2 * net/sched/act_ipt.c iptables target interface
4 *TODO: Add other tables. For now we only support the ipv4 table targets
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
11 * Copyright: Jamal Hadi Salim (2002-13)
14 #include <linux/types.h>
15 #include <linux/kernel.h>
16 #include <linux/string.h>
17 #include <linux/errno.h>
18 #include <linux/skbuff.h>
19 #include <linux/rtnetlink.h>
20 #include <linux/module.h>
21 #include <linux/init.h>
22 #include <linux/slab.h>
23 #include <net/netlink.h>
24 #include <net/pkt_sched.h>
25 #include <linux/tc_act/tc_ipt.h>
26 #include <net/tc_act/tc_ipt.h>
28 #include <linux/netfilter_ipv4/ip_tables.h>
31 static unsigned int ipt_net_id
;
32 static struct tc_action_ops act_ipt_ops
;
34 static unsigned int xt_net_id
;
35 static struct tc_action_ops act_xt_ops
;
37 static int ipt_init_target(struct net
*net
, struct xt_entry_target
*t
,
38 char *table
, unsigned int hook
)
40 struct xt_tgchk_param par
;
41 struct xt_target
*target
;
42 struct ipt_entry e
= {};
45 target
= xt_request_find_target(AF_INET
, t
->u
.user
.name
,
48 return PTR_ERR(target
);
50 t
->u
.kernel
.target
= target
;
51 memset(&par
, 0, sizeof(par
));
56 par
.targinfo
= t
->data
;
58 par
.family
= NFPROTO_IPV4
;
60 ret
= xt_check_target(&par
, t
->u
.target_size
- sizeof(*t
), 0, false);
62 module_put(t
->u
.kernel
.target
->me
);
68 static void ipt_destroy_target(struct xt_entry_target
*t
)
70 struct xt_tgdtor_param par
= {
71 .target
= t
->u
.kernel
.target
,
73 .family
= NFPROTO_IPV4
,
75 if (par
.target
->destroy
!= NULL
)
76 par
.target
->destroy(&par
);
77 module_put(par
.target
->me
);
80 static void tcf_ipt_release(struct tc_action
*a
)
82 struct tcf_ipt
*ipt
= to_ipt(a
);
85 ipt_destroy_target(ipt
->tcfi_t
);
88 kfree(ipt
->tcfi_tname
);
91 static const struct nla_policy ipt_policy
[TCA_IPT_MAX
+ 1] = {
92 [TCA_IPT_TABLE
] = { .type
= NLA_STRING
, .len
= IFNAMSIZ
},
93 [TCA_IPT_HOOK
] = { .type
= NLA_U32
},
94 [TCA_IPT_INDEX
] = { .type
= NLA_U32
},
95 [TCA_IPT_TARG
] = { .len
= sizeof(struct xt_entry_target
) },
98 static int __tcf_ipt_init(struct net
*net
, unsigned int id
, struct nlattr
*nla
,
99 struct nlattr
*est
, struct tc_action
**a
,
100 const struct tc_action_ops
*ops
, int ovr
, int bind
)
102 struct tc_action_net
*tn
= net_generic(net
, id
);
103 struct nlattr
*tb
[TCA_IPT_MAX
+ 1];
105 struct xt_entry_target
*td
, *t
;
115 err
= nla_parse_nested(tb
, TCA_IPT_MAX
, nla
, ipt_policy
, NULL
);
119 if (tb
[TCA_IPT_INDEX
] != NULL
)
120 index
= nla_get_u32(tb
[TCA_IPT_INDEX
]);
122 err
= tcf_idr_check_alloc(tn
, &index
, a
, bind
);
129 if (tb
[TCA_IPT_HOOK
] == NULL
|| tb
[TCA_IPT_TARG
] == NULL
) {
131 tcf_idr_release(*a
, bind
);
133 tcf_idr_cleanup(tn
, index
);
137 td
= (struct xt_entry_target
*)nla_data(tb
[TCA_IPT_TARG
]);
138 if (nla_len(tb
[TCA_IPT_TARG
]) != td
->u
.target_size
) {
140 tcf_idr_release(*a
, bind
);
142 tcf_idr_cleanup(tn
, index
);
147 ret
= tcf_idr_create(tn
, index
, est
, a
, ops
, bind
,
150 tcf_idr_cleanup(tn
, index
);
155 if (bind
)/* dont override defaults */
159 tcf_idr_release(*a
, bind
);
163 hook
= nla_get_u32(tb
[TCA_IPT_HOOK
]);
166 tname
= kmalloc(IFNAMSIZ
, GFP_KERNEL
);
167 if (unlikely(!tname
))
169 if (tb
[TCA_IPT_TABLE
] == NULL
||
170 nla_strlcpy(tname
, tb
[TCA_IPT_TABLE
], IFNAMSIZ
) >= IFNAMSIZ
)
171 strcpy(tname
, "mangle");
173 t
= kmemdup(td
, td
->u
.target_size
, GFP_KERNEL
);
177 err
= ipt_init_target(net
, t
, tname
, hook
);
183 spin_lock_bh(&ipt
->tcf_lock
);
184 if (ret
!= ACT_P_CREATED
) {
185 ipt_destroy_target(ipt
->tcfi_t
);
186 kfree(ipt
->tcfi_tname
);
189 ipt
->tcfi_tname
= tname
;
191 ipt
->tcfi_hook
= hook
;
192 spin_unlock_bh(&ipt
->tcf_lock
);
193 if (ret
== ACT_P_CREATED
)
194 tcf_idr_insert(tn
, *a
);
202 tcf_idr_release(*a
, bind
);
206 static int tcf_ipt_init(struct net
*net
, struct nlattr
*nla
,
207 struct nlattr
*est
, struct tc_action
**a
, int ovr
,
208 int bind
, bool rtnl_held
,
209 struct netlink_ext_ack
*extack
)
211 return __tcf_ipt_init(net
, ipt_net_id
, nla
, est
, a
, &act_ipt_ops
, ovr
,
215 static int tcf_xt_init(struct net
*net
, struct nlattr
*nla
,
216 struct nlattr
*est
, struct tc_action
**a
, int ovr
,
217 int bind
, bool unlocked
,
218 struct netlink_ext_ack
*extack
)
220 return __tcf_ipt_init(net
, xt_net_id
, nla
, est
, a
, &act_xt_ops
, ovr
,
224 static int tcf_ipt_act(struct sk_buff
*skb
, const struct tc_action
*a
,
225 struct tcf_result
*res
)
227 int ret
= 0, result
= 0;
228 struct tcf_ipt
*ipt
= to_ipt(a
);
229 struct xt_action_param par
;
230 struct nf_hook_state state
= {
231 .net
= dev_net(skb
->dev
),
233 .hook
= ipt
->tcfi_hook
,
237 if (skb_unclone(skb
, GFP_ATOMIC
))
238 return TC_ACT_UNSPEC
;
240 spin_lock(&ipt
->tcf_lock
);
242 tcf_lastuse_update(&ipt
->tcf_tm
);
243 bstats_update(&ipt
->tcf_bstats
, skb
);
245 /* yes, we have to worry about both in and out dev
246 * worry later - danger - this API seems to have changed
247 * from earlier kernels
250 par
.target
= ipt
->tcfi_t
->u
.kernel
.target
;
251 par
.targinfo
= ipt
->tcfi_t
->data
;
252 ret
= par
.target
->target(skb
, &par
);
259 result
= TC_ACT_SHOT
;
260 ipt
->tcf_qstats
.drops
++;
263 result
= TC_ACT_PIPE
;
266 net_notice_ratelimited("tc filter: Bogus netfilter code %d assume ACCEPT\n",
271 spin_unlock(&ipt
->tcf_lock
);
276 static int tcf_ipt_dump(struct sk_buff
*skb
, struct tc_action
*a
, int bind
,
279 unsigned char *b
= skb_tail_pointer(skb
);
280 struct tcf_ipt
*ipt
= to_ipt(a
);
281 struct xt_entry_target
*t
;
285 /* for simple targets kernel size == user size
286 * user name = target name
287 * for foolproof you need to not assume this
290 spin_lock_bh(&ipt
->tcf_lock
);
291 t
= kmemdup(ipt
->tcfi_t
, ipt
->tcfi_t
->u
.user
.target_size
, GFP_ATOMIC
);
293 goto nla_put_failure
;
295 c
.bindcnt
= atomic_read(&ipt
->tcf_bindcnt
) - bind
;
296 c
.refcnt
= refcount_read(&ipt
->tcf_refcnt
) - ref
;
297 strcpy(t
->u
.user
.name
, ipt
->tcfi_t
->u
.kernel
.target
->name
);
299 if (nla_put(skb
, TCA_IPT_TARG
, ipt
->tcfi_t
->u
.user
.target_size
, t
) ||
300 nla_put_u32(skb
, TCA_IPT_INDEX
, ipt
->tcf_index
) ||
301 nla_put_u32(skb
, TCA_IPT_HOOK
, ipt
->tcfi_hook
) ||
302 nla_put(skb
, TCA_IPT_CNT
, sizeof(struct tc_cnt
), &c
) ||
303 nla_put_string(skb
, TCA_IPT_TABLE
, ipt
->tcfi_tname
))
304 goto nla_put_failure
;
306 tcf_tm_dump(&tm
, &ipt
->tcf_tm
);
