blob: ce2c30a591d23572c947be16e6445168d230daa8 [file] [log] [blame]
Thomas Gleixner2874c5f2019-05-27 08:55:01 +02001// SPDX-License-Identifier: GPL-2.0-or-later
Linus Torvalds1da177e2005-04-16 15:20:36 -07002/*
Jiri Pirko0c6965d2014-11-05 20:51:51 +01003 * net/sched/act_ipt.c iptables target interface
Linus Torvalds1da177e2005-04-16 15:20:36 -07004 *
5 *TODO: Add other tables. For now we only support the ipv4 table targets
6 *
Jamal Hadi Salim0dcffd02013-04-28 05:06:38 +00007 * Copyright: Jamal Hadi Salim (2002-13)
Linus Torvalds1da177e2005-04-16 15:20:36 -07008 */
9
Linus Torvalds1da177e2005-04-16 15:20:36 -070010#include <linux/types.h>
11#include <linux/kernel.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070012#include <linux/string.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070013#include <linux/errno.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014#include <linux/skbuff.h>
15#include <linux/rtnetlink.h>
16#include <linux/module.h>
17#include <linux/init.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090018#include <linux/slab.h>
Arnaldo Carvalho de Melodc5fc572007-03-25 23:06:12 -070019#include <net/netlink.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020#include <net/pkt_sched.h>
21#include <linux/tc_act/tc_ipt.h>
22#include <net/tc_act/tc_ipt.h>
23
24#include <linux/netfilter_ipv4/ip_tables.h>
25
Linus Torvalds1da177e2005-04-16 15:20:36 -070026
Alexey Dobriyanc7d03a02016-11-17 04:58:21 +030027static unsigned int ipt_net_id;
WANG Conga85a9702016-07-25 16:09:41 -070028static struct tc_action_ops act_ipt_ops;
WANG Congddf97cc2016-02-22 15:57:53 -080029
Alexey Dobriyanc7d03a02016-11-17 04:58:21 +030030static unsigned int xt_net_id;
WANG Conga85a9702016-07-25 16:09:41 -070031static struct tc_action_ops act_xt_ops;
WANG Congddf97cc2016-02-22 15:57:53 -080032
Xin Longec0acb02017-08-08 15:25:25 +080033static int ipt_init_target(struct net *net, struct xt_entry_target *t,
34 char *table, unsigned int hook)
Linus Torvalds1da177e2005-04-16 15:20:36 -070035{
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +020036 struct xt_tgchk_param par;
Jan Engelhardte60a13e2007-02-07 15:12:33 -080037 struct xt_target *target;
Xin Long4f8a8812017-08-18 11:01:36 +080038 struct ipt_entry e = {};
Linus Torvalds1da177e2005-04-16 15:20:36 -070039 int ret = 0;
40
Patrick McHardy239a87c2007-02-02 00:40:36 -080041 target = xt_request_find_target(AF_INET, t->u.user.name,
42 t->u.user.revision);
Jan Engelhardtd2a7b6b2009-07-10 18:55:11 +020043 if (IS_ERR(target))
44 return PTR_ERR(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -070045
Linus Torvalds1da177e2005-04-16 15:20:36 -070046 t->u.kernel.target = target;
Xin Long96d97032017-08-09 18:15:19 +080047 memset(&par, 0, sizeof(par));
Xin Longec0acb02017-08-08 15:25:25 +080048 par.net = net;
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +020049 par.table = table;
Xin Long4f8a8812017-08-18 11:01:36 +080050 par.entryinfo = &e;
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +020051 par.target = target;
