[linux.git] / net / netfilter / xt_TEE.c

/*
 *	"TEE" target extension for Xtables
 *	Copyright © Sebastian Claßen, 2007
 *	Jan Engelhardt, 2007-2010
 *
 *	based on ipt_ROUTE.c from Cédric de Launois
 *	<[email protected]>
 *
 *	This program is free software; you can redistribute it and/or
 *	modify it under the terms of the GNU General Public License
 *	version 2 or later, as published by the Free Software Foundation.
 */
#include <linux/ip.h>
#include <linux/module.h>
#include <linux/percpu.h>
#include <linux/route.h>
#include <linux/skbuff.h>
#include <linux/notifier.h>
#include <net/checksum.h>
#include <net/icmp.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/ip6_route.h>
#include <net/route.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_TEE.h>

#if IS_ENABLED(CONFIG_NF_CONNTRACK)
#	define WITH_CONNTRACK 1
#	include <net/netfilter/nf_conntrack.h>
#endif

struct xt_tee_priv {
	struct notifier_block	notifier;
	struct xt_tee_tginfo	*tginfo;
	int			oif;
};

static const union nf_inet_addr tee_zero_address;
static DEFINE_PER_CPU(bool, tee_active);

static struct net *pick_net(struct sk_buff *skb)
{
#ifdef CONFIG_NET_NS
	const struct dst_entry *dst;

	if (skb->dev != NULL)
		return dev_net(skb->dev);
	dst = skb_dst(skb);
	if (dst != NULL && dst->dev != NULL)
		return dev_net(dst->dev);
#endif
	return &init_net;
}

static bool
tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info)
{
	const struct iphdr *iph = ip_hdr(skb);
	struct net *net = pick_net(skb);
	struct rtable *rt;
	struct flowi4 fl4;

	memset(&fl4, 0, sizeof(fl4));
	if (info->priv) {
		if (info->priv->oif == -1)
			return false;
		fl4.flowi4_oif = info->priv->oif;
	}
	fl4.daddr = info->gw.ip;
	fl4.flowi4_tos = RT_TOS(iph->tos);
	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
	fl4.flowi4_flags = FLOWI_FLAG_KNOWN_NH;
	rt = ip_route_output_key(net, &fl4);
	if (IS_ERR(rt))
		return false;

	skb_dst_drop(skb);
	skb_dst_set(skb, &rt->dst);
	skb->dev      = rt->dst.dev;
	skb->protocol = htons(ETH_P_IP);
	return true;
}

static unsigned int
tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct xt_tee_tginfo *info = par->targinfo;
	struct iphdr *iph;

	if (__this_cpu_read(tee_active))
		return XT_CONTINUE;
	/*
	 * Copy the skb, and route the copy. Will later return %XT_CONTINUE for
	 * the original skb, which should continue on its way as if nothing has
	 * happened. The copy should be independently delivered to the TEE
	 * --gateway.
	 */
	skb = pskb_copy(skb, GFP_ATOMIC);
	if (skb == NULL)
		return XT_CONTINUE;

#ifdef WITH_CONNTRACK
	/* Avoid counting cloned packets towards the original connection. */
	nf_conntrack_put(skb->nfct);
	skb->nfct     = &nf_ct_untracked_get()->ct_general;
	skb->nfctinfo = IP_CT_NEW;
	nf_conntrack_get(skb->nfct);
#endif
	/*
	 * If we are in PREROUTING/INPUT, the checksum must be recalculated
	 * since the length could have changed as a result of defragmentation.
	 *
	 * We also decrease the TTL to mitigate potential TEE loops
	 * between two hosts.
	 *
	 * Set %IP_DF so that the original source is notified of a potentially
	 * decreased MTU on the clone route. IPv6 does this too.
	 */
	iph = ip_hdr(skb);
	iph->frag_off |= htons(IP_DF);
	if (par->hooknum == NF_INET_PRE_ROUTING ||
	    par->hooknum == NF_INET_LOCAL_IN)
		--iph->ttl;
	ip_send_check(iph);

	if (tee_tg_route4(skb, info)) {
		__this_cpu_write(tee_active, true);
		ip_local_out(skb);
		__this_cpu_write(tee_active, false);
	} else {
		kfree_skb(skb);
	}
	return XT_CONTINUE;
}

