[net-next-2.6.git] / net / netfilter / xt_TEE.c

/*
 *	"TEE" target extension for Xtables
 *	Copyright © Sebastian Claßen, 2007
 *	Jan Engelhardt, 2007-2010
 *
 *	based on ipt_ROUTE.c from Cédric de Launois
 *	<delaunois@info.ucl.be>
 *
 *	This program is free software; you can redistribute it and/or
 *	modify it under the terms of the GNU General Public License
 *	version 2 or later, as published by the Free Software Foundation.
 */
#include <linux/ip.h>
#include <linux/module.h>
#include <linux/percpu.h>
#include <linux/route.h>
#include <linux/skbuff.h>
#include <linux/notifier.h>
#include <net/checksum.h>
#include <net/icmp.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/ip6_route.h>
#include <net/route.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_TEE.h>

#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
#	define WITH_CONNTRACK 1
#	include <net/netfilter/nf_conntrack.h>
#endif
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
#	define WITH_IPV6 1
#endif

struct xt_tee_priv {
	struct notifier_block	notifier;
	struct xt_tee_tginfo	*tginfo;
	int			oif;
};

static const union nf_inet_addr tee_zero_address;
static DEFINE_PER_CPU(bool, tee_active);

static struct net *pick_net(struct sk_buff *skb)
{
#ifdef CONFIG_NET_NS
	const struct dst_entry *dst;

	if (skb->dev != NULL)
		return dev_net(skb->dev);
	dst = skb_dst(skb);
	if (dst != NULL && dst->dev != NULL)
		return dev_net(dst->dev);
#endif
	return &init_net;
}

static bool
tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info)
{
	const struct iphdr *iph = ip_hdr(skb);
	struct net *net = pick_net(skb);
	struct rtable *rt;
	struct flowi fl;

	memset(&fl, 0, sizeof(fl));
	if (info->priv) {
		if (info->priv->oif == -1)
			return false;
		fl.oif = info->priv->oif;
	}
	fl.fl4_dst = info->gw.ip;
	fl.fl4_tos = RT_TOS(iph->tos);
	fl.fl4_scope = RT_SCOPE_UNIVERSE;
	if (ip_route_output_key(net, &rt, &fl) != 0)
		return false;

	skb_dst_drop(skb);
	skb_dst_set(skb, &rt->dst);
	skb->dev      = rt->dst.dev;
	skb->protocol = htons(ETH_P_IP);
	return true;
}

static unsigned int
tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct xt_tee_tginfo *info = par->targinfo;
	struct iphdr *iph;

	if (percpu_read(tee_active))
		return XT_CONTINUE;
	/*
	 * Copy the skb, and route the copy. Will later return %XT_CONTINUE for
	 * the original skb, which should continue on its way as if nothing has
	 * happened. The copy should be independently delivered to the TEE
	 * --gateway.
	 */
	skb = pskb_copy(skb, GFP_ATOMIC);
	if (skb == NULL)
		return XT_CONTINUE;

#ifdef WITH_CONNTRACK
	/* Avoid counting cloned packets towards the original connection. */
	nf_conntrack_put(skb->nfct);
	skb->nfct     = &nf_ct_untracked_get()->ct_general;
	skb->nfctinfo = IP_CT_NEW;
	nf_conntrack_get(skb->nfct);
#endif
	/*
	 * If we are in PREROUTING/INPUT, the checksum must be recalculated
	 * since the length could have changed as a result of defragmentation.
	 *
	 * We also decrease the TTL to mitigate potential TEE loops
	 * between two hosts.
	 *
	 * Set %IP_DF so that the original source is notified of a potentially
	 * decreased MTU on the clone route. IPv6 does this too.
	 */
	iph = ip_hdr(skb);
	iph->frag_off |= htons(IP_DF);
	if (par->hooknum == NF_INET_PRE_ROUTING ||
	    par->hooknum == NF_INET_LOCAL_IN)
		--iph->ttl;
	ip_send_check(iph);

	if (tee_tg_route4(skb, info)) {
		percpu_write(tee_active, true);
		ip_local_out(skb);
		percpu_write(tee_active, false);
	} else {
		kfree_skb(skb);
	}
	return XT_CONTINUE;
}

#ifdef WITH_IPV6
static bool
tee_tg_route6(struct sk_buff *skb, const struct xt_tee_tginfo *info)
{
	const struct ipv6hdr *iph = ipv6_hdr(skb);
	struct net *net = pick_net(skb);
	struct dst_entry *dst;
	struct flowi fl;

	memset(&fl, 0, sizeof(fl));
	if (info->priv) {
		if (info->priv->oif == -1)
			return false;
		fl.oif = info->priv->oif;
	}
	fl.fl6_dst = info->gw.in6;
	fl.fl6_flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) |
			   (iph->flow_lbl[1] << 8) | iph->flow_lbl[2];
	dst = ip6_route_output(net, NULL, &fl);
	if (dst == NULL)
		return false;

	skb_dst_drop(skb);
	skb_dst_set(skb, dst);
	skb->dev      = dst->dev;
	skb->protocol = htons(ETH_P_IPV6);
	return true;
}

static unsigned int
tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct xt_tee_tginfo *info = par->targinfo;

	if (percpu_read(tee_active))
		return XT_CONTINUE;
	skb = pskb_copy(skb, GFP_ATOMIC);
	if (skb == NULL)
		return XT_CONTINUE;

#ifdef WITH_CONNTRACK
	nf_conntrack_put(skb->nfct);
	skb->nfct     = &nf_ct_untracked_get()->ct_general;
	skb->nfctinfo = IP_CT_NEW;
	nf_conntrack_get(skb->nfct);
#endif
	if (par->hooknum == NF_INET_PRE_ROUTING ||
	    par->hooknum == NF_INET_LOCAL_IN) {
		struct ipv6hdr *iph = ipv6_hdr(skb);
		--iph->hop_limit;
	}
	if (tee_tg_route6(skb, info)) {
		percpu_write(tee_active, true);
		ip6_local_out(skb);
		percpu_write(tee_active, false);
	} else {
		kfree_skb(skb);
	}
	return XT_CONTINUE;
}
#endif /* WITH_IPV6 */

static int tee_netdev_event(struct notifier_block *this, unsigned long event,
			    void *ptr)
{
	struct net_device *dev = ptr;
	struct xt_tee_priv *priv;

	priv = container_of(this, struct xt_tee_priv, notifier);
	switch (event) {
	case NETDEV_REGISTER:
		if (!strcmp(dev->name, priv->tginfo->oif))
			priv->oif = dev->ifindex;
		break;
	case NETDEV_UNREGISTER:
		if (dev->ifindex == priv->oif)
			priv->oif = -1;
		break;
	case NETDEV_CHANGENAME:
		if (!strcmp(dev->name, priv->tginfo->oif))
			priv->oif = dev->ifindex;
		else if (dev->ifindex == priv->oif)
			priv->oif = -1;
		break;
	}

	return NOTIFY_DONE;
}

static int tee_tg_check(const struct xt_tgchk_param *par)
{
	struct xt_tee_tginfo *info = par->targinfo;
	struct xt_tee_priv *priv;

	/* 0.0.0.0 and :: not allowed */
	if (memcmp(&info->gw, &tee_zero_address,
		   sizeof(tee_zero_address)) == 0)
		return -EINVAL;

	if (info->oif[0]) {
		if (info->oif[sizeof(info->oif)-1] != '\0')
			return -EINVAL;

		priv = kzalloc(sizeof(*priv), GFP_KERNEL);
		if (priv == NULL)
			return -ENOMEM;

		priv->tginfo  = info;
		priv->oif     = -1;
		priv->notifier.notifier_call = tee_netdev_event;
		info->priv    = priv;

		register_netdevice_notifier(&priv->notifier);
	} else
		info->priv = NULL;

	return 0;
}

static void tee_tg_destroy(const struct xt_tgdtor_param *par)
{
	struct xt_tee_tginfo *info = par->targinfo;

	if (info->priv) {
		unregister_netdevice_notifier(&info->priv->notifier);
		kfree(info->priv);
	}
}

static struct xt_target tee_tg_reg[] __read_mostly = {
	{
		.name       = "TEE",
		.revision   = 1,
		.family     = NFPROTO_IPV4,
		.target     = tee_tg4,
		.targetsize = sizeof(struct xt_tee_tginfo),
		.checkentry = tee_tg_check,
		.destroy    = tee_tg_destroy,
		.me         = THIS_MODULE,
	},
#ifdef WITH_IPV6
	{
		.name       = "TEE",
		.revision   = 1,
		.family     = NFPROTO_IPV6,
		.target     = tee_tg6,
		.targetsize = sizeof(struct xt_tee_tginfo),
		.checkentry = tee_tg_check,
		.destroy    = tee_tg_destroy,
		.me         = THIS_MODULE,
	},
#endif
};

static int __init tee_tg_init(void)
{
	return xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
}

static void __exit tee_tg_exit(void)
{
	xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
}

module_init(tee_tg_init);
module_exit(tee_tg_exit);
MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>");
MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
MODULE_DESCRIPTION("Xtables: Reroute packet copy");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_TEE");
MODULE_ALIAS("ip6t_TEE");
Commit	Line	Data
e281b198 JE	1	/*
	2	* "TEE" target extension for Xtables
	3	* Copyright © Sebastian Claßen, 2007
	4	* Jan Engelhardt, 2007-2010
	5	*
	6	* based on ipt_ROUTE.c from Cédric de Launois
	7	* <delaunois@info.ucl.be>
	8	*
	9	* This program is free software; you can redistribute it and/or
	10	* modify it under the terms of the GNU General Public License
	11	* version 2 or later, as published by the Free Software Foundation.
	12	*/
	13	#include <linux/ip.h>
	14	#include <linux/module.h>
cd58bcd9	15	#include <linux/percpu.h>
e281b198 JE	16	#include <linux/route.h>
e281b198 JE	17	#include <linux/skbuff.h>
22265a5c	18	#include <linux/notifier.h>
e281b198 JE	19	#include <net/checksum.h>
	20	#include <net/icmp.h>
	21	#include <net/ip.h>
	22	#include <net/ipv6.h>
	23	#include <net/ip6_route.h>
	24	#include <net/route.h>
	25	#include <linux/netfilter/x_tables.h>
	26	#include <linux/netfilter/xt_TEE.h>
	27
	28	#if defined(CONFIG_NF_CONNTRACK) \|\| defined(CONFIG_NF_CONNTRACK_MODULE)
	29	# define WITH_CONNTRACK 1
	30	# include <net/netfilter/nf_conntrack.h>
	31	#endif
	32	#if defined(CONFIG_IPV6) \|\| defined(CONFIG_IPV6_MODULE)
	33	# define WITH_IPV6 1
	34	#endif
	35
22265a5c PM	36	struct xt_tee_priv {
	37	struct notifier_block notifier;
	38	struct xt_tee_tginfo *tginfo;
	39	int oif;
	40	};
	41
e281b198	42	static const union nf_inet_addr tee_zero_address;
cd58bcd9	43	static DEFINE_PER_CPU(bool, tee_active);
e281b198 JE	44
	45	static struct net pick_net(struct sk_buff skb)
	46	{
	47	#ifdef CONFIG_NET_NS
	48	const struct dst_entry *dst;
	49
	50	if (skb->dev != NULL)
	51	return dev_net(skb->dev);
	52	dst = skb_dst(skb);
	53	if (dst != NULL && dst->dev != NULL)
	54	return dev_net(dst->dev);
	55	#endif
	56	return &init_net;
	57	}
	58
e281b198 JE	59	static bool
	60	tee_tg_route4(struct sk_buff skb, const struct xt_tee_tginfo info)
	61	{
	62	const struct iphdr *iph = ip_hdr(skb);
	63	struct net *net = pick_net(skb);
	64	struct rtable *rt;
	65	struct flowi fl;
	66
	67	memset(&fl, 0, sizeof(fl));
22265a5c PM	68	if (info->priv) {
	69	if (info->priv->oif == -1)
	70	return false;
	71	fl.oif = info->priv->oif;
	72	}
5811662b CG	73	fl.fl4_dst = info->gw.ip;
	74	fl.fl4_tos = RT_TOS(iph->tos);
	75	fl.fl4_scope = RT_SCOPE_UNIVERSE;
e281b198 JE	76	if (ip_route_output_key(net, &rt, &fl) != 0)
	77	return false;
	78
50636af7	79	skb_dst_drop(skb);
d8d1f30b CG	80	skb_dst_set(skb, &rt->dst);
d8d1f30b CG	81	skb->dev = rt->dst.dev;
e281b198 JE	82	skb->protocol = htons(ETH_P_IP);
	83	return true;
	84	}
	85
	86	static unsigned int
4b560b44	87	tee_tg4(struct sk_buff skb, const struct xt_action_param par)
e281b198 JE	88	{
	89	const struct xt_tee_tginfo *info = par->targinfo;
	90	struct iphdr *iph;
	91
