2 * Copyright (c) 2011 Florian Westphal <fw@strlen.de>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * based on fib_frontend.c; Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
10 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
13 #include <linux/netdevice.h>
16 #include <net/ip_fib.h>
17 #include <net/route.h>
19 #include <linux/netfilter/xt_rpfilter.h>
20 #include <linux/netfilter/x_tables.h>
22 MODULE_LICENSE("GPL");
23 MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
24 MODULE_DESCRIPTION("iptables: ipv4 reverse path filter match");
26 /* don't try to find route from mcast/bcast/zeronet */
27 static __be32
rpfilter_get_saddr(__be32 addr
)
29 if (ipv4_is_multicast(addr
) || ipv4_is_lbcast(addr
) ||
30 ipv4_is_zeronet(addr
))
35 static bool rpfilter_lookup_reverse(struct net
*net
, struct flowi4
*fl4
,
36 const struct net_device
*dev
, u8 flags
)
38 struct fib_result res
;
40 int ret __maybe_unused
;
42 if (fib_lookup(net
, fl4
, &res
, FIB_LOOKUP_IGNORE_LINKSTATE
))
45 if (res
.type
!= RTN_UNICAST
) {
46 if (res
.type
!= RTN_LOCAL
|| !(flags
& XT_RPFILTER_ACCEPT_LOCAL
))
50 #ifdef CONFIG_IP_ROUTE_MULTIPATH
51 for (ret
= 0; ret
< res
.fi
->fib_nhs
; ret
++) {
52 struct fib_nh
*nh
= &res
.fi
->fib_nh
[ret
];
54 if (nh
->nh_dev
== dev
) {
60 if (FIB_RES_DEV(res
) == dev
)
63 return dev_match
|| flags
& XT_RPFILTER_LOOSE
;
66 static bool rpfilter_is_local(const struct sk_buff
*skb
)
68 const struct rtable
*rt
= skb_rtable(skb
);
69 return rt
&& (rt
->rt_flags
& RTCF_LOCAL
);
72 static bool rpfilter_mt(const struct sk_buff
*skb
, struct xt_action_param
*par
)
74 const struct xt_rpfilter_info
*info
;
75 const struct iphdr
*iph
;
79 info
= par
->matchinfo
;
80 invert
= info
->flags
& XT_RPFILTER_INVERT
;
82 if (rpfilter_is_local(skb
))
86 if (ipv4_is_multicast(iph
->daddr
)) {
87 if (ipv4_is_zeronet(iph
->saddr
))
88 return ipv4_is_local_multicast(iph
->daddr
) ^ invert
;
90 flow
.flowi4_iif
= LOOPBACK_IFINDEX
;
91 flow
.daddr
= iph
->saddr
;
92 flow
.saddr
= rpfilter_get_saddr(iph
->daddr
);
94 flow
.flowi4_mark
= info
->flags
& XT_RPFILTER_VALID_MARK
? skb
->mark
: 0;
95 flow
.flowi4_tos
= RT_TOS(iph
->tos
);
96 flow
.flowi4_scope
= RT_SCOPE_UNIVERSE
;
98 return rpfilter_lookup_reverse(par
->net
, &flow
, par
->in
, info
->flags
) ^ invert
;
101 static int rpfilter_check(const struct xt_mtchk_param
*par
)
103 const struct xt_rpfilter_info
*info
= par
->matchinfo
;
104 unsigned int options
= ~XT_RPFILTER_OPTION_MASK
;
105 if (info
->flags
& options
) {
106 pr_info("unknown options encountered");
110 if (strcmp(par
->table
, "mangle") != 0 &&
111 strcmp(par
->table
, "raw") != 0) {
112 pr_info("match only valid in the \'raw\' "
113 "or \'mangle\' tables, not \'%s\'.\n", par
->table
);
120 static struct xt_match rpfilter_mt_reg __read_mostly
= {
122 .family
= NFPROTO_IPV4
,
123 .checkentry
= rpfilter_check
,
124 .match
= rpfilter_mt
,
125 .matchsize
= sizeof(struct xt_rpfilter_info
),
126 .hooks
= (1 << NF_INET_PRE_ROUTING
),
130 static int __init
rpfilter_mt_init(void)
132 return xt_register_match(&rpfilter_mt_reg
);
135 static void __exit
rpfilter_mt_exit(void)
137 xt_unregister_match(&rpfilter_mt_reg
);
140 module_init(rpfilter_mt_init
);
141 module_exit(rpfilter_mt_exit
);