52 par.targinfo = t->data;
53 par.hook_mask = hook;
Jan Engelhardt916a9172008-10-08 11:35:20 +020054 par.family = NFPROTO_IPV4;
Linus Torvalds1da177e2005-04-16 15:20:36 -070055
Jan Engelhardt916a9172008-10-08 11:35:20 +020056 ret = xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false);
Jan Engelhardt367c6792008-10-08 11:35:17 +020057 if (ret < 0) {
Patrick McHardy239a87c2007-02-02 00:40:36 -080058 module_put(t->u.kernel.target->me);
Patrick McHardy18118cd2006-04-24 17:18:59 -070059 return ret;
Patrick McHardy239a87c2007-02-02 00:40:36 -080060 }
Jan Engelhardt367c6792008-10-08 11:35:17 +020061 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -070062}
63
Jan Engelhardt87a2e70d2010-10-13 16:11:22 +020064static void ipt_destroy_target(struct xt_entry_target *t)
Linus Torvalds1da177e2005-04-16 15:20:36 -070065{
Jan Engelhardta2df1642008-10-08 11:35:19 +020066 struct xt_tgdtor_param par = {
67 .target = t->u.kernel.target,
68 .targinfo = t->data,
Phil Sutter44ef5482016-03-03 14:34:14 +010069 .family = NFPROTO_IPV4,
Jan Engelhardta2df1642008-10-08 11:35:19 +020070 };
71 if (par.target->destroy != NULL)
72 par.target->destroy(&par);
73 module_put(par.target->me);
Linus Torvalds1da177e2005-04-16 15:20:36 -070074}
75
Cong Wang9a63b252017-12-05 12:53:07 -080076static void tcf_ipt_release(struct tc_action *a)
Linus Torvalds1da177e2005-04-16 15:20:36 -070077{
WANG Cong86062032014-02-11 17:07:31 -080078 struct tcf_ipt *ipt = to_ipt(a);
Davide Caratti1e46ef12018-03-19 15:31:26 +010079
80 if (ipt->tcfi_t) {
81 ipt_destroy_target(ipt->tcfi_t);
82 kfree(ipt->tcfi_t);
83 }
WANG Conga5b5c952014-02-11 17:07:32 -080084 kfree(ipt->tcfi_tname);
Linus Torvalds1da177e2005-04-16 15:20:36 -070085}
86
Patrick McHardy53b2bf32008-01-23 20:36:30 -080087static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = {
88 [TCA_IPT_TABLE] = { .type = NLA_STRING, .len = IFNAMSIZ },
89 [TCA_IPT_HOOK] = { .type = NLA_U32 },
90 [TCA_IPT_INDEX] = { .type = NLA_U32 },
Jan Engelhardt87a2e70d2010-10-13 16:11:22 +020091 [TCA_IPT_TARG] = { .len = sizeof(struct xt_entry_target) },
Patrick McHardy53b2bf32008-01-23 20:36:30 -080092};
93
Xin Longec0acb02017-08-08 15:25:25 +080094static int __tcf_ipt_init(struct net *net, unsigned int id, struct nlattr *nla,
WANG Conga85a9702016-07-25 16:09:41 -070095 struct nlattr *est, struct tc_action **a,
Davide Caratti85d09662019-03-20 14:59:59 +010096 const struct tc_action_ops *ops, int ovr, int bind,
97 struct tcf_proto *tp)
Linus Torvalds1da177e2005-04-16 15:20:36 -070098{
Xin Longec0acb02017-08-08 15:25:25 +080099 struct tc_action_net *tn = net_generic(net, id);
Patrick McHardy7ba699c2008-01-22 22:11:50 -0800100 struct nlattr *tb[TCA_IPT_MAX + 1];
David S. Millere9ce1cd2006-08-21 23:54:55 -0700101 struct tcf_ipt *ipt;
Jan Engelhardt87a2e70d2010-10-13 16:11:22 +0200102 struct xt_entry_target *td, *t;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700103 char *tname;
WANG Congb2313072016-06-13 13:46:28 -0700104 bool exists = false;
