diff --git a/include/linux/netfilter/xt_HMARK.h b/include/linux/netfilter/xt_HMARK.h new file mode 100644 index 0000000..cdf4a8f --- /dev/null +++ b/include/linux/netfilter/xt_HMARK.h @@ -0,0 +1,62 @@ +#ifndef XT_HMARK_H_ +#define XT_HMARK_H_ + +#include + +enum { + XT_HMARK_NONE, + XT_HMARK_SADR_AND, + XT_HMARK_DADR_AND, + XT_HMARK_SPI_AND, + XT_HMARK_SPI_OR, + XT_HMARK_SPORT_AND, + XT_HMARK_DPORT_AND, + XT_HMARK_SPORT_OR, + XT_HMARK_DPORT_OR, + XT_HMARK_PROTO_AND, + XT_HMARK_RND, + XT_HMARK_MODULUS, + XT_HMARK_OFFSET, + XT_HMARK_CT, + XT_HMARK_METHOD_L3, + XT_HMARK_METHOD_L3_4, + XT_F_HMARK_SADR_AND = 1 << XT_HMARK_SADR_AND, + XT_F_HMARK_DADR_AND = 1 << XT_HMARK_DADR_AND, + XT_F_HMARK_SPI_AND = 1 << XT_HMARK_SPI_AND, + XT_F_HMARK_SPI_OR = 1 << XT_HMARK_SPI_OR, + XT_F_HMARK_SPORT_AND = 1 << XT_HMARK_SPORT_AND, + XT_F_HMARK_DPORT_AND = 1 << XT_HMARK_DPORT_AND, + XT_F_HMARK_SPORT_OR = 1 << XT_HMARK_SPORT_OR, + XT_F_HMARK_DPORT_OR = 1 << XT_HMARK_DPORT_OR, + XT_F_HMARK_PROTO_AND = 1 << XT_HMARK_PROTO_AND, + XT_F_HMARK_RND = 1 << XT_HMARK_RND, + XT_F_HMARK_MODULUS = 1 << XT_HMARK_MODULUS, + XT_F_HMARK_OFFSET = 1 << XT_HMARK_OFFSET, + XT_F_HMARK_CT = 1 << XT_HMARK_CT, + XT_F_HMARK_METHOD_L3 = 1 << XT_HMARK_METHOD_L3, + XT_F_HMARK_METHOD_L3_4 = 1 << XT_HMARK_METHOD_L3_4, +}; + +union hmark_ports { + struct { + __u16 src; + __u16 dst; + } p16; + __u32 v32; +}; + +struct xt_hmark_info { + union nf_inet_addr src_mask; /* Source address mask */ + union nf_inet_addr dst_mask; /* Dest address mask */ + union hmark_ports port_mask; + union hmark_ports port_set; + __u32 spi_mask; + __u32 spi_set; + __u32 flags; /* Print out only */ + __u16 proto_mask; /* L4 Proto mask */ + __u32 hashrnd; + __u32 hmodulus; /* Modulus */ + __u32 hoffset; /* Offset */ +}; + +#endif /* XT_HMARK_H_ */ diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig index f8ac4ef..a775804 100644 --- a/net/netfilter/Kconfig +++ b/net/netfilter/Kconfig @@ -488,6 +488,24 @@ config NETFILTER_XT_TARGET_HL since you can easily create immortal packets that loop forever on the network. +config NETFILTER_XT_TARGET_HMARK + tristate '"HMARK" target support' + depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n) + depends on NETFILTER_ADVANCED + ---help--- + This option adds the "HMARK" target. + + The target allows you to create rules in the "raw" and "mangle" tables + which alter the netfilter mark (nfmark) field within a given range. + First a 32 bit hash value is generated then modulus by and + finally an offset is added before it's written to nfmark. + + Prior to routing, the nfmark can influence the routing method (see + "Use netfilter MARK value as routing key") and can also be used by + other subsystems to change their behavior. + + The mark match can also be used to match nfmark produced by this module. + config NETFILTER_XT_TARGET_IDLETIMER tristate "IDLETIMER target support" depends on NETFILTER_ADVANCED diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile index 40f4c3d..2712ba0 100644 --- a/net/netfilter/Makefile +++ b/net/netfilter/Makefile @@ -57,6 +57,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o obj-$(CONFIG_NETFILTER_XT_TARGET_CT) += xt_CT.o