linux-imx

/*

 * net/sched/em_ipt.c IPtables matches Ematch

 *

 * (c) 2018 Eyal Birger <eyal.birger@gmail.com>

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version

 * 2 of the License, or (at your option) any later version.

 */

​

#include <linux/gfp.h>

#include <linux/module.h>

#include <linux/types.h>

#include <linux/kernel.h>

#include <linux/string.h>

#include <linux/skbuff.h>

#include <linux/tc_ematch/tc_em_ipt.h>

#include <linux/netfilter.h>

#include <linux/netfilter/x_tables.h>

#include <linux/netfilter_ipv4/ip_tables.h>

#include <linux/netfilter_ipv6/ip6_tables.h>

#include <net/pkt_cls.h>

​

struct em_ipt_match {

    const struct xt_match *match;

    u32 hook;

    u8 match_data[0] __aligned(8);

};

​

struct em_ipt_xt_match {

    char *match_name;

    int (*validate_match_data)(struct nlattr **tb, u8 mrev);

};

​

static const struct nla_policy em_ipt_policy[TCA_EM_IPT_MAX + 1] = {

    [TCA_EM_IPT_MATCH_NAME]     = { .type = NLA_STRING,

                        .len = XT_EXTENSION_MAXNAMELEN },

    [TCA_EM_IPT_MATCH_REVISION] = { .type = NLA_U8 },

    [TCA_EM_IPT_HOOK]       = { .type = NLA_U32 },

    [TCA_EM_IPT_NFPROTO]        = { .type = NLA_U8 },

    [TCA_EM_IPT_MATCH_DATA]     = { .type = NLA_UNSPEC },

};

​

static int check_match(struct net *net, struct em_ipt_match *im, int mdata_len)

{

    struct xt_mtchk_param mtpar = {};

    union {

        struct ipt_entry e4;

        struct ip6t_entry e6;

    } e = {};

​

    mtpar.net   = net;

    mtpar.table = "filter";

    mtpar.hook_mask = 1 << im->hook;

    mtpar.family    = im->match->family;

    mtpar.match = im->match;

    mtpar.entryinfo = &e;

    mtpar.matchinfo = (void *)im->match_data;

    return xt_check_match(&mtpar, mdata_len, 0, 0);

}

​

static int policy_validate_match_data(struct nlattr **tb, u8 mrev)

{

    if (mrev != 0) {

        pr_err("only policy match revision 0 supported");

        return -EINVAL;

    }

​

    if (nla_get_u32(tb[TCA_EM_IPT_HOOK]) != NF_INET_PRE_ROUTING) {

        pr_err("policy can only be matched on NF_INET_PRE_ROUTING");

        return -EINVAL;

    }

​

    return 0;

}

​

static const struct em_ipt_xt_match em_ipt_xt_matches[] = {

    {

        .match_name = "policy",

        .validate_match_data = policy_validate_match_data

    },

    {}

};

​

static struct xt_match *get_xt_match(struct nlattr **tb)

{

    const struct em_ipt_xt_match *m;

    struct nlattr *mname_attr;

    u8 nfproto, mrev = 0;

    int ret;

​