#if IS_ENABLED(CONFIG_IPV6)
static bool
tee_tg_route6(struct sk_buff *skb, const struct xt_tee_tginfo *info)
{
	const struct ipv6hdr *iph = ipv6_hdr(skb);
	struct net *net = pick_net(skb);
	struct dst_entry *dst;
	struct flowi6 fl6;

	memset(&fl6, 0, sizeof(fl6));
	if (info->priv) {
		if (info->priv->oif == -1)
			return false;
		fl6.flowi6_oif = info->priv->oif;
	}
	fl6.daddr = info->gw.in6;
	fl6.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) |
			   (iph->flow_lbl[1] << 8) | iph->flow_lbl[2];
	dst = ip6_route_output(net, NULL, &fl6);
	if (dst->error) {
		dst_release(dst);
		return false;
	}
	skb_dst_drop(skb);
	skb_dst_set(skb, dst);
	skb->dev      = dst->dev;
	skb->protocol = htons(ETH_P_IPV6);
	return true;
}

static unsigned int
tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct xt_tee_tginfo *info = par->targinfo;

	if (__this_cpu_read(tee_active))
		return XT_CONTINUE;
	skb = pskb_copy(skb, GFP_ATOMIC);
	if (skb == NULL)
		return XT_CONTINUE;

#ifdef WITH_CONNTRACK
	nf_conntrack_put(skb->nfct);
	skb->nfct     = &nf_ct_untracked_get()->ct_general;
	skb->nfctinfo = IP_CT_NEW;
	nf_conntrack_get(skb->nfct);
#endif
	if (par->hooknum == NF_INET_PRE_ROUTING ||
	    par->hooknum == NF_INET_LOCAL_IN) {
		struct ipv6hdr *iph = ipv6_hdr(skb);
		--iph->hop_limit;
	}
	if (tee_tg_route6(skb, info)) {
		__this_cpu_write(tee_active, true);
		ip6_local_out(skb);
		__this_cpu_write(tee_active, false);
	} else {
		kfree_skb(skb);
	}
	return XT_CONTINUE;
}
#endif

static int tee_netdev_event(struct notifier_block *this, unsigned long event,
			    void *ptr)
{
	struct net_device *dev = ptr;
	struct xt_tee_priv *priv;

	priv = container_of(this, struct xt_tee_priv, notifier);
	switch (event) {
	case NETDEV_REGISTER:
		if (!strcmp(dev->name, priv->tginfo->oif))
			priv->oif = dev->ifindex;
		break;
	case NETDEV_UNREGISTER:
		if (dev->ifindex == priv->oif)
			priv->oif = -1;
		break;
	case NETDEV_CHANGENAME:
		if (!strcmp(dev->name, priv->tginfo->oif))
			priv->oif = dev->ifindex;
		else if (dev->ifindex == priv->oif)
			priv->oif = -1;
		break;
	}

	return NOTIFY_DONE;
}

static int tee_tg_check(const struct xt_tgchk_param *par)
{
	struct xt_tee_tginfo *info = par->targinfo;
	struct xt_tee_priv *priv;

	/* 0.0.0.0 and :: not allowed */
	if (memcmp(&info->gw, &tee_zero_address,
		   sizeof(tee_zero_address)) == 0)
		return -EINVAL;

	if (info->oif[0]) {
		if (info->oif[sizeof(info->oif)-1] != '\0')
			return -EINVAL;

		priv = kzalloc(sizeof(*priv), GFP_KERNEL);
		if (priv == NULL)
			return -ENOMEM;

		priv->tginfo  = info;
		priv->oif     = -1;
		priv->notifier.notifier_call = tee_netdev_event;
		info->priv    = priv;

		register_netdevice_notifier(&priv->notifier);
	} else
		info->priv = NULL;

	return 0;
}

static void tee_tg_destroy(const struct xt_tgdtor_param *par)
{
	struct xt_tee_tginfo *info = par->targinfo;

	if (info->priv) {
		unregister_netdevice_notifier(&info->priv->notifier);
		kfree(info->priv);
	}
}

static struct xt_target tee_tg_reg[] __read_mostly = {
	{
		.name       = "TEE",
		.revision   = 1,
		.family     = NFPROTO_IPV4,
		.target     = tee_tg4,
		.targetsize = sizeof(struct xt_tee_tginfo),
		.checkentry = tee_tg_check,
		.destroy    = tee_tg_destroy,
		.me         = THIS_MODULE,
	},
#if IS_ENABLED(CONFIG_IPV6)
	{
		.name       = "TEE",
		.revision   = 1,
		.family     = NFPROTO_IPV6,
		.target     = tee_tg6,
		.targetsize = sizeof(struct xt_tee_tginfo),
		.checkentry = tee_tg_check,
		.destroy    = tee_tg_destroy,
		.me         = THIS_MODULE,
	},
#endif
};

