Commit | Line | Data |
---|---|---|
e281b198 JE |
1 | /* |
2 | * "TEE" target extension for Xtables | |
3 | * Copyright © Sebastian Claßen, 2007 | |
4 | * Jan Engelhardt, 2007-2010 | |
5 | * | |
6 | * based on ipt_ROUTE.c from Cédric de Launois | |
7 | * <delaunois@info.ucl.be> | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or | |
10 | * modify it under the terms of the GNU General Public License | |
11 | * version 2 or later, as published by the Free Software Foundation. | |
12 | */ | |
13 | #include <linux/ip.h> | |
14 | #include <linux/module.h> | |
cd58bcd9 | 15 | #include <linux/percpu.h> |
e281b198 JE |
16 | #include <linux/route.h> |
17 | #include <linux/skbuff.h> | |
22265a5c | 18 | #include <linux/notifier.h> |
e281b198 JE |
19 | #include <net/checksum.h> |
20 | #include <net/icmp.h> | |
21 | #include <net/ip.h> | |
22 | #include <net/ipv6.h> | |
23 | #include <net/ip6_route.h> | |
24 | #include <net/route.h> | |
25 | #include <linux/netfilter/x_tables.h> | |
26 | #include <linux/netfilter/xt_TEE.h> | |
27 | ||
c0cd1156 | 28 | #if IS_ENABLED(CONFIG_NF_CONNTRACK) |
e281b198 JE |
29 | # define WITH_CONNTRACK 1 |
30 | # include <net/netfilter/nf_conntrack.h> | |
31 | #endif | |
e281b198 | 32 | |
22265a5c PM |
33 | struct xt_tee_priv { |
34 | struct notifier_block notifier; | |
35 | struct xt_tee_tginfo *tginfo; | |
36 | int oif; | |
37 | }; | |
38 | ||
e281b198 | 39 | static const union nf_inet_addr tee_zero_address; |
cd58bcd9 | 40 | static DEFINE_PER_CPU(bool, tee_active); |
e281b198 JE |
41 | |
42 | static struct net *pick_net(struct sk_buff *skb) | |
43 | { | |
44 | #ifdef CONFIG_NET_NS | |
45 | const struct dst_entry *dst; | |
46 | ||
47 | if (skb->dev != NULL) | |
48 | return dev_net(skb->dev); | |
49 | dst = skb_dst(skb); | |
50 | if (dst != NULL && dst->dev != NULL) | |
51 | return dev_net(dst->dev); | |
52 | #endif | |
53 | return &init_net; | |
54 | } | |
55 | ||
e281b198 JE |
56 | static bool |
57 | tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info) | |
58 | { | |
59 | const struct iphdr *iph = ip_hdr(skb); | |
60 | struct net *net = pick_net(skb); | |
61 | struct rtable *rt; | |
9d6ec938 | 62 | struct flowi4 fl4; |
e281b198 | 63 | |
9d6ec938 | 64 | memset(&fl4, 0, sizeof(fl4)); |
22265a5c PM |
65 | if (info->priv) { |
66 | if (info->priv->oif == -1) | |
67 | return false; | |
9d6ec938 | 68 | fl4.flowi4_oif = info->priv->oif; |
22265a5c | 69 | } |
9d6ec938 DM |
70 | fl4.daddr = info->gw.ip; |
71 | fl4.flowi4_tos = RT_TOS(iph->tos); | |
72 | fl4.flowi4_scope = RT_SCOPE_UNIVERSE; | |
73 | rt = ip_route_output_key(net, &fl4); | |
b23dd4fe | 74 | if (IS_ERR(rt)) |
e281b198 JE |
75 | return false; |
76 | ||
50636af7 | 77 | skb_dst_drop(skb); |
d8d1f30b CG |
78 | skb_dst_set(skb, &rt->dst); |
79 | skb->dev = rt->dst.dev; | |
e281b198 JE |
80 | skb->protocol = htons(ETH_P_IP); |
81 | return true; | |
82 | } | |
83 | ||
84 | static unsigned int | |
4b560b44 | 85 | tee_tg4(struct sk_buff *skb, const struct xt_action_param *par) |
e281b198 JE |
86 | { |
87 | const struct xt_tee_tginfo *info = par->targinfo; | |
88 | struct iphdr *iph; | |
89 | ||
cd58bcd9 JE |
90 | if (percpu_read(tee_active)) |
91 | return XT_CONTINUE; | |
e281b198 JE |
92 | /* |
93 | * Copy the skb, and route the copy. Will later return %XT_CONTINUE for | |
94 | * the original skb, which should continue on its way as if nothing has | |
95 | * happened. The copy should be independently delivered to the TEE | |
96 | * --gateway. | |
97 | */ | |
98 | skb = pskb_copy(skb, GFP_ATOMIC); | |
99 | if (skb == NULL) | |
100 | return XT_CONTINUE; | |
