2 * net/sched/act_ipt.c iptables target interface
4 *TODO: Add other tables. For now we only support the ipv4 table targets
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
11 * Copyright: Jamal Hadi Salim (2002-13)
14 #include <linux/types.h>
15 #include <linux/kernel.h>
16 #include <linux/string.h>
17 #include <linux/errno.h>
18 #include <linux/skbuff.h>
19 #include <linux/rtnetlink.h>
20 #include <linux/module.h>
21 #include <linux/init.h>
22 #include <linux/slab.h>
23 #include <net/netlink.h>
24 #include <net/pkt_sched.h>
25 #include <linux/tc_act/tc_ipt.h>
26 #include <net/tc_act/tc_ipt.h>
28 #include <linux/netfilter_ipv4/ip_tables.h>
31 #define IPT_TAB_MASK 15
33 static int ipt_init_target(struct xt_entry_target
*t
, char *table
, unsigned int hook
)
35 struct xt_tgchk_param par
;
36 struct xt_target
*target
;
39 target
= xt_request_find_target(AF_INET
, t
->u
.user
.name
,
42 return PTR_ERR(target
);
44 t
->u
.kernel
.target
= target
;
48 par
.targinfo
= t
->data
;
50 par
.family
= NFPROTO_IPV4
;
52 ret
= xt_check_target(&par
, t
->u
.target_size
- sizeof(*t
), 0, false);
54 module_put(t
->u
.kernel
.target
->me
);
60 static void ipt_destroy_target(struct xt_entry_target
*t
)
62 struct xt_tgdtor_param par
= {
63 .target
= t
->u
.kernel
.target
,
65 .family
= NFPROTO_IPV4
,
67 if (par
.target
->destroy
!= NULL
)
68 par
.target
->destroy(&par
);
69 module_put(par
.target
->me
);
72 static void tcf_ipt_release(struct tc_action
*a
, int bind
)
74 struct tcf_ipt
*ipt
= to_ipt(a
);
75 ipt_destroy_target(ipt
->tcfi_t
);
76 kfree(ipt
->tcfi_tname
);
80 static const struct nla_policy ipt_policy
[TCA_IPT_MAX
+ 1] = {
81 [TCA_IPT_TABLE
] = { .type
= NLA_STRING
, .len
= IFNAMSIZ
},
82 [TCA_IPT_HOOK
] = { .type
= NLA_U32
},
83 [TCA_IPT_INDEX
] = { .type
= NLA_U32
},
84 [TCA_IPT_TARG
] = { .len
= sizeof(struct xt_entry_target
) },
87 static int tcf_ipt_init(struct net
*net
, struct nlattr
*nla
, struct nlattr
*est
,
88 struct tc_action
*a
, int ovr
, int bind
)
90 struct nlattr
*tb
[TCA_IPT_MAX
+ 1];
92 struct xt_entry_target
*td
, *t
;
101 err
= nla_parse_nested(tb
, TCA_IPT_MAX
, nla
, ipt_policy
);
105 if (tb
[TCA_IPT_HOOK
] == NULL
)
107 if (tb
[TCA_IPT_TARG
] == NULL
)
110 td
= (struct xt_entry_target
*)nla_data(tb
[TCA_IPT_TARG
]);
111 if (nla_len(tb
[TCA_IPT_TARG
]) < td
->u
.target_size
)
114 if (tb
[TCA_IPT_INDEX
] != NULL
)
115 index
= nla_get_u32(tb
[TCA_IPT_INDEX
]);
117 if (!tcf_hash_check(index
, a
, bind
) ) {
118 ret
= tcf_hash_create(index
, est
, a
, sizeof(*ipt
), bind
, false);
123 if (bind
)/* dont override defaults */
125 tcf_hash_release(a
, bind
);
132 hook
= nla_get_u32(tb
[TCA_IPT_HOOK
]);
135 tname
= kmalloc(IFNAMSIZ
, GFP_KERNEL
);
136 if (unlikely(!tname
))
138 if (tb
[TCA_IPT_TABLE
] == NULL
||
139 nla_strlcpy(tname
, tb
[TCA_IPT_TABLE
], IFNAMSIZ
) >= IFNAMSIZ
)
140 strcpy(tname
, "mangle");
142 t
= kmemdup(td
, td
->u
.target_size
, GFP_KERNEL
);
146 err
= ipt_init_target(t
, tname
, hook
);
150 spin_lock_bh(&ipt
->tcf_lock
);
151 if (ret
!= ACT_P_CREATED
) {
152 ipt_destroy_target(ipt
->tcfi_t
);
153 kfree(ipt
->tcfi_tname
);
156 ipt
->tcfi_tname
= tname
;
158 ipt
->tcfi_hook
= hook
;
159 spin_unlock_bh(&ipt
->tcf_lock
);
160 if (ret
== ACT_P_CREATED
)
169 if (ret
