[RFC,1/2] netfilter: refactor xt_TEE code

Message ID	20150211183902.5040.52479.stgit@nfdev.cica.es
State	RFC
Delegated to:	Pablo Neira
Headers	show Return-Path: <netfilter-devel-owner@vger.kernel.org> Subject: [RFC PATCH 1/2] netfilter: refactor xt_TEE code From: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> To: netfilter-devel@vger.kernel.org Cc: kaber@trash.net, pablo@netfilter.org Date: Wed, 11 Feb 2015 19:39:03 +0100 Message-ID: <20150211183902.5040.52479.stgit@nfdev.cica.es> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk

diff --git a/include/net/netfilter/ipv4/nf_tee_ipv4.h b/include/net/netfilter/ipv4/nf_tee_ipv4.h new file mode 100644 index 0000000..202ad75 --- /dev/null +++ b/include/net/netfilter/ipv4/nf_tee_ipv4.h @@ -0,0 +1,8 @@ +#ifndef _NF_TEE_IPV4_H_ +#define _NF_TEE_IPV4_H_ + +#include <net/netfilter/nf_tee.h> + +unsigned int nf_tee_ipv4(struct sk_buff *skb, const struct nf_tee *tee); + +#endif /* _NF_TEE_IPV4_H_ */ diff --git a/include/net/netfilter/ipv6/nf_tee_ipv6.h b/include/net/netfilter/ipv6/nf_tee_ipv6.h new file mode 100644 index 0000000..fe4c5a1 --- /dev/null +++ b/include/net/netfilter/ipv6/nf_tee_ipv6.h @@ -0,0 +1,8 @@ +#ifndef _NF_TEE_IPV6_H_ +#define _NF_TEE_IPV6_H_ + +#include <net/netfilter/nf_tee.h> + +unsigned int nf_tee_ipv6(struct sk_buff *skb, const struct nf_tee *tee); + +#endif /* _NF_TEE_IPV6_H_ */ diff --git a/include/net/netfilter/nf_tee.h b/include/net/netfilter/nf_tee.h new file mode 100644 index 0000000..2bd6d56 --- /dev/null +++ b/include/net/netfilter/nf_tee.h @@ -0,0 +1,20 @@ +#ifndef _NF_TEE_H_ +#define _NF_TEE_H_ + +#include <linux/netfilter.h> +#include <linux/if.h> + +struct nf_tee { + union nf_inet_addr gw; + char oif_str[IFNAMSIZ]; + int oif; + unsigned int hooknum; + struct notifier_block notifier; +}; + +struct net *nf_tee_pick_net(struct sk_buff *skb); +struct nf_tee *nf_tee_new(union nf_inet_addr gw, const char *oif_str); +bool nf_tee_has_notifier(const struct nf_tee *tee); +void nf_tee_destroy(struct nf_tee *tee); + +#endif diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig index 59f883d..d71dbdf 100644 --- a/net/ipv4/netfilter/Kconfig +++ b/net/ipv4/netfilter/Kconfig @@ -36,6 +36,14 @@ config NF_CONNTRACK_PROC_COMPAT If unsure, say Y. +config NF_TEE_IPV4 + tristate "Netfilter IPv4 packet cloning to alternate destination" + depends on !NF_CONNTRACK || NF_CONNTRACK + depends on NF_TEE + help + This optiones enables the nf_tee_ipv4 engine, which can clone a + packet and this clone be rerouted to another nexthop. + config NF_LOG_ARP tristate "ARP packet logging" default m if NETFILTER_ADVANCED=n diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile index 7fe6c70..6b492de 100644 --- a/net/ipv4/netfilter/Makefile +++ b/net/ipv4/netfilter/Makefile @@ -70,3 +70,5 @@ obj-$(CONFIG_IP_NF_ARP_MANGLE) += arpt_mangle.o # just filtering instance of ARP tables for now obj-$(CONFIG_IP_NF_ARPFILTER) += arptable_filter.o + +obj-$(CONFIG_NF_TEE_IPV4) += nf_tee_ipv4.o diff --git a/net/ipv4/netfilter/nf_tee_ipv4.c b/net/ipv4/netfilter/nf_tee_ipv4.c