105 int ret = 0, err;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700106 u32 hook = 0;
107 u32 index = 0;
108
Patrick McHardycee63722008-01-23 20:33:32 -0800109 if (nla == NULL)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700110 return -EINVAL;
111
Johannes Berg8cb08172019-04-26 14:07:28 +0200112 err = nla_parse_nested_deprecated(tb, TCA_IPT_MAX, nla, ipt_policy,
113 NULL);
Patrick McHardycee63722008-01-23 20:33:32 -0800114 if (err < 0)
115 return err;
116
Jamal Hadi Salima57f19d2016-05-10 16:49:27 -0400117 if (tb[TCA_IPT_INDEX] != NULL)
118 index = nla_get_u32(tb[TCA_IPT_INDEX]);
119
Vlad Buslov0190c1d2018-07-05 17:24:32 +0300120 err = tcf_idr_check_alloc(tn, &index, a, bind);
121 if (err < 0)
122 return err;
123 exists = err;
Jamal Hadi Salima57f19d2016-05-10 16:49:27 -0400124 if (exists && bind)
125 return 0;
126
127 if (tb[TCA_IPT_HOOK] == NULL || tb[TCA_IPT_TARG] == NULL) {
128 if (exists)
Chris Mi65a206c2017-08-30 02:31:59 -0400129 tcf_idr_release(*a, bind);
Vlad Buslov0190c1d2018-07-05 17:24:32 +0300130 else
131 tcf_idr_cleanup(tn, index);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700132 return -EINVAL;
Jamal Hadi Salima57f19d2016-05-10 16:49:27 -0400133 }
Patrick McHardy53b2bf32008-01-23 20:36:30 -0800134
Jan Engelhardt87a2e70d2010-10-13 16:11:22 +0200135 td = (struct xt_entry_target *)nla_data(tb[TCA_IPT_TARG]);
Dan Carpenteraeadd932018-09-22 16:46:48 +0300136 if (nla_len(tb[TCA_IPT_TARG]) != td->u.target_size) {
WANG Congd15ecce2016-06-13 13:44:14 -0700137 if (exists)
Chris Mi65a206c2017-08-30 02:31:59 -0400138 tcf_idr_release(*a, bind);
Vlad Buslov0190c1d2018-07-05 17:24:32 +0300139 else
140 tcf_idr_cleanup(tn, index);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700141 return -EINVAL;
WANG Congd15ecce2016-06-13 13:44:14 -0700142 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700143
WANG Congd15ecce2016-06-13 13:44:14 -0700144 if (!exists) {
Chris Mi65a206c2017-08-30 02:31:59 -0400145 ret = tcf_idr_create(tn, index, est, a, ops, bind,
146 false);
Vlad Buslov0190c1d2018-07-05 17:24:32 +0300147 if (ret) {
148 tcf_idr_cleanup(tn, index);
WANG Cong86062032014-02-11 17:07:31 -0800149 return ret;
Vlad Buslov0190c1d2018-07-05 17:24:32 +0300150 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700151 ret = ACT_P_CREATED;
152 } else {
Jamal Hadi Salim1a293212013-12-23 08:02:11 -0500153 if (bind)/* dont override defaults */
154 return 0;
Jamal Hadi Salim1a293212013-12-23 08:02:11 -0500155
Vlad Buslov4e8ddd72018-07-05 17:24:30 +0300156 if (!ovr) {
157 tcf_idr_release(*a, bind);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700158 return -EEXIST;
Vlad Buslov4e8ddd72018-07-05 17:24:30 +0300159 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700160 }
Patrick McHardy1587bac2008-01-23 20:35:03 -0800161 hook = nla_get_u32(tb[TCA_IPT_HOOK]);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700162
163 err = -ENOMEM;
164 tname = kmalloc(IFNAMSIZ, GFP_KERNEL);
David S. Millere9ce1cd2006-08-21 23:54:55 -0700165 if (unlikely(!tname))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700166 goto err1;
