blob: 6056d20ef429daac373be83b3fefbd9c315c17b5 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * net/sched/ipt.c iptables target interface
3 *
4 *TODO: Add other tables. For now we only support the ipv4 table targets
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 * Copyright: Jamal Hadi Salim (2002-4)
12 */
13
14#include <asm/uaccess.h>
15#include <asm/system.h>
16#include <asm/bitops.h>
17#include <linux/config.h>
18#include <linux/types.h>
19#include <linux/kernel.h>
20#include <linux/sched.h>
21#include <linux/string.h>
22#include <linux/mm.h>
23#include <linux/socket.h>
24#include <linux/sockios.h>
25#include <linux/in.h>
26#include <linux/errno.h>
27#include <linux/interrupt.h>
28#include <linux/netdevice.h>
29#include <linux/skbuff.h>
30#include <linux/rtnetlink.h>
31#include <linux/module.h>
32#include <linux/init.h>
33#include <linux/proc_fs.h>
34#include <linux/kmod.h>
35#include <net/sock.h>
36#include <net/pkt_sched.h>
37#include <linux/tc_act/tc_ipt.h>
38#include <net/tc_act/tc_ipt.h>
39
40#include <linux/netfilter_ipv4/ip_tables.h>
41
42/* use generic hash table */
43#define MY_TAB_SIZE 16
44#define MY_TAB_MASK 15
45
46static u32 idx_gen;
47static struct tcf_ipt *tcf_ipt_ht[MY_TAB_SIZE];
48/* ipt hash table lock */
49static DEFINE_RWLOCK(ipt_lock);
50
51/* ovewrride the defaults */
52#define tcf_st tcf_ipt
53#define tcf_t_lock ipt_lock
54#define tcf_ht tcf_ipt_ht
55
56#define CONFIG_NET_ACT_INIT
57#include <net/pkt_act.h>
58
59static int
60ipt_init_target(struct ipt_entry_target *t, char *table, unsigned int hook)
61{
62 struct ipt_target *target;
63 int ret = 0;
64
Harald Welte2e4e6a12006-01-12 13:30:04 -080065 target = xt_find_target(AF_INET, t->u.user.name, t->u.user.revision);
Linus Torvalds1da177e2005-04-16 15:20:36 -070066 if (!target)
67 return -ENOENT;
68
69 DPRINTK("ipt_init_target: found %s\n", target->name);
70 t->u.kernel.target = target;
71
72 if (t->u.kernel.target->checkentry
Patrick McHardy1c524832006-03-20 18:02:15 -080073 && !t->u.kernel.target->checkentry(table, NULL,
74 t->u.kernel.target, t->data,
Linus Torvalds1da177e2005-04-16 15:20:36 -070075 t->u.target_size - sizeof(*t),
76 hook)) {
77 DPRINTK("ipt_init_target: check failed for `%s'.\n",
78 t->u.kernel.target->name);
79 module_put(t->u.kernel.target->me);
80 ret = -EINVAL;
81 }
82
83 return ret;
84}
85
86static void
87ipt_destroy_target(struct ipt_entry_target *t)
88{
89 if (t->u.kernel.target->destroy)
Patrick McHardy1c524832006-03-20 18:02:15 -080090 t->u.kernel.target->destroy(t->u.kernel.target, t->data,
Linus Torvalds1da177e2005-04-16 15:20:36 -070091 t->u.target_size - sizeof(*t));
92 module_put(t->u.kernel.target->me);
93}
94
95static int
96tcf_ipt_release(struct tcf_ipt *p, int bind)
97{
98 int ret = 0;
99 if (p) {
100 if (bind)
101 p->bindcnt--;
102 p->refcnt--;
103 if (p->bindcnt <= 0 && p->refcnt <= 0) {
104 ipt_destroy_target(p->t);
105 kfree(p->tname);
106 kfree(p->t);
107 tcf_hash_destroy(p);
108 ret = ACT_P_DELETED;
109 }
110 }
111 return ret;
112}
113
114static int
