^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-or-later
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * net/sched/em_ipt.c IPtables matches Ematch
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * (c) 2018 Eyal Birger <eyal.birger@gmail.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) #include <linux/gfp.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) #include <linux/module.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #include <linux/types.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <linux/kernel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <linux/string.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/skbuff.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/tc_ematch/tc_em_ipt.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/netfilter.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include <linux/netfilter/x_tables.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <linux/netfilter_ipv4/ip_tables.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include <linux/netfilter_ipv6/ip6_tables.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include <net/pkt_cls.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) struct em_ipt_match {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) const struct xt_match *match;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) u32 hook;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) u8 nfproto;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) u8 match_data[] __aligned(8);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) struct em_ipt_xt_match {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) char *match_name;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) int (*validate_match_data)(struct nlattr **tb, u8 mrev);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) static const struct nla_policy em_ipt_policy[TCA_EM_IPT_MAX + 1] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) [TCA_EM_IPT_MATCH_NAME] = { .type = NLA_STRING,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) .len = XT_EXTENSION_MAXNAMELEN },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) [TCA_EM_IPT_MATCH_REVISION] = { .type = NLA_U8 },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) [TCA_EM_IPT_HOOK] = { .type = NLA_U32 },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) [TCA_EM_IPT_NFPROTO] = { .type = NLA_U8 },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) [TCA_EM_IPT_MATCH_DATA] = { .type = NLA_UNSPEC },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) static int check_match(struct net *net, struct em_ipt_match *im, int mdata_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) struct xt_mtchk_param mtpar = {};
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) union {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) struct ipt_entry e4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) struct ip6t_entry e6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) } e = {};
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) mtpar.net = net;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) mtpar.table = "filter";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) mtpar.hook_mask = 1 << im->hook;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) mtpar.family = im->match->family;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) mtpar.match = im->match;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) mtpar.entryinfo = &e;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) mtpar.matchinfo = (void *)im->match_data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) return xt_check_match(&mtpar, mdata_len, 0, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) static int policy_validate_match_data(struct nlattr **tb, u8 mrev)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) if (mrev != 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) pr_err("only policy match revision 0 supported");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) if (nla_get_u32(tb[TCA_EM_IPT_HOOK]) != NF_INET_PRE_ROUTING) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) pr_err("policy can only be matched on NF_INET_PRE_ROUTING");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) static int addrtype_validate_match_data(struct nlattr **tb, u8 mrev)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) if (mrev != 1) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) pr_err("only addrtype match revision 1 supported");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) static const struct em_ipt_xt_match em_ipt_xt_matches[] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) .match_name = "policy",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) .validate_match_data = policy_validate_match_data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) .match_name = "addrtype",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) .validate_match_data = addrtype_validate_match_data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) {}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) static struct xt_match *get_xt_match(struct nlattr **tb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) const struct em_ipt_xt_match *m;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) struct nlattr *mname_attr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) u8 nfproto, mrev = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) mname_attr = tb[TCA_EM_IPT_MATCH_NAME];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) for (m = em_ipt_xt_matches; m->match_name; m++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) if (!nla_strcmp(mname_attr, m->match_name))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) if (!m->match_name) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) pr_err("Unsupported xt match");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) return ERR_PTR(-EINVAL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) if (tb[TCA_EM_IPT_MATCH_REVISION])
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) mrev = nla_get_u8(tb[TCA_EM_IPT_MATCH_REVISION]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) ret = m->validate_match_data(tb, mrev);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) if (ret < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) return ERR_PTR(ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) return xt_request_find_match(nfproto, m->match_name, mrev);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) static int em_ipt_change(struct net *net, void *data, int data_len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) struct tcf_ematch *em)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) struct nlattr *tb[TCA_EM_IPT_MAX + 1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) struct em_ipt_match *im = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) struct xt_match *match;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) int mdata_len, ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) u8 nfproto;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) ret = nla_parse_deprecated(tb, TCA_EM_IPT_MAX, data, data_len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) em_ipt_policy, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) if (ret < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) if (!tb[TCA_EM_IPT_HOOK] || !tb[TCA_EM_IPT_MATCH_NAME] ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) !tb[TCA_EM_IPT_MATCH_DATA] || !tb[TCA_EM_IPT_NFPROTO])
