1 /* 2 * "TEE" target extension for Xtables 3 * Copyright © Sebastian Claßen, 2007 4 * Jan Engelhardt, 2007-2010 5 * 6 * based on ipt_ROUTE.c from Cédric de Launois 7 * <delaunois@info.ucl.be> 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License 11 * version 2 or later, as published by the Free Software Foundation. 12 */ 13 #include <linux/ip.h> 14 #include <linux/module.h> 15 #include <linux/percpu.h> 16 #include <linux/route.h> 17 #include <linux/skbuff.h> 18 #include <linux/notifier.h> 19 #include <net/checksum.h> 20 #include <net/icmp.h> 21 #include <net/ip.h> 22 #include <net/ipv6.h> 23 #include <net/ip6_route.h> 24 #include <net/route.h> 25 #include <linux/netfilter/x_tables.h> 26 #include <linux/netfilter/xt_TEE.h> 27 28 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 29 # define WITH_CONNTRACK 1 30 # include <net/netfilter/nf_conntrack.h> 31 #endif 32 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 33 # define WITH_IPV6 1 34 #endif 35 36 struct xt_tee_priv { 37 struct notifier_block notifier; 38 struct xt_tee_tginfo *tginfo; 39 int oif; 40 }; 41 42 static const union nf_inet_addr tee_zero_address; 43 static DEFINE_PER_CPU(bool, tee_active); 44 45 static struct net *pick_net(struct sk_buff *skb) 46 { 47 #ifdef CONFIG_NET_NS 48 const struct dst_entry *dst; 49 50 if (skb->dev != NULL) 51 return dev_net(skb->dev); 52 dst = skb_dst(skb); 53 if (dst != NULL && dst->dev != NULL) 54 return dev_net(dst->dev); 55 #endif 56 return &init_net; 57 } 58 59 static bool 60 tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info) 61 { 62 const struct iphdr *iph = ip_hdr(skb); 63 struct net *net = pick_net(skb); 64 struct rtable *rt; 65 struct flowi4 fl4; 66 67 memset(&fl4, 0, sizeof(fl4)); 68 if (info->priv) { 69 if (info->priv->oif == -1) 70 return false; 71 fl4.flowi4_oif = info->priv->oif; 72 } 73 fl4.daddr = info->gw.ip; 74 fl4.flowi4_tos = RT_TOS(iph->tos); 75 fl4.flowi4_scope = RT_SCOPE_UNIVERSE; 76 rt = ip_route_output_key(net, &fl4); 77 if (IS_ERR(rt)) 78 return false; 79 80 skb_dst_drop(skb); 81 skb_dst_set(skb, &rt->dst); 82 skb->dev = rt->dst.dev; 83 skb->protocol = htons(ETH_P_IP); 84 return true; 85 } 86 87 static unsigned int 88 tee_tg4(struct sk_buff *skb, const struct xt_action_param *par) 89 { 90 const struct xt_tee_tginfo *info = par->targinfo; 91 struct iphdr *iph; 92 93 if (percpu_read(tee_active)) 94 return XT_CONTINUE; 95 /* 96 * Copy the skb, and route the copy. Will later return %XT_CONTINUE for 97 * the original skb, which should continue on its way as if nothing has 98 * happened. The copy should be independently delivered to the TEE 99 * --gateway. 100 */ 101 skb = pskb_copy(skb, GFP_ATOMIC); 102 if (skb == NULL) 103 return XT_CONTINUE; 104 105 #ifdef WITH_CONNTRACK 106 /* Avoid counting cloned packets towards the original connection. */ 107 nf_conntrack_put(skb->nfct); 108 skb->nfct = &nf_ct_untracked_get()->ct_general; 109 skb->nfctinfo = IP_CT_NEW; 110 nf_conntrack_get(skb->nfct); 111 #endif 112 /* 113 * If we are in PREROUTING/INPUT, the checksum must be recalculated 114 * since the length could have changed as a result of defragmentation. 115 * 116 * We also decrease the TTL to mitigate potential TEE loops 117 * between two hosts. 118 * 119 * Set %IP_DF so that the original source is notified of a potentially 120 * decreased MTU on the clone route. IPv6 does this too. 121 */ 122 iph = ip_hdr(skb); 123 iph->frag_off |= htons(IP_DF); 124 if (par->hooknum == NF_INET_PRE_ROUTING || 125 par->hooknum == NF_INET_LOCAL_IN) 126 --iph->ttl; 127 ip_send_check(iph); 128 129 if (tee_tg_route4(skb, info)) { 130 percpu_write(tee_active, true); 131 ip_local_out(skb); 132 percpu_write(tee_active, false); 133 } else { 134 kfree_skb(skb); 135 } 136 return XT_CONTINUE; 137 } 138 139 #ifdef WITH_IPV6 140 static bool 141 tee_tg_route6(struct sk_buff *skb, const struct xt_tee_tginfo *info) 142 { 143 const struct ipv6hdr *iph = ipv6_hdr(skb); 144 struct net *net = pick_net(skb); 145 struct dst_entry *dst; 146 struct flowi6 fl6; 147 148 memset(&fl6, 0, sizeof(fl6)); 149 if (info->priv) { 150 if (info->priv->oif == -1) 151 return false; 152 fl6.flowi6_oif = info->priv->oif; 153 } 154 fl6.daddr = info->gw.in6; 155 fl6.