~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/xt_ipvs.c

Version: ~ [ linux-5.12-rc1 ] ~ [ linux-5.11.2 ] ~ [ linux-5.10.19 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.101 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.177 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.222 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.258 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.258 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0-only
  2 /*
  3  *      xt_ipvs - kernel module to match IPVS connection properties
  4  *
  5  *      Author: Hannes Eder <heder@google.com>
  6  */
  7 
  8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  9 
 10 #include <linux/module.h>
 11 #include <linux/moduleparam.h>
 12 #include <linux/spinlock.h>
 13 #include <linux/skbuff.h>
 14 #ifdef CONFIG_IP_VS_IPV6
 15 #include <net/ipv6.h>
 16 #endif
 17 #include <linux/ip_vs.h>
 18 #include <linux/types.h>
 19 #include <linux/netfilter/x_tables.h>
 20 #include <linux/netfilter/xt_ipvs.h>
 21 #include <net/netfilter/nf_conntrack.h>
 22 
 23 #include <net/ip_vs.h>
 24 
 25 MODULE_AUTHOR("Hannes Eder <heder@google.com>");
 26 MODULE_DESCRIPTION("Xtables: match IPVS connection properties");
 27 MODULE_LICENSE("GPL");
 28 MODULE_ALIAS("ipt_ipvs");
 29 MODULE_ALIAS("ip6t_ipvs");
 30 
 31 /* borrowed from xt_conntrack */
 32 static bool ipvs_mt_addrcmp(const union nf_inet_addr *kaddr,
 33                             const union nf_inet_addr *uaddr,
 34                             const union nf_inet_addr *umask,
 35                             unsigned int l3proto)
 36 {
 37         if (l3proto == NFPROTO_IPV4)
 38                 return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0;
 39 #ifdef CONFIG_IP_VS_IPV6
 40         else if (l3proto == NFPROTO_IPV6)
 41                 return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6,
 42                        &uaddr->in6) == 0;
 43 #endif
 44         else
 45                 return false;
 46 }
 47 
 48 static bool
 49 ipvs_mt(const struct sk_buff *skb, struct xt_action_param *par)
 50 {
 51         const struct xt_ipvs_mtinfo *data = par->matchinfo;
 52         struct netns_ipvs *ipvs = net_ipvs(xt_net(par));
 53         /* ipvs_mt_check ensures that family is only NFPROTO_IPV[46]. */
 54         const u_int8_t family = xt_family(par);
 55         struct ip_vs_iphdr iph;
 56         struct ip_vs_protocol *pp;
 57         struct ip_vs_conn *cp;
 58         bool match = true;
 59 
 60         if (data->bitmask == XT_IPVS_IPVS_PROPERTY) {
 61                 match = skb->ipvs_property ^
 62                         !!(data->invert & XT_IPVS_IPVS_PROPERTY);
 63                 goto out;
 64         }
 65 
 66         /* other flags than XT_IPVS_IPVS_PROPERTY are set */
 67         if (!skb->ipvs_property) {
 68                 match = false;
 69                 goto out;
 70         }
 71 
 72         ip_vs_fill_iph_skb(family, skb, true, &iph);
 73 
 74         if (data->bitmask & XT_IPVS_PROTO)
 75                 if ((iph.protocol == data->l4proto) ^
 76                     !(data->invert & XT_IPVS_PROTO)) {
 77                         match = false;
 78                         goto out;
 79                 }
 80 
 81         pp = ip_vs_proto_get(iph.protocol);
 82         if (unlikely(!pp)) {
 83                 match = false;
 84                 goto out;
 85         }
 86 
 87         /*
 88          * Check if the packet belongs to an existing entry
 89          */
 90         cp = pp->conn_out_get(ipvs, family, skb, &iph);
 91         if (unlikely(cp == NULL)) {
 92                 match = false;
 93                 goto out;
 94         }
 95 
 96         /*
 97          * We found a connection, i.e. ct != 0, make sure to call
 98          * __ip_vs_conn_put before returning.  In our case jump to out_put_con.
 99          */
100 
101         if (data->bitmask & XT_IPVS_VPORT)
102                 if ((cp->vport == data->vport) ^
103                     !(data->invert & XT_IPVS_VPORT)) {
104                         match = false;
105                         goto out_put_cp;
106                 }
107 
108         if (data->bitmask & XT_IPVS_VPORTCTL)
109                 if ((cp->control != NULL &&
110                      cp->control->vport == data->vportctl) ^
111                     !(data->invert & XT_IPVS_VPORTCTL)) {
112                         match = false;
113                         goto out_put_cp;
114                 }
115 
116         if (data->bitmask & XT_IPVS_DIR) {
117                 enum ip_conntrack_info ctinfo;
118                 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
119 
120                 if (ct == NULL) {
121                         match = false;
122                         goto out_put_cp;
123                 }
124 
125                 if ((ctinfo >= IP_CT_IS_REPLY) ^
126                     !!(data->invert & XT_IPVS_DIR)) {
127                         match = false;
128                         goto out_put_cp;
129                 }
130         }
131 
132         if (data->bitmask & XT_IPVS_METHOD)
133                 if (((cp->flags & IP_VS_CONN_F_FWD_MASK) == data->fwd_method) ^
134                     !(data->invert & XT_IPVS_METHOD)) {
135                         match = false;
136                         goto out_put_cp;
137                 }
138 
139         if (data->bitmask & XT_IPVS_VADDR) {
140                 if (ipvs_mt_addrcmp(&cp->vaddr, &data->vaddr,
141                                     &data->vmask, family) ^
142                     !(data->invert & XT_IPVS_VADDR)) {
143                         match = false;
144                         goto out_put_cp;
145                 }
146         }
147 
148 out_put_cp:
149         __ip_vs_conn_put(cp);
150 out:
151         pr_debug("match=%d\n", match);
152         return match;
153 }
154 
155 static int ipvs_mt_check(const struct xt_mtchk_param *par)
156 {
157         if (par->family != NFPROTO_IPV4
158 #ifdef CONFIG_IP_VS_IPV6
159             && par->family != NFPROTO_IPV6
160 #endif
161                 ) {
162                 pr_info_ratelimited("protocol family %u not supported\n",
163                                     par->family);
164                 return -EINVAL;
165         }
166 
167         return 0;
168 }
169 
170 static struct xt_match xt_ipvs_mt_reg __read_mostly = {
171         .name       = "ipvs",
172         .revision   = 0,
173         .family     = NFPROTO_UNSPEC,
174         .match      = ipvs_mt,
175         .checkentry = ipvs_mt_check,
176         .matchsize  = XT_ALIGN(sizeof(struct xt_ipvs_mtinfo)),
177         .me         = THIS_MODULE,
178 };
179 
180 static int __init ipvs_mt_init(void)
181 {
182         return xt_register_match(&xt_ipvs_mt_reg);
183 }
184 
185 static void __exit ipvs_mt_exit(void)
186 {
187         xt_unregister_match(&xt_ipvs_mt_reg);
188 }
189 
190 module_init(ipvs_mt_init);
191 module_exit(ipvs_mt_exit);
192 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp