1/* 2 * Copyright (c) 2011 Florian Westphal <fw@strlen.de> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 * 8 * based on fib_frontend.c; Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 9 */ 10#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 11#include <linux/module.h> 12#include <linux/skbuff.h> 13#include <linux/netdevice.h> 14#include <linux/ip.h> 15#include <net/ip.h> 16#include <net/ip_fib.h> 17#include <net/route.h> 18 19#include <linux/netfilter/xt_rpfilter.h> 20#include <linux/netfilter/x_tables.h> 21 22MODULE_LICENSE("GPL"); 23MODULE_AUTHOR("Florian Westphal <fw@strlen.de>"); 24MODULE_DESCRIPTION("iptables: ipv4 reverse path filter match"); 25 26/* don't try to find route from mcast/bcast/zeronet */ 27static __be32 rpfilter_get_saddr(__be32 addr) 28{ 29 if (ipv4_is_multicast(addr) || ipv4_is_lbcast(addr) || 30 ipv4_is_zeronet(addr)) 31 return 0; 32 return addr; 33} 34 35static bool rpfilter_lookup_reverse(struct flowi4 *fl4, 36 const struct net_device *dev, u8 flags) 37{ 38 struct fib_result res; 39 bool dev_match; 40 struct net *net = dev_net(dev); 41 int ret __maybe_unused; 42 43 if (fib_lookup(net, fl4, &res)) 44 return false; 45 46 if (res.type != RTN_UNICAST) { 47 if (res.type != RTN_LOCAL || !(flags & XT_RPFILTER_ACCEPT_LOCAL)) 48 return false; 49 } 50 dev_match = false; 51#ifdef CONFIG_IP_ROUTE_MULTIPATH 52 for (ret = 0; ret < res.fi->fib_nhs; ret++) { 53 struct fib_nh *nh = &res.fi->fib_nh[ret]; 54 55 if (nh->nh_dev == dev) { 56 dev_match = true; 57 break; 58 } 59 } 60#else 61 if (FIB_RES_DEV(res) == dev) 62 dev_match = true; 63#endif 64 if (dev_match || flags & XT_RPFILTER_LOOSE) 65 return FIB_RES_NH(res).nh_scope <= RT_SCOPE_HOST; 66 return dev_match; 67} 68 69static bool rpfilter_is_local(const struct sk_buff *skb) 70{ 71 const struct rtable *rt = skb_rtable(skb); 72 return rt && (rt->rt_flags & RTCF_LOCAL); 73} 74 75static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par) 76{ 77 const struct xt_rpfilter_info *info; 78 const struct iphdr *iph; 79 struct flowi4 flow; 80 bool invert; 81 82 info = par->matchinfo; 83 invert = info->flags & XT_RPFILTER_INVERT; 84 85 if (rpfilter_is_local(skb)) 86 return true ^ invert; 87 88 iph = ip_hdr(skb); 89 if (ipv4_is_multicast(iph->daddr)) { 90 if (ipv4_is_zeronet(iph->saddr)) 91 return ipv4_is_local_multicast(iph->daddr) ^ invert; 92 } 93 flow.flowi4_iif = LOOPBACK_IFINDEX; 94 flow.daddr = iph->saddr; 95 flow.saddr = rpfilter_get_saddr(iph->daddr); 96 flow.flowi4_oif = 0; 97 flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; 98 flow.flowi4_tos = RT_TOS(iph->tos); 99 flow.flowi4_scope = RT_SCOPE_UNIVERSE; 100 101 return rpfilter_lookup_reverse(&flow, par->in, info->flags) ^ invert; 102} 103 104static int rpfilter_check(const struct xt_mtchk_param *par) 105{ 106 const struct xt_rpfilter_info *info = par->matchinfo; 107 unsigned int options = ~XT_RPFILTER_OPTION_MASK; 108 if (info->flags & options) { 109 pr_info("unknown options encountered"); 110 return -EINVAL; 111 } 112 113 if (strcmp(par->table, "mangle") != 0 && 114 strcmp(par->table, "raw") != 0) { 115 pr_info("match only valid in the \'raw\' " 116 "or \'mangle\' tables, not \'%s\'.\n", par->table); 117 return -EINVAL; 118 } 119 120 return 0; 121} 122 123static struct xt_match rpfilter_mt_reg __read_mostly = { 124 .name = "rpfilter", 125 .family = NFPROTO_IPV4, 126 .checkentry = rpfilter_check, 127 .match = rpfilter_mt, 128 .matchsize = sizeof(struct xt_rpfilter_info), 129 .hooks = (1 << NF_INET_PRE_ROUTING), 130 .me = THIS_MODULE 131}; 132 133static int __init rpfilter_mt_init(void) 134{ 135 return xt_register_match(&rpfilter_mt_reg); 136} 137 138static void __exit rpfilter_mt_exit(void) 139{ 140 xt_unregister_match(&rpfilter_mt_reg); 141} 142 143module_init(rpfilter_mt_init); 144module_exit(rpfilter_mt_exit); 145