net/sched/act_ipt.c

   1 /*
   2  * net/sched/ipt.c      iptables target interface
   3  *
   4  *TODO: Add other tables. For now we only support the ipv4 table targets
   5  *
   6  *              This program is free software; you can redistribute it and/or
   7  *              modify it under the terms of the GNU General Public License
   8  *              as published by the Free Software Foundation; either version
   9  *              2 of the License, or (at your option) any later version.
  10  *
  11  * Copyright:   Jamal Hadi Salim (2002-4)
  12  */
  13
  14 #include <asm/uaccess.h>
  15 #include <asm/system.h>
  16 #include <asm/bitops.h>
  17 #include <linux/types.h>
  18 #include <linux/kernel.h>
  19 #include <linux/sched.h>
  20 #include <linux/string.h>
  21 #include <linux/mm.h>
  22 #include <linux/socket.h>
  23 #include <linux/sockios.h>
  24 #include <linux/in.h>
  25 #include <linux/errno.h>
  26 #include <linux/interrupt.h>
  27 #include <linux/netdevice.h>
  28 #include <linux/skbuff.h>
  29 #include <linux/rtnetlink.h>
  30 #include <linux/module.h>
  31 #include <linux/init.h>
  32 #include <linux/proc_fs.h>
  33 #include <linux/kmod.h>
  34 #include <net/sock.h>
  35 #include <net/pkt_sched.h>
  36 #include <linux/tc_act/tc_ipt.h>
  37 #include <net/tc_act/tc_ipt.h>
  38
  39 #include <linux/netfilter_ipv4/ip_tables.h>
  40
  41 /* use generic hash table */
  42 #define MY_TAB_SIZE     16
  43 #define MY_TAB_MASK     15
  44
  45 static u32 idx_gen;
  46 static struct tcf_ipt *tcf_ipt_ht[MY_TAB_SIZE];
  47 /* ipt hash table lock */
  48 static DEFINE_RWLOCK(ipt_lock);
  49
  50 /* ovewrride the defaults */
  51 #define tcf_st          tcf_ipt
  52 #define tcf_t_lock      ipt_lock
  53 #define tcf_ht          tcf_ipt_ht
  54
  55 #define CONFIG_NET_ACT_INIT
  56 #include <net/pkt_act.h>
  57
  58 static int
  59 ipt_init_target(struct ipt_entry_target *t, char *table, unsigned int hook)
  60 {
  61         struct ipt_target *target;
  62         int ret = 0;
  63
  64         target = xt_find_target(AF_INET, t->u.user.name, t->u.user.revision);
  65         if (!target)
  66                 return -ENOENT;
  67
  68         DPRINTK("ipt_init_target: found %s\n", target->name);
  69         t->u.kernel.target = target;
  70
  71         ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
  72                               table, hook, 0, 0);
  73         if (ret)
  74                 return ret;
  75
  76         if (t->u.kernel.target->checkentry
  77             && !t->u.kernel.target->checkentry(table, NULL,
  78                                                t->u.kernel.target, t->data,
  79                                                t->u.target_size - sizeof(*t),
  80                                                hook)) {
  81                 DPRINTK("ipt_init_target: check failed for `%s'.\n",
  82                         t->u.kernel.target->name);
  83                 module_put(t->u.kernel.target->me);
  84                 ret = -EINVAL;
  85         }
  86
  87         return ret;
  88 }
  89
  90 static void
  91 ipt_destroy_target(struct ipt_entry_target *t)
  92 {
  93         if (t->u.kernel.target->destroy)
  94                 t->u.kernel.target->destroy(t->u.kernel.target, t->data,
  95                                             t->u.target_size - sizeof(*t));
  96         module_put(t->u.kernel.target->me);
  97 }
  98
  99 static int
 100 tcf_ipt_release(struct tcf_ipt *p, int bind)
 101 {
 102         int ret = 0;
 103         if (p) {
 104                 if (bind)
 105                         p->bindcnt--;
 106                 p->refcnt--;
 107                 if (p->bindcnt <= 0 && p->refcnt <= 0) {
 108                         ipt_destroy_target(p->t);
 109                         kfree(p->tname);
 110                         kfree(p->t);
 111                         tcf_hash_destroy(p);
 112                         ret = ACT_P_DELETED;
 113                 }