101 | ||
102 | #ifdef WITH_CONNTRACK | |
103 | /* Avoid counting cloned packets towards the original connection. */ | |
104 | nf_conntrack_put(skb->nfct); | |
5bfddbd4 | 105 | skb->nfct = &nf_ct_untracked_get()->ct_general; |
e281b198 JE |
106 | skb->nfctinfo = IP_CT_NEW; |
107 | nf_conntrack_get(skb->nfct); | |
108 | #endif | |
109 | /* | |
110 | * If we are in PREROUTING/INPUT, the checksum must be recalculated | |
111 | * since the length could have changed as a result of defragmentation. | |
112 | * | |
113 | * We also decrease the TTL to mitigate potential TEE loops | |
114 | * between two hosts. | |
115 | * | |
116 | * Set %IP_DF so that the original source is notified of a potentially | |
117 | * decreased MTU on the clone route. IPv6 does this too. | |
118 | */ | |
119 | iph = ip_hdr(skb); | |
120 | iph->frag_off |= htons(IP_DF); | |
121 | if (par->hooknum == NF_INET_PRE_ROUTING || | |
122 | par->hooknum == NF_INET_LOCAL_IN) | |
123 | --iph->ttl; | |
124 | ip_send_check(iph); | |
125 | ||
cd58bcd9 JE |
126 | if (tee_tg_route4(skb, info)) { |
127 | percpu_write(tee_active, true); | |
128 | ip_local_out(skb); | |
129 | percpu_write(tee_active, false); | |
130 | } else { | |
e281b198 | 131 | kfree_skb(skb); |
cd58bcd9 | 132 | } |
e281b198 JE |
133 | return XT_CONTINUE; |
134 | } | |
135 | ||
dfd56b8b | 136 | #if IS_ENABLED(CONFIG_IPV6) |
e281b198 JE |
137 | static bool |
138 | tee_tg_route6(struct sk_buff *skb, const struct xt_tee_tginfo *info) | |
139 | { | |
140 | const struct ipv6hdr *iph = ipv6_hdr(skb); | |
141 | struct net *net = pick_net(skb); | |
142 | struct dst_entry *dst; | |
4c9483b2 | 143 | struct flowi6 fl6; |
e281b198 | 144 | |
4c9483b2 | 145 | memset(&fl6, 0, sizeof(fl6)); |
22265a5c PM |
146 | if (info->priv) { |
147 | if (info->priv->oif == -1) | |
148 | return false; | |
4c9483b2 | 149 | fl6.flowi6_oif = info->priv->oif; |
22265a5c | 150 | } |
4c9483b2 DM |
151 | fl6.daddr = info->gw.in6; |
152 | fl6.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) | | |
5811662b | 153 | (iph->flow_lbl[1] << 8) | iph->flow_lbl[2]; |
4c9483b2 | 154 | dst = ip6_route_output(net, NULL, &fl6); |
e281b198 JE |
155 | if (dst == NULL) |
156 | return false; | |
157 | ||
50636af7 | 158 | skb_dst_drop(skb); |
e281b198 JE |
159 | skb_dst_set(skb, dst); |
160 | skb->dev = dst->dev; | |
161 | skb->protocol = htons(ETH_P_IPV6); | |
162 | return true; | |
163 | } | |
164 | ||
165 | static unsigned int | |
4b560b44 | 166 | tee_tg6(struct sk_buff *skb, const struct xt_action_param *par) |
e281b198 JE |
167 | { |
168 | const struct xt_tee_tginfo *info = par->targinfo; | |
169 | ||
cd58bcd9 JE |
170 | if (percpu_read(tee_active)) |
171 | return XT_CONTINUE; | |
e281b198 JE |
172 | skb = pskb_copy(skb, GFP_ATOMIC); |
173 | if (skb == NULL) | |
174 | return XT_CONTINUE; | |
175 | ||
176 | #ifdef WITH_CONNTRACK | |
177 | nf_conntrack_put(skb->nfct); | |
5bfddbd4 | 178 | skb->nfct = &nf_ct_untracked_get()->ct_general; |
e281b198 JE |
179 | skb->nfctinfo = IP_CT_NEW; |
180 | nf_conntrack_get(skb->nfct); | |
181 | #endif | |
182 | if (par->hooknum == NF_INET_PRE_ROUTING || | |
183 | par->hooknum == NF_INET_LOCAL_IN) { | |
184 | struct ipv6hdr *iph = ipv6_hdr(skb); | |
185 | --iph->hop_limit; | |
186 | } | |
cd58bcd9 JE |
187 | if (tee_tg_route6(skb, info)) { |
188 | percpu_write(tee_active, true); | |
189 | ip6_local_out(skb); | |
190 | percpu_write(tee_active, false); | |
191 | } else { | |
e281b198 | 192 | kfree_skb(skb); |
cd58bcd9 | 193 | } |
e281b198 JE |
194 | return XT_CONTINUE; |
195 | } | |
dfd56b8b | 196 | #endif |
e281b198 | 197 | |
