1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * net/sched/em_ipt.c IPtables matches Ematch 4 * 5 * (c) 2018 Eyal Birger <eyal.birger@gmail.com> 6 */ 7 8 #include <linux/gfp.h> 9 #include <linux/module.h> 10 #include <linux/types.h> 11 #include <linux/kernel.h> 12 #include <linux/string.h> 13 #include <linux/skbuff.h> 14 #include <linux/tc_ematch/tc_em_ipt.h> 15 #include <linux/netfilter.h> 16 #include <linux/netfilter/x_tables.h> 17 #include <linux/netfilter_ipv4/ip_tables.h> 18 #include <linux/netfilter_ipv6/ip6_tables.h> 19 #include <net/pkt_cls.h> 20 21 struct em_ipt_match { 22 const struct xt_match *match; 23 u32 hook; 24 u8 nfproto; 25 u8 match_data[] __aligned(8); 26 }; 27 28 struct em_ipt_xt_match { 29 char *match_name; 30 int (*validate_match_data)(struct nlattr **tb, u8 mrev); 31 }; 32 33 static const struct nla_policy em_ipt_policy[TCA_EM_IPT_MAX + 1] = { 34 [TCA_EM_IPT_MATCH_NAME] = { .type = NLA_STRING, 35 .len = XT_EXTENSION_MAXNAMELEN }, 36 [TCA_EM_IPT_MATCH_REVISION] = { .type = NLA_U8 }, 37 [TCA_EM_IPT_HOOK] = { .type = NLA_U32 }, 38 [TCA_EM_IPT_NFPROTO] = { .type = NLA_U8 }, 39 [TCA_EM_IPT_MATCH_DATA] = { .type = NLA_UNSPEC }, 40 }; 41 42 static int check_match(struct net *net, struct em_ipt_match *im, int mdata_len) 43 { 44 struct xt_mtchk_param mtpar = {}; 45 union { 46 struct ipt_entry e4; 47 struct ip6t_entry e6; 48 } e = {}; 49 50 mtpar.net = net; 51 mtpar.table = "filter"; 52 mtpar.hook_mask = 1 << im->hook; 53 mtpar.family = im->match->family; 54 mtpar.match = im->match; 55 mtpar.entryinfo = &e; 56 mtpar.matchinfo = (void *)im->match_data; 57 return xt_check_match(&mtpar, mdata_len, 0, 0); 58 } 59 60 static int policy_validate_match_data(struct nlattr **tb, u8 mrev) 61 { 62 if (mrev != 0) { 63 pr_err("only policy match revision 0 supported"); 64 return -EINVAL; 65 } 66 67 if (nla_get_u32(tb[TCA_EM_IPT_HOOK]) != NF_INET_PRE_ROUTING) { 68 pr_err("policy can only be matched on NF_INET_PRE_ROUTING"); 69 return -EINVAL; 70 } 71 72 return 0; 73 } 74 75 static int addrtype_validate_match_data(struct nlattr **tb, u8 mrev) 76 { 77 if (mrev != 1) { 78 pr_err("only addrtype match revision 1 supported"); 79 return -EINVAL; 80 } 81 82 return 0; 83 } 84 85 static const struct em_ipt_xt_match em_ipt_xt_matches[] = { 86 { 87 .match_name = "policy", 88 .validate_match_data = policy_validate_match_data 89 }, 90 { 91 .match_name = "addrtype", 92 .validate_match_data = addrtype_validate_match_data 93 }, 94 {} 95 }; 96 97 static struct xt_match *get_xt_match(struct nlattr **tb) 98 { 99 const struct em_ipt_xt_match *m; 100 struct nlattr *mname_attr; 101 u8 nfproto, mrev = 0; 102 int ret; 103 104 mname_attr = tb[TCA_EM_IPT_MATCH_NAME]; 105 for (m = em_ipt_xt_matches; m->match_name; m++) { 106 if (!nla_strcmp(mname_attr, m->match_name)) 107 break; 108 } 109 110 if (!m->match_name) { 111 pr_err("Unsupported xt match"); 112 return ERR_PTR(-EINVAL); 113 } 114 115 if (tb[TCA_EM_IPT_MATCH_REVISION]) 116 mrev = nla_get_u8(tb[TCA_EM_IPT_MATCH_REVISION]); 117 118 ret = m->validate_match_data(tb, mrev); 119 if (ret < 0) 120 return ERR_PTR(ret); 121 122 nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]); 123 return xt_request_find_match(nfproto, m->match_name, mrev); 124 } 125 126 static int em_ipt_change(struct net *net, void *data, int data_len, 127 struct tcf_ematch *em) 128 { 129 struct nlattr *tb[TCA_EM_IPT_MAX + 1]; 130 struct em_ipt_match *im = NULL; 131 struct xt_match *match; 132 int mdata_len, ret; 133 u8 nfproto; 134 135 ret = nla_parse_deprecated(tb, TCA_EM_IPT_MAX, data, data_len, 136 em_ipt_policy, NULL); 137 if (ret < 0) 138 return ret; 139 140 if (!tb[TCA_EM_IPT_HOOK] || !tb[TCA_EM_IPT_MATCH_NAME] || 141 !tb[TCA_EM_IPT_MATCH_DATA] || !tb[TCA_EM_IPT_NFPROTO]) 142 return -EINVAL; 143 144 nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]); 