new file mode 100644 index 0000000..5fe94b2 --- /dev/null +++ b/net/ipv4/netfilter/nf_tee_ipv4.c @@ -0,0 +1,115 @@ +/* + * "TEE" target extension for Xtables + * Copyright © Sebastian Claßen, 2007 + * Jan Engelhardt, 2007-2010 + * + * based on ipt_ROUTE.c from Cédric de Launois + * <delaunois@info.ucl.be> + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * version 2 or later, as published by the Free Software Foundation. + */ +#include <linux/ip.h> +#include <linux/module.h> +#include <linux/percpu.h> +#include <linux/route.h> +#include <linux/skbuff.h> +#include <net/checksum.h> +#include <net/icmp.h> +#include <net/ip.h> +#include <net/route.h> +#include <net/netfilter/nf_tee.h> +#include <net/netfilter/ipv4/nf_tee_ipv4.h> + +#if IS_ENABLED(CONFIG_NF_CONNTRACK) +# define WITH_CONNTRACK 1 +# include <net/netfilter/nf_conntrack.h> +#endif + +static DEFINE_PER_CPU(bool, tee_active); + +static bool nf_tee_ipv4_route(struct sk_buff *skb, const struct nf_tee *tee) +{ + const struct iphdr *iph = ip_hdr(skb); + struct net *net = nf_tee_pick_net(skb); + struct rtable *rt; + struct flowi4 fl4; + + memset(&fl4, 0, sizeof(fl4)); + if (nf_tee_has_notifier(tee)) { + if (tee->oif == -1) + return false; + + fl4.flowi4_oif = tee->oif; + } + fl4.daddr = tee->gw.ip; + fl4.flowi4_tos = RT_TOS(iph->tos); + fl4.flowi4_scope = RT_SCOPE_UNIVERSE; + fl4.flowi4_flags = FLOWI_FLAG_KNOWN_NH; + rt = ip_route_output_key(net, &fl4); + if (IS_ERR(rt)) + return false; + + skb_dst_drop(skb); + skb_dst_set(skb, &rt->dst); + skb->dev = rt->dst.dev; + skb->protocol = htons(ETH_P_IP); + return true; +} + +unsigned int nf_tee_ipv4(struct sk_buff *skb, const struct nf_tee *tee) +{ + struct iphdr *iph; + + if (__this_cpu_read(tee_active)) + return XT_CONTINUE; + /* + * Copy the skb, and route the copy. Will later return %XT_CONTINUE for + * the original skb, which should continue on its way as if nothing has + * happened. The copy should be independently delivered to the TEE + * --gateway. + */ + skb = pskb_copy(skb, GFP_ATOMIC); + if (skb == NULL) + return XT_CONTINUE; + +#ifdef WITH_CONNTRACK + /* Avoid counting cloned packets towards the original connection. */ + nf_conntrack_put(skb->nfct); + skb->nfct = &nf_ct_untracked_get()->ct_general; + skb->nfctinfo = IP_CT_NEW; + nf_conntrack_get(skb->nfct); +#endif + /* + * If we are in PREROUTING/INPUT, the checksum must be recalculated + * since the length could have changed as a result of defragmentation. + * + * We also decrease the TTL to mitigate potential TEE loops + * between two hosts. + * + * Set %IP_DF so that the original source is notified of a potentially + * decreased MTU on the clone route. IPv6 does this too. + */ + iph = ip_hdr(skb); + iph->frag_off |= htons(IP_DF); + if (tee->hooknum == NF_INET_PRE_ROUTING || + tee->hooknum == NF_INET_LOCAL_IN) + --iph->ttl; + ip_send_check(iph); + + if (nf_tee_ipv4_route(skb, tee)) { + __this_cpu_write(tee_active, true); + ip_local_out(skb); + __this_cpu_write(tee_active, false); + } else { + kfree_skb(skb); + } + return