static int __init tee_tg_init(void)
{
	return xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
}

static void __exit tee_tg_exit(void)
{
	xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
}

module_init(tee_tg_init);
module_exit(tee_tg_exit);
MODULE_AUTHOR("Sebastian Claßen <[email protected]>");
MODULE_AUTHOR("Jan Engelhardt <[email protected]>");
MODULE_DESCRIPTION("Xtables: Reroute packet copy");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_TEE");
MODULE_ALIAS("ip6t_TEE");
Commit	Line	Data
e281b198 JE	1	/*
	2	* "TEE" target extension for Xtables
	3	* Copyright © Sebastian Claßen, 2007
	4	* Jan Engelhardt, 2007-2010
	5	*
	6	* based on ipt_ROUTE.c from Cédric de Launois
	7	* <[email protected]>
	8	*
	9	* This program is free software; you can redistribute it and/or
	10	* modify it under the terms of the GNU General Public License
	11	* version 2 or later, as published by the Free Software Foundation.
	12	*/
	13	#include <linux/ip.h>
	14	#include <linux/module.h>
cd58bcd9	15	#include <linux/percpu.h>
e281b198 JE	16	#include <linux/route.h>
e281b198 JE	17	#include <linux/skbuff.h>
22265a5c	18	#include <linux/notifier.h>
e281b198 JE	19	#include <net/checksum.h>
	20	#include <net/icmp.h>
	21	#include <net/ip.h>
	22	#include <net/ipv6.h>
	23	#include <net/ip6_route.h>
	24	#include <net/route.h>
	25	#include <linux/netfilter/x_tables.h>
	26	#include <linux/netfilter/xt_TEE.h>
	27
c0cd1156	28	#if IS_ENABLED(CONFIG_NF_CONNTRACK)
e281b198 JE	29	# define WITH_CONNTRACK 1
	30	# include <net/netfilter/nf_conntrack.h>
	31	#endif
e281b198	32
22265a5c PM	33	struct xt_tee_priv {
	34	struct notifier_block notifier;
	35	struct xt_tee_tginfo *tginfo;
	36	int oif;
	37	};
	38
e281b198	39	static const union nf_inet_addr tee_zero_address;
cd58bcd9	40	static DEFINE_PER_CPU(bool, tee_active);
e281b198 JE	41
	42	static struct net pick_net(struct sk_buff skb)
	43	{
	44	#ifdef CONFIG_NET_NS
	45	const struct dst_entry *dst;
	46
	47	if (skb->dev != NULL)
	48	return dev_net(skb->dev);
	49	dst = skb_dst(skb);
	50	if (dst != NULL && dst->dev != NULL)
	51	return dev_net(dst->dev);
	52	#endif
	53	return &init_net;
	54	}
	55
e281b198 JE	56	static bool
	57	tee_tg_route4(struct sk_buff skb, const struct xt_tee_tginfo info)
	58	{
	59	const struct iphdr *iph = ip_hdr(skb);
	60	struct net *net = pick_net(skb);
	61	struct rtable *rt;
9d6ec938	62	struct flowi4 fl4;
e281b198	63
9d6ec938	64	memset(&fl4, 0, sizeof(fl4));
22265a5c PM	65	if (info->priv) {
	66	if (info->priv->oif == -1)
	67	return false;
9d6ec938	68	fl4.flowi4_oif = info->priv->oif;
22265a5c	69	}
9d6ec938 DM	70	fl4.daddr = info->gw.ip;
	71	fl4.flowi4_tos = RT_TOS(iph->tos);
	72	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
2ad5b9e4	73	fl4.flowi4_flags = FLOWI_FLAG_KNOWN_NH;
9d6ec938	74	rt = ip_route_output_key(net, &fl4);
b23dd4fe	75	if (IS_ERR(rt))
e281b198 JE	76	return false;
e281b198 JE	77
50636af7	78	skb_dst_drop(skb);
d8d1f30b CG	79	skb_dst_set(skb, &rt->dst);
d8d1f30b CG	80	skb->dev = rt->dst.dev;
e281b198 JE	81	skb->protocol = htons(ETH_P_IP);
	82	return true;
	83	}
	84
	85	static unsigned int
4b560b44	86	tee_tg4(struct sk_buff skb, const struct xt_action_param par)
e281b198 JE	87	{
	88	const struct xt_tee_tginfo *info = par->targinfo;
	89	struct iphdr *iph;
	90
19e8d69c	91	if (__this_cpu_read(tee_active))
cd58bcd9	92	return XT_CONTINUE;
