xref: /openbmc/linux/net/sched/act_ipt.c (revision 89e33ea7)
1 /*
2  * net/sched/act_ipt.c		iptables target interface
3  *
4  *TODO: Add other tables. For now we only support the ipv4 table targets
5  *
6  *		This program is free software; you can redistribute it and/or
7  *		modify it under the terms of the GNU General Public License
8  *		as published by the Free Software Foundation; either version
9  *		2 of the License, or (at your option) any later version.
10  *
11  * Copyright:	Jamal Hadi Salim (2002-13)
12  */
13 
14 #include <linux/types.h>
15 #include <linux/kernel.h>
16 #include <linux/string.h>
17 #include <linux/errno.h>
18 #include <linux/skbuff.h>
19 #include <linux/rtnetlink.h>
20 #include <linux/module.h>
21 #include <linux/init.h>
22 #include <linux/slab.h>
23 #include <net/netlink.h>
24 #include <net/pkt_sched.h>
25 #include <linux/tc_act/tc_ipt.h>
26 #include <net/tc_act/tc_ipt.h>
27 
28 #include <linux/netfilter_ipv4/ip_tables.h>
29 
30 
31 static unsigned int ipt_net_id;
32 static struct tc_action_ops act_ipt_ops;
33 
34 static unsigned int xt_net_id;
35 static struct tc_action_ops act_xt_ops;
36 
37 static int ipt_init_target(struct net *net, struct xt_entry_target *t,
38 			   char *table, unsigned int hook)
39 {
40 	struct xt_tgchk_param par;
41 	struct xt_target *target;
42 	struct ipt_entry e = {};
43 	int ret = 0;
44 
45 	target = xt_request_find_target(AF_INET, t->u.user.name,
46 					t->u.user.revision);
47 	if (IS_ERR(target))
48 		return PTR_ERR(target);
49 
50 	t->u.kernel.target = target;
51 	memset(&par, 0, sizeof(par));
52 	par.net       = net;
53 	par.table     = table;
54 	par.entryinfo = &e;
55 	par.target    = target;
56 	par.targinfo  = t->data;
57 	par.hook_mask = hook;
58 	par.family    = NFPROTO_IPV4;
59 
60 	ret = xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false);
61 	if (ret < 0) {
62 		module_put(t->u.kernel.target->me);
63 		return ret;
64 	}
65 	return 0;
66 }
67 
68 static void ipt_destroy_target(struct xt_entry_target *t)
69 {
70 	struct xt_tgdtor_param par = {
71 		.target   = t->u.kernel.target,
72 		.targinfo = t->data,
73 		.family   = NFPROTO_IPV4,
74 	};
75 	if (par.target->destroy != NULL)
76 		par.target->destroy(&par);
77 	module_put(par.target->me);
78 }
79 
80 static void tcf_ipt_release(struct tc_action *a)
81 {
82 	struct tcf_ipt *ipt = to_ipt(a);
83 
84 	if (ipt->tcfi_t) {
85 		ipt_destroy_target(ipt->tcfi_t);
86 		kfree(ipt->tcfi_t);
87 	}
88 	kfree(ipt->tcfi_tname);
89 }
90 
91 static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = {
92 	[TCA_IPT_TABLE]	= { .type = NLA_STRING, .len = IFNAMSIZ },
93 	[TCA_IPT_HOOK]	= { .type = NLA_U32 },
94 	[TCA_IPT_INDEX]	= { .type = NLA_U32 },
95 	[TCA_IPT_TARG]	= { .len = sizeof(struct xt_entry_target) },
96 };
97 
98 static int __tcf_ipt_init(struct net *net, unsigned int id, struct nlattr *nla,
99 			  struct nlattr *est, struct tc_action **a,
100 			  const struct tc_action_ops *ops, int ovr, int bind)
101 {
102 	struct tc_action_net *tn = net_generic(net, id);
103 	struct nlattr *tb[TCA_IPT_MAX + 1];
104 	struct tcf_ipt *ipt;
105 	struct xt_entry_target *td, *t;