307 if (nla_put_64bit(skb
, TCA_IPT_TM
, sizeof(tm
), &tm
, TCA_IPT_PAD
))
308 goto nla_put_failure
;
310 spin_unlock_bh(&ipt
->tcf_lock
);
315 spin_unlock_bh(&ipt
->tcf_lock
);
321 static int tcf_ipt_walker(struct net
*net
, struct sk_buff
*skb
,
322 struct netlink_callback
*cb
, int type
,
323 const struct tc_action_ops
*ops
,
324 struct netlink_ext_ack
*extack
)
326 struct tc_action_net
*tn
= net_generic(net
, ipt_net_id
);
328 return tcf_generic_walker(tn
, skb
, cb
, type
, ops
, extack
);
331 static int tcf_ipt_search(struct net
*net
, struct tc_action
**a
, u32 index
)
333 struct tc_action_net
*tn
= net_generic(net
, ipt_net_id
);
335 return tcf_idr_search(tn
, a
, index
);
338 static struct tc_action_ops act_ipt_ops
= {
341 .owner
= THIS_MODULE
,
343 .dump
= tcf_ipt_dump
,
344 .cleanup
= tcf_ipt_release
,
345 .init
= tcf_ipt_init
,
346 .walk
= tcf_ipt_walker
,
347 .lookup
= tcf_ipt_search
,
348 .size
= sizeof(struct tcf_ipt
),
351 static __net_init
int ipt_init_net(struct net
*net
)
353 struct tc_action_net
*tn
= net_generic(net
, ipt_net_id
);
355 return tc_action_net_init(tn
, &act_ipt_ops
);
358 static void __net_exit
ipt_exit_net(struct list_head
*net_list
)
360 tc_action_net_exit(net_list
, ipt_net_id
);
363 static struct pernet_operations ipt_net_ops
= {
364 .init
= ipt_init_net
,
365 .exit_batch
= ipt_exit_net
,
367 .size
= sizeof(struct tc_action_net
),
370 static int tcf_xt_walker(struct net
*net
, struct sk_buff
*skb
,
371 struct netlink_callback
*cb
, int type
,
372 const struct tc_action_ops
*ops
,
373 struct netlink_ext_ack
*extack
)
375 struct tc_action_net
*tn
= net_generic(net
, xt_net_id
);
377 return tcf_generic_walker(tn
, skb
, cb
, type
, ops
, extack
);
380 static int tcf_xt_search(struct net
*net
, struct tc_action
**a
, u32 index
)
382 struct tc_action_net
*tn
= net_generic(net
, xt_net_id
);
384 return tcf_idr_search(tn
, a
, index
);
387 static struct tc_action_ops act_xt_ops
= {
390 .owner
= THIS_MODULE
,
392 .dump
= tcf_ipt_dump
,
393 .cleanup
= tcf_ipt_release
,
395 .walk
= tcf_xt_walker
,
396 .lookup
= tcf_xt_search
,
397 .size
= sizeof(struct tcf_ipt
),
400 static __net_init
int xt_init_net(struct net
*net
)
402 struct tc_action_net
*tn
= net_generic(net
, xt_net_id
);
404 return tc_action_net_init(tn
, &act_xt_ops
);
407 static void __net_exit
xt_exit_net(struct list_head
*net_list
)
409 tc_action_net_exit(net_list
, xt_net_id
);
412 static struct pernet_operations xt_net_ops
= {
414 .exit_batch
= xt_exit_net
,
416 .size
= sizeof(struct tc_action_net
),
419 MODULE_AUTHOR("Jamal Hadi Salim(2002-13)");
420 MODULE_DESCRIPTION("Iptables target actions");
421 MODULE_LICENSE("GPL");
422 MODULE_ALIAS("act_xt");
424 static int __init
ipt_init_module(void)
428 ret1
= tcf_register_action(&act_xt_ops
, &xt_net_ops
);
430 pr_err("Failed to load xt action\n");
432 ret2
= tcf_register_action(&act_ipt_ops
, &ipt_net_ops
);
434 pr_err("Failed to load ipt action\n");
436 if (ret1
< 0 && ret2
< 0) {
442 static void __exit
ipt_cleanup_module(void)
444 tcf_unregister_action(&act_ipt_ops
, &ipt_net_ops
);
445 tcf_unregister_action(&act_xt_ops
, &xt_net_ops
);
448 module_init(ipt_init_module
);
449 module_exit(ipt_cleanup_module
);