Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
Jiri Pirko | 0c6965d | 2014-11-05 20:51:51 +0100 | [diff] [blame] | 2 | * net/sched/act_ipt.c iptables target interface |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 3 | * |
| 4 | *TODO: Add other tables. For now we only support the ipv4 table targets |
| 5 | * |
| 6 | * This program is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU General Public License |
| 8 | * as published by the Free Software Foundation; either version |
| 9 | * 2 of the License, or (at your option) any later version. |
| 10 | * |
Jamal Hadi Salim | 0dcffd0 | 2013-04-28 05:06:38 +0000 | [diff] [blame] | 11 | * Copyright: Jamal Hadi Salim (2002-13) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 12 | */ |
| 13 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 14 | #include <linux/types.h> |
| 15 | #include <linux/kernel.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 16 | #include <linux/string.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 17 | #include <linux/errno.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 18 | #include <linux/skbuff.h> |
| 19 | #include <linux/rtnetlink.h> |
| 20 | #include <linux/module.h> |
| 21 | #include <linux/init.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 22 | #include <linux/slab.h> |
Arnaldo Carvalho de Melo | dc5fc57 | 2007-03-25 23:06:12 -0700 | [diff] [blame] | 23 | #include <net/netlink.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 24 | #include <net/pkt_sched.h> |
| 25 | #include <linux/tc_act/tc_ipt.h> |
| 26 | #include <net/tc_act/tc_ipt.h> |
| 27 | |
| 28 | #include <linux/netfilter_ipv4/ip_tables.h> |
| 29 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 30 | |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 31 | #define IPT_TAB_MASK 15 |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 32 | |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 33 | static int ipt_net_id; |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 34 | static struct tc_action_ops act_ipt_ops; |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 35 | |
| 36 | static int xt_net_id; |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 37 | static struct tc_action_ops act_xt_ops; |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 38 | |
Jamal Hadi Salim | 0b0f43f | 2016-06-05 10:41:32 -0400 | [diff] [blame] | 39 | static int ipt_init_target(struct xt_entry_target *t, char *table, |
| 40 | unsigned int hook) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 41 | { |
Jan Engelhardt | af5d6dc | 2008-10-08 11:35:19 +0200 | [diff] [blame] | 42 | struct xt_tgchk_param par; |
Jan Engelhardt | e60a13e | 2007-02-07 15:12:33 -0800 | [diff] [blame] | 43 | struct xt_target *target; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 44 | int ret = 0; |
| 45 | |
Patrick McHardy | 239a87c | 2007-02-02 00:40:36 -0800 | [diff] [blame] | 46 | target = xt_request_find_target(AF_INET, t->u.user.name, |
| 47 | t->u.user.revision); |
Jan Engelhardt | d2a7b6b | 2009-07-10 18:55:11 +0200 | [diff] [blame] | 48 | if (IS_ERR(target)) |
| 49 | return PTR_ERR(target); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 50 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 51 | t->u.kernel.target = target; |
Jan Engelhardt | af5d6dc | 2008-10-08 11:35:19 +0200 | [diff] [blame] | 52 | par.table = table; |
| 53 | par.entryinfo = NULL; |
| 54 | par.target = target; |
| 55 | par.targinfo = t->data; |
| 56 | par.hook_mask = hook; |
Jan Engelhardt | 916a917 | 2008-10-08 11:35:20 +0200 | [diff] [blame] | 57 | par.family = NFPROTO_IPV4; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 58 | |
Jan Engelhardt | 916a917 | 2008-10-08 11:35:20 +0200 | [diff] [blame] | 59 | ret = xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false); |