== ACT_P_CREATED
)
170 tcf_hash_cleanup(a
, est
);
174 static int tcf_ipt(struct sk_buff
*skb
, const struct tc_action
*a
,
175 struct tcf_result
*res
)
177 int ret
= 0, result
= 0;
178 struct tcf_ipt
*ipt
= a
->priv
;
179 struct xt_action_param par
;
181 if (skb_unclone(skb
, GFP_ATOMIC
))
182 return TC_ACT_UNSPEC
;
184 spin_lock(&ipt
->tcf_lock
);
186 ipt
->tcf_tm
.lastuse
= jiffies
;
187 bstats_update(&ipt
->tcf_bstats
, skb
);
189 /* yes, we have to worry about both in and out dev
190 * worry later - danger - this API seems to have changed
191 * from earlier kernels
193 par
.net
= dev_net(skb
->dev
);
196 par
.hooknum
= ipt
->tcfi_hook
;
197 par
.target
= ipt
->tcfi_t
->u
.kernel
.target
;
198 par
.targinfo
= ipt
->tcfi_t
->data
;
199 par
.family
= NFPROTO_IPV4
;
200 ret
= par
.target
->target(skb
, &par
);
207 result
= TC_ACT_SHOT
;
208 ipt
->tcf_qstats
.drops
++;
211 result
= TC_ACT_PIPE
;
214 net_notice_ratelimited("tc filter: Bogus netfilter code %d assume ACCEPT\n",
216 result
= TC_POLICE_OK
;
219 spin_unlock(&ipt
->tcf_lock
);
224 static int tcf_ipt_dump(struct sk_buff
*skb
, struct tc_action
*a
, int bind
, int ref
)
226 unsigned char *b
= skb_tail_pointer(skb
);
227 struct tcf_ipt
*ipt
= a
->priv
;
228 struct xt_entry_target
*t
;
232 /* for simple targets kernel size == user size
233 * user name = target name
234 * for foolproof you need to not assume this
237 t
= kmemdup(ipt
->tcfi_t
, ipt
->tcfi_t
->u
.user
.target_size
, GFP_ATOMIC
);
239 goto nla_put_failure
;
241 c
.bindcnt
= ipt
->tcf_bindcnt
- bind
;
242 c
.refcnt
= ipt
->tcf_refcnt
- ref
;
243 strcpy(t
->u
.user
.name
, ipt
->tcfi_t
->u
.kernel
.target
->name
);
245 if (nla_put(skb
, TCA_IPT_TARG
, ipt
->tcfi_t
->u
.user
.target_size
, t
) ||
246 nla_put_u32(skb
, TCA_IPT_INDEX
, ipt
->tcf_index
) ||
247 nla_put_u32(skb
, TCA_IPT_HOOK
, ipt
->tcfi_hook
) ||
248 nla_put(skb
, TCA_IPT_CNT
, sizeof(struct tc_cnt
), &c
) ||
249 nla_put_string(skb
, TCA_IPT_TABLE
, ipt
->tcfi_tname
))
250 goto nla_put_failure
;
251 tm
.install
= jiffies_to_clock_t(jiffies
- ipt
->tcf_tm
.install
);
252 tm
.lastuse
= jiffies_to_clock_t(jiffies
- ipt
->tcf_tm
.lastuse
);
253 tm
.expires
= jiffies_to_clock_t(ipt
->tcf_tm
.expires
);
254 if (nla_put(skb
, TCA_IPT_TM
, sizeof (tm
), &tm
))
255 goto nla_put_failure
;
265 static struct tc_action_ops act_ipt_ops
= {
268 .owner
= THIS_MODULE
,
270 .dump
= tcf_ipt_dump
,
271 .cleanup
= tcf_ipt_release
,
272 .init
= tcf_ipt_init
,
275 static struct tc_action_ops act_xt_ops
= {
278 .owner
= THIS_MODULE
,
280 .dump
= tcf_ipt_dump
,
281 .cleanup
= tcf_ipt_release
,
282 .init
= tcf_ipt_init
,
285 MODULE_AUTHOR("Jamal Hadi Salim(2002-13)");
286 MODULE_DESCRIPTION("Iptables target actions");
287 MODULE_LICENSE("GPL");
288 MODULE_ALIAS("act_xt");
290 static int __init
ipt_init_module(void)
294 ret1
= tcf_register_action(&act_xt_ops
, IPT_TAB_MASK
);
296 printk("Failed to load xt action\n");
297 ret2
= tcf_register_action(&act_ipt_ops
, IPT_TAB_MASK
);
299 printk("Failed to load ipt action\n");
301 if (ret1
< 0 && ret2
< 0) {
307 static void __exit
ipt_cleanup_module(void)
309 tcf_unregister_action(&act_xt_ops
);
310 tcf_unregister_action(&act_ipt_ops
);
313 module_init(ipt_init_module
);
314 module_exit(ipt_cleanup_module
);