Merge branch 'master'
[linux-2.6] / net / sched / ipt.c
1 /*
2  * net/sched/ipt.c      iptables target interface
3  *
4  *TODO: Add other tables. For now we only support the ipv4 table targets
5  *
6  *              This program is free software; you can redistribute it and/or
7  *              modify it under the terms of the GNU General Public License
8  *              as published by the Free Software Foundation; either version
9  *              2 of the License, or (at your option) any later version.
10  *
11  * Copyright:   Jamal Hadi Salim (2002-4)
12  */
13
14 #include <asm/uaccess.h>
15 #include <asm/system.h>
16 #include <asm/bitops.h>
17 #include <linux/config.h>
18 #include <linux/types.h>
19 #include <linux/kernel.h>
20 #include <linux/sched.h>
21 #include <linux/string.h>
22 #include <linux/mm.h>
23 #include <linux/socket.h>
24 #include <linux/sockios.h>
25 #include <linux/in.h>
26 #include <linux/errno.h>
27 #include <linux/interrupt.h>
28 #include <linux/netdevice.h>
29 #include <linux/skbuff.h>
30 #include <linux/rtnetlink.h>
31 #include <linux/module.h>
32 #include <linux/init.h>
33 #include <linux/proc_fs.h>
34 #include <linux/kmod.h>
35 #include <net/sock.h>
36 #include <net/pkt_sched.h>
37 #include <linux/tc_act/tc_ipt.h>
38 #include <net/tc_act/tc_ipt.h>
39
40 #include <linux/netfilter_ipv4/ip_tables.h>
41
42 /* use generic hash table */
43 #define MY_TAB_SIZE     16
44 #define MY_TAB_MASK     15
45
46 static u32 idx_gen;
47 static struct tcf_ipt *tcf_ipt_ht[MY_TAB_SIZE];
48 /* ipt hash table lock */
49 static DEFINE_RWLOCK(ipt_lock);
50
51 /* ovewrride the defaults */
52 #define tcf_st          tcf_ipt
53 #define tcf_t_lock      ipt_lock
54 #define tcf_ht          tcf_ipt_ht
55
56 #define CONFIG_NET_ACT_INIT
57 #include <net/pkt_act.h>
58
59 static int
60 ipt_init_target(struct ipt_entry_target *t, char *table, unsigned int hook)
61 {
62         struct ipt_target *target;
63         int ret = 0;
64
65         target = ipt_find_target(t->u.user.name, t->u.user.revision);
66         if (!target)
67                 return -ENOENT;
68
69         DPRINTK("ipt_init_target: found %s\n", target->name);
70         t->u.kernel.target = target;
71
72         if (t->u.kernel.target->checkentry
73             && !t->u.kernel.target->checkentry(table, NULL, t->data,
74                                                t->u.target_size - sizeof(*t),
75                                                hook)) {
76                 DPRINTK("ipt_init_target: check failed for `%s'.\n",
77                         t->u.kernel.target->name);
78                 module_put(t->u.kernel.target->me);
79                 ret = -EINVAL;
80         }
81
82         return ret;
83 }
84
85 static void
86 ipt_destroy_target(struct ipt_entry_target *t)
87 {
88         if (t->u.kernel.target->destroy)
89                 t->u.kernel.target->destroy(t->data,
90                                             t->u.target_size - sizeof(*t));
91         module_put(t->u.kernel.target->me);
92 }
93
94 static int
95 tcf_ipt_release(struct tcf_ipt *p, int bind)
96 {
97         int ret = 0;
98         if (p) {
99                 if (bind)
100                         p->bindcnt--;
101                 p->refcnt--;
102                 if (p->bindcnt <= 0 && p->refcnt <= 0) {
103                         ipt_destroy_target(p->t);
104                         kfree(p->tname);
105                         kfree(p->t);
106                         tcf_hash_destroy(p);
107                         ret = ACT_P_DELETED;
108                 }
109         }
110         return ret;
111 }
112
113 static int
114 tcf_ipt_init(struct rtattr *rta, struct rtattr *est, struct tc_action *a,