Jan Engelhardt | 367c679 | 2008-10-08 11:35:17 +0200 | [diff] [blame] | 60 | if (ret < 0) { |
Patrick McHardy | 239a87c | 2007-02-02 00:40:36 -0800 | [diff] [blame] | 61 | module_put(t->u.kernel.target->me); |
Patrick McHardy | 18118cd | 2006-04-24 17:18:59 -0700 | [diff] [blame] | 62 | return ret; |
Patrick McHardy | 239a87c | 2007-02-02 00:40:36 -0800 | [diff] [blame] | 63 | } |
Jan Engelhardt | 367c679 | 2008-10-08 11:35:17 +0200 | [diff] [blame] | 64 | return 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 65 | } |
| 66 | |
Jan Engelhardt | 87a2e70d | 2010-10-13 16:11:22 +0200 | [diff] [blame] | 67 | static void ipt_destroy_target(struct xt_entry_target *t) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 68 | { |
Jan Engelhardt | a2df164 | 2008-10-08 11:35:19 +0200 | [diff] [blame] | 69 | struct xt_tgdtor_param par = { |
| 70 | .target = t->u.kernel.target, |
| 71 | .targinfo = t->data, |
Phil Sutter | 44ef548 | 2016-03-03 14:34:14 +0100 | [diff] [blame] | 72 | .family = NFPROTO_IPV4, |
Jan Engelhardt | a2df164 | 2008-10-08 11:35:19 +0200 | [diff] [blame] | 73 | }; |
| 74 | if (par.target->destroy != NULL) |
| 75 | par.target->destroy(&par); |
| 76 | module_put(par.target->me); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 77 | } |
| 78 | |
WANG Cong | a5b5c95 | 2014-02-11 17:07:32 -0800 | [diff] [blame] | 79 | static void tcf_ipt_release(struct tc_action *a, int bind) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 80 | { |
WANG Cong | 8606203 | 2014-02-11 17:07:31 -0800 | [diff] [blame] | 81 | struct tcf_ipt *ipt = to_ipt(a); |
WANG Cong | a5b5c95 | 2014-02-11 17:07:32 -0800 | [diff] [blame] | 82 | ipt_destroy_target(ipt->tcfi_t); |
| 83 | kfree(ipt->tcfi_tname); |
| 84 | kfree(ipt->tcfi_t); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 85 | } |
| 86 | |
Patrick McHardy | 53b2bf3 | 2008-01-23 20:36:30 -0800 | [diff] [blame] | 87 | static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = { |
| 88 | [TCA_IPT_TABLE] = { .type = NLA_STRING, .len = IFNAMSIZ }, |
| 89 | [TCA_IPT_HOOK] = { .type = NLA_U32 }, |
| 90 | [TCA_IPT_INDEX] = { .type = NLA_U32 }, |
Jan Engelhardt | 87a2e70d | 2010-10-13 16:11:22 +0200 | [diff] [blame] | 91 | [TCA_IPT_TARG] = { .len = sizeof(struct xt_entry_target) }, |
Patrick McHardy | 53b2bf3 | 2008-01-23 20:36:30 -0800 | [diff] [blame] | 92 | }; |
| 93 | |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 94 | static int __tcf_ipt_init(struct tc_action_net *tn, struct nlattr *nla, |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 95 | struct nlattr *est, struct tc_action **a, |
| 96 | const struct tc_action_ops *ops, int ovr, int bind) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 97 | { |
Patrick McHardy | 7ba699c | 2008-01-22 22:11:50 -0800 | [diff] [blame] | 98 | struct nlattr *tb[TCA_IPT_MAX + 1]; |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 99 | struct tcf_ipt *ipt; |
Jan Engelhardt | 87a2e70d | 2010-10-13 16:11:22 +0200 | [diff] [blame] | 100 | struct xt_entry_target *td, *t; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 101 | char *tname; |
WANG Cong | b231307 | 2016-06-13 13:46:28 -0700 | [diff] [blame] | 102 | bool exists = false; |
| 103 | int ret = 0, err; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 104 | u32 hook = 0; |
| 105 | u32 index = 0; |
| 106 | |
Patrick McHardy | cee6372 | 2008-01-23 20:33:32 -0800 | [diff] [blame] | 107 | if (nla == NULL) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 108 | return -EINVAL; |
| 109 | |
Patrick McHardy | 53b2bf3 | 2008-01-23 20:36:30 -0800 | [diff] [blame] | 110 | err = nla_parse_nested(tb, TCA_IPT_MAX, nla, ipt_policy); |
Patrick McHardy | cee6372 | 2008-01-23 20:33:32 -0800 | [diff] [blame] | 111 | if (err < 0) |
| 112 | return err; |
| 113 | |
Jamal Hadi Salim | a57f19d | 2016-05-10 16:49:27 -0400 | [diff] [blame] | 114 | if (tb[TCA_IPT_INDEX] != NULL) |