145 switch (nfproto) { 146 case NFPROTO_IPV4: 147 case NFPROTO_IPV6: 148 break; 149 default: 150 return -EINVAL; 151 } 152 153 match = get_xt_match(tb); 154 if (IS_ERR(match)) { 155 pr_err("unable to load match\n"); 156 return PTR_ERR(match); 157 } 158 159 mdata_len = XT_ALIGN(nla_len(tb[TCA_EM_IPT_MATCH_DATA])); 160 im = kzalloc(sizeof(*im) + mdata_len, GFP_KERNEL); 161 if (!im) { 162 ret = -ENOMEM; 163 goto err; 164 } 165 166 im->match = match; 167 im->hook = nla_get_u32(tb[TCA_EM_IPT_HOOK]); 168 im->nfproto = nfproto; 169 nla_memcpy(im->match_data, tb[TCA_EM_IPT_MATCH_DATA], mdata_len); 170 171 ret = check_match(net, im, mdata_len); 172 if (ret) 173 goto err; 174 175 em->datalen = sizeof(*im) + mdata_len; 176 em->data = (unsigned long)im; 177 return 0; 178 179 err: 180 kfree(im); 181 module_put(match->me); 182 return ret; 183 } 184 185 static void em_ipt_destroy(struct tcf_ematch *em) 186 { 187 struct em_ipt_match *im = (void *)em->data; 188 189 if (!im) 190 return; 191 192 if (im->match->destroy) { 193 struct xt_mtdtor_param par = { 194 .net = em->net, 195 .match = im->match, 196 .matchinfo = im->match_data, 197 .family = im->match->family 198 }; 199 im->match->destroy(&par); 200 } 201 module_put(im->match->me); 202 kfree(im); 203 } 204 205 static int em_ipt_match(struct sk_buff *skb, struct tcf_ematch *em, 206 struct tcf_pkt_info *info) 207 { 208 const struct em_ipt_match *im = (const void *)em->data; 209 struct xt_action_param acpar = {}; 210 struct net_device *indev = NULL; 211 u8 nfproto = im->match->family; 212 struct nf_hook_state state; 213 int ret; 214 215 switch (skb_protocol(skb, true)) { 216 case htons(ETH_P_IP): 217 if (!pskb_network_may_pull(skb, sizeof(struct iphdr))) 218 return 0; 219 if (nfproto == NFPROTO_UNSPEC) 220 nfproto = NFPROTO_IPV4; 221 break; 222 case htons(ETH_P_IPV6): 223 if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr))) 224 return 0; 225 if (nfproto == NFPROTO_UNSPEC) 226 nfproto = NFPROTO_IPV6; 227 break; 228 default: 229 return 0; 230 } 231 232 rcu_read_lock(); 233 234 if (skb->skb_iif) 235 indev = dev_get_by_index_rcu(em->net, skb->skb_iif); 236 237 nf_hook_state_init(&state, im->hook, nfproto, 238 indev ?: skb->dev, skb->dev, NULL, em->net, NULL); 239 240 acpar.match = im->match; 241 acpar.matchinfo = im->match_data; 242 acpar.state = &state; 243 244 ret = im->match->match(skb, &acpar); 245 246 rcu_read_unlock(); 247 return ret; 248 } 249 250 static int em_ipt_dump(struct sk_buff *skb, struct tcf_ematch *em) 251 { 252 struct em_ipt_match *im = (void *)em->data; 253 254 if (nla_put_string(skb, TCA_EM_IPT_MATCH_NAME, im->match->name) < 0) 255 return -EMSGSIZE; 256 if (nla_put_u32(skb, TCA_EM_IPT_HOOK, im->hook) < 0) 257 return -EMSGSIZE; 258 if (nla_put_u8(skb, TCA_EM_IPT_MATCH_REVISION, im->match->revision) < 0) 259 return -EMSGSIZE; 260 if (nla_put_u8(skb, TCA_EM_IPT_NFPROTO, im->nfproto) < 0) 261 return -EMSGSIZE; 262 if (nla_put(skb, TCA_EM_IPT_MATCH_DATA, 263 im->match->usersize ?: im->match->matchsize, 264 im->match_data) < 0) 265 return -EMSGSIZE; 266 267 return 0; 268 } 269 270 static struct tcf_ematch_ops em_ipt_ops = { 271 .kind = TCF_EM_IPT, 272 .change = em_ipt_change, 273 .destroy = em_ipt_destroy, 274 .match = em_ipt_match, 275 .dump = em_ipt_dump, 276 .owner = THIS_MODULE, 277 .link = LIST_HEAD_INIT(em_ipt_ops.link) 278 }; 279 280 static int __init init_em_ipt(void) 281 { 282 return tcf_em_register(&em_ipt_ops); 283 } 284 285 static void __exit exit_em_ipt(void) 286 { 287 tcf_em_unregister(&em_ipt_ops); 288 } 289 290 MODULE_LICENSE("GPL"); 291 MODULE_AUTHOR("Eyal Birger <eyal.birger@gmail.com>"); 292 MODULE_DESCRIPTION("TC extended match for IPtables matches"); 293 294 module_init(init_em_ipt); 295 module_exit(exit_em_ipt); 296 297 MODULE_ALIAS_TCF_EMATCH(TCF_EM_IPT); 298