115              int ovr, int bind)
116 {
117         struct rtattr *tb[TCA_IPT_MAX];
118         struct tcf_ipt *p;
119         struct ipt_entry_target *td, *t;
120         char *tname;
121         int ret = 0, err;
122         u32 hook = 0;
123         u32 index = 0;
124
125         if (rta == NULL || rtattr_parse_nested(tb, TCA_IPT_MAX, rta) < 0)
126                 return -EINVAL;
127
128         if (tb[TCA_IPT_HOOK-1] == NULL ||
129             RTA_PAYLOAD(tb[TCA_IPT_HOOK-1]) < sizeof(u32))
130                 return -EINVAL;
131         if (tb[TCA_IPT_TARG-1] == NULL ||
132             RTA_PAYLOAD(tb[TCA_IPT_TARG-1]) < sizeof(*t))
133                 return -EINVAL;
134         td = (struct ipt_entry_target *)RTA_DATA(tb[TCA_IPT_TARG-1]);
135         if (RTA_PAYLOAD(tb[TCA_IPT_TARG-1]) < td->u.target_size)
136                 return -EINVAL;
137
138         if (tb[TCA_IPT_INDEX-1] != NULL &&
139             RTA_PAYLOAD(tb[TCA_IPT_INDEX-1]) >= sizeof(u32))
140                 index = *(u32 *)RTA_DATA(tb[TCA_IPT_INDEX-1]);
141
142         p = tcf_hash_check(index, a, ovr, bind);
143         if (p == NULL) {
144                 p = tcf_hash_create(index, est, a, sizeof(*p), ovr, bind);
145                 if (p == NULL)
146                         return -ENOMEM;
147                 ret = ACT_P_CREATED;
148         } else {
149                 if (!ovr) {
150                         tcf_ipt_release(p, bind);
151                         return -EEXIST;
152                 }
153         }
154
155         hook = *(u32 *)RTA_DATA(tb[TCA_IPT_HOOK-1]);
156
157         err = -ENOMEM;
158         tname = kmalloc(IFNAMSIZ, GFP_KERNEL);
159         if (tname == NULL)
160                 goto err1;
161         if (tb[TCA_IPT_TABLE - 1] == NULL ||
162             rtattr_strlcpy(tname, tb[TCA_IPT_TABLE-1], IFNAMSIZ) >= IFNAMSIZ)
163                 strcpy(tname, "mangle");
164
165         t = kmalloc(td->u.target_size, GFP_KERNEL);
166         if (t == NULL)
167                 goto err2;
168         memcpy(t, td, td->u.target_size);
169
170         if ((err = ipt_init_target(t, tname, hook)) < 0)
171                 goto err3;
172
173         spin_lock_bh(&p->lock);
174         if (ret != ACT_P_CREATED) {
175                 ipt_destroy_target(p->t);
176                 kfree(p->tname);
177                 kfree(p->t);
178         }
179         p->tname = tname;
180         p->t     = t;
181         p->hook  = hook;
182         spin_unlock_bh(&p->lock);
183         if (ret == ACT_P_CREATED)
184                 tcf_hash_insert(p);
185         return ret;
186
187 err3:
188         kfree(t);
189 err2:
190         kfree(tname);
191 err1:
192         kfree(p);
193         return err;
194 }
195
196 static int
197 tcf_ipt_cleanup(struct tc_action *a, int bind)
198 {
199         struct tcf_ipt *p = PRIV(a, ipt);
200         return tcf_ipt_release(p, bind);
201 }
202
203 static int
204 tcf_ipt(struct sk_buff **pskb, struct tc_action *a, struct tcf_result *res)
205 {
206         int ret = 0, result = 0;
207         struct tcf_ipt *p = PRIV(a, ipt);
208         struct sk_buff *skb = *pskb;
209
210         if (skb_cloned(skb)) {
211                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
212                         return TC_ACT_UNSPEC;
213         }
214
215         spin_lock(&p->lock);
216
217         p->tm.lastuse = jiffies;
218         p->bstats.bytes += skb->len;
219         p->bstats.packets++;
220
221         /* yes, we have to worry about both in and out dev
222          worry later - danger - this API seems to have changed
223          from earlier kernels */
224
