1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * net/sched/em_ipt.c IPtables matches Ematch 4 * 5 * (c) 2018 Eyal Birger <eyal.birger@gmail.com> 6 */ 7 8 #include <linux/gfp.h> 9 #include <linux/module.h> 10 #include <linux/types.h> 11 #include <linux/kernel.h> 12 #include <linux/string.h> 13 #include <linux/skbuff.h> 14 #include <linux/tc_ematch/tc_em_ipt.h> 15 #include <linux/netfilter.h> 16 #include <linux/netfilter/x_tables.h> 17 #include <linux/netfilter_ipv4/ip_tables.h> 18 #include <linux/netfilter_ipv6/ip6_tables.h> 19 #include <net/pkt_cls.h> 20 21 struct em_ipt_match { 22 const struct xt_match *match; 23 u32 hook; 24 u8 match_data[0] __aligned(8); 25 }; 26 27 struct em_ipt_xt_match { 28 char *match_name; 29 int (*validate_match_data)(struct nlattr **tb, u8 mrev); 30 }; 31 32 static const struct nla_policy em_ipt_policy[TCA_EM_IPT_MAX + 1] = { 33 [TCA_EM_IPT_MATCH_NAME] = { .type = NLA_STRING, 34 .len = XT_EXTENSION_MAXNAMELEN }, 35 [TCA_EM_IPT_MATCH_REVISION] = { .type = NLA_U8 }, 36 [TCA_EM_IPT_HOOK] = { .type = NLA_U32 }, 37 [TCA_EM_IPT_NFPROTO] = { .type = NLA_U8 }, 38 [TCA_EM_IPT_MATCH_DATA] = { .type = NLA_UNSPEC }, 39 }; 40 41 static int check_match(struct net *net, struct em_ipt_match *im, int mdata_len) 42 { 43 struct xt_mtchk_param mtpar = {}; 44 union { 45 struct ipt_entry e4; 46 struct ip6t_entry e6; 47 } e = {}; 48 49 mtpar.net = net; 50 mtpar.table = "filter"; 51 mtpar.hook_mask = 1 << im->hook; 52 mtpar.family = im->match->family; 53 mtpar.match = im->match; 54 mtpar.entryinfo = &e; 55 mtpar.matchinfo = (void *)im->match_data; 56 return xt_check_match(&mtpar, mdata_len, 0, 0); 57 } 58 59 static int policy_validate_match_data(struct nlattr **tb, u8 mrev) 60 { 61 if (mrev != 0) { 62 pr_err("only policy match revision 0 supported"); 63 return -EINVAL; 64 } 65 66 if (nla_get_u32(tb[TCA_EM_IPT_HOOK]) != NF_INET_PRE_ROUTING) { 67 pr_err("policy can only be matched on NF_INET_PRE_ROUTING"); 68 return -EINVAL; 69 } 70 71 return 0; 72 } 73 74 static const struct em_ipt_xt_match em_ipt_xt_matches[] = { 75 { 76 .match_name = "policy", 77 .validate_match_data = policy_validate_match_data 78 }, 79 {} 80 }; 81 82 static struct xt_match *get_xt_match(struct nlattr **tb) 83 { 84 const struct em_ipt_xt_match *m; 85 struct nlattr *mname_attr; 86 u8 nfproto, mrev = 0; 87 int ret; 88 89 mname_attr = tb[TCA_EM_IPT_MATCH_NAME]; 90 for (m = em_ipt_xt_matches; m->match_name; m++) { 91 if (!nla_strcmp(mname_attr, m->match_name)) 92 break; 93 } 94 95 if (!m->match_name) { 96 pr_err("Unsupported xt match"); 97 return ERR_PTR(-EINVAL); 98 } 99 100 if (tb[TCA_EM_IPT_MATCH_REVISION]) 101 mrev = nla_get_u8(tb[TCA_EM_IPT_MATCH_REVISION]); 102 103 ret = m->validate_match_data(tb, mrev); 104 if (ret < 0) 105 return ERR_PTR(ret); 106 107 nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]); 108 return xt_request_find_match(nfproto, m->match_name, mrev); 109 } 110 111 static int em_ipt_change(struct net *net, void *data, int data_len, 112 struct tcf_ematch *em) 113 { 114 struct nlattr *tb[TCA_EM_IPT_MAX + 1]; 115 struct em_ipt_match *im = NULL; 116 struct xt_match *match; 117 int mdata_len, ret; 118 119 ret = nla_parse_deprecated(tb, TCA_EM_IPT_MAX, data, data_len, 120 em_ipt_policy, NULL); 121 if (ret < 0) 122 return ret; 123 124 if (!tb[TCA_EM_IPT_HOOK] || !tb[TCA_EM_IPT_MATCH_NAME] || 125 !tb[TCA_EM_IPT_MATCH_DATA] || !tb[TCA_EM_IPT_NFPROTO]) 126 return -EINVAL; 127 128 match = get_xt_match(tb); 129 if (IS_ERR(match)) { 130 pr_err("unable to load match\n"); 131 return PTR_ERR(match); 132 } 133 134 mdata_len = XT_ALIGN(nla_len(tb[TCA_EM_IPT_MATCH_DATA])); 135 im = kzalloc(sizeof(*im) + mdata_len, GFP_KERNEL); 136 if (!im) { 137 ret = -ENOMEM; 138 goto err; 139 } 140 141 im->match = match; 142 im->hook = nla_get_u32(tb[TCA_EM_IPT_HOOK]); 143 nla_memcpy(im->match_data, tb[TCA_EM_IPT_MATCH_DATA], mdata_len); 144 145 ret = check_match(net, im, mdata_len); 146 if (ret) 147 goto err; 148 149 em->datalen = sizeof(*im) + mdata_len; 150 em->data = (unsigned long)im; 151 return 0; 152 153 err: 154 kfree(im); 155 module_put(match->me); 156 return ret; 157 } 158 159 static void em_ipt_destroy(struct tcf_ematch *em) 160 { 161 struct em_ipt_match *im = (void *)em->data; 162 163 if (!im) 164 return; 165 166 if (im->match->destroy) { 167 struct xt_mtdtor_param par = { 168 .net = em->net, 169 .match = im->match, 170 .matchinfo = im->match_data, 171 .family = im->match->family 172 }; 173 im->match->destroy(&par); 174 } 175 module_put(im->match->me); 176 kfree((void *)im); 177 } 178 179 static int em_ipt_match(struct sk_buff *skb, struct tcf_ematch *em, 180 struct tcf_pkt_info *info) 181 { 182 const struct em_ipt_match *im = (const void *)em->data; 183 struct xt_action_param acpar = {}; 184 struct net_device *indev = NULL; 185 struct nf_hook_state state; 186 int ret; 187 188 switch (tc_skb_protocol(skb)) { 189 case htons(ETH_P_IP): 190 if (!pskb_network_may_pull(skb, sizeof(struct iphdr))) 191 return 0; 192 break; 193 case htons(ETH_P_IPV6): 194 if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr))) 195 return 0; 196 break; 197 default: 198 return 0; 199 } 200 201 rcu_read_lock(); 202 203 if (skb->skb_iif) 204 indev = dev_get_by_index_rcu(em->net, skb->skb_iif); 205 206 nf_hook_state_init(&state, im->hook, im->match->family, 207 indev ?: skb->dev, skb->dev, NULL, em->net, NULL); 208 209 acpar.match = im->match; 210 acpar.matchinfo = im->match_data; 211 acpar.state = &state; 212 213 ret = im->match->match(skb, &acpar); 214 215 rcu_read_unlock(); 216 return ret; 217 } 218 219 static int em_ipt_dump(struct sk_buff *skb, struct tcf_ematch *em) 220 { 221 struct em_ipt_match *im = (void *)em->data; 222 223 if (nla_put_string(skb, TCA_EM_IPT_MATCH_NAME, im->match->name) < 0) 224 return -EMSGSIZE; 225 if (nla_put_u32(skb, TCA_EM_IPT_HOOK, im->hook) < 0) 226 return -EMSGSIZE; 227 if (nla_put_u8(skb, TCA_EM_IPT_MATCH_REVISION, im->match->revision) < 0) 228 return -EMSGSIZE; 229 if (nla_put_u8(skb, TCA_EM_IPT_NFPROTO, im->match->family) < 0) 230 return -EMSGSIZE; 231 if (nla_put(skb, TCA_EM_IPT_MATCH_DATA, 232 im->match->usersize ?: im->match->matchsize, 233 im->match_data) < 0) 234 return -EMSGSIZE; 235 236 return 0; 237 } 238 239 static struct tcf_ematch_ops em_ipt_ops = { 240 .kind = TCF_EM_IPT, 241 .change = em_ipt_change, 242 .destroy = em_ipt_destroy, 243 .match = em_ipt_match, 244 .dump = em_ipt_dump, 245 .owner = THIS_MODULE, 246 .link = LIST_HEAD_INIT(em_ipt_ops.link) 247 }; 248 249 static int __init init_em_ipt(void) 250 { 251 return tcf_em_register(&em_ipt_ops); 252 } 253 254 static void __exit exit_em_ipt(void) 255 { 256 tcf_em_unregister(&em_ipt_ops); 257 } 258 259 MODULE_LICENSE("GPL"); 260 MODULE_AUTHOR("Eyal Birger <eyal.birger@gmail.com>"); 261 MODULE_DESCRIPTION("TC extended match for IPtables matches"); 262 263 module_init(init_em_ipt); 264 module_exit(exit_em_ipt); 265 266 MODULE_ALIAS_TCF_EMATCH(TCF_EM_IPT); 267