| 115 | index = nla_get_u32(tb[TCA_IPT_INDEX]); |
| 116 | |
| 117 | exists = tcf_hash_check(tn, index, a, bind); |
| 118 | if (exists && bind) |
| 119 | return 0; |
| 120 | |
| 121 | if (tb[TCA_IPT_HOOK] == NULL || tb[TCA_IPT_TARG] == NULL) { |
| 122 | if (exists) |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 123 | tcf_hash_release(*a, bind); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 124 | return -EINVAL; |
Jamal Hadi Salim | a57f19d | 2016-05-10 16:49:27 -0400 | [diff] [blame] | 125 | } |
Patrick McHardy | 53b2bf3 | 2008-01-23 20:36:30 -0800 | [diff] [blame] | 126 | |
Jan Engelhardt | 87a2e70d | 2010-10-13 16:11:22 +0200 | [diff] [blame] | 127 | td = (struct xt_entry_target *)nla_data(tb[TCA_IPT_TARG]); |
WANG Cong | d15ecce | 2016-06-13 13:44:14 -0700 | [diff] [blame] | 128 | if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size) { |
| 129 | if (exists) |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 130 | tcf_hash_release(*a, bind); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 131 | return -EINVAL; |
WANG Cong | d15ecce | 2016-06-13 13:44:14 -0700 | [diff] [blame] | 132 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 133 | |
WANG Cong | d15ecce | 2016-06-13 13:44:14 -0700 | [diff] [blame] | 134 | if (!exists) { |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 135 | ret = tcf_hash_create(tn, index, est, a, ops, bind, |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 136 | false); |
WANG Cong | 8606203 | 2014-02-11 17:07:31 -0800 | [diff] [blame] | 137 | if (ret) |
| 138 | return ret; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 139 | ret = ACT_P_CREATED; |
| 140 | } else { |
Jamal Hadi Salim | 1a29321 | 2013-12-23 08:02:11 -0500 | [diff] [blame] | 141 | if (bind)/* dont override defaults */ |
| 142 | return 0; |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 143 | tcf_hash_release(*a, bind); |
Jamal Hadi Salim | 1a29321 | 2013-12-23 08:02:11 -0500 | [diff] [blame] | 144 | |
| 145 | if (!ovr) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 146 | return -EEXIST; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 147 | } |
Patrick McHardy | 1587bac | 2008-01-23 20:35:03 -0800 | [diff] [blame] | 148 | hook = nla_get_u32(tb[TCA_IPT_HOOK]); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 149 | |
| 150 | err = -ENOMEM; |
| 151 | tname = kmalloc(IFNAMSIZ, GFP_KERNEL); |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 152 | if (unlikely(!tname)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 153 | goto err1; |
Patrick McHardy | 7ba699c | 2008-01-22 22:11:50 -0800 | [diff] [blame] | 154 | if (tb[TCA_IPT_TABLE] == NULL || |
| 155 | nla_strlcpy(tname, tb[TCA_IPT_TABLE], IFNAMSIZ) >= IFNAMSIZ) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 156 | strcpy(tname, "mangle"); |
| 157 | |
Arnaldo Carvalho de Melo | c7b1b24 | 2006-11-21 01:19:40 -0200 | [diff] [blame] | 158 | t = kmemdup(td, td->u.target_size, GFP_KERNEL); |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 159 | if (unlikely(!t)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 160 | goto err2; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 161 | |
Eric Dumazet | cc7ec45 | 2011-01-19 19:26:56 +0000 | [diff] [blame] | 162 | err = ipt_init_target(t, tname, hook); |
| 163 | if (err < 0) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 164 | goto err3; |
| 165 | |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 166 | ipt = to_ipt(*a); |
| 167 | |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 168 | spin_lock_bh(&ipt->tcf_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 169 | if (ret != ACT_P_CREATED) { |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 170 | ipt_destroy_target(ipt->tcfi_t); |
| 171 | kfree(ipt->tcfi_tname); |