Patrick McHardy7ba699c2008-01-22 22:11:50 -0800167 if (tb[TCA_IPT_TABLE] == NULL ||
168 nla_strlcpy(tname, tb[TCA_IPT_TABLE], IFNAMSIZ) >= IFNAMSIZ)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700169 strcpy(tname, "mangle");
170
Arnaldo Carvalho de Meloc7b1b242006-11-21 01:19:40 -0200171 t = kmemdup(td, td->u.target_size, GFP_KERNEL);
David S. Millere9ce1cd2006-08-21 23:54:55 -0700172 if (unlikely(!t))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700173 goto err2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700174
Xin Longec0acb02017-08-08 15:25:25 +0800175 err = ipt_init_target(net, t, tname, hook);
Eric Dumazetcc7ec452011-01-19 19:26:56 +0000176 if (err < 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700177 goto err3;
178
WANG Conga85a9702016-07-25 16:09:41 -0700179 ipt = to_ipt(*a);
180
David S. Millere9ce1cd2006-08-21 23:54:55 -0700181 spin_lock_bh(&ipt->tcf_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700182 if (ret != ACT_P_CREATED) {
David S. Millere9ce1cd2006-08-21 23:54:55 -0700183 ipt_destroy_target(ipt->tcfi_t);
184 kfree(ipt->tcfi_tname);
185 kfree(ipt->tcfi_t);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700186 }
David S. Millere9ce1cd2006-08-21 23:54:55 -0700187 ipt->tcfi_tname = tname;
188 ipt->tcfi_t = t;
189 ipt->tcfi_hook = hook;
190 spin_unlock_bh(&ipt->tcf_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700191 if (ret == ACT_P_CREATED)
Chris Mi65a206c2017-08-30 02:31:59 -0400192 tcf_idr_insert(tn, *a);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700193 return ret;
194
195err3:
196 kfree(t);
197err2:
198 kfree(tname);
199err1:
Davide Caratti8f67c902019-02-22 12:33:25 +0100200 tcf_idr_release(*a, bind);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700201 return err;
202}
203
WANG Congddf97cc2016-02-22 15:57:53 -0800204static int tcf_ipt_init(struct net *net, struct nlattr *nla,
WANG Conga85a9702016-07-25 16:09:41 -0700205 struct nlattr *est, struct tc_action **a, int ovr,
Davide Caratti85d09662019-03-20 14:59:59 +0100206 int bind, bool rtnl_held, struct tcf_proto *tp,
Vlad Buslov789871b2018-07-05 17:24:25 +0300207 struct netlink_ext_ack *extack)
WANG Congddf97cc2016-02-22 15:57:53 -0800208{
Xin Longec0acb02017-08-08 15:25:25 +0800209 return __tcf_ipt_init(net, ipt_net_id, nla, est, a, &act_ipt_ops, ovr,
Davide Caratti85d09662019-03-20 14:59:59 +0100210 bind, tp);
WANG Congddf97cc2016-02-22 15:57:53 -0800211}
212
213static int tcf_xt_init(struct net *net, struct nlattr *nla,
WANG Conga85a9702016-07-25 16:09:41 -0700214 struct nlattr *est, struct tc_action **a, int ovr,
Davide Caratti85d09662019-03-20 14:59:59 +0100215 int bind, bool unlocked, struct tcf_proto *tp,
Vlad Buslov789871b2018-07-05 17:24:25 +0300216 struct netlink_ext_ack *extack)
WANG Congddf97cc2016-02-22 15:57:53 -0800217{
Xin Longec0acb02017-08-08 15:25:25 +0800218 return __tcf_ipt_init(net, xt_net_id, nla, est, a, &act_xt_ops, ovr,
Davide Caratti85d09662019-03-20 14:59:59 +0100219 bind, tp);