XT_CONTINUE; +} +EXPORT_SYMBOL_GPL(nf_tee_ipv4); + +MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>"); +MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>"); +MODULE_DESCRIPTION("nf_tee_ipv4: Reroute IPv4 packet copy"); +MODULE_LICENSE("GPL"); diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig index a069822..fefd1bb 100644 --- a/net/ipv6/netfilter/Kconfig +++ b/net/ipv6/netfilter/Kconfig @@ -55,6 +55,14 @@ config NF_LOG_IPV6 default m if NETFILTER_ADVANCED=n select NF_LOG_COMMON +config NF_TEE_IPV6 + tristate "Netfilter IPv6 packet cloning to alternate destination" + depends on !NF_CONNTRACK || NF_CONNTRACK + depends on NF_TEE + help + This optiones enables the nf_tee_ipv6 engine, which can clone a + packet and this clone be rerouted to another nexthop. + config NF_NAT_IPV6 tristate "IPv6 NAT" depends on NF_CONNTRACK_IPV6 diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile index c36e0a5..b3a2946 100644 --- a/net/ipv6/netfilter/Makefile +++ b/net/ipv6/netfilter/Makefile @@ -30,6 +30,8 @@ obj-$(CONFIG_NF_LOG_IPV6) += nf_log_ipv6.o # reject obj-$(CONFIG_NF_REJECT_IPV6) += nf_reject_ipv6.o +obj-$(CONFIG_NF_TEE_IPV6) += nf_tee_ipv6.o + # nf_tables obj-$(CONFIG_NF_TABLES_IPV6) += nf_tables_ipv6.o obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV6) += nft_chain_route_ipv6.o diff --git a/net/ipv6/netfilter/nf_tee_ipv6.c b/net/ipv6/netfilter/nf_tee_ipv6.c new file mode 100644 index 0000000..4b95cdd --- /dev/null +++ b/net/ipv6/netfilter/nf_tee_ipv6.c @@ -0,0 +1,89 @@ +/* + * "TEE" target extension for Xtables + * Copyright © Sebastian Claßen, 2007 + * Jan Engelhardt, 2007-2010 + * + * based on ipt_ROUTE.c from Cédric de Launois + * <delaunois@info.ucl.be> + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * version 2 or later, as published by the Free Software Foundation. + */ +#include <linux/module.h> +#include <linux/percpu.h> +#include <linux/skbuff.h> +#include <net/ipv6.h> +#include <net/ip6_route.h> +#include <net/netfilter/nf_tee.h> +#include <net/netfilter/ipv6/nf_tee_ipv6.h> + +#if IS_ENABLED(CONFIG_NF_CONNTRACK) +# define WITH_CONNTRACK 1 +# include <net/netfilter/nf_conntrack.h> +#endif + +static DEFINE_PER_CPU(bool, tee_active); + +static bool nf_tee_ipv6_route(struct sk_buff *skb, const struct nf_tee *tee) +{ + const struct ipv6hdr *iph = ipv6_hdr(skb); + struct net *net = nf_tee_pick_net(skb); + struct dst_entry *dst; + struct flowi6 fl6; + + memset(&fl6, 0, sizeof(fl6)); + if (nf_tee_has_notifier(tee)) { + if (tee->oif == -1) + return false; + fl6.flowi6_oif = tee->oif; + } + fl6.daddr = tee->gw.in6; + fl6.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) | + (iph->flow_lbl[1] << 8) | iph->flow_lbl[2]; + dst = ip6_route_output(net, NULL, &fl6); + if (dst->error) { + dst_release(dst); + return false; + } + skb_dst_drop(skb); + skb_dst_set(skb, dst); + skb->dev = dst->dev; + skb->protocol = htons(ETH_P_IPV6); + return true; +} + +unsigned int nf_tee_ipv6(struct sk_buff *skb, const struct nf_tee *tee) +{ + if (__this_cpu_read(tee_active)) + return XT_CONTINUE; + skb = pskb_copy(skb, GFP_ATOMIC); + if (skb == NULL) + return XT_CONTINUE; + +#ifdef WITH_CONNTRACK + nf_conntrack_put(skb->nfct); + skb->nfct = &nf_ct_untracked_get()->ct_general; + skb->nfctinfo = IP_CT_NEW; + nf_conntrack_get(skb->nfct); +#endif + if (tee->hooknum == NF_INET_PRE_ROUTING || + tee->hooknum == NF_INET_LOCAL_IN) { + struct ipv6hdr *iph = ipv6_hdr(skb); + --iph->hop_limit; + } + if (nf_tee_ipv6_route(skb, tee)) { + __this_cpu_write(tee_active, true); + ip6_local_out(skb); + __this_cpu_write(tee_active, false); + } else { + kfree_skb(skb); + } + return XT_CONTINUE; +} +EXPORT_SYMBOL_GPL(nf_tee_ipv6); + +MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>"); +MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>"); +MODULE_DESCRIPTION("nf_tee_ipv6: Reroute IPv6 packet copy"); +MODULE_LICENSE("GPL"); diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig index b02660f..f0a0712 100644 --- a/net/netfilter/Kconfig +++ b/net/netfilter/Kconfig @@ -562,6 +562,13 @@ config NFT_COMPAT x_tables match/target extensions over the nf_tables framework. +config NF_TEE + tristate "Netfilter nf_tee module" + help + This module is the core nf_tee engine, which allows you + to copy and redirect packets to another gateway. + + config NETFILTER_XTABLES tristate "Netfilter Xtables support (required for ip_tables)" default m if NETFILTER_ADVANCED=n @@ -863,6 +870,7 @@ config NETFILTER_XT_TARGET_REDIRECT config NETFILTER_XT_TARGET_TEE tristate '"TEE" - packet cloning to alternate destination' depends on NETFILTER_ADVANCED + depends on NF_TEE_IPV4 || NF_TEE_IPV6 depends on (IPV6 || IPV6=n) depends on !NF_CONNTRACK || NF_CONNTRACK ---help--- diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile index 89f73a9..0cd2f03 100644 --- a/net/netfilter/Makefile +++ b/net/netfilter/Makefile @@ -47,6 +47,8 @@ obj-$(CONFIG_NF_CONNTRACK_TFTP) += nf_conntrack_tftp.o nf_nat-y := nf_nat_core.o nf_nat_proto_unknown.o nf_nat_proto_common.o \ nf_nat_proto_udp.o nf_nat_proto_tcp.o nf_nat_helper.o +obj-$(CONFIG_NF_TEE) += nf_tee.o + # generic transport layer logging obj-$(CONFIG_NF_LOG_COMMON) += nf_log_common.o diff --git a/net/netfilter/nf_tee.c b/net/netfilter/nf_tee.c new file mode 100644 index 0000000..4560ecc --- /dev/null +++ b/net/netfilter/nf_tee.c @@ -0,0 +1,115 @@ +/* + * "TEE" target extension for Xtables + * Copyright © Sebastian Claßen, 2007 + * Jan Engelhardt, 2007-2010 + * + * based on ipt_ROUTE.c from Cédric de Launois + * <delaunois@info.ucl.be> + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * version 2 or later, as published by the Free Software Foundation. + */ + +#include <linux/ip.h> +#include <linux/module.h> +#include <linux/percpu.h> +#include <linux/skbuff.h> +#include <linux/notifier.h> +#include <linux/netdevice.h> +#include <net/net_namespace.h> +#include <net/dst.h> +#include <net/netfilter/nf_tee.h> + +struct net *nf_tee_pick_net(struct sk_buff *skb) +{ +#ifdef CONFIG_NET_NS + const struct dst_entry *dst; + + if (skb->dev != NULL) + return dev_net(skb->dev); + dst = skb_dst(skb); + if (dst != NULL && dst->dev != NULL) + return