22265a5c PM |
198 | static int tee_netdev_event(struct notifier_block *this, unsigned long event, |
199 | void *ptr) | |
200 | { | |
201 | struct net_device *dev = ptr; | |
202 | struct xt_tee_priv *priv; | |
203 | ||
204 | priv = container_of(this, struct xt_tee_priv, notifier); | |
205 | switch (event) { | |
206 | case NETDEV_REGISTER: | |
207 | if (!strcmp(dev->name, priv->tginfo->oif)) | |
208 | priv->oif = dev->ifindex; | |
209 | break; | |
210 | case NETDEV_UNREGISTER: | |
211 | if (dev->ifindex == priv->oif) | |
212 | priv->oif = -1; | |
213 | break; | |
214 | case NETDEV_CHANGENAME: | |
215 | if (!strcmp(dev->name, priv->tginfo->oif)) | |
216 | priv->oif = dev->ifindex; | |
217 | else if (dev->ifindex == priv->oif) | |
218 | priv->oif = -1; | |
219 | break; | |
220 | } | |
221 | ||
222 | return NOTIFY_DONE; | |
223 | } | |
224 | ||
e281b198 JE |
225 | static int tee_tg_check(const struct xt_tgchk_param *par) |
226 | { | |
22265a5c PM |
227 | struct xt_tee_tginfo *info = par->targinfo; |
228 | struct xt_tee_priv *priv; | |
e281b198 | 229 | |
e281b198 | 230 | /* 0.0.0.0 and :: not allowed */ |
22265a5c PM |
231 | if (memcmp(&info->gw, &tee_zero_address, |
232 | sizeof(tee_zero_address)) == 0) | |
233 | return -EINVAL; | |
234 | ||
235 | if (info->oif[0]) { | |
236 | if (info->oif[sizeof(info->oif)-1] != '\0') | |
237 | return -EINVAL; | |
238 | ||
239 | priv = kzalloc(sizeof(*priv), GFP_KERNEL); | |
240 | if (priv == NULL) | |
241 | return -ENOMEM; | |
242 | ||
243 | priv->tginfo = info; | |
244 | priv->oif = -1; | |
245 | priv->notifier.notifier_call = tee_netdev_event; | |
246 | info->priv = priv; | |
247 | ||
248 | register_netdevice_notifier(&priv->notifier); | |
249 | } else | |
250 | info->priv = NULL; | |
251 | ||
252 | return 0; | |
253 | } | |
254 | ||
255 | static void tee_tg_destroy(const struct xt_tgdtor_param *par) | |
256 | { | |
257 | struct xt_tee_tginfo *info = par->targinfo; | |
258 | ||
259 | if (info->priv) { | |
260 | unregister_netdevice_notifier(&info->priv->notifier); | |
261 | kfree(info->priv); | |
262 | } | |
e281b198 JE |
263 | } |
264 | ||
265 | static struct xt_target tee_tg_reg[] __read_mostly = { | |
266 | { | |
267 | .name = "TEE", | |
268 | .revision = 1, | |
269 | .family = NFPROTO_IPV4, | |
270 | .target = tee_tg4, | |
271 | .targetsize = sizeof(struct xt_tee_tginfo), | |
272 | .checkentry = tee_tg_check, | |
22265a5c | 273 | .destroy = tee_tg_destroy, |
e281b198 JE |
274 | .me = THIS_MODULE, |
275 | }, | |
dfd56b8b | 276 | #if IS_ENABLED(CONFIG_IPV6) |
e281b198 JE |
277 | { |
278 | .name = "TEE", | |
279 | .revision = 1, | |
280 | .family = NFPROTO_IPV6, | |
281 | .target = tee_tg6, | |
282 | .targetsize = sizeof(struct xt_tee_tginfo), | |
283 | .checkentry = tee_tg_check, | |
22265a5c | 284 | .destroy = tee_tg_destroy, |
e281b198 JE |
285 | .me = THIS_MODULE, |
286 | }, | |
287 | #endif | |
288 | }; | |
289 | ||
290 | static int __init tee_tg_init(void) | |
291 | { | |
292 | return xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg)); | |
293 | } | |
294 | ||
295 | static void __exit tee_tg_exit(void) | |
296 | { | |
297 | xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg)); | |
298 | } | |
299 | ||
300 | module_init(tee_tg_init); | |
301 | module_exit(tee_tg_exit); | |
302 | MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>"); | |
303 | MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>"); | |
304 | MODULE_DESCRIPTION("Xtables: Reroute packet copy"); | |
305 | MODULE_LICENSE("GPL"); | |
306 | MODULE_ALIAS("ipt_TEE"); | |
307 | MODULE_ALIAS("ip6t_TEE"); |