cd58bcd9 JE	92	if (percpu_read(tee_active))
cd58bcd9 JE	93	return XT_CONTINUE;
e281b198 JE	94	/*
	95	* Copy the skb, and route the copy. Will later return %XT_CONTINUE for
	96	* the original skb, which should continue on its way as if nothing has
	97	* happened. The copy should be independently delivered to the TEE
	98	* --gateway.
	99	*/
	100	skb = pskb_copy(skb, GFP_ATOMIC);
	101	if (skb == NULL)
	102	return XT_CONTINUE;
	103
	104	#ifdef WITH_CONNTRACK
	105	/* Avoid counting cloned packets towards the original connection. */
	106	nf_conntrack_put(skb->nfct);
5bfddbd4	107	skb->nfct = &nf_ct_untracked_get()->ct_general;
e281b198 JE	108	skb->nfctinfo = IP_CT_NEW;
	109	nf_conntrack_get(skb->nfct);
	110	#endif
	111	/*
	112	* If we are in PREROUTING/INPUT, the checksum must be recalculated
	113	* since the length could have changed as a result of defragmentation.
	114	*
	115	* We also decrease the TTL to mitigate potential TEE loops
	116	* between two hosts.
	117	*
	118	* Set %IP_DF so that the original source is notified of a potentially
	119	* decreased MTU on the clone route. IPv6 does this too.
	120	*/
	121	iph = ip_hdr(skb);
	122	iph->frag_off \|= htons(IP_DF);
	123	if (par->hooknum == NF_INET_PRE_ROUTING \|\|
	124	par->hooknum == NF_INET_LOCAL_IN)
	125	--iph->ttl;
	126	ip_send_check(iph);
	127
cd58bcd9 JE	128	if (tee_tg_route4(skb, info)) {
	129	percpu_write(tee_active, true);
	130	ip_local_out(skb);
	131	percpu_write(tee_active, false);
	132	} else {
e281b198	133	kfree_skb(skb);
cd58bcd9	134	}
e281b198 JE	135	return XT_CONTINUE;
	136	}
	137
	138	#ifdef WITH_IPV6
	139	static bool
	140	tee_tg_route6(struct sk_buff skb, const struct xt_tee_tginfo info)
	141	{
	142	const struct ipv6hdr *iph = ipv6_hdr(skb);
	143	struct net *net = pick_net(skb);
	144	struct dst_entry *dst;
	145	struct flowi fl;
	146
	147	memset(&fl, 0, sizeof(fl));
22265a5c PM	148	if (info->priv) {
	149	if (info->priv->oif == -1)
	150	return false;
	151	fl.oif = info->priv->oif;
	152	}
5811662b CG	153	fl.fl6_dst = info->gw.in6;
	154	fl.fl6_flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) \|
	155	(iph->flow_lbl[1] << 8) \| iph->flow_lbl[2];
e281b198 JE	156	dst = ip6_route_output(net, NULL, &fl);
	157	if (dst == NULL)
	158	return false;
	159
50636af7	160	skb_dst_drop(skb);
e281b198 JE	161	skb_dst_set(skb, dst);
	162	skb->dev = dst->dev;
	163	skb->protocol = htons(ETH_P_IPV6);
	164	return true;
	165	}
	166
	167	static unsigned int
4b560b44	168	tee_tg6(struct sk_buff skb, const struct xt_action_param par)
e281b198 JE	169	{
	170	const struct xt_tee_tginfo *info = par->targinfo;
	171
cd58bcd9 JE	172	if (percpu_read(tee_active))
cd58bcd9 JE	173	return XT_CONTINUE;
e281b198 JE	174	skb = pskb_copy(skb, GFP_ATOMIC);
	175	if (skb == NULL)
	176	return XT_CONTINUE;
	177
	178	#ifdef WITH_CONNTRACK
	179	nf_conntrack_put(skb->nfct);
5bfddbd4	180	skb->nfct = &nf_ct_untracked_get()->ct_general;
e281b198 JE	181	skb->nfctinfo = IP_CT_NEW;
	182	nf_conntrack_get(skb->nfct);
	183	#endif
	184	if (par->hooknum == NF_INET_PRE_ROUTING \|\|
	185	par->hooknum == NF_INET_LOCAL_IN) {
	186	struct ipv6hdr *iph = ipv6_hdr(skb);
	187	--iph->hop_limit;
	188	}
cd58bcd9 JE	189	if (tee_tg_route6(skb, info)) {
	190	percpu_write(tee_active, true);
	191	ip6_local_out(skb);
	192	percpu_write(tee_active, false);
	193	} else {
e281b198	194	kfree_skb(skb);
cd58bcd9	195	}
e281b198 JE	196	return XT_CONTINUE;
	197	}
	198	#endif /* WITH_IPV6 */
	199
22265a5c PM	200	static int tee_netdev_event(struct notifier_block *this, unsigned long event,
	201	void *ptr)
	202	{
	203	struct net_device *dev = ptr;
	204	struct xt_tee_priv *priv;
	205
	206	priv = container_of(this, struct xt_tee_priv, notifier);
	207	switch (event) {
	208	case NETDEV_REGISTER:
	209	if (!strcmp(dev->name, priv->tginfo->oif))
	210	priv->oif = dev->ifindex;
	211	break;
	212	case NETDEV_UNREGISTER:
	213	if (dev->ifindex == priv->oif)
	214	priv->oif = -1;
	215	break;
	216	case NETDEV_CHANGENAME:
	217	if (!strcmp(dev->name, priv->tginfo->oif))
	218	priv->oif = dev->ifindex;
	219	else if (dev->ifindex == priv->oif)
	220	priv->oif = -1;
	221	break;
	222	}
	223
	224	return NOTIFY_DONE;
	225	}
	226
e281b198 JE	227	static int tee_tg_check(const struct xt_tgchk_param *par)
e281b198 JE	228	{
22265a5c PM	229	struct xt_tee_tginfo *info = par->targinfo;
22265a5c PM	230	struct xt_tee_priv *priv;
e281b198	231
e281b198	232	/* 0.0.0.0 and :: not allowed */
22265a5c PM	233	if (memcmp(&info->gw, &tee_zero_address,
	234	sizeof(tee_zero_address)) == 0)
	235	return -EINVAL;
	236
	237	if (info->oif[0]) {
	238	if (info->oif[sizeof(info->oif)-1] != '\0')
	239	return -EINVAL;
	240
	241	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
	242	if (priv == NULL)
	243	return -ENOMEM;
	244
	245	priv->tginfo = info;
	246	priv->oif = -1;
	247	priv->notifier.notifier_call = tee_netdev_event;
	248	info->priv = priv;
	249
	250	register_netdevice_notifier(&priv->notifier);
	251	} else
	252	info->priv = NULL;
	253
	254	return 0;
	255	}
	256
	257	static void tee_tg_destroy(const struct xt_tgdtor_param *par)
	258	{
	259	struct xt_tee_tginfo *info = par->targinfo;
	260
	261	if (info->priv) {
	262	unregister_netdevice_notifier(&info->priv->notifier);
	263	kfree(info->priv);
	264	}
e281b198 JE	265	}
	266
	267	static struct xt_target tee_tg_reg[] __read_mostly = {
	268	{
	269	.name = "TEE",
	270	.revision = 1,
	271	.family = NFPROTO_IPV4,
	272	.target = tee_tg4,
	273	.targetsize = sizeof(struct xt_tee_tginfo),
	274	.checkentry = tee_tg_check,
22265a5c	275	.destroy = tee_tg_destroy,
e281b198 JE	276	.me = THIS_MODULE,
	277	},
	278	#ifdef WITH_IPV6
	279	{
	280	.name = "TEE",
	281	.revision = 1,
	282	.family = NFPROTO_IPV6,
	283	.target = tee_tg6,
	284	.targetsize = sizeof(struct xt_tee_tginfo),
	285	.checkentry = tee_tg_check,
22265a5c	286	.destroy = tee_tg_destroy,
e281b198 JE	287	.me = THIS_MODULE,
	288	},
	289	#endif
	290	};
	291
	292	static int __init tee_tg_init(void)
	293	{
	294	return xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
	295	}
	296
	297	static void __exit tee_tg_exit(void)
	298	{
	299	xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
	300	}
	301
	302	module_init(tee_tg_init);
	303	module_exit(tee_tg_exit);
	304	MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>");
	305	MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
	306	MODULE_DESCRIPTION("Xtables: Reroute packet copy");
	307	MODULE_LICENSE("GPL");
	308	MODULE_ALIAS("ipt_TEE");
	309	MODULE_ALIAS("ip6t_TEE");