netfilter: factor out packet duplication for IPv4/IPv6
authorPablo Neira Ayuso <pablo@netfilter.org>
Sun, 31 May 2015 15:54:44 +0000 (17:54 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Fri, 7 Aug 2015 09:49:49 +0000 (11:49 +0200)
Extracted from the xtables TEE target. This creates two new modules for IPv4
and IPv6 that are shared between the TEE target and the new nf_tables dup
expressions.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include/net/netfilter/ipv4/nf_dup_ipv4.h [new file with mode: 0644]
include/net/netfilter/ipv6/nf_dup_ipv6.h [new file with mode: 0644]
net/ipv4/netfilter/Kconfig
net/ipv4/netfilter/Makefile
net/ipv4/netfilter/nf_dup_ipv4.c [new file with mode: 0644]
net/ipv6/netfilter/Kconfig
net/ipv6/netfilter/Makefile
net/ipv6/netfilter/nf_dup_ipv6.c [new file with mode: 0644]
net/netfilter/Kconfig
net/netfilter/xt_TEE.c

diff --git a/include/net/netfilter/ipv4/nf_dup_ipv4.h b/include/net/netfilter/ipv4/nf_dup_ipv4.h
new file mode 100644 (file)
index 0000000..42008f1
--- /dev/null
@@ -0,0 +1,7 @@
+#ifndef _NF_DUP_IPV4_H_
+#define _NF_DUP_IPV4_H_
+
+void nf_dup_ipv4(struct sk_buff *skb, unsigned int hooknum,
+                const struct in_addr *gw, int oif);
+
+#endif /* _NF_DUP_IPV4_H_ */
diff --git a/include/net/netfilter/ipv6/nf_dup_ipv6.h b/include/net/netfilter/ipv6/nf_dup_ipv6.h
new file mode 100644 (file)
index 0000000..ed6bd66
--- /dev/null
@@ -0,0 +1,7 @@
+#ifndef _NF_DUP_IPV6_H_
+#define _NF_DUP_IPV6_H_
+
+void nf_dup_ipv6(struct sk_buff *skb, unsigned int hooknum,
+                const struct in6_addr *gw, int oif);
+
+#endif /* _NF_DUP_IPV6_H_ */
index 2199a5db25e60412389d861a105d86c62100b396..0142ea259d7d7aeec969539a9ee64d5af2c97ff2 100644 (file)
@@ -67,6 +67,12 @@ config NF_TABLES_ARP
 
 endif # NF_TABLES
 
+config NF_DUP_IPV4
+       tristate "Netfilter IPv4 packet duplication to alternate destination"
+       help
+         This option enables the nf_dup_ipv4 core, which duplicates an IPv4
+         packet to be rerouted to another destination.
+
 config NF_LOG_ARP
        tristate "ARP packet logging"
        default m if NETFILTER_ADVANCED=n
index 7fe6c703528f79f3ba6d355724c26f32e20a21c5..9136ffc2d4740cb8a005102312b15f9c7df340c5 100644 (file)
@@ -70,3 +70,5 @@ obj-$(CONFIG_IP_NF_ARP_MANGLE) += arpt_mangle.o
 