e281b198 JE	93	/*
	94	* Copy the skb, and route the copy. Will later return %XT_CONTINUE for
	95	* the original skb, which should continue on its way as if nothing has
	96	* happened. The copy should be independently delivered to the TEE
	97	* --gateway.
	98	*/
	99	skb = pskb_copy(skb, GFP_ATOMIC);
	100	if (skb == NULL)
	101	return XT_CONTINUE;
	102
	103	#ifdef WITH_CONNTRACK
	104	/* Avoid counting cloned packets towards the original connection. */
	105	nf_conntrack_put(skb->nfct);
5bfddbd4	106	skb->nfct = &nf_ct_untracked_get()->ct_general;
e281b198 JE	107	skb->nfctinfo = IP_CT_NEW;
	108	nf_conntrack_get(skb->nfct);
	109	#endif
	110	/*
	111	* If we are in PREROUTING/INPUT, the checksum must be recalculated
	112	* since the length could have changed as a result of defragmentation.
	113	*
	114	* We also decrease the TTL to mitigate potential TEE loops
	115	* between two hosts.
	116	*
	117	* Set %IP_DF so that the original source is notified of a potentially
	118	* decreased MTU on the clone route. IPv6 does this too.
	119	*/
	120	iph = ip_hdr(skb);
	121	iph->frag_off \|= htons(IP_DF);
	122	if (par->hooknum == NF_INET_PRE_ROUTING \|\|
	123	par->hooknum == NF_INET_LOCAL_IN)
	124	--iph->ttl;
	125	ip_send_check(iph);
	126
cd58bcd9	127	if (tee_tg_route4(skb, info)) {
19e8d69c	128	__this_cpu_write(tee_active, true);
cd58bcd9	129	ip_local_out(skb);
19e8d69c	130	__this_cpu_write(tee_active, false);
cd58bcd9	131	} else {
e281b198	132	kfree_skb(skb);
cd58bcd9	133	}
e281b198 JE	134	return XT_CONTINUE;
	135	}
	136
dfd56b8b	137	#if IS_ENABLED(CONFIG_IPV6)
e281b198 JE	138	static bool
	139	tee_tg_route6(struct sk_buff skb, const struct xt_tee_tginfo info)
	140	{
	141	const struct ipv6hdr *iph = ipv6_hdr(skb);
	142	struct net *net = pick_net(skb);
	143	struct dst_entry *dst;
4c9483b2	144	struct flowi6 fl6;
e281b198	145
4c9483b2	146	memset(&fl6, 0, sizeof(fl6));
22265a5c PM	147	if (info->priv) {
	148	if (info->priv->oif == -1)
	149	return false;
4c9483b2	150	fl6.flowi6_oif = info->priv->oif;
22265a5c	151	}
4c9483b2 DM	152	fl6.daddr = info->gw.in6;
4c9483b2 DM	153	fl6.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) \|
5811662b	154	(iph->flow_lbl[1] << 8) \| iph->flow_lbl[2];
4c9483b2	155	dst = ip6_route_output(net, NULL, &fl6);
5d38b1f8 RL	156	if (dst->error) {
5d38b1f8 RL	157	dst_release(dst);
e281b198	158	return false;
5d38b1f8	159	}
50636af7	160	skb_dst_drop(skb);
e281b198 JE	161	skb_dst_set(skb, dst);
	162	skb->dev = dst->dev;
	163	skb->protocol = htons(ETH_P_IPV6);
	164	return true;
	165	}
	166
	167	static unsigned int
4b560b44	168	tee_tg6(struct sk_buff skb, const struct xt_action_param par)
e281b198 JE	169	{
	170	const struct xt_tee_tginfo *info = par->targinfo;
	171
19e8d69c	172	if (__this_cpu_read(tee_active))
cd58bcd9	173	return XT_CONTINUE;
e281b198 JE	174	skb = pskb_copy(skb, GFP_ATOMIC);
	175	if (skb == NULL)
	176	return XT_CONTINUE;
	177
	178	#ifdef WITH_CONNTRACK
	179	nf_conntrack_put(skb->nfct);
5bfddbd4	180	skb->nfct = &nf_ct_untracked_get()->ct_general;
e281b198 JE	181	skb->nfctinfo = IP_CT_NEW;
	182	nf_conntrack_get(skb->nfct);
	183	#endif
	184	if (par->hooknum == NF_INET_PRE_ROUTING \|\|
	185	par->hooknum == NF_INET_LOCAL_IN) {
	186	struct ipv6hdr *iph = ipv6_hdr(skb);
	187	--iph->hop_limit;
	188	}
cd58bcd9	189	if (tee_tg_route6(skb, info)) {
