[net-next-2.6.git] / net / ipv4 / netfilter.c

/* IPv4 specific functions of netfilter core */
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/ip.h>
#include <linux/skbuff.h>
#include <net/route.h>
#include <net/xfrm.h>
#include <net/ip.h>
#include <net/netfilter/nf_queue.h>

/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
{
	const struct iphdr *iph = ip_hdr(skb);
	struct rtable *rt;
	struct flowi fl = {};
	struct dst_entry *odst;
	unsigned int hh_len;
	unsigned int type;

	type = inet_addr_type(&init_net, iph->saddr);
	if (skb->sk && inet_sk(skb->sk)->transparent)
		type = RTN_LOCAL;
	if (addr_type == RTN_UNSPEC)
		addr_type = type;

	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
	 * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
	 */
	if (addr_type == RTN_LOCAL) {
		fl.nl_u.ip4_u.daddr = iph->daddr;
		if (type == RTN_LOCAL)
			fl.nl_u.ip4_u.saddr = iph->saddr;
		fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
		fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
		fl.mark = skb->mark;
		fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
		if (ip_route_output_key(&init_net, &rt, &fl) != 0)
			return -1;

		/* Drop old route. */
		dst_release(skb->dst);
		skb->dst = &rt->u.dst;
	} else {
		/* non-local src, find valid iif to satisfy
		 * rp-filter when calling ip_route_input. */
		fl.nl_u.ip4_u.daddr = iph->saddr;
		if (ip_route_output_key(&init_net, &rt, &fl) != 0)
			return -1;

		odst = skb->dst;
		if (ip_route_input(skb, iph->daddr, iph->saddr,
				   RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
			dst_release(&rt->u.dst);
			return -1;
		}
		dst_release(&rt->u.dst);
		dst_release(odst);
	}

	if (skb->dst->error)
		return -1;

#ifdef CONFIG_XFRM
	if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
	    xfrm_decode_session(skb, &fl, AF_INET) == 0)
		if (xfrm_lookup(&skb->dst, &fl, skb->sk, 0))
			return -1;
#endif

	/* Change in oif may mean change in hh_len. */
	hh_len = skb->dst->dev->hard_header_len;
	if (skb_headroom(skb) < hh_len &&
	    pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
		return -1;

	return 0;
}
EXPORT_SYMBOL(ip_route_me_harder);

#ifdef CONFIG_XFRM
int ip_xfrm_me_harder(struct sk_buff *skb)
{
	struct flowi fl;
	unsigned int hh_len;
	struct dst_entry *dst;

	if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
		return 0;
	if (xfrm_decode_session(skb, &fl, AF_INET) < 0)
		return -1;

	dst = skb->dst;
	if (dst->xfrm)
		dst = ((struct xfrm_dst *)dst)->route;
	dst_hold(dst);

	if (xfrm_lookup(&dst, &fl, skb->sk, 0) < 0)
		return -1;

	dst_release(skb->dst);
	skb->dst = dst;

	/* Change in oif may mean change in hh_len. */
	hh_len = skb->dst->dev->hard_header_len;
	if (skb_headroom(skb) < hh_len &&
	    pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
		return -1;
	return 0;
}
EXPORT_SYMBOL(ip_xfrm_me_harder);
#endif

void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
EXPORT_SYMBOL(ip_nat_decode_session);

/*
 * Extra routing may needed on local out, as the QUEUE target never
 * returns control to the table.
 */

struct ip_rt_info {
	__be32 daddr;
	__be32 saddr;
	u_int8_t tos;
};

static void nf_ip_saveroute(const struct sk_buff *skb,
			    struct nf_queue_entry *entry)
{
	struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);

	if (entry->hook == NF_INET_LOCAL_OUT) {
		const struct iphdr *iph = ip_hdr(skb);

		rt_info->tos = iph->tos;
		rt_info->daddr = iph->daddr;
		rt_info->saddr = iph->saddr;
	}
}

static int nf_ip_reroute(struct sk_buff *skb,
			 const struct nf_queue_entry *entry)
{
	const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);

	if (entry->hook == NF_INET_LOCAL_OUT) {
		const struct iphdr *iph = ip_hdr(skb);

		if (!(iph->tos == rt_info->tos
		      && iph->daddr == rt_info->daddr
		      && iph->saddr == rt_info->saddr))
			return ip_route_me_harder(skb, RTN_UNSPEC);
	}
	return 0;
}

__sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
			    unsigned int dataoff, u_int8_t protocol)
{
	const struct iphdr *iph = ip_hdr(skb);
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
			break;
		if ((protocol == 0 && !csum_fold(skb->csum)) ||
		    !csum_tcpudp_magic(iph->saddr, iph->daddr,
				       skb->len - dataoff, protocol,
				       skb->csum)) {
			skb->ip_summed = CHECKSUM_UNNECESSARY;
			break;
		}
		/* fall through */
	case CHECKSUM_NONE:
		if (protocol == 0)
			skb->csum = 0;
		else
			skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
						       skb->len - dataoff,
						       protocol, 0);
		csum = __skb_checksum_complete(skb);
	}
	return csum;
}
EXPORT_SYMBOL(nf_ip_checksum);

static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
				      unsigned int dataoff, unsigned int len,
				      u_int8_t protocol)
{
	const struct iphdr *iph = ip_hdr(skb);
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (len == skb->len - dataoff)
			return nf_ip_checksum(skb, hook, dataoff, protocol);
		/* fall through */
	case CHECKSUM_NONE:
		skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, protocol,
					       skb->len - dataoff, 0);
		skb->ip_summed = CHECKSUM_NONE;
		csum = __skb_checksum_complete_head(skb, dataoff + len);
		if (!csum)
			skb->ip_summed = CHECKSUM_UNNECESSARY;
	}
	return csum;
}

static int nf_ip_route(struct dst_entry **dst, struct flowi *fl)
{
	return ip_route_output_key(&init_net, (struct rtable **)dst, fl);
}

static const struct nf_afinfo nf_ip_afinfo = {
	.family			= AF_INET,
	.checksum		= nf_ip_checksum,
	.checksum_partial	= nf_ip_checksum_partial,
	.route			= nf_ip_route,
	.saveroute		= nf_ip_saveroute,
	.reroute		= nf_ip_reroute,
	.route_key_size		= sizeof(struct ip_rt_info),
};

static int ipv4_netfilter_init(void)
{
	return nf_register_afinfo(&nf_ip_afinfo);
}

static void ipv4_netfilter_fini(void)
{
	nf_unregister_afinfo(&nf_ip_afinfo);
}

module_init(ipv4_netfilter_init);
module_exit(ipv4_netfilter_fini);

#ifdef CONFIG_SYSCTL
struct ctl_path nf_net_ipv4_netfilter_sysctl_path[] = {
	{ .procname = "net", .ctl_name = CTL_NET, },
	{ .procname = "ipv4", .ctl_name = NET_IPV4, },
	{ .procname = "netfilter", .ctl_name = NET_IPV4_NETFILTER, },
	{ }
};
EXPORT_SYMBOL_GPL(nf_net_ipv4_netfilter_sysctl_path);
#endif /* CONFIG_SYSCTL */
Commit	Line	Data
2cc7d573	1	/* IPv4 specific functions of netfilter core */
020b4c12 HW	2	#include <linux/kernel.h>
020b4c12 HW	3	#include <linux/netfilter.h>
2cc7d573	4	#include <linux/netfilter_ipv4.h>
3e3850e9	5	#include <linux/ip.h>
2ca7b0ac	6	#include <linux/skbuff.h>
020b4c12	7	#include <net/route.h>
3e3850e9 PM	8	#include <net/xfrm.h>
3e3850e9 PM	9	#include <net/ip.h>
c01cd429	10	#include <net/netfilter/nf_queue.h>
020b4c12 HW	11
020b4c12 HW	12	/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
3db05fea	13	int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
020b4c12	14	{
3db05fea	15	const struct iphdr *iph = ip_hdr(skb);
020b4c12 HW	16	struct rtable *rt;
	17	struct flowi fl = {};
	18	struct dst_entry *odst;
	19	unsigned int hh_len;
c68b8b68	20	unsigned int type;
020b4c12	21
6b175b26	22	type = inet_addr_type(&init_net, iph->saddr);
86b08d86 KK	23	if (skb->sk && inet_sk(skb->sk)->transparent)
86b08d86 KK	24	type = RTN_LOCAL;
b4c4ed17	25	if (addr_type == RTN_UNSPEC)
c68b8b68	26	addr_type = type;
b4c4ed17	27
020b4c12	28	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
6e23ae2a	29	* packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
020b4c12	30	*/
b4c4ed17	31	if (addr_type == RTN_LOCAL) {
020b4c12	32	fl.nl_u.ip4_u.daddr = iph->daddr;
c68b8b68 PM	33	if (type == RTN_LOCAL)
c68b8b68 PM	34	fl.nl_u.ip4_u.saddr = iph->saddr;
020b4c12	35	fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
3db05fea HX	36	fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
3db05fea HX	37	fl.mark = skb->mark;
86b08d86	38	fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
f206351a	39	if (ip_route_output_key(&init_net, &rt, &fl) != 0)
020b4c12 HW	40	return -1;
	41
	42	/* Drop old route. */
3db05fea HX	43	dst_release(skb->dst);
3db05fea HX	44	skb->dst = &rt->u.dst;
020b4c12 HW	45	} else {
	46	/* non-local src, find valid iif to satisfy
	47	* rp-filter when calling ip_route_input. */
	48	fl.nl_u.ip4_u.daddr = iph->saddr;
f206351a	49	if (ip_route_output_key(&init_net, &rt, &fl) != 0)
020b4c12 HW	50	return -1;
020b4c12 HW	51
3db05fea HX	52	odst = skb->dst;
3db05fea HX	53	if (ip_route_input(skb, iph->daddr, iph->saddr,
020b4c12 HW	54	RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
	55	dst_release(&rt->u.dst);
	56	return -1;
	57	}
	58	dst_release(&rt->u.dst);
	59	dst_release(odst);
	60	}
e905a9ed	61
3db05fea	62	if (skb->dst->error)
020b4c12 HW	63	return -1;
020b4c12 HW	64
3e3850e9	65	#ifdef CONFIG_XFRM
3db05fea HX	66	if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
	67	xfrm_decode_session(skb, &fl, AF_INET) == 0)
	68	if (xfrm_lookup(&skb->dst, &fl, skb->sk, 0))
3e3850e9 PM	69	return -1;
	70	#endif
	71
020b4c12	72	/* Change in oif may mean change in hh_len. */
3db05fea HX	73	hh_len = skb->dst->dev->hard_header_len;
	74	if (skb_headroom(skb) < hh_len &&
	75	pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
2ca7b0ac	76	return -1;
020b4c12 HW	77
	78	return 0;
	79	}
	80	EXPORT_SYMBOL(ip_route_me_harder);
2cc7d573	81
ee68cea2	82	#ifdef CONFIG_XFRM
3db05fea	83	int ip_xfrm_me_harder(struct sk_buff *skb)
ee68cea2 PM	84	{
	85	struct flowi fl;
	86	unsigned int hh_len;
	87	struct dst_entry *dst;
	88
3db05fea	89	if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
ee68cea2	90	return 0;
3db05fea	91	if (xfrm_decode_session(skb, &fl, AF_INET) < 0)
ee68cea2 PM	92	return -1;
ee68cea2 PM	93
3db05fea	94	dst = skb->dst;
ee68cea2 PM	95	if (dst->xfrm)
	96	dst = ((struct xfrm_dst *)dst)->route;
	97	dst_hold(dst);
	98
3db05fea	99	if (xfrm_lookup(&dst, &fl, skb->sk, 0) < 0)
ee68cea2 PM	100	return -1;
ee68cea2 PM	101
3db05fea HX	102	dst_release(skb->dst);
3db05fea HX	103	skb->dst = dst;
ee68cea2 PM	104
ee68cea2 PM	105	/* Change in oif may mean change in hh_len. */
3db05fea HX	106	hh_len = skb->dst->dev->hard_header_len;
	107	if (skb_headroom(skb) < hh_len &&
	108	pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
2ca7b0ac	109	return -1;
ee68cea2 PM	110	return 0;
	111	}
	112	EXPORT_SYMBOL(ip_xfrm_me_harder);
	113	#endif
	114
eb9c7ebe PM	115	void (ip_nat_decode_session)(struct sk_buff , struct flowi *);
	116	EXPORT_SYMBOL(ip_nat_decode_session);
	117
2cc7d573 HW	118	/*
	119	* Extra routing may needed on local out, as the QUEUE target never
	120	* returns control to the table.
	121	*/
	122
	123	struct ip_rt_info {
59b8bfd8 AV	124	__be32 daddr;
59b8bfd8 AV	125	__be32 saddr;
2cc7d573 HW	126	u_int8_t tos;
	127	};
	128
02f014d8 PM	129	static void nf_ip_saveroute(const struct sk_buff *skb,
02f014d8 PM	130	struct nf_queue_entry *entry)
2cc7d573	131	{
02f014d8	132	struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
2cc7d573	133
02f014d8	134	if (entry->hook == NF_INET_LOCAL_OUT) {
eddc9ec5	135	const struct iphdr *iph = ip_hdr(skb);
2cc7d573 HW	136
	137	rt_info->tos = iph->tos;
	138	rt_info->daddr = iph->daddr;
	139	rt_info->saddr = iph->saddr;
	140	}
	141	}
	142
02f014d8 PM	143	static int nf_ip_reroute(struct sk_buff *skb,
02f014d8 PM	144	const struct nf_queue_entry *entry)
2cc7d573	145	{
02f014d8	146	const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
2cc7d573	147
02f014d8	148	if (entry->hook == NF_INET_LOCAL_OUT) {
3db05fea	149	const struct iphdr *iph = ip_hdr(skb);
2cc7d573 HW	150
	151	if (!(iph->tos == rt_info->tos
	152	&& iph->daddr == rt_info->daddr
	153	&& iph->saddr == rt_info->saddr))
3db05fea	154	return ip_route_me_harder(skb, RTN_UNSPEC);
2cc7d573 HW	155	}
	156	return 0;
	157	}
	158
b51655b9	159	__sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
422c346f PM	160	unsigned int dataoff, u_int8_t protocol)
422c346f PM	161	{
eddc9ec5	162	const struct iphdr *iph = ip_hdr(skb);
b51655b9	163	__sum16 csum = 0;
422c346f PM	164
422c346f PM	165	switch (skb->ip_summed) {
84fa7933	166	case CHECKSUM_COMPLETE:
6e23ae2a	167	if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
422c346f	168	break;
d3bc23e7	169	if ((protocol == 0 && !csum_fold(skb->csum)) \|\|
422c346f	170	!csum_tcpudp_magic(iph->saddr, iph->daddr,
e905a9ed	171	skb->len - dataoff, protocol,
422c346f PM	172	skb->csum)) {
	173	skb->ip_summed = CHECKSUM_UNNECESSARY;
	174	break;
	175	}
	176	/* fall through */
	177	case CHECKSUM_NONE:
	178	if (protocol == 0)
	179	skb->csum = 0;
	180	else
	181	skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
	182	skb->len - dataoff,
	183	protocol, 0);
	184	csum = __skb_checksum_complete(skb);
	185	}
	186	return csum;
	187	}
422c346f PM	188	EXPORT_SYMBOL(nf_ip_checksum);
422c346f PM	189
d63a6507 PM	190	static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
	191	unsigned int dataoff, unsigned int len,
	192	u_int8_t protocol)
	193	{
	194	const struct iphdr *iph = ip_hdr(skb);
	195	__sum16 csum = 0;
	196
	197	switch (skb->ip_summed) {
	198	case CHECKSUM_COMPLETE:
	199	if (len == skb->len - dataoff)
	200	return nf_ip_checksum(skb, hook, dataoff, protocol);
	201	/* fall through */
	202	case CHECKSUM_NONE:
	203	skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, protocol,
	204	skb->len - dataoff, 0);
	205	skb->ip_summed = CHECKSUM_NONE;
	206	csum = __skb_checksum_complete_head(skb, dataoff + len);
	207	if (!csum)
	208	skb->ip_summed = CHECKSUM_UNNECESSARY;
	209	}
	210	return csum;
	211	}
	212
1841a4c7 PM	213	static int nf_ip_route(struct dst_entry *dst, struct flowi fl)
1841a4c7 PM	214	{
f206351a	215	return ip_route_output_key(&init_net, (struct rtable **)dst, fl);
1841a4c7 PM	216	}
1841a4c7 PM	217
1e796fda	218	static const struct nf_afinfo nf_ip_afinfo = {
d63a6507 PM	219	.family = AF_INET,
	220	.checksum = nf_ip_checksum,
	221	.checksum_partial = nf_ip_checksum_partial,
	222	.route = nf_ip_route,
	223	.saveroute = nf_ip_saveroute,
	224	.reroute = nf_ip_reroute,
	225	.route_key_size = sizeof(struct ip_rt_info),
2cc7d573 HW	226	};
2cc7d573 HW	227
65b4b4e8	228	static int ipv4_netfilter_init(void)
2cc7d573	229	{
bce8032e	230	return nf_register_afinfo(&nf_ip_afinfo);
2cc7d573 HW	231	}
2cc7d573 HW	232
65b4b4e8	233	static void ipv4_netfilter_fini(void)
2cc7d573	234	{
bce8032e	235	nf_unregister_afinfo(&nf_ip_afinfo);
2cc7d573 HW	236	}
2cc7d573 HW	237
65b4b4e8 AM	238	module_init(ipv4_netfilter_init);
65b4b4e8 AM	239	module_exit(ipv4_netfilter_fini);
4f536522 PM	240
	241	#ifdef CONFIG_SYSCTL
	242	struct ctl_path nf_net_ipv4_netfilter_sysctl_path[] = {
	243	{ .procname = "net", .ctl_name = CTL_NET, },
	244	{ .procname = "ipv4", .ctl_name = NET_IPV4, },
	245	{ .procname = "netfilter", .ctl_name = NET_IPV4_NETFILTER, },
	246	{ }
	247	};
	248	EXPORT_SYMBOL_GPL(nf_net_ipv4_netfilter_sysctl_path);
	249	#endif /* CONFIG_SYSCTL */