2 * net/sched/ipt.c iptables target interface
4 *TODO: Add other tables. For now we only support the ipv4 table targets
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
11 * Copyright: Jamal Hadi Salim (2002-4)
14 #include <linux/types.h>
15 #include <linux/kernel.h>
16 #include <linux/string.h>
17 #include <linux/errno.h>
18 #include <linux/skbuff.h>
19 #include <linux/rtnetlink.h>
20 #include <linux/module.h>
21 #include <linux/init.h>
22 #include <net/netlink.h>
23 #include <net/pkt_sched.h>
24 #include <linux/tc_act/tc_ipt.h>
25 #include <net/tc_act/tc_ipt.h>
27 #include <linux/netfilter_ipv4/ip_tables.h>
30 #define IPT_TAB_MASK 15
31 static struct tcf_common
*tcf_ipt_ht
[IPT_TAB_MASK
+ 1];
32 static u32 ipt_idx_gen
;
33 static DEFINE_RWLOCK(ipt_lock
);
35 static struct tcf_hashinfo ipt_hash_info
= {
37 .hmask
= IPT_TAB_MASK
,
41 static int ipt_init_target(struct ipt_entry_target
*t
, char *table
, unsigned int hook
)
43 struct xt_tgchk_param par
;
44 struct xt_target
*target
;
47 target
= xt_request_find_target(AF_INET
, t
->u
.user
.name
,
52 t
->u
.kernel
.target
= target
;
56 par
.targinfo
= t
->data
;
59 ret
= xt_check_target(&par
, NFPROTO_IPV4
,
60 t
->u
.target_size
- sizeof(*t
), 0, false);
62 module_put(t
->u
.kernel
.target
->me
);
68 static void ipt_destroy_target(struct ipt_entry_target
*t
)
70 if (t
->u
.kernel
.target
->destroy
)
71 t
->u
.kernel
.target
->destroy(t
->u
.kernel
.target
, t
->data
);
72 module_put(t
->u
.kernel
.target
->me
);
75 static int tcf_ipt_release(struct tcf_ipt
*ipt
, int bind
)
82 if (ipt
->tcf_bindcnt
<= 0 && ipt
->tcf_refcnt
<= 0) {
83 ipt_destroy_target(ipt
->tcfi_t
);
84 kfree(ipt
->tcfi_tname
);
86 tcf_hash_destroy(&ipt
->common
, &ipt_hash_info
);
93 static const struct nla_policy ipt_policy
[TCA_IPT_MAX
+ 1] = {
94 [TCA_IPT_TABLE
] = { .type
= NLA_STRING
, .len
= IFNAMSIZ
},
95 [TCA_IPT_HOOK
] = { .type
= NLA_U32
},
96 [TCA_IPT_INDEX
] = { .type
= NLA_U32
},
97 [TCA_IPT_TARG
] = { .len
= sizeof(struct ipt_entry_target
) },
100 static int tcf_ipt_init(struct nlattr
*nla
, struct nlattr
*est
,
101 struct tc_action
*a
, int ovr
, int bind
)
103 struct nlattr
*tb
[TCA_IPT_MAX
+ 1];
105 struct tcf_common
*pc
;
106 struct ipt_entry_target
*td
, *t
;
115 err
= nla_parse_nested(tb
, TCA_IPT_MAX
, nla
, ipt_policy
);
119 if (tb
[TCA_IPT_HOOK
] == NULL
)
121 if (tb
[TCA_IPT_TARG
] == NULL
)
124 td
= (struct ipt_entry_target
*)nla_data(tb
[TCA_IPT_TARG
]);
125 if (nla_len(tb
[TCA_IPT_TARG
]) < td
->u
.target_size
)
128 if (tb
[TCA_IPT_INDEX
] != NULL
)
129 index
= nla_get_u32(tb
[TCA_IPT_INDEX
]);
131 pc
= tcf_hash_check(index
, a
, bind
, &ipt_hash_info
);
133 pc
= tcf_hash_create(index
, est
, a
, sizeof(*ipt
), bind
,
134 &ipt_idx_gen
, &ipt_hash_info
);
140 tcf_ipt_release(to_ipt(pc
), bind
);
146 hook
= nla_get_u32(tb
[TCA_IPT_HOOK
]);
149 tname
= kmalloc(IFNAMSIZ
, GFP_KERNEL
);
150 if (unlikely(!tname
))
152 if (tb
[TCA_IPT_TABLE
] == NULL
||
153 nla_strlcpy(tname
, tb
[TCA_IPT_TABLE
], IFNAMSIZ
) >= IFNAMSIZ
)
154 strcpy(tname
, "mangle");
156 t
= kmemdup(td
, td
->u
.target_size
, GFP_KERNEL
);
160 if ((err
= ipt_init_target(t
, tname
, hook
)) < 0)
163 spin_lock_bh(&ipt
->tcf_lock
);
164 if (ret
!= ACT_P_CREATED
