put(skb, TCA_EM_IPT_MATCH_DATA,
223 im->match->usersize ?: im->match->matchsize,
224 im->match_data) < 0)
225 return -EMSGSIZE;
226
227 return 0;
228}
229
230static struct tcf_ematch_ops em_ipt_ops = {
231 .kind = TCF_EM_IPT,
232 .change = em_ipt_change,
233 .destroy = em_ipt_destroy,
234 .match = em_ipt_match,
235 .dump = em_ipt_dump,
236 .owner = THIS_MODULE,
237 .link = LIST_HEAD_INIT(em_ipt_ops.link)
238};
239
240static int __init init_em_ipt(void)
241{
242 return tcf_em_register(&em_ipt_ops);
243}
244
245static void __exit exit_em_ipt(void)
246{
247 tcf_em_unregister(&em_ipt_ops);
248}
249
250MODULE_LICENSE("GPL");
251MODULE_AUTHOR("Eyal Birger <eyal.birger@gmail.com>");
252MODULE_DESCRIPTION("TC extended match for IPtables matches");
253
254module_init(init_em_ipt);
255module_exit(exit_em_ipt);
256
257MODULE_ALIAS_TCF_EMATCH(TCF_EM_IPT);