115tcf_ipt_init(struct rtattr *rta, struct rtattr *est, struct tc_action *a,
116 int ovr, int bind)
117{
118 struct rtattr *tb[TCA_IPT_MAX];
119 struct tcf_ipt *p;
120 struct ipt_entry_target *td, *t;
121 char *tname;
122 int ret = 0, err;
123 u32 hook = 0;
124 u32 index = 0;
125
126 if (rta == NULL || rtattr_parse_nested(tb, TCA_IPT_MAX, rta) < 0)
127 return -EINVAL;
128
129 if (tb[TCA_IPT_HOOK-1] == NULL ||
130 RTA_PAYLOAD(tb[TCA_IPT_HOOK-1]) < sizeof(u32))
131 return -EINVAL;
132 if (tb[TCA_IPT_TARG-1] == NULL ||
133 RTA_PAYLOAD(tb[TCA_IPT_TARG-1]) < sizeof(*t))
134 return -EINVAL;
135 td = (struct ipt_entry_target *)RTA_DATA(tb[TCA_IPT_TARG-1]);
136 if (RTA_PAYLOAD(tb[TCA_IPT_TARG-1]) < td->u.target_size)
137 return -EINVAL;
138
139 if (tb[TCA_IPT_INDEX-1] != NULL &&
140 RTA_PAYLOAD(tb[TCA_IPT_INDEX-1]) >= sizeof(u32))
141 index = *(u32 *)RTA_DATA(tb[TCA_IPT_INDEX-1]);
142
143 p = tcf_hash_check(index, a, ovr, bind);
144 if (p == NULL) {
145 p = tcf_hash_create(index, est, a, sizeof(*p), ovr, bind);
146 if (p == NULL)
147 return -ENOMEM;
148 ret = ACT_P_CREATED;
149 } else {
150 if (!ovr) {
151 tcf_ipt_release(p, bind);
152 return -EEXIST;
153 }
154 }
155
156 hook = *(u32 *)RTA_DATA(tb[TCA_IPT_HOOK-1]);
157
158 err = -ENOMEM;
159 tname = kmalloc(IFNAMSIZ, GFP_KERNEL);
160 if (tname == NULL)
161 goto err1;
162 if (tb[TCA_IPT_TABLE - 1] == NULL ||
163 rtattr_strlcpy(tname, tb[TCA_IPT_TABLE-1], IFNAMSIZ) >= IFNAMSIZ)
164 strcpy(tname, "mangle");
165
166 t = kmalloc(td->u.target_size, GFP_KERNEL);
167 if (t == NULL)
168 goto err2;
169 memcpy(t, td, td->u.target_size);
170
171 if ((err = ipt_init_target(t, tname, hook)) < 0)
172 goto err3;
173
174 spin_lock_bh(&p->lock);
175 if (ret != ACT_P_CREATED) {
176 ipt_destroy_target(p->t);
177 kfree(p->tname);
178 kfree(p->t);
179 }
180 p->tname = tname;
181 p->t = t;
182 p->hook = hook;
183 spin_unlock_bh(&p->lock);
184 if (ret == ACT_P_CREATED)
185 tcf_hash_insert(p);
186 return ret;
187
188err3:
189 kfree(t);
190err2:
191 kfree(tname);
192err1:
193 kfree(p);
194 return err;
195}
196
197static int
198tcf_ipt_cleanup(struct tc_action *a, int bind)
199{
200 struct tcf_ipt *p = PRIV(a, ipt);
201 return tcf_ipt_release(p, bind);
202}
203
204static int
Patrick McHardyf43c5a02006-01-08 22:15:34 -0800205tcf_ipt(struct sk_buff *skb, struct tc_action *a, struct tcf_result *res)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700206{
207 int ret = 0, result = 0;
208 struct tcf_ipt *p = PRIV(a, ipt);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700209
210 if (skb_cloned(skb)) {
211 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
212 return TC_ACT_UNSPEC;
213 }
214
215 spin_lock(&p->lock);
216
217 p->tm.lastuse = jiffies;
218 p->bstats.bytes += skb->len;
219 p->bstats.packets++;
220
221 /* yes, we have to worry about both in and out dev
222 worry later - danger - this API seems to have changed
223 from earlier kernels */
224
Patrick McHardyf43c5a02006-01-08 22:15:34 -0800225 /* iptables targets take a double skb pointer in case the skb