19e8d69c	190	__this_cpu_write(tee_active, true);
cd58bcd9	191	ip6_local_out(skb);
19e8d69c	192	__this_cpu_write(tee_active, false);
cd58bcd9	193	} else {
e281b198	194	kfree_skb(skb);
cd58bcd9	195	}
e281b198 JE	196	return XT_CONTINUE;
e281b198 JE	197	}
dfd56b8b	198	#endif
e281b198	199
22265a5c PM	200	static int tee_netdev_event(struct notifier_block *this, unsigned long event,
	201	void *ptr)
	202	{
	203	struct net_device *dev = ptr;
	204	struct xt_tee_priv *priv;
	205
	206	priv = container_of(this, struct xt_tee_priv, notifier);
	207	switch (event) {
	208	case NETDEV_REGISTER:
	209	if (!strcmp(dev->name, priv->tginfo->oif))
	210	priv->oif = dev->ifindex;
	211	break;
	212	case NETDEV_UNREGISTER:
	213	if (dev->ifindex == priv->oif)
	214	priv->oif = -1;
	215	break;
	216	case NETDEV_CHANGENAME:
	217	if (!strcmp(dev->name, priv->tginfo->oif))
	218	priv->oif = dev->ifindex;
	219	else if (dev->ifindex == priv->oif)
	220	priv->oif = -1;
	221	break;
	222	}
	223
	224	return NOTIFY_DONE;
	225	}
	226
e281b198 JE	227	static int tee_tg_check(const struct xt_tgchk_param *par)
e281b198 JE	228	{
22265a5c PM	229	struct xt_tee_tginfo *info = par->targinfo;
22265a5c PM	230	struct xt_tee_priv *priv;
e281b198	231
e281b198	232	/* 0.0.0.0 and :: not allowed */
22265a5c PM	233	if (memcmp(&info->gw, &tee_zero_address,
	234	sizeof(tee_zero_address)) == 0)
	235	return -EINVAL;
	236
	237	if (info->oif[0]) {
	238	if (info->oif[sizeof(info->oif)-1] != '\0')
	239	return -EINVAL;
	240
	241	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
	242	if (priv == NULL)
	243	return -ENOMEM;
	244
	245	priv->tginfo = info;
	246	priv->oif = -1;
	247	priv->notifier.notifier_call = tee_netdev_event;
	248	info->priv = priv;
	249
	250	register_netdevice_notifier(&priv->notifier);
	251	} else
	252	info->priv = NULL;
	253
	254	return 0;
	255	}
	256
	257	static void tee_tg_destroy(const struct xt_tgdtor_param *par)
	258	{
	259	struct xt_tee_tginfo *info = par->targinfo;
	260
	261	if (info->priv) {
	262	unregister_netdevice_notifier(&info->priv->notifier);
	263	kfree(info->priv);
	264	}
e281b198 JE	265	}
	266
	267	static struct xt_target tee_tg_reg[] __read_mostly = {
	268	{
	269	.name = "TEE",
	270	.revision = 1,
	271	.family = NFPROTO_IPV4,
	272	.target = tee_tg4,
	273	.targetsize = sizeof(struct xt_tee_tginfo),
	274	.checkentry = tee_tg_check,
22265a5c	275	.destroy = tee_tg_destroy,
e281b198 JE	276	.me = THIS_MODULE,
e281b198 JE	277	},
dfd56b8b	278	#if IS_ENABLED(CONFIG_IPV6)
e281b198 JE	279	{
	280	.name = "TEE",
	281	.revision = 1,
	282	.family = NFPROTO_IPV6,
	283	.target = tee_tg6,
	284	.targetsize = sizeof(struct xt_tee_tginfo),
	285	.checkentry = tee_tg_check,
22265a5c	286	.destroy = tee_tg_destroy,
e281b198 JE	287	.me = THIS_MODULE,
	288	},
	289	#endif
	290	};
	291
	292	static int __init tee_tg_init(void)
	293	{
	294	return xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
	295	}
	296
	297	static void __exit tee_tg_exit(void)
	298	{
	299	xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
	300	}
	301
	302	module_init(tee_tg_init);
	303	module_exit(tee_tg_exit);
	304	MODULE_AUTHOR("Sebastian Claßen <[email protected]>");
	305	MODULE_AUTHOR("Jan Engelhardt <[email protected]>");
	306	MODULE_DESCRIPTION("Xtables: Reroute packet copy");
	307	MODULE_LICENSE("GPL");
	308	MODULE_ALIAS("ipt_TEE");
	309	MODULE_ALIAS("ip6t_TEE");