2 * "TEE" target extension for Xtables
3 * Copyright © Sebastian Claßen, 2007
4 * Jan Engelhardt, 2007-2010
6 * based on ipt_ROUTE.c from Cédric de Launois
7 * <delaunois@info.ucl.be>
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * version 2 or later, as published by the Free Software Foundation.
14 #include <linux/module.h>
15 #include <linux/percpu.h>
16 #include <linux/route.h>
17 #include <linux/skbuff.h>
18 #include <linux/notifier.h>
19 #include <net/checksum.h>
23 #include <net/ip6_route.h>
24 #include <net/route.h>
25 #include <linux/netfilter/x_tables.h>
26 #include <linux/netfilter/xt_TEE.h>
28 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
29 # define WITH_CONNTRACK 1
30 # include <net/netfilter/nf_conntrack.h>
34 struct notifier_block notifier
;
35 struct xt_tee_tginfo
*tginfo
;
39 static const union nf_inet_addr tee_zero_address
;
40 static DEFINE_PER_CPU(bool, tee_active
);
42 static struct net
*pick_net(struct sk_buff
*skb
)
45 const struct dst_entry
*dst
;
48 return dev_net(skb
->dev
);
50 if (dst
!= NULL
&& dst
->dev
!= NULL
)
51 return dev_net(dst
->dev
);
57 tee_tg_route4(struct sk_buff
*skb
, const struct xt_tee_tginfo
*info
)
59 const struct iphdr
*iph
= ip_hdr(skb
);
60 struct net
*net
= pick_net(skb
);
64 memset(&fl4
, 0, sizeof(fl4
));
66 if (info
->priv
->oif
== -1)
68 fl4
.flowi4_oif
= info
->priv
->oif
;
70 fl4
.daddr
= info
->gw
.ip
;
71 fl4
.flowi4_tos
= RT_TOS(iph
->tos
);
72 fl4
.flowi4_scope
= RT_SCOPE_UNIVERSE
;
73 rt
= ip_route_output_key(net
, &fl4
);
78 skb_dst_set(skb
, &rt
->dst
);
79 skb
->dev
= rt
->dst
.dev
;
80 skb
->protocol
= htons(ETH_P_IP
);
85 tee_tg4(struct sk_buff
*skb
, const struct xt_action_param
*par
)
87 const struct xt_tee_tginfo
*info
= par
->targinfo
;
90 if (percpu_read(tee_active
))
93 * Copy the skb, and route the copy. Will later return %XT_CONTINUE for
94 * the original skb, which should continue on its way as if nothing has
95 * happened. The copy should be independently delivered to the TEE
98 skb
= pskb_copy(skb
, GFP_ATOMIC
);
102 #ifdef WITH_CONNTRACK
103 /* Avoid counting cloned packets towards the original connection. */
104 nf_conntrack_put(skb
->nfct
);
105 skb
->nfct
= &nf_ct_untracked_get()->ct_general
;
106 skb
->nfctinfo
= IP_CT_NEW
;
107 nf_conntrack_get(skb
->nfct
);
110 * If we are in PREROUTING/INPUT, the checksum must be recalculated
111 * since the length could have changed as a result of defragmentation.
113 * We also decrease the TTL to mitigate potential TEE loops
116 * Set %IP_DF so that the original source is notified of a potentially
117 * decreased MTU on the clone route. IPv6 does this too.