WANG Congddf97cc2016-02-22 15:57:53 -0800220}
221
Jamal Hadi Salim11b96952018-08-12 09:34:53 -0400222static int tcf_ipt_act(struct sk_buff *skb, const struct tc_action *a,
223 struct tcf_result *res)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700224{
225 int ret = 0, result = 0;
WANG Conga85a9702016-07-25 16:09:41 -0700226 struct tcf_ipt *ipt = to_ipt(a);
Jan Engelhardt4b560b42009-07-05 19:43:26 +0200227 struct xt_action_param par;
Pablo Neira Ayuso613dbd92016-11-03 10:56:21 +0100228 struct nf_hook_state state = {
229 .net = dev_net(skb->dev),
230 .in = skb->dev,
231 .hook = ipt->tcfi_hook,
232 .pf = NFPROTO_IPV4,
233 };
Linus Torvalds1da177e2005-04-16 15:20:36 -0700234
Pravin B Shelar14bbd6a2013-02-14 09:44:49 +0000235 if (skb_unclone(skb, GFP_ATOMIC))
236 return TC_ACT_UNSPEC;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700237
David S. Millere9ce1cd2006-08-21 23:54:55 -0700238 spin_lock(&ipt->tcf_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700239
Jamal Hadi Salim9c4a4e42016-06-06 06:32:53 -0400240 tcf_lastuse_update(&ipt->tcf_tm);
Eric Dumazetbfe0d022011-01-09 08:30:54 +0000241 bstats_update(&ipt->tcf_bstats, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700242
243 /* yes, we have to worry about both in and out dev
Eric Dumazetcc7ec452011-01-19 19:26:56 +0000244 * worry later - danger - this API seems to have changed
245 * from earlier kernels
246 */
Pablo Neira Ayuso613dbd92016-11-03 10:56:21 +0100247 par.state = &state;
Jan Engelhardt7eb35582008-10-08 11:35:19 +0200248 par.target = ipt->tcfi_t->u.kernel.target;
249 par.targinfo = ipt->tcfi_t->data;
250 ret = par.target->target(skb, &par);
251
Linus Torvalds1da177e2005-04-16 15:20:36 -0700252 switch (ret) {
253 case NF_ACCEPT:
254 result = TC_ACT_OK;
255 break;
256 case NF_DROP:
257 result = TC_ACT_SHOT;
David S. Millere9ce1cd2006-08-21 23:54:55 -0700258 ipt->tcf_qstats.drops++;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700259 break;
Jan Engelhardt243bf6e2010-10-13 16:28:00 +0200260 case XT_CONTINUE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700261 result = TC_ACT_PIPE;
262 break;
263 default:
Joe Perchese87cc472012-05-13 21:56:26 +0000264 net_notice_ratelimited("tc filter: Bogus netfilter code %d assume ACCEPT\n",
265 ret);
WANG Cong95df1b12016-06-13 10:47:43 -0700266 result = TC_ACT_OK;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700267 break;
268 }
David S. Millere9ce1cd2006-08-21 23:54:55 -0700269 spin_unlock(&ipt->tcf_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700270 return result;
271
272}
273
Jamal Hadi Salim0b0f43f2016-06-05 10:41:32 -0400274static int tcf_ipt_dump(struct sk_buff *skb, struct tc_action *a, int bind,
275 int ref)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700276{
Arnaldo Carvalho de Melo27a884d2007-04-19 20:29:13 -0700277 unsigned char *b = skb_tail_pointer(skb);
WANG Conga85a9702016-07-25 16:09:41 -0700278 struct tcf_ipt *ipt = to_ipt(a);
Jan Engelhardt87a2e70d2010-10-13 16:11:22 +0200279 struct xt_entry_target *t;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700280 struct tcf_t tm;
281 struct tc_cnt c;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700282
283 /* for simple targets kernel size == user size
Eric Dumazetcc7ec452011-01-19 19:26:56 +0000284 * user name = target name
285 * for foolproof you need to not assume this
286 */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700287
Vlad Buslovff252762018-08-10 20:51:45 +0300288 spin_lock_bh(&ipt->tcf_lock);
Arnaldo Carvalho de Meloc7b1b242006-11-21 01:19:40 -0200289 t = kmemdup(ipt->tcfi_t, ipt->tcfi_t->u.user.target_size, GFP_ATOMIC);
David S. Millere9ce1cd2006-08-21 23:54:55 -0700290 if (unlikely(!t))
Patrick McHardy7ba699c2008-01-22 22:11:50 -0800291 goto nla_put_failure;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700292
Vlad Buslov036bb442018-07-05 17:24:24 +0300293 c.bindcnt = atomic_read(&ipt->tcf_bindcnt) - bind;
294 c.refcnt = refcount_read(&ipt->tcf_refcnt) - ref;
David S. Millere9ce1cd2006-08-21 23:54:55 -0700295 strcpy(t->u.user.name, ipt->tcfi_t->u.kernel.target->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700296
David S. Miller1b34ec42012-03-29 05:11:39 -0400297 if (nla_put(skb, TCA_IPT_TARG, ipt->tcfi_t->u.user.target_size, t) ||
298 nla_put_u32(skb, TCA_IPT_INDEX, ipt->tcf_index) ||
299 nla_put_u32(skb, TCA_IPT_HOOK, ipt->tcfi_hook) ||
300 nla_put(skb, TCA_IPT_CNT, sizeof(struct tc_cnt), &c) ||
301 nla_put_string(skb, TCA_IPT_TABLE, ipt->tcfi_tname))
302 goto nla_put_failure;
Jamal Hadi Salim48d8ee12016-06-06 06:32:55 -0400303
304 tcf_tm_dump(&tm, &ipt->tcf_tm);
Nicolas Dichtel9854518e2016-04-26 10:06:18 +0200305 if (nla_put_64bit(skb, TCA_IPT_TM, sizeof(tm), &tm, TCA_IPT_PAD))
David S. Miller1b34ec42012-03-29 05:11:39 -0400306 goto nla_put_failure;
Jamal Hadi Salim48d8ee12016-06-06 06:32:55 -0400307
Vlad Buslovff252762018-08-10 20:51:45 +0300308 spin_unlock_bh(&ipt->tcf_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700309 kfree(t);
310 return skb->len;
311
Patrick McHardy7ba699c2008-01-22 22:11:50 -0800312nla_put_failure:
Vlad Buslovff252762018-08-10 20:51:45 +0300313 spin_unlock_bh(&ipt->tcf_lock);
Arnaldo Carvalho de Melodc5fc572007-03-25 23:06:12 -0700314 nlmsg_trim(skb, b);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700315 kfree(t);
316 return -1;
317}
318
WANG Congddf97cc2016-02-22 15:57:53 -0800319static int tcf_ipt_walker(struct net *net, struct sk_buff *skb,
320 struct netlink_callback *cb, int type,
Alexander Aring41780102018-02-15 10:54:58 -0500321 const struct tc_action_ops *ops,
322 struct netlink_ext_ack *extack)
WANG Congddf97cc2016-02-22 15:57:53 -0800323{
324 struct tc_action_net *tn = net_generic(net, ipt_net_id);
325
Alexander Aringb3620142018-02-15 10:54:59 -0500326 return tcf_generic_walker(tn, skb, cb, type, ops, extack);
WANG Congddf97cc2016-02-22 15:57:53 -0800327}
328
Cong Wangf061b482018-08-29 10:15:35 -0700329static int tcf_ipt_search(struct net *net, struct tc_action **a, u32 index)
WANG Congddf97cc2016-02-22 15:57:53 -0800330{
331 struct tc_action_net *tn = net_generic(net, ipt_net_id);
