2 * "TEE" target extension for Xtables
3 * Copyright © Sebastian Claßen, 2007
4 * Jan Engelhardt, 2007-2010
6 * based on ipt_ROUTE.c from Cédric de Launois
7 * <delaunois@info.ucl.be>
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * version 2 or later, as published by the Free Software Foundation.
14 #include <linux/module.h>
15 #include <linux/percpu.h>
16 #include <linux/route.h>
17 #include <linux/skbuff.h>
18 #include <linux/notifier.h>
19 #include <net/checksum.h>
23 #include <net/ip6_route.h>
24 #include <net/route.h>
25 #include <linux/netfilter/x_tables.h>
26 #include <linux/netfilter/xt_TEE.h>
28 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
29 # define WITH_CONNTRACK 1
30 # include <net/netfilter/nf_conntrack.h>
34 struct notifier_block notifier
;
35 struct xt_tee_tginfo
*tginfo
;
39 static const union nf_inet_addr tee_zero_address
;
40 static DEFINE_PER_CPU(bool, tee_active
);
42 static struct net
*pick_net(struct sk_buff
*skb
)
45 const struct dst_entry
*dst
;
48 return dev_net(skb
->dev
);
50 if (dst
!= NULL
&& dst
->dev
!= NULL
)
51 return dev_net(dst
->dev
);
57 tee_tg_route4(struct sk_buff
*skb
, const struct xt_tee_tginfo
*info
)
59 const struct iphdr
*iph
= ip_hdr(skb
);
60 struct net
*net
= pick_net(skb
);
64 memset(&fl4
, 0, sizeof(fl4
));
66 if (info
->priv
->oif
== -1)
68 fl4
.flowi4_oif
= info
->priv
->oif
;
70 fl4
.daddr
= info
->gw
.ip
;
71 fl4
.flowi4_tos
= RT_TOS(iph
->tos
);
72 fl4
.flowi4_scope
= RT_SCOPE_UNIVERSE
;
73 fl4
.flowi4_flags
= FLOWI_FLAG_KNOWN_NH
;
74 rt
= ip_route_output_key(net
, &fl4
);
79 skb_dst_set(skb
, &rt
->dst
);
80 skb
->dev
= rt
->dst
.dev
;
81 skb
->protocol
= htons(ETH_P_IP
);
86 tee_tg4(struct sk_buff
*skb
, const struct xt_action_param
*par
)
88 const struct xt_tee_tginfo
*info
= par
->targinfo
;
91 if (__this_cpu_read(tee_active
))
94 * Copy the skb, and route the copy. Will later return %XT_CONTINUE for
95 * the original skb, which should continue on its way as if nothing has
96 * happened. The copy should be independently delivered to the TEE
99 skb
= pskb_copy(skb
, GFP_ATOMIC
);
103 #ifdef WITH_CONNTRACK
104 /* Avoid counting cloned packets towards the original connection. */
105 nf_conntrack_put(skb
->nfct
);
106 skb
->nfct
= &nf_ct_untracked_get()->ct_general
;
107 skb
->nfctinfo
= IP_CT_NEW
;
108 nf_conntrack_get(skb
->nfct
);
111 * If we are in PREROUTING/INPUT, the checksum must be recalculated
112 * since the length could have changed as a result of defragmentation.
114 * We also decrease the TTL to mitigate potential TEE loops
117 * Set %IP_DF so that the original source is notified of a potentially
118 * decreased MTU on the clone route. IPv6 does this too.