dev_net(dst->dev); +#endif + return &init_net; +} +EXPORT_SYMBOL_GPL(nf_tee_pick_net); + +static int +nf_tee_netdev_event(struct notifier_block *this, unsigned long event, + void *ptr) +{ + struct net_device *dev = netdev_notifier_info_to_dev(ptr); + struct nf_tee *tee; + + tee = container_of(this, struct nf_tee, notifier); + switch (event) { + case NETDEV_REGISTER: + if (!strcmp(dev->name, tee->oif_str)) + tee->oif = dev->ifindex; + break; + case NETDEV_UNREGISTER: + if (dev->ifindex == tee->oif) + tee->oif = -1; + break; + case NETDEV_CHANGENAME: + if (!strcmp(dev->name, tee->oif_str)) + tee->oif = dev->ifindex; + else if (dev->ifindex == tee->oif) + tee->oif = -1; + break; + } + + return NOTIFY_DONE; +} + +static const union nf_inet_addr tee_zero_address; + +struct nf_tee *nf_tee_new(union nf_inet_addr gw, const char *oif_str) +{ + struct nf_tee *tee; + + /* 0.0.0.0 and :: not allowed */ + if (memcmp(&gw, &tee_zero_address, + sizeof(tee_zero_address)) == 0) + return ERR_PTR(-EINVAL); + + tee = kzalloc(sizeof(struct nf_tee), GFP_KERNEL); + if (tee == NULL) + return ERR_PTR(-ENOMEM); + + if (oif_str && oif_str[0]) { + if (oif_str[sizeof(tee->oif_str) - 1] != '\0') + return ERR_PTR(-EINVAL); + + memcpy(tee->oif_str, oif_str, sizeof(tee->oif_str)); + tee->oif = -1; + tee->notifier.notifier_call = nf_tee_netdev_event; + register_netdevice_notifier(&tee->notifier); + } + + tee->gw = gw; + return tee; +} +EXPORT_SYMBOL_GPL(nf_tee_new); + +bool nf_tee_has_notifier(const struct nf_tee *tee) +{ + return (tee->notifier.notifier_call == nf_tee_netdev_event); +} +EXPORT_SYMBOL_GPL(nf_tee_has_notifier); + +void nf_tee_destroy(struct nf_tee *tee) +{ + if (nf_tee_has_notifier(tee)) + unregister_netdevice_notifier(&tee->notifier); + + kfree(tee); +} +EXPORT_SYMBOL_GPL(nf_tee_destroy); + +MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>"); +MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>"); +MODULE_DESCRIPTION("nf_tee: Reroute packet copy"); +MODULE_LICENSE("GPL"); diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c index 292934d..98bde0f 100644 --- a/net/netfilter/xt_TEE.c +++ b/net/netfilter/xt_TEE.c @@ -10,247 +10,48 @@ * modify it under the terms of the GNU General Public License * version 2 or later, as published by the Free Software Foundation. */ -#include <linux/ip.h> #include <linux/module.h> -#include <linux/percpu.h> -#include <linux/route.h> #include <linux/skbuff.h> -#include <linux/notifier.h> -#include <net/checksum.h> -#include <net/icmp.h> -#include <net/ip.h> -#include <net/ipv6.h> -#include <net/ip6_route.h> -#include <net/route.h> #include <linux/netfilter/x_tables.h> #include <linux/netfilter/xt_TEE.h> - -#if IS_ENABLED(CONFIG_NF_CONNTRACK) -# define WITH_CONNTRACK 1 -# include <net/netfilter/nf_conntrack.h> -#endif - -struct xt_tee_priv { - struct notifier_block notifier; - struct xt_tee_tginfo *tginfo; - int oif; -}; - -static const union nf_inet_addr tee_zero_address; -static DEFINE_PER_CPU(bool, tee_active); - -static struct net *pick_net(struct sk_buff *skb) -{ -#ifdef