332
Chris Mi65a206c2017-08-30 02:31:59 -0400333 return tcf_idr_search(tn, a, index);
WANG Congddf97cc2016-02-22 15:57:53 -0800334}
335
Linus Torvalds1da177e2005-04-16 15:20:36 -0700336static struct tc_action_ops act_ipt_ops = {
337 .kind = "ipt",
Eli Coheneddd2cf2019-02-10 14:25:00 +0200338 .id = TCA_ID_IPT,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700339 .owner = THIS_MODULE,
Jamal Hadi Salim11b96952018-08-12 09:34:53 -0400340 .act = tcf_ipt_act,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700341 .dump = tcf_ipt_dump,
WANG Cong86062032014-02-11 17:07:31 -0800342 .cleanup = tcf_ipt_release,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700343 .init = tcf_ipt_init,
WANG Congddf97cc2016-02-22 15:57:53 -0800344 .walk = tcf_ipt_walker,
345 .lookup = tcf_ipt_search,
WANG Conga85a9702016-07-25 16:09:41 -0700346 .size = sizeof(struct tcf_ipt),
Linus Torvalds1da177e2005-04-16 15:20:36 -0700347};
348
WANG Congddf97cc2016-02-22 15:57:53 -0800349static __net_init int ipt_init_net(struct net *net)
350{
351 struct tc_action_net *tn = net_generic(net, ipt_net_id);
352
Cong Wangc7e460c2017-11-06 13:47:18 -0800353 return tc_action_net_init(tn, &act_ipt_ops);
WANG Congddf97cc2016-02-22 15:57:53 -0800354}
355
Cong Wang039af9c2017-12-11 15:35:03 -0800356static void __net_exit ipt_exit_net(struct list_head *net_list)
WANG Congddf97cc2016-02-22 15:57:53 -0800357{
Cong Wang039af9c2017-12-11 15:35:03 -0800358 tc_action_net_exit(net_list, ipt_net_id);
WANG Congddf97cc2016-02-22 15:57:53 -0800359}
360
361static struct pernet_operations ipt_net_ops = {
362 .init = ipt_init_net,
Cong Wang039af9c2017-12-11 15:35:03 -0800363 .exit_batch = ipt_exit_net,
WANG Congddf97cc2016-02-22 15:57:53 -0800364 .id = &ipt_net_id,
365 .size = sizeof(struct tc_action_net),
366};
367
368static int tcf_xt_walker(struct net *net, struct sk_buff *skb,
369 struct netlink_callback *cb, int type,
Alexander Aring41780102018-02-15 10:54:58 -0500370 const struct tc_action_ops *ops,
371 struct netlink_ext_ack *extack)
WANG Congddf97cc2016-02-22 15:57:53 -0800372{
373 struct tc_action_net *tn = net_generic(net, xt_net_id);
374
Alexander Aringb3620142018-02-15 10:54:59 -0500375 return tcf_generic_walker(tn, skb, cb, type, ops, extack);
WANG Congddf97cc2016-02-22 15:57:53 -0800376}
377
Cong Wangf061b482018-08-29 10:15:35 -0700378static int tcf_xt_search(struct net *net, struct tc_action **a, u32 index)
WANG Congddf97cc2016-02-22 15:57:53 -0800379{
380 struct tc_action_net *tn = net_generic(net, xt_net_id);
381
Chris Mi65a206c2017-08-30 02:31:59 -0400382 return tcf_idr_search(tn, a, index);
WANG Congddf97cc2016-02-22 15:57:53 -0800383}
384
Jamal Hadi Salim0dcffd02013-04-28 05:06:38 +0000385static struct tc_action_ops act_xt_ops = {
386 .kind = "xt",
Eli Coheneddd2cf2019-02-10 14:25:00 +0200387 .id = TCA_ID_XT,
Jamal Hadi Salim0dcffd02013-04-28 05:06:38 +0000388 .owner = THIS_MODULE,
Jamal Hadi Salim11b96952018-08-12 09:34:53 -0400389 .act = tcf_ipt_act,
Jamal Hadi Salim0dcffd02013-04-28 05:06:38 +0000390 .dump = tcf_ipt_dump,