| 172 | kfree(ipt->tcfi_t); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 173 | } |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 174 | ipt->tcfi_tname = tname; |
| 175 | ipt->tcfi_t = t; |
| 176 | ipt->tcfi_hook = hook; |
| 177 | spin_unlock_bh(&ipt->tcf_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 178 | if (ret == ACT_P_CREATED) |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 179 | tcf_hash_insert(tn, *a); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 180 | return ret; |
| 181 | |
| 182 | err3: |
| 183 | kfree(t); |
| 184 | err2: |
| 185 | kfree(tname); |
| 186 | err1: |
WANG Cong | 8606203 | 2014-02-11 17:07:31 -0800 | [diff] [blame] | 187 | if (ret == ACT_P_CREATED) |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 188 | tcf_hash_cleanup(*a, est); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 189 | return err; |
| 190 | } |
| 191 | |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 192 | static int tcf_ipt_init(struct net *net, struct nlattr *nla, |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 193 | struct nlattr *est, struct tc_action **a, int ovr, |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 194 | int bind) |
| 195 | { |
| 196 | struct tc_action_net *tn = net_generic(net, ipt_net_id); |
| 197 | |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 198 | return __tcf_ipt_init(tn, nla, est, a, &act_ipt_ops, ovr, bind); |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 199 | } |
| 200 | |
| 201 | static int tcf_xt_init(struct net *net, struct nlattr *nla, |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 202 | struct nlattr *est, struct tc_action **a, int ovr, |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 203 | int bind) |
| 204 | { |
| 205 | struct tc_action_net *tn = net_generic(net, xt_net_id); |
| 206 | |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 207 | return __tcf_ipt_init(tn, nla, est, a, &act_xt_ops, ovr, bind); |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 208 | } |
| 209 | |
Eric Dumazet | dc7f9f6 | 2011-07-05 23:25:42 +0000 | [diff] [blame] | 210 | static int tcf_ipt(struct sk_buff *skb, const struct tc_action *a, |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 211 | struct tcf_result *res) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 212 | { |
| 213 | int ret = 0, result = 0; |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 214 | struct tcf_ipt *ipt = to_ipt(a); |
Jan Engelhardt | 4b560b4 | 2009-07-05 19:43:26 +0200 | [diff] [blame] | 215 | struct xt_action_param par; |
Pablo Neira Ayuso | 613dbd9 | 2016-11-03 10:56:21 +0100 | [diff] [blame] | 216 | struct nf_hook_state state = { |
| 217 | .net = dev_net(skb->dev), |
| 218 | .in = skb->dev, |
| 219 | .hook = ipt->tcfi_hook, |
| 220 | .pf = NFPROTO_IPV4, |
| 221 | }; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 222 | |
Pravin B Shelar | 14bbd6a | 2013-02-14 09:44:49 +0000 | [diff] [blame] | 223 | if (skb_unclone(skb, GFP_ATOMIC)) |
| 224 | return TC_ACT_UNSPEC; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 225 | |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 226 | spin_lock(&ipt->tcf_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 227 | |
Jamal Hadi Salim | 9c4a4e4 | 2016-06-06 06:32:53 -0400 | [diff] [blame] | 228 | tcf_lastuse_update(&ipt->tcf_tm); |
Eric Dumazet | bfe0d02 | 2011-01-09 08:30:54 +0000 | [diff] [blame] | 229 | bstats_update(&ipt->tcf_bstats, skb); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 230 | |
| 231 | /* yes, we have to worry about both in and out dev |
Eric Dumazet | cc7ec45 | 2011-01-19 19:26:56 +0000 | [diff] [blame] | 232 | * worry later - danger - this API seems to have changed |
| 233 | * from earlier kernels |
| 234 | */ |
Pablo Neira Ayuso | 613dbd9 | 2016-11-03 10:56:21 +0100 | [diff] [blame] | 235 | par.state = &state; |
Jan Engelhardt | 7eb3558 | 2008-10-08 11:35:19 +0200 | [diff] [blame] | 236 | par.target = ipt->tcfi_t->u.kernel.target; |
| 237 | par.targinfo = ipt->tcfi_t->data; |
| 238 | ret = par.target->target(skb, &par); |
| 239 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 240 | switch (ret) { |
| 241 | case NF_ACCEPT: |
| 242 | result = TC_ACT_OK; |
| 243 | break; |
| 244 | case NF_DROP: |
| 245 | result = TC_ACT_SHOT; |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 246 | ipt->tcf_qstats.drops++; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 247 | break; |
Jan Engelhardt | 243bf6e | 2010-10-13 16:28:00 +0200 | [diff] [blame] | 248 | case XT_CONTINUE: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 249 | result = TC_ACT_PIPE; |
| 250 | break; |
| 251 | default: |
Joe Perches | e87cc47 | 2012-05-13 21:56:26 +0000 | [diff] [blame] | 252 | net_notice_ratelimited("tc filter: Bogus netfilter code %d assume ACCEPT\n", |
| 253 | ret); |
WANG Cong | 95df1b1 | 2016-06-13 10:47:43 -0700 | [diff] [blame] | 254 | result = TC_ACT_OK; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 255 | break; |
| 256 | } |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 257 | spin_unlock(&ipt->tcf_lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 258 | return result; |
| 259 | |
| 260 | } |
| 261 | |
Jamal Hadi Salim | 0b0f43f | 2016-06-05 10:41:32 -0400 | [diff] [blame] | 262 | static int tcf_ipt_dump(struct sk_buff *skb, struct tc_action *a, int bind, |
| 263 | int ref) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 264 | { |
Arnaldo Carvalho de Melo | 27a884d | 2007-04-19 20:29:13 -0700 | [diff] [blame] | 265 | unsigned char *b = skb_tail_pointer(skb); |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 266 | struct tcf_ipt *ipt = to_ipt(a); |
Jan Engelhardt | 87a2e70d | 2010-10-13 16:11:22 +0200 | [diff] [blame] | 267 | struct xt_entry_target *t; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 268 | struct tcf_t tm; |
| 269 | struct tc_cnt c; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 270 | |
| 271 | /* for simple targets kernel size == user size |
Eric Dumazet | cc7ec45 | 2011-01-19 19:26:56 +0000 | [diff] [blame] | 272 | * user name = target name |
| 273 | * for foolproof you need to not assume this |
| 274 | */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 275 | |
Arnaldo Carvalho de Melo | c7b1b24 | 2006-11-21 01:19:40 -0200 | [diff] [blame] | 276 | t = kmemdup(ipt->tcfi_t, ipt->tcfi_t->u.user.target_size, GFP_ATOMIC); |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 277 | if (unlikely(!t)) |
Patrick McHardy | 7ba699c | 2008-01-22 22:11:50 -0800 | [diff] [blame] | 278 | goto nla_put_failure; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 279 | |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 280 | c.bindcnt = ipt->tcf_bindcnt - bind; |
| 281 | c.refcnt = ipt->tcf_refcnt - ref; |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 282 | strcpy(t->u.user.name, ipt->tcfi_t->u.kernel.target->name); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 283 | |
David S. Miller | 1b34ec4 | 2012-03-29 05:11:39 -0400 | [diff] [blame] | 284 | if (nla_put(skb, TCA_IPT_TARG, ipt->tcfi_t->u.user.target_size, t) || |
| 285 | nla_put_u32(skb, TCA_IPT_INDEX, ipt->tcf_index) || |
| 286 | nla_put_u32(skb, TCA_IPT_HOOK, ipt->tcfi_hook) || |
| 287 | nla_put(skb, TCA_IPT_CNT, sizeof(struct tc_cnt), &c) || |
| 288 | nla_put_string(skb, TCA_IPT_TABLE, ipt->tcfi_tname)) |
| 289 | goto nla_put_failure; |
Jamal Hadi Salim | 48d8ee1 | 2016-06-06 06:32:55 -0400 | [diff] [blame] | 290 | |
| 291 | tcf_tm_dump(&tm, &ipt->tcf_tm); |
Nicolas Dichtel | 9854518 | 2016-04-26 10:06:18 +0200 | [diff] [blame] | 292 | if (nla_put_64bit(skb, TCA_IPT_TM, sizeof(tm), &tm, TCA_IPT_PAD)) |
David S. Miller | 1b34ec4 | 2012-03-29 05:11:39 -0400 | [diff] [blame] | 293 | goto nla_put_failure; |