225         ret = p->t->u.kernel.target->target(&skb, skb->dev, NULL,
226                                             p->hook, p->t->data, NULL);
227         switch (ret) {
228         case NF_ACCEPT:
229                 result = TC_ACT_OK;
230                 break;
231         case NF_DROP:
232                 result = TC_ACT_SHOT;
233                 p->qstats.drops++;
234                 break;
235         case IPT_CONTINUE:
236                 result = TC_ACT_PIPE;
237                 break;
238         default:
239                 if (net_ratelimit())
240                         printk("Bogus netfilter code %d assume ACCEPT\n", ret);
241                 result = TC_POLICE_OK;
242                 break;
243         }
244         spin_unlock(&p->lock);
245         return result;
246
247 }
248
249 static int
250 tcf_ipt_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
251 {
252         struct ipt_entry_target *t;
253         struct tcf_t tm;
254         struct tc_cnt c;
255         unsigned char *b = skb->tail;
256         struct tcf_ipt *p = PRIV(a, ipt);
257
258         /* for simple targets kernel size == user size
259         ** user name = target name
260         ** for foolproof you need to not assume this
261         */
262
263         t = kmalloc(p->t->u.user.target_size, GFP_ATOMIC);
264         if (t == NULL)
265                 goto rtattr_failure;
266
267         c.bindcnt = p->bindcnt - bind;
268         c.refcnt = p->refcnt - ref;
269         memcpy(t, p->t, p->t->u.user.target_size);
270         strcpy(t->u.user.name, p->t->u.kernel.target->name);
271
272         DPRINTK("\ttcf_ipt_dump tablename %s length %d\n", p->tname,
273                 strlen(p->tname));
274         DPRINTK("\tdump target name %s size %d size user %d "
275                 "data[0] %x data[1] %x\n", p->t->u.kernel.target->name,
276                 p->t->u.target_size, p->t->u.user.target_size,
277                 p->t->data[0], p->t->data[1]);
278         RTA_PUT(skb, TCA_IPT_TARG, p->t->u.user.target_size, t);
279         RTA_PUT(skb, TCA_IPT_INDEX, 4, &p->index);
280         RTA_PUT(skb, TCA_IPT_HOOK, 4, &p->hook);
281         RTA_PUT(skb, TCA_IPT_CNT, sizeof(struct tc_cnt), &c);
282         RTA_PUT(skb, TCA_IPT_TABLE, IFNAMSIZ, p->tname);
283         tm.install = jiffies_to_clock_t(jiffies - p->tm.install);
284         tm.lastuse = jiffies_to_clock_t(jiffies - p->tm.lastuse);
285         tm.expires = jiffies_to_clock_t(p->tm.expires);
286         RTA_PUT(skb, TCA_IPT_TM, sizeof (tm), &tm);
287         kfree(t);
288         return skb->len;
289
290       rtattr_failure:
291         skb_trim(skb, b - skb->data);
292         kfree(t);
293         return -1;
294 }
295
296 static struct tc_action_ops act_ipt_ops = {
297         .kind           =       "ipt",
298         .type           =       TCA_ACT_IPT,
299         .capab          =       TCA_CAP_NONE,
300         .owner          =       THIS_MODULE,
301         .act            =       tcf_ipt,
302         .dump           =       tcf_ipt_dump,
303         .cleanup        =       tcf_ipt_cleanup,
304         .lookup         =       tcf_hash_search,
305         .init           =       tcf_ipt_init,
306         .walk           =       tcf_generic_walker
307 };
308
309 MODULE_AUTHOR("Jamal Hadi Salim(2002-4)");
310 MODULE_DESCRIPTION("Iptables target actions");
311 MODULE_LICENSE("GPL");
312
313 static int __init
314 ipt_init_module(void)
315 {
316         return tcf_register_action(&act_ipt_ops);
317 }
318
319 static void __exit
320 ipt_cleanup_module(void)
321 {
322         tcf_unregister_action(&act_ipt_ops);
323 }
324
325 module_init(ipt_init_module);
326 module_exit(ipt_cleanup_module);