120 iph
->frag_off
|= htons(IP_DF
);
121 if (par
->hooknum
== NF_INET_PRE_ROUTING
||
122 par
->hooknum
== NF_INET_LOCAL_IN
)
126 if (tee_tg_route4(skb
, info
)) {
127 percpu_write(tee_active
, true);
129 percpu_write(tee_active
, false);
136 #if IS_ENABLED(CONFIG_IPV6)
138 tee_tg_route6(struct sk_buff
*skb
, const struct xt_tee_tginfo
*info
)
140 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
141 struct net
*net
= pick_net(skb
);
142 struct dst_entry
*dst
;
145 memset(&fl6
, 0, sizeof(fl6
));
147 if (info
->priv
->oif
== -1)
149 fl6
.flowi6_oif
= info
->priv
->oif
;
151 fl6
.daddr
= info
->gw
.in6
;
152 fl6
.flowlabel
= ((iph
->flow_lbl
[0] & 0xF) << 16) |
153 (iph
->flow_lbl
[1] << 8) | iph
->flow_lbl
[2];
154 dst
= ip6_route_output(net
, NULL
, &fl6
);
159 skb_dst_set(skb
, dst
);
161 skb
->protocol
= htons(ETH_P_IPV6
);
166 tee_tg6(struct sk_buff
*skb
, const struct xt_action_param
*par
)
168 const struct xt_tee_tginfo
*info
= par
->targinfo
;
170 if (percpu_read(tee_active
))
172 skb
= pskb_copy(skb
, GFP_ATOMIC
);
176 #ifdef WITH_CONNTRACK
177 nf_conntrack_put(skb
->nfct
);
178 skb
->nfct
= &nf_ct_untracked_get()->ct_general
;
179 skb
->nfctinfo
= IP_CT_NEW
;
180 nf_conntrack_get(skb
->nfct
);
182 if (par
->hooknum
== NF_INET_PRE_ROUTING
||
183 par
->hooknum
== NF_INET_LOCAL_IN
) {
184 struct ipv6hdr
*iph
= ipv6_hdr(skb
);
187 if (tee_tg_route6(skb
, info
)) {
188 percpu_write(tee_active
, true);
190 percpu_write(tee_active
, false);
198 static int tee_netdev_event(struct notifier_block
*this, unsigned long event
,
201 struct net_device
*dev
= ptr
;
202 struct xt_tee_priv
*priv
;
204 priv
= container_of(this, struct xt_tee_priv
, notifier
);
206 case NETDEV_REGISTER
:
207 if (!strcmp(dev
->name
, priv
->tginfo
->oif
))
208 priv
->oif
= dev
->ifindex
;
210 case NETDEV_UNREGISTER
:
211 if (dev
->ifindex
== priv
->oif
)
214 case NETDEV_CHANGENAME
:
215 if (!strcmp(dev
->name
, priv
->tginfo
->oif
))
216 priv
->oif
= dev
->ifindex
;
217 else if (dev
->ifindex
== priv
->oif
)
225 static int tee_tg_check(const struct xt_tgchk_param
*par
)
227 struct xt_tee_tginfo
*info
= par
->targinfo
;
228 struct xt_tee_priv
*priv
;
230 /* 0.0.0.0 and :: not allowed */
231 if (memcmp(&info
->gw
, &tee_zero_address
,
232 sizeof(tee_zero_address
)) == 0)
236 if (info
->oif
[sizeof(info
->oif
)-1] != '\0')
239 priv
= kzalloc(sizeof(*priv
), GFP_KERNEL
);
245 priv
->notifier
.notifier_call
= tee_netdev_event
;
248 register_netdevice_notifier(&priv
->notifier
);
255 static void tee_tg_destroy(const struct xt_tgdtor_param
*par
)
257 struct xt_tee_tginfo
*info
= par
->targinfo
;
260 unregister_netdevice_notifier(&info
->priv
->notifier
);
265 static struct xt_target tee_tg_reg
[] __read_mostly
= {
269 .family
= NFPROTO_IPV4
,
271 .targetsize
= sizeof(struct xt_tee_tginfo
),
272 .checkentry
= tee_tg_check
,
273 .destroy
= tee_tg_destroy
,
276 #if IS_ENABLED(CONFIG_IPV6)
280 .family
= NFPROTO_IPV6
,
282 .targetsize
= sizeof(struct xt_tee_tginfo
),
283 .checkentry
= tee_tg_check
,
284 .destroy
= tee_tg_destroy
,
290 static int __init
tee_tg_init(void)
292 return xt_register_targets(tee_tg_reg
, ARRAY_SIZE(tee_tg_reg
));
295 static void __exit
tee_tg_exit(void)
297 xt_unregister_targets(tee_tg_reg
, ARRAY_SIZE(tee_tg_reg
));
300 module_init(tee_tg_init
);
301 module_exit(tee_tg_exit
);
302 MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>");
303 MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
304 MODULE_DESCRIPTION("Xtables: Reroute packet copy");
305 MODULE_LICENSE("GPL");
306 MODULE_ALIAS("ipt_TEE");
307 MODULE_ALIAS("ip6t_TEE");