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) | 156 (iph->flow_lbl[1] << 8) | iph->flow_lbl[2]; 157 dst = ip6_route_output(net, NULL, &fl6); 158 if (dst == NULL) 159 return false; 160 161 skb_dst_drop(skb); 162 skb_dst_set(skb, dst); 163 skb->dev = dst->dev; 164 skb->protocol = htons(ETH_P_IPV6); 165 return true; 166 } 167 168 static unsigned int 169 tee_tg6(struct sk_buff *skb, const struct xt_action_param *par) 170 { 171 const struct xt_tee_tginfo *info = par->targinfo; 172 173 if (percpu_read(tee_active)) 174 return XT_CONTINUE; 175 skb = pskb_copy(skb, GFP_ATOMIC); 176 if (skb == NULL) 177 return XT_CONTINUE; 178 179 #ifdef WITH_CONNTRACK 180 nf_conntrack_put(skb->nfct); 181 skb->nfct = &nf_ct_untracked_get()->ct_general; 182 skb->nfctinfo = IP_CT_NEW; 183 nf_conntrack_get(skb->nfct); 184 #endif 185 if (par->hooknum == NF_INET_PRE_ROUTING || 186 par->hooknum == NF_INET_LOCAL_IN) { 187 struct ipv6hdr *iph = ipv6_hdr(skb); 188 --iph->hop_limit; 189 } 190 if (tee_tg_route6(skb, info)) { 191 percpu_write(tee_active, true); 192 ip6_local_out(skb); 193 percpu_write(tee_active, false); 194 } else { 195 kfree_skb(skb); 196 } 197 return XT_CONTINUE; 198 } 199 #endif /* WITH_IPV6 */ 200 201 static int tee_netdev_event(struct notifier_block *this, unsigned long event, 202 void *ptr) 203 { 204 struct net_device *dev = ptr; 205 struct xt_tee_priv *priv; 206 207 priv = container_of(this, struct xt_tee_priv, notifier); 208 switch (event) { 209 case NETDEV_REGISTER: 210 if (!strcmp(dev->name, priv->tginfo->oif)) 211 priv->oif = dev->ifindex; 212 break; 213 case NETDEV_UNREGISTER: 214 if (dev->ifindex == priv->oif) 215 priv->oif = -1; 216 break; 217 case NETDEV_CHANGENAME: 218 if (!strcmp(dev->name, priv->tginfo->oif)) 219 priv->oif = dev->ifindex; 220 else if (dev->ifindex == priv->oif) 221 priv->oif = -1; 222 break; 223 } 224 225 return NOTIFY_DONE; 226 } 227 228 static int tee_tg_check(const struct xt_tgchk_param *par) 229 { 230 struct xt_tee_tginfo *info = par->targinfo; 231 struct xt_tee_priv *priv; 232 233 /* 0.0.0.0 and :: not allowed */ 234 if (memcmp(&info->gw, &tee_zero_address, 235 sizeof(tee_zero_address)) == 0) 236 return -EINVAL; 237 238 if (info->oif[0]) { 239 if (info->oif[sizeof(info->oif)-1] != '\0') 240 return -EINVAL; 241 242 priv = kzalloc(sizeof(*priv), GFP_KERNEL); 243 if (priv == NULL) 244 return -ENOMEM; 245 246 priv->tginfo = info; 247 priv->oif = -1; 248 priv->notifier.notifier_call = tee_netdev_event; 249 info->priv = priv; 250 251 register_netdevice_notifier(&priv->notifier); 252 } else 253 info->priv = NULL; 254 255 return 0; 256 } 257 258 static void tee_tg_destroy(const struct xt_tgdtor_param *par) 259 { 260 struct xt_tee_tginfo *info = par->targinfo; 261 262 if (info->priv) { 263 unregister_netdevice_notifier(&info->priv->notifier); 264 kfree(info->priv); 265 } 266 } 267 268 static struct xt_target tee_tg_reg[] __read_mostly = { 269 { 270 .name = "TEE", 271 .revision = 1, 272 .family = NFPROTO_IPV4, 273 .target = tee_tg4, 274 .targetsize = sizeof(struct xt_tee_tginfo), 275 .checkentry = tee_tg_check, 276 .destroy = tee_tg_destroy, 277 .me = THIS_MODULE, 278 }, 279 #ifdef WITH_IPV6 280 { 281 .name = "TEE", 282 .revision = 1, 283 .family = NFPROTO_IPV6, 284 .target = tee_tg6, 285 .targetsize = sizeof(struct xt_tee_tginfo), 286 .checkentry = tee_tg_check, 287 .destroy = tee_tg_destroy, 288 .me = THIS_MODULE, 289 }, 290 #endif 291 }; 292 293 static int __init tee_tg_init(void) 294 { 295 return xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg)); 296 } 297 298 static void __exit tee_tg_exit(void) 299 { 300 xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg)); 301 } 302 303 module_init(tee_tg_init); 304 module_exit(tee_tg_exit); 305 MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>"); 306 MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>"); 307 MODULE_DESCRIPTION("Xtables: Reroute packet copy"); 308 MODULE_LICENSE("GPL"); 309 MODULE_ALIAS("ipt_TEE"); 310 MODULE_ALIAS("ip6t_TEE"); 311