121 iph
->frag_off
|= htons(IP_DF
);
122 if (par
->hooknum
== NF_INET_PRE_ROUTING
||
123 par
->hooknum
== NF_INET_LOCAL_IN
)
127 if (tee_tg_route4(skb
, info
)) {
128 __this_cpu_write(tee_active
, true);
130 __this_cpu_write(tee_active
, false);
137 #if IS_ENABLED(CONFIG_IPV6)
139 tee_tg_route6(struct sk_buff
*skb
, const struct xt_tee_tginfo
*info
)
141 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
142 struct net
*net
= pick_net(skb
);
143 struct dst_entry
*dst
;
146 memset(&fl6
, 0, sizeof(fl6
));
148 if (info
->priv
->oif
== -1)
150 fl6
.flowi6_oif
= info
->priv
->oif
;
152 fl6
.daddr
= info
->gw
.in6
;
153 fl6
.flowlabel
= ((iph
->flow_lbl
[0] & 0xF) << 16) |
154 (iph
->flow_lbl
[1] << 8) | iph
->flow_lbl
[2];
155 dst
= ip6_route_output(net
, NULL
, &fl6
);
161 skb_dst_set(skb
, dst
);
163 skb
->protocol
= htons(ETH_P_IPV6
);
168 tee_tg6(struct sk_buff
*skb
, const struct xt_action_param
*par
)
170 const struct xt_tee_tginfo
*info
= par
->targinfo
;
172 if (__this_cpu_read(tee_active
))
174 skb
= pskb_copy(skb
, GFP_ATOMIC
);
178 #ifdef WITH_CONNTRACK
179 nf_conntrack_put(skb
->nfct
);
180 skb
->nfct
= &nf_ct_untracked_get()->ct_general
;
181 skb
->nfctinfo
= IP_CT_NEW
;
182 nf_conntrack_get(skb
->nfct
);
184 if (par
->hooknum
== NF_INET_PRE_ROUTING
||
185 par
->hooknum
== NF_INET_LOCAL_IN
) {
186 struct ipv6hdr
*iph
= ipv6_hdr(skb
);
189 if (tee_tg_route6(skb
, info
)) {
190 __this_cpu_write(tee_active
, true);
192 __this_cpu_write(tee_active
, false);
200 static int tee_netdev_event(struct notifier_block
*this, unsigned long event
,
203 struct net_device
*dev
= ptr
;
204 struct xt_tee_priv
*priv
;
206 priv
= container_of(this, struct xt_tee_priv
, notifier
);
208 case NETDEV_REGISTER
:
209 if (!strcmp(dev
->name
, priv
->tginfo
->oif
))
210 priv
->oif
= dev
->ifindex
;
212 case NETDEV_UNREGISTER
:
213 if (dev
->ifindex
== priv
->oif
)
216 case NETDEV_CHANGENAME
:
217 if (!strcmp(dev
->name
, priv
->tginfo
->oif
))
218 priv
->oif
= dev
->ifindex
;
219 else if (dev
->ifindex
== priv
->oif
)
227 static int tee_tg_check(const struct xt_tgchk_param
*par
)
229 struct xt_tee_tginfo
*info
= par
->targinfo
;
230 struct xt_tee_priv
*priv
;
232 /* 0.0.0.0 and :: not allowed */
233 if (memcmp(&info
->gw
, &tee_zero_address
,
234 sizeof(tee_zero_address
)) == 0)
238 if (info
->oif
[sizeof(info
->oif
)-1] != '\0')
241 priv
= kzalloc(sizeof(*priv
), GFP_KERNEL
);
247 priv
->notifier
.notifier_call
= tee_netdev_event
;
250 register_netdevice_notifier(&priv
->notifier
);
257 static void tee_tg_destroy(const struct xt_tgdtor_param
*par
)
259 struct xt_tee_tginfo
*info
= par
->targinfo
;
262 unregister_netdevice_notifier(&info
->priv
->notifier
);
267 static struct xt_target tee_tg_reg
[] __read_mostly
= {
271 .family
= NFPROTO_IPV4
,
273 .targetsize
= sizeof(struct xt_tee_tginfo
),
274 .checkentry
= tee_tg_check
,
275 .destroy
= tee_tg_destroy
,
278 #if IS_ENABLED(CONFIG_IPV6)
282 .family
= NFPROTO_IPV6
,
284 .targetsize
= sizeof(struct xt_tee_tginfo
),
285 .checkentry
= tee_tg_check
,
286 .destroy
= tee_tg_destroy
,
292 static int __init
tee_tg_init(void)
294 return xt_register_targets(tee_tg_reg
, ARRAY_SIZE(tee_tg_reg
));
297 static void __exit
tee_tg_exit(void)
299 xt_unregister_targets(tee_tg_reg
, ARRAY_SIZE(tee_tg_reg
));
302 module_init(tee_tg_init
);
303 module_exit(tee_tg_exit
);
304 MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>");
305 MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
306 MODULE_DESCRIPTION("Xtables: Reroute packet copy");
307 MODULE_LICENSE("GPL");
308 MODULE_ALIAS("ipt_TEE");
309 MODULE_ALIAS("ip6t_TEE");