1 /* 2 * Copyright (c) 2011 Florian Westphal <fw@strlen.de> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 * 8 * based on fib_frontend.c; Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 9 */ 10 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 11 #include <linux/module.h> 12 #include <linux/skbuff.h> 13 #include <linux/netdevice.h> 14 #include <linux/ip.h> 15 #include <net/ip.h> 16 #include <net/ip_fib.h> 17 #include <net/route.h> 18 19 #include <linux/netfilter/xt_rpfilter.h> 20 #include <linux/netfilter/x_tables.h> 21 22 MODULE_LICENSE("GPL"); 23 MODULE_AUTHOR("Florian Westphal <fw@strlen.de>"); 24 MODULE_DESCRIPTION("iptables: ipv4 reverse path filter match"); 25 26 /* don't try to find route from mcast/bcast/zeronet */ 27 static __be32 rpfilter_get_saddr(__be32 addr) 28 { 29 if (ipv4_is_multicast(addr) || ipv4_is_lbcast(addr) || 30 ipv4_is_zeronet(addr)) 31 return 0; 32 return addr; 33 } 34 35 static bool rpfilter_lookup_reverse(struct net *net, struct flowi4 *fl4, 36 const struct net_device *dev, u8 flags) 37 { 38 struct fib_result res; 39 bool dev_match; 40 int ret __maybe_unused; 41 42 if (fib_lookup(net, fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE)) 43 return false; 44 45 if (res.type != RTN_UNICAST) { 46 if (res.type != RTN_LOCAL || !(flags & XT_RPFILTER_ACCEPT_LOCAL)) 47 return false; 48 } 49 dev_match = false; 50 #ifdef CONFIG_IP_ROUTE_MULTIPATH 51 for (ret = 0; ret < res.fi->fib_nhs; ret++) { 52 struct fib_nh *nh = &res.fi->fib_nh[ret]; 53 54 if (nh->nh_dev == dev) { 55 dev_match = true; 56 break; 57 } 58 } 59 #else 60 if (FIB_RES_DEV(res) == dev) 61 dev_match = true; 62 #endif 63 return dev_match || flags & XT_RPFILTER_LOOSE; 64 } 65 66 static bool rpfilter_is_local(const struct sk_buff *skb) 67 { 68 const struct rtable *rt = skb_rtable(skb); 69 return rt && (rt->rt_flags & RTCF_LOCAL); 70 } 71 72 static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par) 73 { 74 const struct xt_rpfilter_info *info; 75 const struct iphdr *iph; 76 struct flowi4 flow; 77 bool invert; 78 79 info = par->matchinfo; 80 invert = info->flags & XT_RPFILTER_INVERT; 81 82 if (rpfilter_is_local(skb)) 83 return true ^ invert; 84 85 iph = ip_hdr(skb); 86 if (ipv4_is_multicast(iph->daddr)) { 87 if (ipv4_is_zeronet(iph->saddr)) 88 return ipv4_is_local_multicast(iph->daddr) ^ invert; 89 } 90 flow.flowi4_iif = LOOPBACK_IFINDEX; 91 flow.daddr = iph->saddr; 92 flow.saddr = rpfilter_get_saddr(iph->daddr); 93 flow.flowi4_oif = 0; 94 flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; 95 flow.flowi4_tos = RT_TOS(iph->tos); 96 flow.flowi4_scope = RT_SCOPE_UNIVERSE; 97 98 return rpfilter_lookup_reverse(par->net, &flow, par->in, info->flags) ^ invert; 99 } 100 101 static int rpfilter_check(const struct xt_mtchk_param *par) 102 { 103 const struct xt_rpfilter_info *info = par->matchinfo; 104 unsigned int options = ~XT_RPFILTER_OPTION_MASK; 105 if (info->flags & options) { 106 pr_info("unknown options encountered"); 107 return -EINVAL; 108 } 109 110 if (strcmp(par->table, "mangle") != 0 && 111 strcmp(par->table, "raw") != 0) { 112 pr_info("match only valid in the \'raw\' " 113 "or \'mangle\' tables, not \'%s\'.\n", par->table); 114 return -EINVAL; 115 } 116 117 return 0; 118 } 119 120 static struct xt_match rpfilter_mt_reg __read_mostly = { 121 .name = "rpfilter", 122 .family = NFPROTO_IPV4, 123 .checkentry = rpfilter_check, 124 .match = rpfilter_mt, 125 .matchsize = sizeof(struct xt_rpfilter_info), 126 .hooks = (1 << NF_INET_PRE_ROUTING), 127 .me = THIS_MODULE 128 }; 129 130 static int __init rpfilter_mt_init(void) 131 { 132 return xt_register_match(&rpfilter_mt_reg); 133 } 134 135 static void __exit rpfilter_mt_exit(void) 136 { 137 xt_unregister_match(&rpfilter_mt_reg); 138 } 139 140 module_init(rpfilter_mt_init); 141 module_exit(rpfilter_mt_exit); 142