CONFIG_NET_NS - const struct dst_entry *dst; - - if (skb->dev != NULL) - return dev_net(skb->dev); - dst = skb_dst(skb); - if (dst != NULL && dst->dev != NULL) - return dev_net(dst->dev); -#endif - return &init_net; -} - -static bool -tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info) -{ - const struct iphdr *iph = ip_hdr(skb); - struct net *net = pick_net(skb); - struct rtable *rt; - struct flowi4 fl4; - - memset(&fl4, 0, sizeof(fl4)); - if (info->priv) { - if (info->priv->oif == -1) - return false; - fl4.flowi4_oif = info->priv->oif; - } - fl4.daddr = info->gw.ip; - fl4.flowi4_tos = RT_TOS(iph->tos); - fl4.flowi4_scope = RT_SCOPE_UNIVERSE; - fl4.flowi4_flags = FLOWI_FLAG_KNOWN_NH; - rt = ip_route_output_key(net, &fl4); - if (IS_ERR(rt)) - return false; - - skb_dst_drop(skb); - skb_dst_set(skb, &rt->dst); - skb->dev = rt->dst.dev; - skb->protocol = htons(ETH_P_IP); - return true; -} +#include <net/netfilter/nf_tee.h> +#include <net/netfilter/ipv4/nf_tee_ipv4.h> +#include <net/netfilter/ipv6/nf_tee_ipv6.h> static unsigned int tee_tg4(struct sk_buff *skb, const struct xt_action_param *par) { const struct xt_tee_tginfo *info = par->targinfo; - struct iphdr *iph; + struct nf_tee *tee = (struct nf_tee *)info->priv; - if (__this_cpu_read(tee_active)) - return XT_CONTINUE; - /* - * Copy the skb, and route the copy. Will later return %XT_CONTINUE for - * the original skb, which should continue on its way as if nothing has - * happened. The copy should be independently delivered to the TEE - * --gateway. - */ - skb = pskb_copy(skb, GFP_ATOMIC); - if (skb == NULL) - return XT_CONTINUE; + tee->hooknum = par->hooknum; -#ifdef WITH_CONNTRACK - /* Avoid counting cloned packets towards the original connection. */ - nf_conntrack_put(skb->nfct); - skb->nfct = &nf_ct_untracked_get()->ct_general; - skb->nfctinfo = IP_CT_NEW; - nf_conntrack_get(skb->nfct); -#endif - /* - * If we are in PREROUTING/INPUT, the checksum must be recalculated - * since the length could have changed as a result of defragmentation. - * - * We also decrease the TTL to mitigate potential TEE loops - * between two hosts. - * - * Set %IP_DF so that the original source is notified of a potentially - * decreased MTU on the clone route. IPv6 does this too. - */ - iph = ip_hdr(skb); - iph->frag_off |= htons(IP_DF); - if (par->hooknum == NF_INET_PRE_ROUTING || - par->hooknum == NF_INET_LOCAL_IN) - --iph->ttl; - ip_send_check(iph); - - if (tee_tg_route4(skb, info)) { - __this_cpu_write(tee_active, true); - ip_local_out(skb); - __this_cpu_write(tee_active, false); - } else { - kfree_skb(skb); - } - return XT_CONTINUE; + return nf_tee_ipv4(skb, tee); } #if IS_ENABLED(CONFIG_IPV6) -static bool -tee_tg_route6(struct sk_buff *skb, const struct xt_tee_tginfo *info) -{ - const struct ipv6hdr *iph = ipv6_hdr(skb); - struct net *net = pick_net(skb); - struct dst_entry *dst; - struct flowi6 fl6; - - memset(&fl6, 0, sizeof(fl6)); - if (info->priv) { - if (info->priv->oif == -1) - return false; - fl6.flowi6_oif = info->priv->oif; - } - fl6.daddr = info->gw.in6; - fl6.