1/* 2 * "TEE" target extension for Xtables 3 * Copyright �� Sebastian Cla��en, 2007 4 * Jan Engelhardt, 2007-2010 5 * 6 * based on ipt_ROUTE.c from C��dric de Launois 7 * <delaunois@info.ucl.be> 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License 11 * version 2 or later, as published by the Free Software Foundation. 12 */ 13#include <linux/ip.h> 14#include <linux/module.h> 15#include <linux/percpu.h> 16#include <linux/route.h> 17#include <linux/skbuff.h> 18#include <linux/notifier.h> 19#include <net/checksum.h> 20#include <net/icmp.h> 21#include <net/ip.h> 22#include <net/ipv6.h> 23#include <net/ip6_route.h> 24#include <net/route.h> 25#include <linux/netfilter/x_tables.h> 26#include <linux/netfilter/xt_TEE.h> 27 28#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 29# define WITH_CONNTRACK 1 30# include <net/netfilter/nf_conntrack.h> 31#endif 32#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 33# define WITH_IPV6 1 34#endif 35 36struct xt_tee_priv { 37 struct notifier_block notifier; 38 struct xt_tee_tginfo *tginfo; 39 int oif; 40}; 41 42static const union nf_inet_addr tee_zero_address; 43static DEFINE_PER_CPU(bool, tee_active); 44 45static struct net *pick_net(struct sk_buff *skb) 46{ 47#ifdef CONFIG_NET_NS 48 const struct dst_entry *dst; 49 50 if (skb->dev != NULL) 51 return dev_net(skb->dev); 52 dst = skb_dst(skb); 53 if (dst != NULL && dst->dev != NULL) 54 return dev_net(dst->dev); 55#endif 56 return &init_net; 57} 58 59static bool 60tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info) 61{ 62 const struct iphdr *iph = ip_hdr(skb); 63 struct net *net = pick_net(skb); 64 struct rtable *rt; 65 struct flowi fl; 66 67 memset(&fl, 0, sizeof(fl)); 68 if (info->priv) { 69 if (info->priv->oif == -1) 70 return false; 71 fl.oif = info->priv->oif; 72 } 73 fl.nl_u.ip4_u.daddr = info->gw.ip; 74 fl.nl_u.ip4_u.tos = RT_TOS(iph->tos); 75 fl.nl_u.ip4_u.scope = RT_SCOPE_UNIVERSE; 76 if (ip_route_output_key(net, &rt, &fl) != 0) 77 return false; 78 79 skb_dst_drop(skb); 80 skb_dst_set(skb, &rt->dst); 81 skb->dev = rt->dst.dev; 82 skb->protocol = htons(ETH_P_IP); 83 return true; 84} 85 86static unsigned int 87tee_tg4(struct sk_buff *skb, const struct xt_action_param *par) 88{ 89 const struct xt_tee_tginfo *info = par->targinfo; 90 struct iphdr *iph; 91 92 if (percpu_read(tee_active)) 93 return XT_CONTINUE; 94 /* 95 * Copy the skb, and route the copy. Will later return %XT_CONTINUE for 96 * the original skb, which should continue on its way as if nothing has 97 * happened. The copy should be independently delivered to the TEE 98 * --gateway. 99 */ 100 skb = pskb_copy(skb, GFP_ATOMIC); 101 if (skb == NULL) 102 return XT_CONTINUE; 103 104#ifdef WITH_CONNTRACK 105 /* Avoid counting cloned packets towards the original connection. */ 106 nf_conntrack_put(skb->nfct); 107 skb->nfct = &nf_ct_untracked_get()->ct_general; 108 skb->nfctinfo = IP_CT_NEW; 109 nf_conntrack_get(skb->nfct); 110#endif 111 /* 112 * If we are in PREROUTING/INPUT, the checksum must be recalculated 113 * since the length could have changed as a result of defragmentation. 114 * 115 * We also decrease the TTL to mitigate potential TEE loops 116 * between two hosts. 117 * 118 * Set %IP_DF so that the original source is notified of a potentially 119 * decreased MTU on the clone route. IPv6 does this too. 120 */ 121 iph = ip_hdr(skb); 122 iph->frag_off |= htons(IP_DF); 123 if (par->hooknum == NF_INET_PRE_ROUTING || 124 par->hooknum == NF_INET_LOCAL_IN) 125 --iph->ttl; 126 ip_send_check(iph); 127 128 if (tee_tg_route4(skb, info)) { 129 percpu_write(tee_active, true); 130 ip_local_out(skb); 131 percpu_write(tee_active, false); 132 } else { 133 kfree_skb(skb); 134 } 135 return XT_CONTINUE; 136} 137 138#ifdef WITH_IPV6 139static bool 140tee_tg_route6(struct sk_buff *skb, const struct xt_tee_tginfo *info) 141{ 142 const struct ipv6hdr *iph = ipv6_hdr(skb); 143 struct net *net = pick_net(skb); 144 struct dst_entry *dst; 145 struct flowi fl; 146 147 memset(&fl, 0, sizeof(fl)); 148 if (info->priv) { 149 if (info->priv->oif == -1) 150 return false; 151 fl.oif = info->priv->oif; 152 } 153 fl.nl_u.ip6_u.daddr = info->gw.in6; 154 fl.nl_u.ip6_u.