WANG Cong86062032014-02-11 17:07:31 -0800391 .cleanup = tcf_ipt_release,
WANG Congddf97cc2016-02-22 15:57:53 -0800392 .init = tcf_xt_init,
393 .walk = tcf_xt_walker,
394 .lookup = tcf_xt_search,
WANG Conga85a9702016-07-25 16:09:41 -0700395 .size = sizeof(struct tcf_ipt),
WANG Congddf97cc2016-02-22 15:57:53 -0800396};
397
398static __net_init int xt_init_net(struct net *net)
399{
400 struct tc_action_net *tn = net_generic(net, xt_net_id);
401
Cong Wangc7e460c2017-11-06 13:47:18 -0800402 return tc_action_net_init(tn, &act_xt_ops);
WANG Congddf97cc2016-02-22 15:57:53 -0800403}
404
Cong Wang039af9c2017-12-11 15:35:03 -0800405static void __net_exit xt_exit_net(struct list_head *net_list)
WANG Congddf97cc2016-02-22 15:57:53 -0800406{
Cong Wang039af9c2017-12-11 15:35:03 -0800407 tc_action_net_exit(net_list, xt_net_id);
WANG Congddf97cc2016-02-22 15:57:53 -0800408}
409
410static struct pernet_operations xt_net_ops = {
411 .init = xt_init_net,
Cong Wang039af9c2017-12-11 15:35:03 -0800412 .exit_batch = xt_exit_net,
WANG Congddf97cc2016-02-22 15:57:53 -0800413 .id = &xt_net_id,
414 .size = sizeof(struct tc_action_net),
Jamal Hadi Salim0dcffd02013-04-28 05:06:38 +0000415};
416
417MODULE_AUTHOR("Jamal Hadi Salim(2002-13)");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700418MODULE_DESCRIPTION("Iptables target actions");
419MODULE_LICENSE("GPL");
Jamal Hadi Salim0dcffd02013-04-28 05:06:38 +0000420MODULE_ALIAS("act_xt");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700421
David S. Millere9ce1cd2006-08-21 23:54:55 -0700422static int __init ipt_init_module(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700423{
WANG Cong4f1e9d82014-02-11 17:07:33 -0800424 int ret1, ret2;
WANG Cong369ba562013-12-15 20:15:08 -0800425
WANG Congddf97cc2016-02-22 15:57:53 -0800426 ret1 = tcf_register_action(&act_xt_ops, &xt_net_ops);
Jamal Hadi Salim0dcffd02013-04-28 05:06:38 +0000427 if (ret1 < 0)
WANG Congddf97cc2016-02-22 15:57:53 -0800428 pr_err("Failed to load xt action\n");
429
430 ret2 = tcf_register_action(&act_ipt_ops, &ipt_net_ops);
Jamal Hadi Salim0dcffd02013-04-28 05:06:38 +0000431 if (ret2 < 0)
WANG Congddf97cc2016-02-22 15:57:53 -0800432 pr_err("Failed to load ipt action\n");
Jamal Hadi Salim0dcffd02013-04-28 05:06:38 +0000433
WANG Cong369ba562013-12-15 20:15:08 -0800434 if (ret1 < 0 && ret2 < 0) {
Jamal Hadi Salim0dcffd02013-04-28 05:06:38 +0000435 return ret1;
WANG Cong369ba562013-12-15 20:15:08 -0800436 } else
Jamal Hadi Salim0dcffd02013-04-28 05:06:38 +0000437 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700438}
439
David S. Millere9ce1cd2006-08-21 23:54:55 -0700440static void __exit ipt_cleanup_module(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700441{
WANG Congddf97cc2016-02-22 15:57:53 -0800442 tcf_unregister_action(&act_ipt_ops, &ipt_net_ops);
443 tcf_unregister_action(&act_xt_ops, &xt_net_ops);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700444}
445
446module_init(ipt_init_module);
447module_exit(ipt_cleanup_module);