106 	char *tname;
107 	bool exists = false;
108 	int ret = 0, err;
109 	u32 hook = 0;
110 	u32 index = 0;
111 
112 	if (nla == NULL)
113 		return -EINVAL;
114 
115 	err = nla_parse_nested(tb, TCA_IPT_MAX, nla, ipt_policy, NULL);
116 	if (err < 0)
117 		return err;
118 
119 	if (tb[TCA_IPT_INDEX] != NULL)
120 		index = nla_get_u32(tb[TCA_IPT_INDEX]);
121 
122 	err = tcf_idr_check_alloc(tn, &index, a, bind);
123 	if (err < 0)
124 		return err;
125 	exists = err;
126 	if (exists && bind)
127 		return 0;
128 
129 	if (tb[TCA_IPT_HOOK] == NULL || tb[TCA_IPT_TARG] == NULL) {
130 		if (exists)
131 			tcf_idr_release(*a, bind);
132 		else
133 			tcf_idr_cleanup(tn, index);
134 		return -EINVAL;
135 	}
136 
137 	td = (struct xt_entry_target *)nla_data(tb[TCA_IPT_TARG]);
138 	if (nla_len(tb[TCA_IPT_TARG]) != td->u.target_size) {
139 		if (exists)
140 			tcf_idr_release(*a, bind);
141 		else
142 			tcf_idr_cleanup(tn, index);
143 		return -EINVAL;
144 	}
145 
146 	if (!exists) {
147 		ret = tcf_idr_create(tn, index, est, a, ops, bind,
148 				     false);
149 		if (ret) {
150 			tcf_idr_cleanup(tn, index);
151 			return ret;
152 		}
153 		ret = ACT_P_CREATED;
154 	} else {
155 		if (bind)/* dont override defaults */
156 			return 0;
157 
158 		if (!ovr) {
159 			tcf_idr_release(*a, bind);
160 			return -EEXIST;
161 		}
162 	}
163 	hook = nla_get_u32(tb[TCA_IPT_HOOK]);
164 
165 	err = -ENOMEM;
166 	tname = kmalloc(IFNAMSIZ, GFP_KERNEL);
167 	if (unlikely(!tname))
168 		goto err1;
169 	if (tb[TCA_IPT_TABLE] == NULL ||
170 	    nla_strlcpy(tname, tb[TCA_IPT_TABLE], IFNAMSIZ) >= IFNAMSIZ)
171 		strcpy(tname, "mangle");
172 
173 	t = kmemdup(td, td->u.target_size, GFP_KERNEL);
174 	if (unlikely(!t))
175 		goto err2;
176 
177 	err = ipt_init_target(net, t, tname, hook);
178 	if (err < 0)
179 		goto err3;
180 
181 	ipt = to_ipt(*a);
182 
183 	spin_lock_bh(&ipt->tcf_lock);
184 	if (ret != ACT_P_CREATED) {
185 		ipt_destroy_target(ipt->tcfi_t);
186 		kfree(ipt->tcfi_tname);
187 		kfree(ipt->tcfi_t);
188 	}
189 	ipt->tcfi_tname = tname;
190 	ipt->tcfi_t     = t;
191 	ipt->tcfi_hook  = hook;
192 	spin_unlock_bh(&ipt->tcf_lock);
193 	if (ret == ACT_P_CREATED)
194 		tcf_idr_insert(tn, *a);
195 	return ret;
196 
197 err3:
198 	kfree(t);
199 err2:
200 	kfree(tname);
201 err1:
202 	tcf_idr_release(*a, bind);
203 	return err;
204 }
205 
206 static int tcf_ipt_init(struct net *net, struct nlattr *nla,
207 			struct nlattr *est, struct tc_action **a, int ovr,
208 			int bind, bool rtnl_held,
209 			struct netlink_ext_ack *extack)
210 {
211 	return __tcf_ipt_init(net, ipt_net_id, nla, est, a, &act_ipt_ops, ovr,
212 			      bind);
213 }
214 
215 static int tcf_xt_init(struct net *net, struct nlattr *nla,
216 		       struct nlattr *est, struct tc_action **a, int ovr,
217 		       int bind, bool unlocked,
218 		       struct netlink_ext_ack *extack)
219 {
220 	return __tcf_ipt_init(net, xt_net_id, nla, est, a, &act_xt_ops, ovr,
221 			      bind);
222 }
223 
224 static int tcf_ipt_act(struct sk_buff *skb, const struct tc_action *a,
225 		       struct tcf_result *res)
226 {
227 	int ret = 0, result = 0;
228 	struct tcf_ipt *ipt = to_ipt(a);