Jamal Hadi Salim | 48d8ee1 | 2016-06-06 06:32:55 -0400 | [diff] [blame] | 294 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 295 | kfree(t); |
| 296 | return skb->len; |
| 297 | |
Patrick McHardy | 7ba699c | 2008-01-22 22:11:50 -0800 | [diff] [blame] | 298 | nla_put_failure: |
Arnaldo Carvalho de Melo | dc5fc57 | 2007-03-25 23:06:12 -0700 | [diff] [blame] | 299 | nlmsg_trim(skb, b); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 300 | kfree(t); |
| 301 | return -1; |
| 302 | } |
| 303 | |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 304 | static int tcf_ipt_walker(struct net *net, struct sk_buff *skb, |
| 305 | struct netlink_callback *cb, int type, |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 306 | const struct tc_action_ops *ops) |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 307 | { |
| 308 | struct tc_action_net *tn = net_generic(net, ipt_net_id); |
| 309 | |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 310 | return tcf_generic_walker(tn, skb, cb, type, ops); |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 311 | } |
| 312 | |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 313 | static int tcf_ipt_search(struct net *net, struct tc_action **a, u32 index) |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 314 | { |
| 315 | struct tc_action_net *tn = net_generic(net, ipt_net_id); |
| 316 | |
| 317 | return tcf_hash_search(tn, a, index); |
| 318 | } |
| 319 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 320 | static struct tc_action_ops act_ipt_ops = { |
| 321 | .kind = "ipt", |
| 322 | .type = TCA_ACT_IPT, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 323 | .owner = THIS_MODULE, |
| 324 | .act = tcf_ipt, |
| 325 | .dump = tcf_ipt_dump, |
WANG Cong | 8606203 | 2014-02-11 17:07:31 -0800 | [diff] [blame] | 326 | .cleanup = tcf_ipt_release, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 327 | .init = tcf_ipt_init, |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 328 | .walk = tcf_ipt_walker, |
| 329 | .lookup = tcf_ipt_search, |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 330 | .size = sizeof(struct tcf_ipt), |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 331 | }; |
| 332 | |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 333 | static __net_init int ipt_init_net(struct net *net) |
| 334 | { |
| 335 | struct tc_action_net *tn = net_generic(net, ipt_net_id); |
| 336 | |
| 337 | return tc_action_net_init(tn, &act_ipt_ops, IPT_TAB_MASK); |
| 338 | } |
| 339 | |
| 340 | static void __net_exit ipt_exit_net(struct net *net) |
| 341 | { |
| 342 | struct tc_action_net *tn = net_generic(net, ipt_net_id); |
| 343 | |
| 344 | tc_action_net_exit(tn); |
| 345 | } |
| 346 | |
| 347 | static struct pernet_operations ipt_net_ops = { |
| 348 | .init = ipt_init_net, |
| 349 | .exit = ipt_exit_net, |
| 350 | .id = &ipt_net_id, |
| 351 | .size = sizeof(struct tc_action_net), |
| 352 | }; |
| 353 | |
| 354 | static int tcf_xt_walker(struct net *net, struct sk_buff *skb, |
| 355 | struct netlink_callback *cb, int type, |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 356 | const struct tc_action_ops *ops) |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 357 | { |
| 358 | struct tc_action_net *tn = net_generic(net, xt_net_id); |
| 359 | |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 360 | return tcf_generic_walker(tn, skb, cb, type, ops); |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 361 | } |
| 362 | |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 363 | static int tcf_xt_search(struct net *net, struct tc_action **a, u32 index) |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 364 | { |
| 365 | struct tc_action_net *tn = net_generic(net, xt_net_id); |
| 366 | |
| 367 | return tcf_hash_search(tn, a, index); |
| 368 | } |
| 369 | |
Jamal Hadi Salim | 0dcffd0 | 2013-04-28 05:06:38 +0000 | [diff] [blame] | 370 | static struct tc_action_ops act_xt_ops = { |
| 371 | .kind = "xt", |
WANG Cong | 6c80563 | 2014-01-15 15:38:43 -0800 | [diff] [blame] | 372 | .type = TCA_ACT_XT, |
Jamal Hadi Salim | 0dcffd0 | 2013-04-28 05:06:38 +0000 | [diff] [blame] | 373 | .owner = THIS_MODULE, |
| 374 | .act = tcf_ipt, |
| 375 | .dump = tcf_ipt_dump, |
WANG Cong | 8606203 | 2014-02-11 17:07:31 -0800 | [diff] [blame] | 376 | .cleanup = tcf_ipt_release, |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 377 | .init = tcf_xt_init, |
| 378 | .walk = tcf_xt_walker, |
| 379 | .lookup = tcf_xt_search, |
WANG Cong | a85a970 | 2016-07-25 16:09:41 -0700 | [diff] [blame] | 380 | .size = sizeof(struct tcf_ipt), |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 381 | }; |
| 382 | |
| 383 | static __net_init int xt_init_net(struct net *net) |
| 384 | { |
| 385 | struct tc_action_net *tn = net_generic(net, xt_net_id); |
| 386 | |
| 387 | return tc_action_net_init(tn, &act_xt_ops, IPT_TAB_MASK); |
| 388 | } |
| 389 | |
| 390 | static void __net_exit xt_exit_net(struct net *net) |
| 391 | { |
| 392 | struct tc_action_net *tn = net_generic(net, xt_net_id); |
| 393 | |
| 394 | tc_action_net_exit(tn); |
| 395 | } |
| 396 | |
| 397 | static struct pernet_operations xt_net_ops = { |
| 398 | .init = xt_init_net, |
| 399 | .exit = xt_exit_net, |
| 400 | .id = &xt_net_id, |
| 401 | .size = sizeof(struct tc_action_net), |
Jamal Hadi Salim | 0dcffd0 | 2013-04-28 05:06:38 +0000 | [diff] [blame] | 402 | }; |
| 403 | |
| 404 | MODULE_AUTHOR("Jamal Hadi Salim(2002-13)"); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 405 | MODULE_DESCRIPTION("Iptables target actions"); |
| 406 | MODULE_LICENSE("GPL"); |
Jamal Hadi Salim | 0dcffd0 | 2013-04-28 05:06:38 +0000 | [diff] [blame] | 407 | MODULE_ALIAS("act_xt"); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 408 | |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 409 | static int __init ipt_init_module(void) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 410 | { |
WANG Cong | 4f1e9d8 | 2014-02-11 17:07:33 -0800 | [diff] [blame] | 411 | int ret1, ret2; |
WANG Cong | 369ba56 | 2013-12-15 20:15:08 -0800 | [diff] [blame] | 412 | |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 413 | ret1 = tcf_register_action(&act_xt_ops, &xt_net_ops); |
Jamal Hadi Salim | 0dcffd0 | 2013-04-28 05:06:38 +0000 | [diff] [blame] | 414 | if (ret1 < 0) |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 415 | pr_err("Failed to load xt action\n"); |
| 416 | |
| 417 | ret2 = tcf_register_action(&act_ipt_ops, &ipt_net_ops); |
Jamal Hadi Salim | 0dcffd0 | 2013-04-28 05:06:38 +0000 | [diff] [blame] | 418 | if (ret2 < 0) |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 419 | pr_err("Failed to load ipt action\n"); |
Jamal Hadi Salim | 0dcffd0 | 2013-04-28 05:06:38 +0000 | [diff] [blame] | 420 | |
WANG Cong | 369ba56 | 2013-12-15 20:15:08 -0800 | [diff] [blame] | 421 | if (ret1 < 0 && ret2 < 0) { |
Jamal Hadi Salim | 0dcffd0 | 2013-04-28 05:06:38 +0000 | [diff] [blame] | 422 | return ret1; |
WANG Cong | 369ba56 | 2013-12-15 20:15:08 -0800 | [diff] [blame] | 423 | } else |
Jamal Hadi Salim | 0dcffd0 | 2013-04-28 05:06:38 +0000 | [diff] [blame] | 424 | return 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 425 | } |
| 426 | |
David S. Miller | e9ce1cd | 2006-08-21 23:54:55 -0700 | [diff] [blame] | 427 | static void __exit ipt_cleanup_module(void) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 428 | { |
WANG Cong | ddf97cc | 2016-02-22 15:57:53 -0800 | [diff] [blame] | 429 | tcf_unregister_action(&act_ipt_ops, &ipt_net_ops); |
| 430 | tcf_unregister_action(&act_xt_ops, &xt_net_ops); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 431 | } |
| 432 | |
| 433 | module_init(ipt_init_module); |
| 434 | module_exit(ipt_cleanup_module); |