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) | - (iph->flow_lbl[1] << 8) | iph->flow_lbl[2]; - dst = ip6_route_output(net, NULL, &fl6); - if (dst->error) { - dst_release(dst); - return false; - } - skb_dst_drop(skb); - skb_dst_set(skb, dst); - skb->dev = dst->dev; - skb->protocol = htons(ETH_P_IPV6); - return true; -} - static unsigned int tee_tg6(struct sk_buff *skb, const struct xt_action_param *par) { const struct xt_tee_tginfo *info = par->targinfo; + struct nf_tee *tee = (struct nf_tee *)info->priv; - if (__this_cpu_read(tee_active)) - return XT_CONTINUE; - skb = pskb_copy(skb, GFP_ATOMIC); - if (skb == NULL) - return XT_CONTINUE; + tee->hooknum = par->hooknum; -#ifdef WITH_CONNTRACK - nf_conntrack_put(skb->nfct); - skb->nfct = &nf_ct_untracked_get()->ct_general; - skb->nfctinfo = IP_CT_NEW; - nf_conntrack_get(skb->nfct); -#endif - if (par->hooknum == NF_INET_PRE_ROUTING || - par->hooknum == NF_INET_LOCAL_IN) { - struct ipv6hdr *iph = ipv6_hdr(skb); - --iph->hop_limit; - } - if (tee_tg_route6(skb, info)) { - __this_cpu_write(tee_active, true); - ip6_local_out(skb); - __this_cpu_write(tee_active, false); - } else { - kfree_skb(skb); - } - return XT_CONTINUE; + return nf_tee_ipv6(skb, tee); } #endif -static int tee_netdev_event(struct notifier_block *this, unsigned long event, - void *ptr) -{ - struct net_device *dev = netdev_notifier_info_to_dev(ptr); - struct xt_tee_priv *priv; - - priv = container_of(this, struct xt_tee_priv, notifier); - switch (event) { - case NETDEV_REGISTER: - if (!strcmp(dev->name, priv->tginfo->oif)) - priv->oif = dev->ifindex; - break; - case NETDEV_UNREGISTER: - if (dev->ifindex == priv->oif) - priv->oif = -1; - break; - case NETDEV_CHANGENAME: - if (!strcmp(dev->name, priv->tginfo->oif)) - priv->oif = dev->ifindex; - else if (dev->ifindex == priv->oif) - priv->oif = -1; - break; - } - - return NOTIFY_DONE; -} - static int tee_tg_check(const struct xt_tgchk_param *par) { struct xt_tee_tginfo *info = par->targinfo; - struct xt_tee_priv *priv; - - /* 0.0.0.0 and :: not allowed */ - if (memcmp(&info->gw, &tee_zero_address, - sizeof(tee_zero_address)) == 0) - return -EINVAL; - - if (info->oif[0]) { - if (info->oif[sizeof(info->oif)-1] != '\0') - return -EINVAL; - - priv = kzalloc(sizeof(*priv), GFP_KERNEL); - if (priv == NULL) - return -ENOMEM; - - priv->tginfo = info; - priv->oif = -1; - priv->notifier.notifier_call = tee_netdev_event; - info->priv = priv; + struct nf_tee *tee; - register_netdevice_notifier(&priv->notifier); - } else - info->priv = NULL; + tee = nf_tee_new(info->gw, info->oif); + if (IS_ERR(tee)) + return PTR_ERR(tee); + info->priv = (struct xt_tee_priv *)tee; return 0; } @@ -258,10 +59,7 @@ static void tee_tg_destroy(const struct xt_tgdtor_param *par) { struct xt_tee_tginfo *info = par->targinfo; - if (info->priv) { - unregister_netdevice_notifier(&info->priv->notifier); - kfree(info->priv); - } + nf_tee_destroy((struct nf_tee *)info->priv); } static struct xt_target tee_tg_reg[] __read_mostly = {

[RFC,1/2] netfilter: refactor xt_TEE code

Commit Message

Patch