229 	struct xt_action_param par;
230 	struct nf_hook_state state = {
231 		.net	= dev_net(skb->dev),
232 		.in	= skb->dev,
233 		.hook	= ipt->tcfi_hook,
234 		.pf	= NFPROTO_IPV4,
235 	};
236 
237 	if (skb_unclone(skb, GFP_ATOMIC))
238 		return TC_ACT_UNSPEC;
239 
240 	spin_lock(&ipt->tcf_lock);
241 
242 	tcf_lastuse_update(&ipt->tcf_tm);
243 	bstats_update(&ipt->tcf_bstats, skb);
244 
245 	/* yes, we have to worry about both in and out dev
246 	 * worry later - danger - this API seems to have changed
247 	 * from earlier kernels
248 	 */
249 	par.state    = &state;
250 	par.target   = ipt->tcfi_t->u.kernel.target;
251 	par.targinfo = ipt->tcfi_t->data;
252 	ret = par.target->target(skb, &par);
253 
254 	switch (ret) {
255 	case NF_ACCEPT:
256 		result = TC_ACT_OK;
257 		break;
258 	case NF_DROP:
259 		result = TC_ACT_SHOT;
260 		ipt->tcf_qstats.drops++;
261 		break;
262 	case XT_CONTINUE:
263 		result = TC_ACT_PIPE;
264 		break;
265 	default:
266 		net_notice_ratelimited("tc filter: Bogus netfilter code %d assume ACCEPT\n",
267 				       ret);
268 		result = TC_ACT_OK;
269 		break;
270 	}
271 	spin_unlock(&ipt->tcf_lock);
272 	return result;
273 
274 }
275 
276 static int tcf_ipt_dump(struct sk_buff *skb, struct tc_action *a, int bind,
277 			int ref)
278 {
279 	unsigned char *b = skb_tail_pointer(skb);
280 	struct tcf_ipt *ipt = to_ipt(a);
281 	struct xt_entry_target *t;
282 	struct tcf_t tm;
283 	struct tc_cnt c;
284 
285 	/* for simple targets kernel size == user size
286 	 * user name = target name
287 	 * for foolproof you need to not assume this
288 	 */
289 
290 	spin_lock_bh(&ipt->tcf_lock);
291 	t = kmemdup(ipt->tcfi_t, ipt->tcfi_t->u.user.target_size, GFP_ATOMIC);
292 	if (unlikely(!t))
293 		goto nla_put_failure;
294 
295 	c.bindcnt = atomic_read(&ipt->tcf_bindcnt) - bind;
296 	c.refcnt = refcount_read(&ipt->tcf_refcnt) - ref;
297 	strcpy(t->u.user.name, ipt->tcfi_t->u.kernel.target->name);
298 
299 	if (nla_put(skb, TCA_IPT_TARG, ipt->tcfi_t->u.user.target_size, t) ||
300 	    nla_put_u32(skb, TCA_IPT_INDEX, ipt->tcf_index) ||
301 	    nla_put_u32(skb, TCA_IPT_HOOK, ipt->tcfi_hook) ||
302 	    nla_put(skb, TCA_IPT_CNT, sizeof(struct tc_cnt), &c) ||
303 	    nla_put_string(skb, TCA_IPT_TABLE, ipt->tcfi_tname))
304 		goto nla_put_failure;
305 
306 	tcf_tm_dump(&tm, &ipt->tcf_tm);
307 	if (nla_put_64bit(skb, TCA_IPT_TM, sizeof(tm), &tm, TCA_IPT_PAD))
308 		goto nla_put_failure;
309 
310 	spin_unlock_bh(&ipt->tcf_lock);
311 	kfree(t);
312 	return skb->len;
313 
314 nla_put_failure:
315 	spin_unlock_bh(&ipt->tcf_lock);
316 	nlmsg_trim(skb, b);
317 	kfree(t);
318 	return -1;
319 }
320 
321 static int tcf_ipt_walker(struct net *net, struct sk_buff *skb,
322 			  struct netlink_callback *cb, int type,
323 			  const struct tc_action_ops *ops,
324 			  struct netlink_ext_ack *extack)
325 {
326 	struct tc_action_net *tn = net_generic(net, ipt_net_id);
327 
328 	return tcf_generic_walker(tn, skb, cb, type, ops, extack);
329 }
330 
331 static int tcf_ipt_search(struct net *net, struct tc_action **a, u32 index)
332 {
333 	struct tc_action_net *tn = net_generic(net, ipt_net_id);