obj-$(CONFIG_NETFILTER_XT_TARGET_DSCP) += xt_DSCP.o obj-$(CONFIG_NETFILTER_XT_TARGET_HL) += xt_HL.o +obj-$(CONFIG_NETFILTER_XT_TARGET_HMARK) += xt_HMARK.o obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o obj-$(CONFIG_NETFILTER_XT_TARGET_NFLOG) += xt_NFLOG.o obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE) += xt_NFQUEUE.o diff --git a/net/netfilter/xt_HMARK.c b/net/netfilter/xt_HMARK.c new file mode 100644 index 0000000..d90549d --- /dev/null +++ b/net/netfilter/xt_HMARK.c @@ -0,0 +1,319 @@ +/* + * xt_hmark - Netfilter module to set mark as hash value + * + * (C) 2012 Hans Schillstrom + * + *Description: + * This module calculates a hash value that can be modified by modulus + * and an offset, i.e. it is possible to produce a skb->mark within a range + * The hash value is based on a direction independent five tuple: + * src & dst addr src & dst ports and protocol. + * There is two distinct modes for hash calculation: + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#include +#include +#include +#include + +#include +#include +#include +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) +#include +#include +#endif + +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("Hans Schillstrom "); +MODULE_DESCRIPTION("Xtables: Packet range mark operations by Hash value"); +MODULE_ALIAS("ipt_HMARK"); +MODULE_ALIAS("ip6t_HMARK"); + +/* + * ICMP, get header offset if icmp error + */ +static int get_inner_hdr(struct sk_buff *skb, int iphsz, int *nhoff) +{ + const struct icmphdr *icmph; + struct icmphdr _ih; + + /* Not enough header? */ + icmph = skb_header_pointer(skb, *nhoff + iphsz, sizeof(_ih), &_ih); + if (icmph == NULL && icmph->type > NR_ICMP_TYPES) + return 0; + + /* Error message? */ + if (icmph->type != ICMP_DEST_UNREACH && + icmph->type != ICMP_SOURCE_QUENCH && + icmph->type != ICMP_TIME_EXCEEDED && + icmph->type != ICMP_PARAMETERPROB && + icmph->type != ICMP_REDIRECT) + return 0; + + *nhoff += iphsz + sizeof(_ih); + return 1; +} + +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) +/* + * Get ipv6 header offset if icmp error + */ +static int get_inner6_hdr(struct sk_buff *skb, int *offset) +{ + struct icmp6hdr *icmp6h, _ih6; + + icmp6h = skb_header_pointer(skb, *offset, sizeof(_ih6), &_ih6); + if (icmp6h == NULL) + return 0; + + if (icmp6h->icmp6_type && icmp6h->icmp6_type < 128) { + *offset += sizeof(struct icmp6hdr); + return 1; + } + return 0; +} +/* + * Calculate hash based fw-mark, on the five tuple if possible. + * special cases : + * - Fragments do not use ports not even on the first fragment, + * nf_defrag_ipv6.ko don't defrag for us like it do in ipv4. + * This might be changed in the future. + * - On ICMP errors the inner header will be used. + * - Tunnels no ports + * - ESP & AH uses SPI + * @returns XT_CONTINUE + */ +static unsigned int +hmark_v6(struct sk_buff *skb, const struct xt_action_param *par) +{ + const struct xt_hmark_info *info = par->targinfo; + struct ipv6hdr *ip6, _ip6; + int poff, flag = IP6T_FH_F_AUTH; /* Ports offset, find_hdr flags */ + union hmark_ports uports; + u32 addr_src, addr_dst, hash, nhoffs = 0; + u16 fragoff = 0; + u8 nexthdr; + + ip6 = (struct ipv6hdr *) (skb->data + skb_network_offset(skb)); + nexthdr = ipv6_find_hdr(skb, &nhoffs, -1, &fragoff, &flag); + if (nexthdr < 0) + return XT_CONTINUE; + /* No need to check for icmp errors on fragments */ + if ((flag & IP6T_FH_F_FRAG) || (nexthdr != IPPROTO_ICMPV6)) + goto noicmp; + /* if an icmp error, use the inner header */ + if (get_inner6_hdr(skb, &nhoffs)) { + ip6 = skb_header_pointer(skb, nhoffs, sizeof(_ip6), &_ip6); + if (!ip6) + return XT_CONTINUE; + /* Treat AH as ESP, use SPI nothing else. */ + flag = IP6T_FH_F_AUTH; + nexthdr = ipv6_find_hdr(skb, &nhoffs, -1, &fragoff, &flag); + if (nexthdr < 0) + return XT_CONTINUE; + } +noicmp: + addr_src = (__force u32) + (ip6->saddr.s6_addr32[0] & info->src_mask.in6.s6_addr32[0]) ^ + (ip6->saddr.s6_addr32[1] & info->src_mask.in6.s6_addr32[1]) ^ + (ip6->saddr.s6_addr32[2] & info->src_mask.in6.s6_addr32[2]) ^ + (ip6->saddr.s6_addr32[3] & info->src_mask.in6.s6_addr32[3]); + addr_dst = (__force u32) + (ip6->daddr.s6_addr32[0] & info->dst_mask.in6.s6_addr32[0]) ^ + (ip6->daddr.s6_addr32[1] & info->dst_mask.in6.s6_addr32[1]) ^ + (ip6->daddr.s6_addr32[2] & info->dst_mask.in6.s6_addr32[2]) ^ + (ip6->daddr.s6_addr32[3] & info->dst_mask.in6.s6_addr32[3]); + + uports.v32 = 0; + if ((info->flags & XT_F_HMARK_METHOD_L3) || + (nexthdr == IPPROTO_ICMPV6)) + goto no_ports; + /* Is next header valid for port or SPI calculation ? */ + poff = proto_ports_offset(nexthdr); + if ((flag & IP6T_FH_F_FRAG) || poff < 0) + return XT_CONTINUE; + + nhoffs += poff; + if (skb_copy_bits(skb, nhoffs, &uports, sizeof(uports)) < 0) + return XT_CONTINUE; + + if ((nexthdr == IPPROTO_ESP) || (nexthdr == IPPROTO_AH)) + uports.v32 = (uports.v32 & info->spi_mask) | info->spi_set; + else { + uports.v32 = (uports.v32 & info->port_mask.v32) | + info->port_set.v32; + /* get a consistent hash (same value in any flow dirs.) */ + if (uports.p16.dst < uports.p16.src) + swap(uports.p16.dst, uports.p16.src); + } + +no_ports: + nexthdr &= info->proto_mask; + /* get a consistent hash (same value in any flow direction) */ + if (addr_dst < addr_src) + swap(addr_src, addr_dst); + + hash = jhash_3words(addr_src, addr_dst, uports.v32, info->hashrnd) ^ nexthdr; + skb->mark = (hash % info->hmodulus) + info->hoffset; + return XT_CONTINUE; +} +#endif +/* + * Calculate hash based fw-mark, on the five tuple if possible. + * special cases : + * - Fragments do not use ports not even on the first fragment, + * unless nf_defrag_xx.ko is used. + * - On ICMP errors the inner header will be used. + * - Tunnels no ports + * - ESP & AH uses SPI + * @returns XT_CONTINUE + */ +static unsigned int +hmark_v4(struct sk_buff *skb, const struct xt_action_param *par) +{ + const struct xt_hmark_info *info = par->targinfo; + struct iphdr *ip, _ip; + int nhoff, poff, frag = 0; + union hmark_ports uports; + u32 addr_src, addr_dst, hash; + u8 ip_proto; + + nhoff = skb_network_offset(skb); + ip = (struct iphdr *) (skb->data + nhoff); + if (ip->protocol == IPPROTO_ICMP) { + /* if an icmp error, calc hash on inner header */ + if (get_inner_hdr(skb, ip->ihl * 4, &nhoff)) { + ip = skb_header_pointer(skb, nhoff, sizeof(_ip), &_ip); + if (!ip) + return XT_CONTINUE; + } + } + + ip_proto = ip->protocol; + if (ip->frag_off & htons(IP_MF | IP_OFFSET)) + frag = 1; + + addr_src = (__force u32) ip->saddr; + addr_dst = (__force u32) ip->daddr; + uports.v32 = 0; +/* todo: Check conntrack ICMP relation */ +#if IS_ENABLED(CONFIG_NF_CONNTRACK) + if (info->flags & XT_F_HMARK_CT) { + struct nf_conntrack_tuple *otuple; + struct nf_conntrack_tuple *rtuple; + enum ip_conntrack_info ctinfo; + struct nf_conn *ct = nf_ct_get(skb, &ctinfo); + + if (!ct || nf_ct_is_untracked(ct)) + return XT_CONTINUE; + + otuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; + rtuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple; + + addr_src = (__force u32)otuple->src.u3.in.s_addr; + uports.p16.src = otuple->src.u.udp.port; + addr_dst = (__force u32)rtuple->src.u3.in.s_addr; + uports.p16.dst = rtuple->src.u.udp.port; + } +#endif + addr_src &= info->src_mask.ip; + addr_dst &= info->dst_mask.ip; + + if ((info->flags & XT_F_HMARK_METHOD_L3) || + (ip_proto == IPPROTO_ICMP)) { + uports.v32 = 0; + goto noports; + } + /* Check if ports can be used in hash calculation. */ + poff = proto_ports_offset(ip_proto); + if (frag || poff < 0) + return XT_CONTINUE; + + /* if no ports from conntrack try to get ports from skb */ + if (!uports.v32) { + nhoff += (ip->ihl * 4) + poff; + if (skb_copy_bits(skb, nhoff, &uports, sizeof(uports)) < 0) + return XT_CONTINUE; + } + + if (ip_proto == IPPROTO_ESP || ip_proto == IPPROTO_AH) + uports.v32 = (uports.v32 & info->spi_mask) | info->spi_set; + else { + uports.v32 = (uports.v32 & info->port_mask.v32) | + info->port_set.v32; + /* get a consistent hash (same value in any flow dirs.) */ + if (uports.p16.dst < uports.p16.src) + swap(uports.p16.src, uports.p16.dst); + } + +noports: + /* get a consistent hash (same value in any flow direction) */ + if (addr_dst < addr_src) + swap(addr_src, addr_dst); + + hash = jhash_3words(addr_src, addr_dst, uports.v32, info->hashrnd); + hash = hash ^ (ip_proto & info->proto_mask); + skb->mark = (hash % info->hmodulus) + info->hoffset; + return XT_CONTINUE; +} + +static int hmark_check(const struct xt_tgchk_param *par) +{ + const struct xt_hmark_info *info = par->targinfo; + + if (!info->hmodulus) { + pr_info("HMARK: hmark-mod can't be zero\n"); + return -EINVAL; + } + if (info->proto_mask && (info->flags & XT_F_HMARK_METHOD_L3)) { + pr_info("HMARK: When method L3 proto mask must be zero\n"); + return -EINVAL; + } + return 0; +} + +static struct xt_target hmark_tg_reg[] __read_mostly = { + { + .name = "HMARK", + .revision = 0, + .family = NFPROTO_IPV4, + .target = hmark_v4, + .targetsize = sizeof(struct xt_hmark_info), + .checkentry = hmark_check, + .me = THIS_MODULE, + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name = "HMARK", + .revision = 0, + .family = NFPROTO_IPV6, + .target = hmark_v6, + .targetsize = sizeof(struct xt_hmark_info), + .checkentry = hmark_check, + .me = THIS_MODULE, + }, +#endif +}; + +static int __init hmark_mt_init(void) +{ + int ret; + + ret = xt_register_targets(hmark_tg_reg, ARRAY_SIZE(hmark_tg_reg)); + if (ret < 0) + return ret; + return 0; +} + +static void __exit hmark_mt_exit(void) +{ + xt_unregister_targets(hmark_tg_reg, ARRAY_SIZE(hmark_tg_reg)); +} + +module_init(hmark_mt_init); +module_exit(hmark_mt_exit);