226 * needs to be replaced. We don't own the skb, so this must not
227 * happen. The pskb_expand_head above should make sure of this */
Patrick McHardy1c524832006-03-20 18:02:15 -0800228 ret = p->t->u.kernel.target->target(&skb, skb->dev, NULL, p->hook,
229 p->t->u.kernel.target, p->t->data,
230 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700231 switch (ret) {
232 case NF_ACCEPT:
233 result = TC_ACT_OK;
234 break;
235 case NF_DROP:
236 result = TC_ACT_SHOT;
237 p->qstats.drops++;
238 break;
239 case IPT_CONTINUE:
240 result = TC_ACT_PIPE;
241 break;
242 default:
243 if (net_ratelimit())
244 printk("Bogus netfilter code %d assume ACCEPT\n", ret);
245 result = TC_POLICE_OK;
246 break;
247 }
248 spin_unlock(&p->lock);
249 return result;
250
251}
252
253static int
254tcf_ipt_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
255{
256 struct ipt_entry_target *t;
257 struct tcf_t tm;
258 struct tc_cnt c;
259 unsigned char *b = skb->tail;
260 struct tcf_ipt *p = PRIV(a, ipt);
261
262 /* for simple targets kernel size == user size
263 ** user name = target name
264 ** for foolproof you need to not assume this
265 */
266
267 t = kmalloc(p->t->u.user.target_size, GFP_ATOMIC);
268 if (t == NULL)
269 goto rtattr_failure;
270
271 c.bindcnt = p->bindcnt - bind;
272 c.refcnt = p->refcnt - ref;
273 memcpy(t, p->t, p->t->u.user.target_size);
274 strcpy(t->u.user.name, p->t->u.kernel.target->name);
275
276 DPRINTK("\ttcf_ipt_dump tablename %s length %d\n", p->tname,
277 strlen(p->tname));
278 DPRINTK("\tdump target name %s size %d size user %d "
279 "data[0] %x data[1] %x\n", p->t->u.kernel.target->name,
280 p->t->u.target_size, p->t->u.user.target_size,
281 p->t->data[0], p->t->data[1]);
282 RTA_PUT(skb, TCA_IPT_TARG, p->t->u.user.target_size, t);
283 RTA_PUT(skb, TCA_IPT_INDEX, 4, &p->index);
284 RTA_PUT(skb, TCA_IPT_HOOK, 4, &p->hook);
285 RTA_PUT(skb, TCA_IPT_CNT, sizeof(struct tc_cnt), &c);
286 RTA_PUT(skb, TCA_IPT_TABLE, IFNAMSIZ, p->tname);
287 tm.install = jiffies_to_clock_t(jiffies - p->tm.install);
288 tm.lastuse = jiffies_to_clock_t(jiffies - p->tm.lastuse);
289 tm.expires = jiffies_to_clock_t(p->tm.expires);
290 RTA_PUT(skb, TCA_IPT_TM, sizeof (tm), &tm);
291 kfree(t);
292 return skb->len;
293
294 rtattr_failure:
295 skb_trim(skb, b - skb->data);
296 kfree(t);
297 return -1;
298}
299
300static struct tc_action_ops act_ipt_ops = {
301 .kind = "ipt",
302 .type = TCA_ACT_IPT,
303 .capab = TCA_CAP_NONE,
304 .owner = THIS_MODULE,
305 .act = tcf_ipt,
306 .dump = tcf_ipt_dump,
307 .cleanup = tcf_ipt_cleanup,
308 .lookup = tcf_hash_search,
309 .init = tcf_ipt_init,
310 .walk = tcf_generic_walker
311};
312
313MODULE_AUTHOR("Jamal Hadi Salim(2002-4)");
314MODULE_DESCRIPTION("Iptables target actions");
315MODULE_LICENSE("GPL");
316
317static int __init
318ipt_init_module(void)
319{
320 return tcf_register_action(&act_ipt_ops);
321}
322
323static void __exit
324ipt_cleanup_module(void)
325{
326 tcf_unregister_action(&act_ipt_ops);
327}
328
329module_init(ipt_init_module);
330module_exit(ipt_cleanup_module);