) {
165 ipt_destroy_target(ipt
->tcfi_t
);
166 kfree(ipt
->tcfi_tname
);
169 ipt
->tcfi_tname
= tname
;
171 ipt
->tcfi_hook
= hook
;
172 spin_unlock_bh(&ipt
->tcf_lock
);
173 if (ret
== ACT_P_CREATED
)
174 tcf_hash_insert(pc
, &ipt_hash_info
);
186 static int tcf_ipt_cleanup(struct tc_action
*a
, int bind
)
188 struct tcf_ipt
*ipt
= a
->priv
;
189 return tcf_ipt_release(ipt
, bind
);
192 static int tcf_ipt(struct sk_buff
*skb
, struct tc_action
*a
,
193 struct tcf_result
*res
)
195 int ret
= 0, result
= 0;
196 struct tcf_ipt
*ipt
= a
->priv
;
197 struct xt_target_param par
;
199 if (skb_cloned(skb
)) {
200 if (pskb_expand_head(skb
, 0, 0, GFP_ATOMIC
))
201 return TC_ACT_UNSPEC
;
204 spin_lock(&ipt
->tcf_lock
);
206 ipt
->tcf_tm
.lastuse
= jiffies
;
207 ipt
->tcf_bstats
.bytes
+= qdisc_pkt_len(skb
);
208 ipt
->tcf_bstats
.packets
++;
210 /* yes, we have to worry about both in and out dev
211 worry later - danger - this API seems to have changed
212 from earlier kernels */
215 par
.hooknum
= ipt
->tcfi_hook
;
216 par
.target
= ipt
->tcfi_t
->u
.kernel
.target
;
217 par
.targinfo
= ipt
->tcfi_t
->data
;
218 ret
= par
.target
->target(skb
, &par
);
225 result
= TC_ACT_SHOT
;
226 ipt
->tcf_qstats
.drops
++;
229 result
= TC_ACT_PIPE
;
233 printk("Bogus netfilter code %d assume ACCEPT\n", ret
);
234 result
= TC_POLICE_OK
;
237 spin_unlock(&ipt
->tcf_lock
);
242 static int tcf_ipt_dump(struct sk_buff
*skb
, struct tc_action
*a
, int bind
, int ref
)
244 unsigned char *b
= skb_tail_pointer(skb
);
245 struct tcf_ipt
*ipt
= a
->priv
;
246 struct ipt_entry_target
*t
;
250 /* for simple targets kernel size == user size
251 ** user name = target name
252 ** for foolproof you need to not assume this
255 t
= kmemdup(ipt
->tcfi_t
, ipt
->tcfi_t
->u
.user
.target_size
, GFP_ATOMIC
);
257 goto nla_put_failure
;
259 c
.bindcnt
= ipt
->tcf_bindcnt
- bind
;
260 c
.refcnt
= ipt
->tcf_refcnt
- ref
;
261 strcpy(t
->u
.user
.name
, ipt
->tcfi_t
->u
.kernel
.target
->name
);
263 NLA_PUT(skb
, TCA_IPT_TARG
, ipt
->tcfi_t
->u
.user
.target_size
, t
);
264 NLA_PUT_U32(skb
, TCA_IPT_INDEX
, ipt
->tcf_index
);
265 NLA_PUT_U32(skb
, TCA_IPT_HOOK
, ipt
->tcfi_hook
);
266 NLA_PUT(skb
, TCA_IPT_CNT
, sizeof(struct tc_cnt
), &c
);
267 NLA_PUT_STRING(skb
, TCA_IPT_TABLE
, ipt
->tcfi_tname
);
268 tm
.install
= jiffies_to_clock_t(jiffies
- ipt
->tcf_tm
.install
);
269 tm
.lastuse
= jiffies_to_clock_t(jiffies
- ipt
->tcf_tm
.lastuse
);
270 tm
.expires
= jiffies_to_clock_t(ipt
->tcf_tm
.expires
);
271 NLA_PUT(skb
, TCA_IPT_TM
, sizeof (tm
), &tm
);
281 static struct tc_action_ops act_ipt_ops
= {
283 .hinfo
= &ipt_hash_info
,
285 .capab
= TCA_CAP_NONE
,
286 .owner
= THIS_MODULE
,
288 .dump
= tcf_ipt_dump
,
289 .cleanup
= tcf_ipt_cleanup
,
290 .lookup
= tcf_hash_search
,
291 .init
= tcf_ipt_init
,
292 .walk
= tcf_generic_walker
295 MODULE_AUTHOR("Jamal Hadi Salim(2002-4)");
296 MODULE_DESCRIPTION("Iptables target actions");
297 MODULE_LICENSE("GPL");
299 static int __init
ipt_init_module(void)
301 return tcf_register_action(&act_ipt_ops
);
304 static void __exit
ipt_cleanup_module(void)
306 tcf_unregister_action(&act_ipt_ops
);
309 module_init(ipt_init_module
);
310 module_exit(ipt_cleanup_module
);