 114         }
 115         return ret;
 116 }
 117
 118 static int
 119 tcf_ipt_init(struct rtattr *rta, struct rtattr *est, struct tc_action *a,
 120              int ovr, int bind)
 121 {
 122         struct rtattr *tb[TCA_IPT_MAX];
 123         struct tcf_ipt *p;
 124         struct ipt_entry_target *td, *t;
 125         char *tname;
 126         int ret = 0, err;
 127         u32 hook = 0;
 128         u32 index = 0;
 129
 130         if (rta == NULL || rtattr_parse_nested(tb, TCA_IPT_MAX, rta) < 0)
 131                 return -EINVAL;
 132
 133         if (tb[TCA_IPT_HOOK-1] == NULL ||
 134             RTA_PAYLOAD(tb[TCA_IPT_HOOK-1]) < sizeof(u32))
 135                 return -EINVAL;
 136         if (tb[TCA_IPT_TARG-1] == NULL ||
 137             RTA_PAYLOAD(tb[TCA_IPT_TARG-1]) < sizeof(*t))
 138                 return -EINVAL;
 139         td = (struct ipt_entry_target *)RTA_DATA(tb[TCA_IPT_TARG-1]);
 140         if (RTA_PAYLOAD(tb[TCA_IPT_TARG-1]) < td->u.target_size)
 141                 return -EINVAL;
 142
 143         if (tb[TCA_IPT_INDEX-1] != NULL &&
 144             RTA_PAYLOAD(tb[TCA_IPT_INDEX-1]) >= sizeof(u32))
 145                 index = *(u32 *)RTA_DATA(tb[TCA_IPT_INDEX-1]);
 146
 147         p = tcf_hash_check(index, a, ovr, bind);
 148         if (p == NULL) {
 149                 p = tcf_hash_create(index, est, a, sizeof(*p), ovr, bind);
 150                 if (p == NULL)
 151                         return -ENOMEM;
 152                 ret = ACT_P_CREATED;
 153         } else {
 154                 if (!ovr) {
 155                         tcf_ipt_release(p, bind);
 156                         return -EEXIST;
 157                 }
 158         }
 159
 160         hook = *(u32 *)RTA_DATA(tb[TCA_IPT_HOOK-1]);
 161
 162         err = -ENOMEM;
 163         tname = kmalloc(IFNAMSIZ, GFP_KERNEL);
 164         if (tname == NULL)
 165                 goto err1;
 166         if (tb[TCA_IPT_TABLE - 1] == NULL ||
 167             rtattr_strlcpy(tname, tb[TCA_IPT_TABLE-1], IFNAMSIZ) >= IFNAMSIZ)
 168                 strcpy(tname, "mangle");
 169
 170         t = kmalloc(td->u.target_size, GFP_KERNEL);
 171         if (t == NULL)
 172                 goto err2;
 173         memcpy(t, td, td->u.target_size);
 174
 175         if ((err = ipt_init_target(t, tname, hook)) < 0)
 176                 goto err3;
 177
 178         spin_lock_bh(&p->lock);
 179         if (ret != ACT_P_CREATED) {
 180                 ipt_destroy_target(p->t);
 181                 kfree(p->tname);
 182                 kfree(p->t);
 183         }
 184         p->tname = tname;
 185         p->t     = t;
 186         p->hook  = hook;
 187         spin_unlock_bh(&p->lock);
 188         if (ret == ACT_P_CREATED)
 189                 tcf_hash_insert(p);
 190         return ret;
 191
 192 err3:
 193         kfree(t);
 194 err2:
 195         kfree(tname);
 196 err1:
 197         kfree(p);
 198         return err;
 199 }
 200
 201 static int
 202 tcf_ipt_cleanup(struct tc_action *a, int bind)
 203 {
 204         struct tcf_ipt *p = PRIV(a, ipt);
 205         return tcf_ipt_release(p, bind);
 206 }
 207
 208 static int
 209 tcf_ipt(struct sk_buff *skb, struct tc_action *a, struct tcf_result *res)
 210 {
 211         int ret = 0, result = 0;
 212         struct tcf_ipt *p = PRIV(a, ipt);
 213
 214         if (skb_cloned(skb)) {
 215                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 216                         return TC_ACT_UNSPEC;
 217         }
 218
 219         spin_lock(&p->lock);
 220
 221         p->tm.lastuse = jiffies;
 222         p->bstats.bytes += skb->len;
 223         p->bstats.packets++;
 224
 225         /* yes, we have to worry about both in and out dev
 226          worry later - danger - this API seems to have changed
 227          from earlier kernels */
 228
 229         /* iptables targets take a double skb pointer in case the skb
 230          * needs to be replaced. We don't own the skb, so this must not
 231          * happen. The pskb_expand_head above should make sure of this */
 232         ret = p->t->u.kernel.target->target(&skb, skb->dev, NULL, p->hook,
 233                                             p->t->u.kernel.target, p->t->data,
 234                                             NULL);
 235         switch (ret) {
 236         case NF_ACCEPT:
 237                 result = TC_ACT_OK;
 238                 break;
 239         case NF_DROP:
 240                 result = TC_ACT_SHOT;
 241                 p->qstats.drops++;
 242                 break;
 243         case IPT_CONTINUE:
 244                 result = TC_ACT_PIPE;
 245                 break;
 246         default:
 247                 if (net_ratelimit())
 248                         printk("Bogus netfilter code %d assume ACCEPT\n", ret);
 249                 result = TC_POLICE_OK;
 250                 break;
 251         }
 252         spin_unlock(&p->lock);
 253         return result;
 254
 255 }
 256
 257 static int
 258 tcf_ipt_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 259 {
 260         struct ipt_entry_target *t;
 261         struct tcf_t tm;
 262         struct tc_cnt c;
 263         unsigned char *b = skb->tail;
 264         struct tcf_ipt *p = PRIV(a, ipt);
 265
 266         /* for simple targets kernel size == user size
 267         ** user name = target name
 268         ** for foolproof you need to not assume this
 269         */
 270
 271         t = kmalloc(p->t->u.user.target_size, GFP_ATOMIC);
 272         if (t == NULL)
 273                 goto rtattr_failure;
 274
 275         c.bindcnt = p->bindcnt - bind;
 276         c.refcnt = p->refcnt - ref;
 277         memcpy(t, p->t, p->t->u.user.target_size);
 278         strcpy(t->u.user.name, p->t->u.kernel.target->name);
 279
 280         DPRINTK("\ttcf_ipt_dump tablename %s length %d\n", p->tname,
 281                 strlen(p->tname));
 282         DPRINTK("\tdump target name %s size %d size user %d "
 283                 "data[0] %x data[1] %x\n", p->t->u.kernel.target->name,
 284                 p->t->u.target_size, p->t->u.user.target_size,
 285                 p->t->data[0], p->t->data[1]);
 286         RTA_PUT(skb, TCA_IPT_TARG, p->t->u.user.target_size, t);
 287         RTA_PUT(skb, TCA_IPT_INDEX, 4, &p->index);
 288         RTA_PUT(skb, TCA_IPT_HOOK, 4, &p->hook);
 289         RTA_PUT(skb, TCA_IPT_CNT, sizeof(struct tc_cnt), &c);
 290         RTA_PUT(skb, TCA_IPT_TABLE, IFNAMSIZ, p->tname);
 291         tm.install = jiffies_to_clock_t(jiffies - p->tm.install);
 292         tm.lastuse = jiffies_to_clock_t(jiffies - p->tm.lastuse);
 293         tm.expires = jiffies_to_clock_t(p->tm.expires);
 294         RTA_PUT(skb, TCA_IPT_TM, sizeof (tm), &tm);
 295         kfree(t);
 296         return skb->len;
 297
 298       rtattr_failure:
 299         skb_trim(skb, b - skb->data);
 300         kfree(t);
 301         return -1;
 302 }
 303
 304 static struct tc_action_ops act_ipt_ops = {
 305         .kind           =       "ipt",
 306         .type           =       TCA_ACT_IPT,
 307         .capab          =       TCA_CAP_NONE,
 308         .owner          =       THIS_MODULE,
 309         .act            =       tcf_ipt,
 310         .dump           =       tcf_ipt_dump,
 311         .cleanup        =       tcf_ipt_cleanup,
 312         .lookup         =       tcf_hash_search,
 313         .init           =       tcf_ipt_init,
 314         .walk           =       tcf_generic_walker
 315 };
 316
 317 MODULE_AUTHOR("Jamal Hadi Salim(2002-4)");
 318 MODULE_DESCRIPTION("Iptables target actions");
 319 MODULE_LICENSE("GPL");
 320
 321 static int __init
 322 ipt_init_module(void)
 323 {
 324         return tcf_register_action(&act_ipt_ops);
 325 }
 326
 327 static void __exit
 328 ipt_cleanup_module(void)
 329 {
 330         tcf_unregister_action(&act_ipt_ops);
 331 }
 332
 333 module_init(ipt_init_module);
 334 module_exit(ipt_cleanup_module);