 # just filtering instance of ARP tables for now
 obj-$(CONFIG_IP_NF_ARPFILTER) += arptable_filter.o
+
+obj-$(CONFIG_NF_DUP_IPV4) += nf_dup_ipv4.o
diff --git a/net/ipv4/netfilter/nf_dup_ipv4.c b/net/ipv4/netfilter/nf_dup_ipv4.c
new file mode 100644 (file)
index 0000000..eff85ab
--- /dev/null
@@ -0,0 +1,120 @@
+/*
+ * (C) 2007 by Sebastian Claßen <sebastian.classen@freenet.ag>
+ * (C) 2007-2010 by Jan Engelhardt <jengelh@medozas.de>
+ *
+ * Extracted from xt_TEE.c
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 or later, as
+ * published by the Free Software Foundation.
+ */
+#include <linux/ip.h>
+#include <linux/module.h>
+#include <linux/percpu.h>
+#include <linux/route.h>
+#include <linux/skbuff.h>
+#include <net/checksum.h>
+#include <net/icmp.h>
+#include <net/ip.h>
+#include <net/route.h>
+#include <net/netfilter/ipv4/nf_dup_ipv4.h>
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+#include <net/netfilter/nf_conntrack.h>
+#endif
+
+static struct net *pick_net(struct sk_buff *skb)
+{
+#ifdef CONFIG_NET_NS
+       const struct dst_entry *dst;
+
+       if (skb->dev != NULL)
+               return dev_net(skb->dev);
+       dst = skb_dst(skb);
+       if (dst != NULL && dst->dev != NULL)
+               return dev_net(dst->dev);
+#endif
+       return &init_net;
+}
+
+static bool nf_dup_ipv4_route(struct sk_buff *skb, const struct in_addr *gw,
+                             int oif)
+{
+       const struct iphdr *iph = ip_hdr(skb);
+       struct net *net = pick_net(skb);
+       struct rtable *rt;
+       struct flowi4 fl4;
+
+       memset(&fl4, 0, sizeof(fl4));
+       if (oif != -1)
+               fl4.flowi4_oif = oif;
+
+       fl4.daddr = gw->s_addr;
+       fl4.flowi4_tos = RT_TOS(iph->tos);
+       fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
+       fl4.flowi4_flags = FLOWI_FLAG_KNOWN_NH;
+       rt = ip_route_output_key(net, &fl4);
+       if (IS_ERR(rt))
+               return false;
+
+       skb_dst_drop(skb);
+       skb_dst_set(skb, &rt->dst);
+       skb->dev      = rt->dst.dev;
+       skb->protocol = htons(ETH_P_IP);
+
+       return true;
+}
+
+void nf_dup_ipv4(struct sk_buff *skb, unsigned int hooknum,
+                const struct in_addr *gw, int oif)
+{
+       struct iphdr *iph;
+
+       if (__this_cpu_read(nf_skb_duplicated))
+               return;
+       /*
+        * Copy the skb, and route the copy. Will later return %XT_CONTINUE for
+        * the original skb, which should continue on its way as if nothing has
+        * happened. The copy should be independently delivered to the gateway.
+        */
+       skb = pskb_copy(skb, GFP_ATOMIC);
+       if (skb == NULL)
+               return;
+
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+       /* Avoid counting cloned packets towards the original connection. */
+       nf_conntrack_put(skb->nfct);
+       skb->nfct     = &nf_ct_untracked_get()->ct_general;
+       skb->nfctinfo = IP_CT_NEW;
+       nf_conntrack_get(skb->nfct);
+#endif
+       /*
+        * If we are in PREROUTING/INPUT, the checksum must be recalculated
+        * since the length could have changed as a result of defragmentation.
+        *
+        * We also decrease the TTL to mitigate potential loops between two
+        * hosts.
+        *
+        * Set %IP_DF so that the original source is notified of a potentially
+        * decreased MTU on the clone route. IPv6 does this too.
+        */
+       iph = ip_hdr(skb);
+       iph->frag_off |= htons(IP_DF);
+       if (hooknum == NF_INET_PRE_ROUTING ||
+           hooknum == NF_INET_LOCAL_IN)
+               --iph->ttl;
+       ip_send_check(iph);
+
+       if (nf_dup_ipv4_route(skb, gw, oif)) {
+               __this_cpu_write(nf_skb_duplicated, true);
+               ip_local_out(skb);
+               __this_cpu_write(nf_skb_duplicated, false);
+       } else {
+               kfree_skb(skb);
+       }
+}
+EXPORT_SYMBOL_GPL(nf_dup_ipv4);
+
+MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>");
+MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
+MODULE_DESCRIPTION("nf_dup_ipv4: Duplicate IPv4 packet");
+MODULE_LICENSE("GPL");
index b552cf0d6198c50308461d0d83ac09bdd8c21f82..298daf30d8575ed19eb506efd0627abb49fced57 100644 (file)
@@ -50,6 +50,12 @@ config NFT_REJECT_IPV6
 endif # NF_TABLES_IPV6
 endif # NF_TABLES
 
+config NF_DUP_IPV6
+       tristate "Netfilter IPv6 packet duplication to alternate destination"
+       help
+         This option enables the nf_dup_ipv6 core, which duplicates an IPv6
+         packet to be rerouted to another destination.
+
 config NF_REJECT_IPV6
        tristate "IPv6 packet rejection"
        default m if NETFILTER_ADVANCED=n
index c36e0a5490de10cd64f5c64571efa13628568199..dc6c732f98caa9810491b070257cb2836233103d 100644 (file)
@@ -30,6 +30,8 @@ obj-$(CONFIG_NF_LOG_IPV6) += nf_log_ipv6.o
 # reject
 obj-$(CONFIG_NF_REJECT_IPV6) += nf_reject_ipv6.o
 
+obj-$(CONFIG_NF_DUP_IPV6) += nf_dup_ipv6.o
+
 # nf_tables
 obj-$(CONFIG_NF_TABLES_IPV6) += nf_tables_ipv6.o
 obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV6) += nft_chain_route_ipv6.o
diff --git a/net/ipv6/netfilter/nf_dup_ipv6.c b/net/ipv6/netfilter/nf_dup_ipv6.c
new file mode 100644 (file)
index 0000000..399fdda
--- /dev/null
@@ -0,0 +1,96 @@
+/*
+ * (C) 2007 by Sebastian Claßen <sebastian.classen@freenet.ag>
+ * (C) 2007-2010 by Jan Engelhardt <jengelh@medozas.de>
+ *
+ * Extracted from xt_TEE.c
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 or later, as
+ * published by the Free Software Foundation.
+ */
+#include <linux/module.h>
+#include <linux/percpu.h>
+#include <linux/skbuff.h>
+#include <net/ipv6.h>
+#include <net/ip6_route.h>
+#include <net/netfilter/ipv6/nf_dup_ipv6.h>
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+#include <net/netfilter/nf_conntrack.h>
+#endif
+
+static struct net *pick_net(struct sk_buff *skb)
+{
+#ifdef CONFIG_NET_NS
+       const struct dst_entry *dst;
+
+       if (skb->dev != NULL)
+               return dev_net(skb->dev);
+       dst = skb_dst(skb);
+       if (dst != NULL && dst->dev != NULL)
+               return dev_net(dst->dev);
+#endif
+       return &init_net;
+}
+
+static bool nf_dup_ipv6_route(struct sk_buff *skb, const struct in6_addr *gw,
+                             int oif)
+{
+       const struct ipv6hdr *iph = ipv6_hdr(skb);
+       struct net *net = pick_net(skb);
+       struct dst_entry *dst;
+       struct flowi6 fl6;
+
+       memset(&fl6, 0, sizeof(fl6));
+       if (oif != -1)
+               fl6.flowi6_oif = oif;
+
+       fl6.daddr = *gw;
+       fl6.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) |
+                        (iph->flow_lbl[1] << 8) | iph->flow_lbl[2];
+       dst = ip6_route_output(net, NULL, &fl6);
+       if (dst->error) {
+               dst_release(dst);
+               return false;
+       }
+       skb_dst_drop(skb);
+       skb_dst_set(skb, dst);
+       skb->dev      = dst->dev;
+       skb->protocol = htons(ETH_P_IPV6);
+
+       return true;
+}
+
+void nf_dup_ipv6(struct sk_buff *skb, unsigned int hooknum,
+                const struct in6_addr *gw, int oif)
+{
+       if (__this_cpu_read(nf_skb_duplicated))
+               return;
+       skb = pskb_copy(skb, GFP_ATOMIC);
+       if (skb == NULL)
+               return;
+
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+       nf_conntrack_put(skb->nfct);
+       skb->nfct     = &nf_ct_untracked_get()->ct_general;
+       skb->nfctinfo = IP_CT_NEW;
+       nf_conntrack_get(skb->nfct);
+#endif
+       if (hooknum == NF_INET_PRE_ROUTING ||
+           hooknum == NF_INET_LOCAL_IN) {
+               struct ipv6hdr *iph = ipv6_hdr(skb);
+               --iph->hop_limit;
+       }
+       if (nf_dup_ipv6_route(skb, gw, oif)) {
+               __this_cpu_write(nf_skb_duplicated, true);
+               ip6_local_out(skb);
+               __this_cpu_write(nf_skb_duplicated, false);
+       } else {
+               kfree_skb(skb);
+       }
+}
+EXPORT_SYMBOL_GPL(nf_dup_ipv6);
+
+MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>");
+MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
+MODULE_DESCRIPTION("nf_dup_ipv6: IPv6 packet duplication");
+MODULE_LICENSE("GPL");
index 6eae69a698ed8344fee68a46e767a2393e53148a..3e1b4abf1897a5bdeca9e5fa061bd06d9b858263 100644 (file)
@@ -867,6 +867,8 @@ config NETFILTER_XT_TARGET_TEE
        depends on NETFILTER_ADVANCED
        depends on IPV6 || IPV6=n
        depends on !NF_CONNTRACK || NF_CONNTRACK
+       select NF_DUP_IPV4
+       select NF_DUP_IPV6 if IP6_NF_IPTABLES
        ---help---
        This option adds a "TEE" target with which a packet can be cloned and
        this clone be rerouted to another nexthop.
index 0ed9fb61d470032b8815f393591c2bba97d391f0..49fee6aa2c0aa03b8af6bf9c3358d300d8b9ac7c 100644 (file)
  *     modify it under the terms of the GNU General Public License
  *     version 2 or later, as published by the Free Software Foundation.
  */
-#include <linux/ip.h>
 #include <linux/module.h>
-#include <linux/percpu.h>
-#include <linux/route.h>
 #include <linux/skbuff.h>
-#include <linux/notifier.h>
-#include <net/checksum.h>
-#include <net/icmp.h>
-#include <net/ip.h>
-#include <net/ipv6.h>
-#include <net/ip6_route.h>
-#include <net/route.h>
+#include <linux/route.h>
 #include <linux/netfilter/x_tables.h>
+#include <net/route.h>
+#include <net/netfilter/ipv4/nf_dup_ipv4.h>
+#include <net/netfilter/ipv6/nf_dup_ipv6.h>
 #include <linux/netfilter/xt_TEE.h>
-#if IS_ENABLED(CONFIG_NF_CONNTRACK)
-#include <net/netfilter/nf_conntrack.h>
-#endif
 
 struct xt_tee_priv {
        struct notifier_block   notifier;
@@ -36,161 +27,24 @@ struct xt_tee_priv {
 
 static const union nf_inet_addr tee_zero_address;
 
-static struct net *pick_net(struct sk_buff *skb)
-{
-#ifdef CONFIG_NET_NS
-       const struct dst_entry *dst;
-
-       if (skb->dev != NULL)
-               return dev_net(skb->dev);
-       dst = skb_dst(skb);
-       if (dst != NULL && dst->dev != NULL)
-               return dev_net(dst->dev);
-#endif
-       return &init_net;
-}
-
-static bool
-tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info)
-{
-       const struct iphdr *iph = ip_hdr(skb);
-       struct net *net = pick_net(skb);
-       struct rtable *rt;
-       struct flowi4 fl4;
-
-       memset(&fl4, 0, sizeof(fl4));
-       if (info->priv) {
-               if (info->priv->oif == -1)
-                       return false;
-               fl4.flowi4_oif = info->priv->oif;
-       }
-       fl4.daddr = info->gw.ip;
-       fl4.flowi4_tos = RT_TOS(iph->tos);
-       fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
-       fl4.flowi4_flags = FLOWI_FLAG_KNOWN_NH;
-       rt = ip_route_output_key(net, &fl4);
-       if (IS_ERR(rt))
-               return false;
-
-       skb_dst_drop(skb);
-       skb_dst_set(skb, &rt->dst);
-       skb->dev      = rt->dst.dev;
-       skb->protocol = htons(ETH_P_IP);
-       return true;
-}
-
 static unsigned int
 tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)
 {
        const struct xt_tee_tginfo *info = par->targinfo;
-       struct iphdr *iph;
 