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) | 155 (iph->flow_lbl[1] << 8) | iph->flow_lbl[2]; 156 dst = ip6_route_output(net, NULL, &fl); 157 if (dst == NULL) 158 return false; 159 160 skb_dst_drop(skb); 161 skb_dst_set(skb, dst); 162 skb->dev = dst->dev; 163 skb->protocol = htons(ETH_P_IPV6); 164 return true; 165} 166 167static unsigned int 168tee_tg6(struct sk_buff *skb, const struct xt_action_param *par) 169{ 170 const struct xt_tee_tginfo *info = par->targinfo; 171 172 if (percpu_read(tee_active)) 173 return XT_CONTINUE; 174 skb = pskb_copy(skb, GFP_ATOMIC); 175 if (skb == NULL) 176 return XT_CONTINUE; 177 178#ifdef WITH_CONNTRACK 179 nf_conntrack_put(skb->nfct); 180 skb->nfct = &nf_ct_untracked_get()->ct_general; 181 skb->nfctinfo = IP_CT_NEW; 182 nf_conntrack_get(skb->nfct); 183#endif 184 if (par->hooknum == NF_INET_PRE_ROUTING || 185 par->hooknum == NF_INET_LOCAL_IN) { 186 struct ipv6hdr *iph = ipv6_hdr(skb); 187 --iph->hop_limit; 188 } 189 if (tee_tg_route6(skb, info)) { 190 percpu_write(tee_active, true); 191 ip6_local_out(skb); 192 percpu_write(tee_active, false); 193 } else { 194 kfree_skb(skb); 195 } 196 return XT_CONTINUE; 197} 198#endif /* WITH_IPV6 */ 199 200static int tee_netdev_event(struct notifier_block *this, unsigned long event, 201 void *ptr) 202{ 203 struct net_device *dev = ptr; 204 struct xt_tee_priv *priv; 205 206 priv = container_of(this, struct xt_tee_priv, notifier); 207 switch (event) { 208 case NETDEV_REGISTER: 209 if (!strcmp(dev->name, priv->tginfo->oif)) 210 priv->oif = dev->ifindex; 211 break; 212 case NETDEV_UNREGISTER: 213 if (dev->ifindex == priv->oif) 214 priv->oif = -1; 215 break; 216 case NETDEV_CHANGENAME: 217 if (!strcmp(dev->name, priv->tginfo->oif)) 218 priv->oif = dev->ifindex; 219 else if (dev->ifindex == priv->oif) 220 priv->oif = -1; 221 break; 222 } 223 224 return NOTIFY_DONE; 225} 226 227static int tee_tg_check(const struct xt_tgchk_param *par) 228{ 229 struct xt_tee_tginfo *info = par->targinfo; 230 struct xt_tee_priv *priv; 231 232 /* 0.0.0.0 and :: not allowed */ 233 if (memcmp(&info->gw, &tee_zero_address, 234 sizeof(tee_zero_address)) == 0) 235 return -EINVAL; 236 237 if (info->oif[0]) { 238 if (info->oif[sizeof(info->oif)-1] != '\0') 239 return -EINVAL; 240 241 priv = kzalloc(sizeof(*priv), GFP_KERNEL); 242 if (priv == NULL) 243 return -ENOMEM; 244 245 priv->tginfo = info; 246 priv->oif = -1; 247 priv->notifier.notifier_call = tee_netdev_event; 248 info->priv = priv; 249 250 register_netdevice_notifier(&priv->notifier); 251 } else 252 info->priv = NULL; 253 254 return 0; 255} 256 257static void tee_tg_destroy(const struct xt_tgdtor_param *par) 258{ 259 struct xt_tee_tginfo *info = par->targinfo; 260 261 if (info->priv) { 262 unregister_netdevice_notifier(&info->priv->notifier); 263 kfree(info->priv); 264 } 265} 266 267static struct xt_target tee_tg_reg[] __read_mostly = { 268 { 269 .name = "TEE", 270 .revision = 1, 271 .family = NFPROTO_IPV4, 272 .target = tee_tg4, 273 .targetsize = sizeof(struct xt_tee_tginfo), 274 .checkentry = tee_tg_check, 275 .destroy = tee_tg_destroy, 276 .me = THIS_MODULE, 277 }, 278#ifdef WITH_IPV6 279 { 280 .name = "TEE", 281 .revision = 1, 282 .family = NFPROTO_IPV6, 283 .target = tee_tg6, 284 .targetsize = sizeof(struct xt_tee_tginfo), 285 .checkentry = tee_tg_check, 286 .destroy = tee_tg_destroy, 287 .me = THIS_MODULE, 288 }, 289#endif 290}; 291 292static int __init tee_tg_init(void) 293{ 294 return xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg)); 295} 296 297static void __exit tee_tg_exit(void) 298{ 299 xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg)); 300} 301 302module_init(tee_tg_init); 303module_exit(tee_tg_exit); 304MODULE_AUTHOR("Sebastian Cla��en <sebastian.classen@freenet.ag>"); 305MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>"); 306MODULE_DESCRIPTION("Xtables: Reroute packet copy"); 307MODULE_LICENSE("GPL"); 308MODULE_ALIAS("ipt_TEE"); 309MODULE_ALIAS("ip6t_TEE"); 310