334 
335 	return tcf_idr_search(tn, a, index);
336 }
337 
338 static struct tc_action_ops act_ipt_ops = {
339 	.kind		=	"ipt",
340 	.id		=	TCA_ID_IPT,
341 	.owner		=	THIS_MODULE,
342 	.act		=	tcf_ipt_act,
343 	.dump		=	tcf_ipt_dump,
344 	.cleanup	=	tcf_ipt_release,
345 	.init		=	tcf_ipt_init,
346 	.walk		=	tcf_ipt_walker,
347 	.lookup		=	tcf_ipt_search,
348 	.size		=	sizeof(struct tcf_ipt),
349 };
350 
351 static __net_init int ipt_init_net(struct net *net)
352 {
353 	struct tc_action_net *tn = net_generic(net, ipt_net_id);
354 
355 	return tc_action_net_init(tn, &act_ipt_ops);
356 }
357 
358 static void __net_exit ipt_exit_net(struct list_head *net_list)
359 {
360 	tc_action_net_exit(net_list, ipt_net_id);
361 }
362 
363 static struct pernet_operations ipt_net_ops = {
364 	.init = ipt_init_net,
365 	.exit_batch = ipt_exit_net,
366 	.id   = &ipt_net_id,
367 	.size = sizeof(struct tc_action_net),
368 };
369 
370 static int tcf_xt_walker(struct net *net, struct sk_buff *skb,
371 			 struct netlink_callback *cb, int type,
372 			 const struct tc_action_ops *ops,
373 			 struct netlink_ext_ack *extack)
374 {
375 	struct tc_action_net *tn = net_generic(net, xt_net_id);
376 
377 	return tcf_generic_walker(tn, skb, cb, type, ops, extack);
378 }
379 
380 static int tcf_xt_search(struct net *net, struct tc_action **a, u32 index)
381 {
382 	struct tc_action_net *tn = net_generic(net, xt_net_id);
383 
384 	return tcf_idr_search(tn, a, index);
385 }
386 
387 static struct tc_action_ops act_xt_ops = {
388 	.kind		=	"xt",
389 	.id		=	TCA_ID_XT,
390 	.owner		=	THIS_MODULE,
391 	.act		=	tcf_ipt_act,
392 	.dump		=	tcf_ipt_dump,
393 	.cleanup	=	tcf_ipt_release,
394 	.init		=	tcf_xt_init,
395 	.walk		=	tcf_xt_walker,
396 	.lookup		=	tcf_xt_search,
397 	.size		=	sizeof(struct tcf_ipt),
398 };
399 
400 static __net_init int xt_init_net(struct net *net)
401 {
402 	struct tc_action_net *tn = net_generic(net, xt_net_id);
403 
404 	return tc_action_net_init(tn, &act_xt_ops);
405 }
406 
407 static void __net_exit xt_exit_net(struct list_head *net_list)
408 {
409 	tc_action_net_exit(net_list, xt_net_id);
410 }
411 
412 static struct pernet_operations xt_net_ops = {
413 	.init = xt_init_net,
414 	.exit_batch = xt_exit_net,
415 	.id   = &xt_net_id,
416 	.size = sizeof(struct tc_action_net),
417 };
418 
419 MODULE_AUTHOR("Jamal Hadi Salim(2002-13)");
420 MODULE_DESCRIPTION("Iptables target actions");
421 MODULE_LICENSE("GPL");
422 MODULE_ALIAS("act_xt");
423 
424 static int __init ipt_init_module(void)
425 {
426 	int ret1, ret2;
427 
428 	ret1 = tcf_register_action(&act_xt_ops, &xt_net_ops);
429 	if (ret1 < 0)
430 		pr_err("Failed to load xt action\n");
431 
432 	ret2 = tcf_register_action(&act_ipt_ops, &ipt_net_ops);
433 	if (ret2 < 0)
434 		pr_err("Failed to load ipt action\n");
435 
436 	if (ret1 < 0 && ret2 < 0) {
437 		return ret1;
438 	} else
439 		return 0;
440 }
441 
442 static void __exit ipt_cleanup_module(void)
443 {
444 	tcf_unregister_action(&act_ipt_ops, &ipt_net_ops);
445 	tcf_unregister_action(&act_xt_ops, &xt_net_ops);
446 }
447 
448 module_init(ipt_init_module);
449 module_exit(ipt_cleanup_module);
450