-       if (__this_cpu_read(nf_skb_duplicated))
-               return XT_CONTINUE;
-       /*
-        * Copy the skb, and route the copy. Will later return %XT_CONTINUE for
-        * the original skb, which should continue on its way as if nothing has
-        * happened. The copy should be independently delivered to the TEE
-        * --gateway.
-        */
-       skb = pskb_copy(skb, GFP_ATOMIC);
-       if (skb == NULL)
-               return XT_CONTINUE;
-
-#if IS_ENABLED(CONFIG_NF_CONNTRACK)
-       /* Avoid counting cloned packets towards the original connection. */
-       nf_conntrack_put(skb->nfct);
-       skb->nfct     = &nf_ct_untracked_get()->ct_general;
-       skb->nfctinfo = IP_CT_NEW;
-       nf_conntrack_get(skb->nfct);
-#endif
-       /*
-        * If we are in PREROUTING/INPUT, the checksum must be recalculated
-        * since the length could have changed as a result of defragmentation.
-        *
-        * We also decrease the TTL to mitigate potential TEE loops
-        * between two hosts.
-        *
-        * Set %IP_DF so that the original source is notified of a potentially
-        * decreased MTU on the clone route. IPv6 does this too.
-        */
-       iph = ip_hdr(skb);
-       iph->frag_off |= htons(IP_DF);
-       if (par->hooknum == NF_INET_PRE_ROUTING ||
-           par->hooknum == NF_INET_LOCAL_IN)
-               --iph->ttl;
-       ip_send_check(iph);
+       nf_dup_ipv4(skb, par->hooknum, &info->gw.in, info->priv->oif);
 
-       if (tee_tg_route4(skb, info)) {
-               __this_cpu_write(nf_skb_duplicated, true);
-               ip_local_out(skb);
-               __this_cpu_write(nf_skb_duplicated, false);
-       } else {
-               kfree_skb(skb);
-       }
        return XT_CONTINUE;
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
-static bool
-tee_tg_route6(struct sk_buff *skb, const struct xt_tee_tginfo *info)
-{
-       const struct ipv6hdr *iph = ipv6_hdr(skb);
-       struct net *net = pick_net(skb);
-       struct dst_entry *dst;
-       struct flowi6 fl6;
-
-       memset(&fl6, 0, sizeof(fl6));
-       if (info->priv) {
-               if (info->priv->oif == -1)
-                       return false;
-               fl6.flowi6_oif = info->priv->oif;
-       }
-       fl6.daddr = info->gw.in6;
-       fl6.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) |
-                          (iph->flow_lbl[1] << 8) | iph->flow_lbl[2];
-       fl6.flowi6_flags = FLOWI_FLAG_KNOWN_NH;
-       dst = ip6_route_output(net, NULL, &fl6);
-       if (dst->error) {
-               dst_release(dst);
-               return false;
-       }
-       skb_dst_drop(skb);
-       skb_dst_set(skb, dst);
-       skb->dev      = dst->dev;
-       skb->protocol = htons(ETH_P_IPV6);
-       return true;
-}
-
 static unsigned int
 tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 {
        const struct xt_tee_tginfo *info = par->targinfo;
 
-       if (__this_cpu_read(nf_skb_duplicated))
-               return XT_CONTINUE;
-       skb = pskb_copy(skb, GFP_ATOMIC);
-       if (skb == NULL)
-               return XT_CONTINUE;
+       nf_dup_ipv6(skb, par->hooknum, &info->gw.in6, info->priv->oif);
 
-#if IS_ENABLED(CONFIG_NF_CONNTRACK)
-       nf_conntrack_put(skb->nfct);
-       skb->nfct     = &nf_ct_untracked_get()->ct_general;
-       skb->nfctinfo = IP_CT_NEW;
-       nf_conntrack_get(skb->nfct);
-#endif
-       if (par->hooknum == NF_INET_PRE_ROUTING ||
-           par->hooknum == NF_INET_LOCAL_IN) {
-               struct ipv6hdr *iph = ipv6_hdr(skb);
-               --iph->hop_limit;
-       }
-       if (tee_tg_route6(skb, info)) {
-               __this_cpu_write(nf_skb_duplicated, true);
-               ip6_local_out(skb);
-               __this_cpu_write(nf_skb_duplicated, false);
-       } else {
-               kfree_skb(skb);
-       }
        return XT_CONTINUE;
 }
 #endif