tc/em_ipt.c

/*
 * em_ipt.c		IPtables extensions matching Ematch
 *
 * (C) 2018 Eyal Birger <eyal.birger@gmail.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <getopt.h>

#include <linux/tc_ematch/tc_em_ipt.h>
#include <linux/pkt_cls.h>
#include <xtables.h>
#include "m_ematch.h"

static void em_ipt_print_usage(FILE *fd)
{
	fprintf(fd,
		"Usage: ipt([-6] -m MATCH_NAME [MATCH_OPTS])\n"
		"Example: 'ipt(-m policy --reqid 1 --pol ipsec --dir in)'\n");
}

static struct option original_opts[] = {
	{
		.name = "match",
		.has_arg = 1,
		.val = 'm'
	},
	{
		.name = "ipv6",
		.val = '6'
	},
	{}
};

static struct xtables_globals em_tc_ipt_globals = {
	.option_offset = 0,
	.program_name = "tc-em-ipt",
	.program_version = "0.1",
	.orig_opts = original_opts,
	.opts = original_opts,
#if (XTABLES_VERSION_CODE >= 11)
	.compat_rev = xtables_compatible_revision,
#endif
};

static struct xt_entry_match *fake_xt_entry_match(int data_size, void *data)
{
	struct xt_entry_match *m;

	m = xtables_calloc(1, XT_ALIGN(sizeof(*m)) + data_size);
	if (!m)
		return NULL;

	if (data)
		memcpy(m->data, data, data_size);

	m->u.user.match_size = data_size;
	return m;
}

static void scrub_match(struct xtables_match *match)
{
	match->mflags = 0;
	free(match->m);
	match->m = NULL;
}

/* IPv4 and IPv6 share the same hooking enumeration */
#define HOOK_PRE_ROUTING 0
#define HOOK_POST_ROUTING 4

static __u32 em_ipt_hook(struct nlmsghdr *n)
{
	struct tcmsg *t = NLMSG_DATA(n);

	if (t->tcm_parent != TC_H_ROOT &&
	    t->tcm_parent == TC_H_MAJ(TC_H_INGRESS))
		return HOOK_PRE_ROUTING;

	return HOOK_POST_ROUTING;
}

static int em_ipt_parse_eopt_argv(struct nlmsghdr *n,
				  struct tcf_ematch_hdr *hdr,
				  int argc, char **argv)
{
	struct xtables_globals tmp_tcipt_globals = em_tc_ipt_globals;
	struct xtables_match *match = NULL;
	__u8 nfproto = NFPROTO_IPV4;

	while (1) {
		struct option *opts;
		int c;

		c = getopt_long(argc, argv, "6m:", tmp_tcipt_globals.opts,
				NULL);
		if (c == -1)
			break;

		switch (c) {
		case 'm':
			xtables_init_all(&tmp_tcipt_globals, nfproto);

			match = xtables_find_match(optarg, XTF_TRY_LOAD, NULL);
			if (!match || !match->x6_parse) {
				fprintf(stderr, " failed to find match %s\n\n",
					optarg);
				return -1;
			}

			match->m = fake_xt_entry_match(match->size, NULL);
			if (!match->m) {
				printf(" %s error\n", match->name);
				return -1;
			}

			if (match->init)
				match->init(match->m);

			opts = xtables_options_xfrm(tmp_tcipt_globals.orig_opts,
						    tmp_tcipt_globals.opts,
						    match->x6_options,
						    &match->option_offset);
			if (!opts) {
				scrub_match(match);
				return -1;
			}

			tmp_tcipt_globals.opts = opts;
			break;

		case '6':
			nfproto = NFPROTO_IPV6;
			break;

		default:
			if (!match) {
				fprintf(stderr, "failed to find match %s\n\n",
					optarg);
				return -1;

			}
			xtables_option_mpcall(c, argv, 0, match, NULL);
			break;
		}
	}

	if (!match) {
		fprintf(stderr, " failed to parse parameters (%s)\n", *argv);
		return -1;
	}

	/* check that we passed the correct parameters to the match */
	xtables_option_mfcall(match);

	addraw_l(n, MAX_MSG, hdr, sizeof(*hdr));
	addattr32(n, MAX_MSG, TCA_EM_IPT_HOOK, em_ipt_hook(n));
	addattrstrz(n, MAX_MSG, TCA_EM_IPT_MATCH_NAME, match->name);
	addattr8(n, MAX_MSG, TCA_EM_IPT_MATCH_REVISION, match->revision);
	addattr8(n, MAX_MSG, TCA_EM_IPT_NFPROTO, nfproto);
	addattr_l(n, MAX_MSG, TCA_EM_IPT_MATCH_DATA, match->m->data,
		  match->size);

	xtables_free_opts(1);

	scrub_match(match);
	return 0;
}

static int em_ipt_print_epot(FILE *fd, struct tcf_ematch_hdr *hdr, void *data,
			     int data_len)
{
	struct rtattr *tb[TCA_EM_IPT_MAX + 1];
	struct xtables_match *match;
	const char *mname;
	__u8 nfproto;

	if (parse_rtattr(tb, TCA_EM_IPT_MAX, data, data_len) < 0)
		return -1;

	nfproto = rta_getattr_u8(tb[TCA_EM_IPT_NFPROTO]);

	xtables_init_all(&em_tc_ipt_globals, nfproto);

	mname = rta_getattr_str(tb[TCA_EM_IPT_MATCH_NAME]);
	match = xtables_find_match(mname, XTF_TRY_LOAD, NULL);
	if (!match)
		return -1;

	match->m = fake_xt_entry_match(RTA_PAYLOAD(tb[TCA_EM_IPT_MATCH_DATA]),
				       RTA_DATA(tb[TCA_EM_IPT_MATCH_DATA]));
	if (!match->m)
		return -1;

	match->print(NULL, match->m, 0);

	scrub_match(match);
	return 0;
}

struct ematch_util ipt_ematch_util = {
	.kind = "ipt",
	.kind_num = TCF_EM_IPT,
	.parse_eopt_argv = em_ipt_parse_eopt_argv,
	.print_eopt = em_ipt_print_epot,
	.print_usage = em_ipt_print_usage
};