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) switch (nfproto) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) case NFPROTO_IPV4:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) case NFPROTO_IPV6:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) match = get_xt_match(tb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) if (IS_ERR(match)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) pr_err("unable to load match\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) return PTR_ERR(match);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) mdata_len = XT_ALIGN(nla_len(tb[TCA_EM_IPT_MATCH_DATA]));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) im = kzalloc(sizeof(*im) + mdata_len, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) if (!im) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) ret = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) im->match = match;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) im->hook = nla_get_u32(tb[TCA_EM_IPT_HOOK]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) im->nfproto = nfproto;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) nla_memcpy(im->match_data, tb[TCA_EM_IPT_MATCH_DATA], mdata_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) ret = check_match(net, im, mdata_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) em->datalen = sizeof(*im) + mdata_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) em->data = (unsigned long)im;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) err:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) kfree(im);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) module_put(match->me);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) static void em_ipt_destroy(struct tcf_ematch *em)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) struct em_ipt_match *im = (void *)em->data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) if (!im)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) if (im->match->destroy) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) struct xt_mtdtor_param par = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) .net = em->net,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) .match = im->match,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) .matchinfo = im->match_data,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) .family = im->match->family
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) im->match->destroy(&par);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) module_put(im->match->me);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) kfree(im);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) static int em_ipt_match(struct sk_buff *skb, struct tcf_ematch *em,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) struct tcf_pkt_info *info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) const struct em_ipt_match *im = (const void *)em->data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) struct xt_action_param acpar = {};
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) struct net_device *indev = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) u8 nfproto = im->match->family;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) struct nf_hook_state state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) switch (skb_protocol(skb, true)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) case htons(ETH_P_IP):
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) if (!pskb_network_may_pull(skb, sizeof(struct iphdr)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) if (nfproto == NFPROTO_UNSPEC)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) nfproto = NFPROTO_IPV4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) case htons(ETH_P_IPV6):
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) if (nfproto == NFPROTO_UNSPEC)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) nfproto = NFPROTO_IPV6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) if (skb->skb_iif)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) indev = dev_get_by_index_rcu(em->net, skb->skb_iif);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) nf_hook_state_init(&state, im->hook, nfproto,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) indev ?: skb->dev, skb->dev, NULL, em->net, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) acpar.match = im->match;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) acpar.matchinfo = im->match_data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) acpar.state = &state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) ret = im->match->match(skb, &acpar);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) static int em_ipt_dump(struct sk_buff *skb, struct tcf_ematch *em)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) struct em_ipt_match *im = (void *)em->data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) if (nla_put_string(skb, TCA_EM_IPT_MATCH_NAME, im->match->name) < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) return -EMSGSIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) if (nla_put_u32(skb, TCA_EM_IPT_HOOK, im->hook) < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) return -EMSGSIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) if (nla_put_u8(skb, TCA_EM_IPT_MATCH_REVISION, im->match->revision) < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) return -EMSGSIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) if (nla_put_u8(skb, TCA_EM_IPT_NFPROTO, im->nfproto) < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) return -EMSGSIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) if (nla_put(skb, TCA_EM_IPT_MATCH_DATA,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) im->match->usersize ?: im->match->matchsize,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) im->match_data) < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) return -EMSGSIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) static struct tcf_ematch_ops em_ipt_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) .kind = TCF_EM_IPT,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) .change = em_ipt_change,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) .destroy = em_ipt_destroy,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) .match = em_ipt_match,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) .dump = em_ipt_dump,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) .owner = THIS_MODULE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) .link = LIST_HEAD_INIT(em_ipt_ops.link)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) static int __init init_em_ipt(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) return tcf_em_register(&em_ipt_ops);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) static void __exit exit_em_ipt(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) tcf_em_unregister(&em_ipt_ops);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) MODULE_LICENSE("GPL");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) MODULE_AUTHOR("Eyal Birger <eyal.birger@gmail.com>");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) MODULE_DESCRIPTION("TC extended match for IPtables matches");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) module_init(init_em_ipt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) module_exit(exit_em_ipt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) MODULE_ALIAS_TCF_EMATCH(TCF_EM_IPT);
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags