summaryrefslogtreecommitdiffstats
path: root/src/extra/pktbuff.c
blob: 6250fbf3ac8bf39472e69e0469069a2b40c06cee (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
/*
 * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This code has been sponsored by Vyatta Inc. <http://www.vyatta.com>
 */

#include <errno.h>
#include <stdlib.h>
#include <string.h> /* for memcpy */
#include <stdbool.h>

#include <netinet/if_ether.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>

#include "internal.h"

/**
 * \defgroup pktbuff User-space network packet buffer
 *
 * This library provides the user-space network packet buffer. This abstraction
 * is strongly inspired by Linux kernel network buffer, the so-called sk_buff.
 *
 * @{
 */

/**
 * pktb_alloc - allocate a new packet buffer
 * \param family Indicate what family. Currently supported families are
 * AF_BRIDGE, AF_INET & AF_INET6.
 * \param data Pointer to packet data
 * \param len Packet length
 * \param extra Extra memory in the tail to be allocated (for mangling)
 *
 * This function returns a packet buffer that contains the packet data and
 * some extra memory room in the tail (if requested).
 *
 * \return Pointer to a new userspace packet buffer or NULL on failure.
 * \par Errors
 * __ENOMEM__ From __calloc__()
 * \n
 * __EPROTONOSUPPORT__ _family_ was __AF_BRIDGE__ and this is not an IP packet
 * (v4 or v6)
 * \sa __calloc__(3)
 */
EXPORT_SYMBOL
struct pkt_buff *pktb_alloc(int family, void *data, size_t len, size_t extra)
{
	struct pkt_buff *pktb;
	void *pkt_data;

	pktb = calloc(1, sizeof(struct pkt_buff) + len + extra);
	if (pktb == NULL)
		return NULL;

	/* Better make sure alignment is correct. */
	pkt_data = (uint8_t *)pktb + sizeof(struct pkt_buff);
	memcpy(pkt_data, data, len);

	pktb->len = len;
	pktb->data_len = len + extra;

	pktb->head = pkt_data;
	pktb->data = pkt_data;
	pktb->tail = pktb->head + len;

	switch(family) {
	case AF_INET:
	case AF_INET6:
		pktb->network_header = pktb->data;
		break;
	case AF_BRIDGE: {
		struct ethhdr *ethhdr = (struct ethhdr *)pktb->data;

		pktb->mac_header = pktb->data;

		switch(ethhdr->h_proto) {
		case ETH_P_IP:
		case ETH_P_IPV6:
			pktb->network_header = pktb->data + ETH_HLEN;
			break;
		default:
			/* This protocol is unsupported. */
			errno = EPROTONOSUPPORT;
			free(pktb);
			return NULL;
		}
		break;
	}
	}
	return pktb;
}

/**
 * pktb_data - get pointer to network packet
 * \param pktb Pointer to userspace packet buffer
 * \return Pointer to start of network packet data within __pktb__
 * \par
 * It is appropriate to use _pktb_data_ as the second argument of
 * nfq_nlmsg_verdict_put_pkt()
 */
EXPORT_SYMBOL
uint8_t *pktb_data(struct pkt_buff *pktb)
{
	return pktb->data;
}

/**
 * pktb_len - get length of packet buffer
 * \param pktb Pointer to userspace packet buffer
 * \return Length of packet contained within __pktb__
 * \par
 * It is appropriate to use _pktb_len_ as the third argument of
 * nfq_nlmsg_verdict_put_pkt()
 */
EXPORT_SYMBOL
uint32_t pktb_len(struct pkt_buff *pktb)
{
	return pktb->len;
}

/**
 * pktb_free - release packet buffer
 * \param pktb Pointer to userspace packet buffer
 */
EXPORT_SYMBOL
void pktb_free(struct pkt_buff *pktb)
{
	free(pktb);
}

/**
 * \defgroup otherfns Other functions
 *
 * The library provides a number of other functions which many user-space
 * programs will never need. These divide into 2 groups:
 * \n
 * 1. Functions to get values of members of opaque __struct pktbuff__, described
 * below
 * \n
 * 2. Internal functions, described in Module __Internal functions__
 *
 * @{
 */

/**
 * \defgroup uselessfns Internal functions
 *
 * \warning Do not use these functions. Instead, always use the mangle
 * function appropriate to the level at which you are working.
 * \n
 * pktb_mangle() uses all the below functions except _pktb_pull_, which is not
 * used by anything.
 *
 * @{
 */

/**
 * pktb_push - decrement pointer to packet buffer
 * \param pktb Pointer to userspace packet buffer
 * \param len Number of bytes to subtract from packet start address
 */
EXPORT_SYMBOL
void pktb_push(struct pkt_buff *pktb, unsigned int len)
{
	pktb->data -= len;
	pktb->len += len;
}

/**
 * pktb_pull - increment pointer to packet buffer
 * \param pktb Pointer to userspace packet buffer
 * \param len Number of bytes to add to packet start address
 */
EXPORT_SYMBOL
void pktb_pull(struct pkt_buff *pktb, unsigned int len)
{
	pktb->data += len;
	pktb->len -= len;
}

/**
 * pktb_put - add extra bytes to the tail of the packet buffer
 * \param pktb Pointer to userspace packet buffer
 * \param len Number of bytes to add to packet tail (and length)
 */
EXPORT_SYMBOL
void pktb_put(struct pkt_buff *pktb, unsigned int len)
{
	pktb->tail += len;
	pktb->len += len;
}

/**
 * pktb_trim - set new length for this packet buffer
 * \param pktb Pointer to userspace packet buffer
 * \param len New packet length (tail is adjusted to reflect this)
 */
EXPORT_SYMBOL
void pktb_trim(struct pkt_buff *pktb, unsigned int len)
{
	pktb->len = len;
	pktb->tail = pktb->head + len;
}

/**
 * @}
 */

/**
 * pktb_tailroom - get room available for packet expansion
 * \param pktb Pointer to userspace packet buffer
 * \return room in bytes after the tail of the packet buffer
 * \n
 * This starts off as the __extra__ argument to pktb_alloc().
 * Programmers should ensure this __extra__ argument is sufficient for any
 * packet mangle, as packet buffers cannot be expanded dynamically.
 */
EXPORT_SYMBOL
unsigned int pktb_tailroom(struct pkt_buff *pktb)
{
	return pktb->data_len - pktb->len;
}

/**
 * pktb_mac_header - get address of layer 2 header (if any)
 * \param pktb Pointer to userspace packet buffer
 * \return Pointer to MAC header or NULL if no such header present.
 * \n
 * Only packet buffers in family __AF_BRIDGE__ have a non-NULL MAC header.
 */
EXPORT_SYMBOL
uint8_t *pktb_mac_header(struct pkt_buff *pktb)
{
	return pktb->mac_header;
}

/**
 * pktb_network_header - get address of layer 3 header
 * \param pktb Pointer to userspace packet buffer
 * \return Pointer to layer 3 header or NULL if the packet buffer was created
 * with an unsupported family
 */
EXPORT_SYMBOL
uint8_t *pktb_network_header(struct pkt_buff *pktb)
{
	return pktb->network_header;
}

/**
 * pktb_transport_header - get address of layer 4 header (if known)
 * \param pktb Pointer to userspace packet buffer
 * \return Pointer to layer 4 header or NULL if not (yet) set
 * \note
 * Unlike the lower-level headers, it is the programmer's responsibility to
 * create the level 4 (transport) header pointer by caling e.g.
 * nfq_ip_set_transport_header()
 */
EXPORT_SYMBOL
uint8_t *pktb_transport_header(struct pkt_buff *pktb)
{
	return pktb->transport_header;
}

/**
 * @}
 */

static int pktb_expand_tail(struct pkt_buff *pkt, int extra)
{
	/* No room in packet, cannot mangle it. We don't support dynamic
	 * reallocation. Instead, increase the size of the extra room in
	 * the tail in pktb_alloc.
	 */
	if (pkt->len + extra > pkt->data_len)
		return 0;

	pkt->len += extra;
	pkt->tail = pkt->tail + extra;
	return 1;
}

static int enlarge_pkt(struct pkt_buff *pkt, unsigned int extra)
{
	if (pkt->len + extra > 65535)
		return 0;

	if (!pktb_expand_tail(pkt, extra - pktb_tailroom(pkt)))
		return 0;

	return 1;
}

/**
 * pktb_mangle - adjust contents of a packet
 * \param pktb Pointer to userspace packet buffer
 * \param dataoff Supplementary offset, usually offset from layer 3 (IP) header
 * to the layer 4 (TCP or UDP) header. Specify zero to access the layer 3
 * header. If \b pktb was created in family \b AF_BRIDGE, specify
 * \b -ETH_HLEN (a negative offset) to access the layer 2 (MAC) header.
 * \param match_offset Further offset to content that you want to mangle
 * \param match_len Length of the existing content you want to mangle
 * \param rep_buffer Pointer to data you want to use to replace current content
 * \param rep_len Length of data you want to use to replace current content
 * \returns 1 for success and 0 for failure. Failure will occur if the \b extra
 * argument to the pktb_alloc() call that created \b pktb is less than the
 * excess of \b rep_len over \b match_len
 \warning pktb_mangle does not update any checksums. Developers should use the
 appropriate mangler for the protocol level: nfq_ip_mangle(),
 nfq_tcp_mangle_ipv4() or nfq_udp_mangle_ipv4(). IPv6 versions are planned.
 \n
 It is appropriate to use pktb_mangle to change the MAC header.
 */
EXPORT_SYMBOL
int pktb_mangle(struct pkt_buff *pktb,
		int dataoff,
		unsigned int match_offset,
		unsigned int match_len,
		const char *rep_buffer,
		unsigned int rep_len)
{
	unsigned char *data;

	if (rep_len > match_len &&
	    rep_len - match_len > pktb_tailroom(pktb) &&
	    !enlarge_pkt(pktb, rep_len - match_len))
		return 0;

	data = pktb->network_header + dataoff;

	/* move post-replacement */
	memmove(data + match_offset + rep_len,
		data + match_offset + match_len,
		pktb->tail - (pktb->network_header + dataoff +
			     match_offset + match_len));

	/* insert data from buffer */
	memcpy(data + match_offset, rep_buffer, rep_len);

	/* update packet info */
	if (rep_len > match_len)
		pktb_put(pktb, rep_len - match_len);
	else
		pktb_trim(pktb, pktb->len + rep_len - match_len);

	pktb->mangled = true;
	return 1;
}

/**
 * pktb_mangled - test whether packet has been mangled
 * \param pktb Pointer to userspace packet buffer
 * \return __true__ if packet has been mangled (modified), else __false__
 * \par
 * When assembling a verdict, it is not necessary to return the contents of
 * un-modified packets. Use _pktb_mangled_ to decide whether packet contents
 * need to be returned.
 */
EXPORT_SYMBOL
bool pktb_mangled(const struct pkt_buff *pktb)
{
	return pktb->mangled;
}

/**
 * @}
 */