[net-next-2.6.git] / net / ipv4 / netfilter.c

/* IPv4 specific functions of netfilter core */
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/ip.h>
#include <linux/skbuff.h>
#include <net/route.h>
#include <net/xfrm.h>
#include <net/ip.h>
#include <net/netfilter/nf_queue.h>

/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
{
	struct net *net = dev_net(skb->dst->dev);
	const struct iphdr *iph = ip_hdr(skb);
	struct rtable *rt;
	struct flowi fl = {};
	struct dst_entry *odst;
	unsigned int hh_len;
	unsigned int type;

	type = inet_addr_type(net, iph->saddr);
	if (skb->sk && inet_sk(skb->sk)->transparent)
		type = RTN_LOCAL;
	if (addr_type == RTN_UNSPEC)
		addr_type = type;

	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
	 * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
	 */
	if (addr_type == RTN_LOCAL) {
		fl.nl_u.ip4_u.daddr = iph->daddr;
		if (type == RTN_LOCAL)
			fl.nl_u.ip4_u.saddr = iph->saddr;
		fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
		fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
		fl.mark = skb->mark;
		fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
		if (ip_route_output_key(net, &rt, &fl) != 0)
			return -1;

		/* Drop old route. */
		dst_release(skb->dst);
		skb->dst = &rt->u.dst;
	} else {
		/* non-local src, find valid iif to satisfy
		 * rp-filter when calling ip_route_input. */
		fl.nl_u.ip4_u.daddr = iph->saddr;
		if (ip_route_output_key(net, &rt, &fl) != 0)
			return -1;

		odst = skb->dst;
		if (ip_route_input(skb, iph->daddr, iph->saddr,
				   RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
			dst_release(&rt->u.dst);
			return -1;
		}
		dst_release(&rt->u.dst);
		dst_release(odst);
	}

	if (skb->dst->error)
		return -1;

#ifdef CONFIG_XFRM
	if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
	    xfrm_decode_session(skb, &fl, AF_INET) == 0)
		if (xfrm_lookup(&skb->dst, &fl, skb->sk, 0))
			return -1;
#endif

	/* Change in oif may mean change in hh_len. */
	hh_len = skb->dst->dev->hard_header_len;
	if (skb_headroom(skb) < hh_len &&
	    pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
		return -1;

	return 0;
}
EXPORT_SYMBOL(ip_route_me_harder);

#ifdef CONFIG_XFRM
int ip_xfrm_me_harder(struct sk_buff *skb)
{
	struct flowi fl;
	unsigned int hh_len;
	struct dst_entry *dst;

	if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
		return 0;
	if (xfrm_decode_session(skb, &fl, AF_INET) < 0)
		return -1;

	dst = skb->dst;
	if (dst->xfrm)
		dst = ((struct xfrm_dst *)dst)->route;
	dst_hold(dst);

	if (xfrm_lookup(&dst, &fl, skb->sk, 0) < 0)
		return -1;

	dst_release(skb->dst);
	skb->dst = dst;

	/* Change in oif may mean change in hh_len. */
	hh_len = skb->dst->dev->hard_header_len;
	if (skb_headroom(skb) < hh_len &&
	    pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
		return -1;
	return 0;
}
EXPORT_SYMBOL(ip_xfrm_me_harder);
#endif

void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
EXPORT_SYMBOL(ip_nat_decode_session);

/*
 * Extra routing may needed on local out, as the QUEUE target never
 * returns control to the table.
 */

struct ip_rt_info {
	__be32 daddr;
	__be32 saddr;
	u_int8_t tos;
};

static void nf_ip_saveroute(const struct sk_buff *skb,
			    struct nf_queue_entry *entry)
{
	struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);

	if (entry->hook == NF_INET_LOCAL_OUT) {
		const struct iphdr *iph = ip_hdr(skb);

		rt_info->tos = iph->tos;
		rt_info->daddr = iph->daddr;
		rt_info->saddr = iph->saddr;
	}
}

static int nf_ip_reroute(struct sk_buff *skb,
			 const struct nf_queue_entry *entry)
{
	const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);

	if (entry->hook == NF_INET_LOCAL_OUT) {
		const struct iphdr *iph = ip_hdr(skb);

		if (!(iph->tos == rt_info->tos
		      && iph->daddr == rt_info->daddr
		      && iph->saddr == rt_info->saddr))
			return ip_route_me_harder(skb, RTN_UNSPEC);
	}
	return 0;
}

__sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
			    unsigned int dataoff, u_int8_t protocol)
{
	const struct iphdr *iph = ip_hdr(skb);
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
			break;
		if ((protocol == 0 && !csum_fold(skb->csum)) ||
		    !csum_tcpudp_magic(iph->saddr, iph->daddr,
				       skb->len - dataoff, protocol,
				       skb->csum)) {
			skb->ip_summed = CHECKSUM_UNNECESSARY;
			break;
		}
		/* fall through */
	case CHECKSUM_NONE:
		if (protocol == 0)
			skb->csum = 0;
		else
			skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
						       skb->len - dataoff,
						       protocol, 0);
		csum = __skb_checksum_complete(skb);
	}
	return csum;
}
EXPORT_SYMBOL(nf_ip_checksum);

static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
				      unsigned int dataoff, unsigned int len,
				      u_int8_t protocol)
{
	const struct iphdr *iph = ip_hdr(skb);
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (len == skb->len - dataoff)
			return nf_ip_checksum(skb, hook, dataoff, protocol);
		/* fall through */
	case CHECKSUM_NONE:
		skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, protocol,
					       skb->len - dataoff, 0);
		skb->ip_summed = CHECKSUM_NONE;
		csum = __skb_checksum_complete_head(skb, dataoff + len);
		if (!csum)
			skb->ip_summed = CHECKSUM_UNNECESSARY;
	}
	return csum;
}

static int nf_ip_route(struct dst_entry **dst, struct flowi *fl)
{
	return ip_route_output_key(&init_net, (struct rtable **)dst, fl);
}

static const struct nf_afinfo nf_ip_afinfo = {
	.family			= AF_INET,
	.checksum		= nf_ip_checksum,
	.checksum_partial	= nf_ip_checksum_partial,
	.route			= nf_ip_route,
	.saveroute		= nf_ip_saveroute,
	.reroute		= nf_ip_reroute,
	.route_key_size		= sizeof(struct ip_rt_info),
};

static int ipv4_netfilter_init(void)
{
	return nf_register_afinfo(&nf_ip_afinfo);
}

static void ipv4_netfilter_fini(void)
{
	nf_unregister_afinfo(&nf_ip_afinfo);
}

module_init(ipv4_netfilter_init);
module_exit(ipv4_netfilter_fini);

#ifdef CONFIG_SYSCTL
struct ctl_path nf_net_ipv4_netfilter_sysctl_path[] = {
	{ .procname = "net", .ctl_name = CTL_NET, },
	{ .procname = "ipv4", .ctl_name = NET_IPV4, },
	{ .procname = "netfilter", .ctl_name = NET_IPV4_NETFILTER, },
	{ }
};
EXPORT_SYMBOL_GPL(nf_net_ipv4_netfilter_sysctl_path);
#endif /* CONFIG_SYSCTL */
Commit	Line	Data
2cc7d573	1	/* IPv4 specific functions of netfilter core */
020b4c12 HW	2	#include <linux/kernel.h>
020b4c12 HW	3	#include <linux/netfilter.h>
2cc7d573	4	#include <linux/netfilter_ipv4.h>
3e3850e9	5	#include <linux/ip.h>
2ca7b0ac	6	#include <linux/skbuff.h>
020b4c12	7	#include <net/route.h>
3e3850e9 PM	8	#include <net/xfrm.h>
3e3850e9 PM	9	#include <net/ip.h>
c01cd429	10	#include <net/netfilter/nf_queue.h>
020b4c12 HW	11
020b4c12 HW	12	/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
3db05fea	13	int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
020b4c12	14	{
b21f8901	15	struct net *net = dev_net(skb->dst->dev);
3db05fea	16	const struct iphdr *iph = ip_hdr(skb);
020b4c12 HW	17	struct rtable *rt;
	18	struct flowi fl = {};
	19	struct dst_entry *odst;
	20	unsigned int hh_len;
c68b8b68	21	unsigned int type;
020b4c12	22
b21f8901	23	type = inet_addr_type(net, iph->saddr);
86b08d86 KK	24	if (skb->sk && inet_sk(skb->sk)->transparent)
86b08d86 KK	25	type = RTN_LOCAL;
b4c4ed17	26	if (addr_type == RTN_UNSPEC)
c68b8b68	27	addr_type = type;
b4c4ed17	28
020b4c12	29	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
6e23ae2a	30	* packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
020b4c12	31	*/
b4c4ed17	32	if (addr_type == RTN_LOCAL) {
020b4c12	33	fl.nl_u.ip4_u.daddr = iph->daddr;
c68b8b68 PM	34	if (type == RTN_LOCAL)
c68b8b68 PM	35	fl.nl_u.ip4_u.saddr = iph->saddr;
020b4c12	36	fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
3db05fea HX	37	fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
3db05fea HX	38	fl.mark = skb->mark;
86b08d86	39	fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
b21f8901	40	if (ip_route_output_key(net, &rt, &fl) != 0)
020b4c12 HW	41	return -1;
	42
	43	/* Drop old route. */
3db05fea HX	44	dst_release(skb->dst);
3db05fea HX	45	skb->dst = &rt->u.dst;
020b4c12 HW	46	} else {
	47	/* non-local src, find valid iif to satisfy
	48	* rp-filter when calling ip_route_input. */
	49	fl.nl_u.ip4_u.daddr = iph->saddr;
b21f8901	50	if (ip_route_output_key(net, &rt, &fl) != 0)
020b4c12 HW	51	return -1;
020b4c12 HW	52
3db05fea HX	53	odst = skb->dst;
3db05fea HX	54	if (ip_route_input(skb, iph->daddr, iph->saddr,
020b4c12 HW	55	RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
	56	dst_release(&rt->u.dst);
	57	return -1;
	58	}
	59	dst_release(&rt->u.dst);
	60	dst_release(odst);
	61	}
e905a9ed	62
3db05fea	63	if (skb->dst->error)
020b4c12 HW	64	return -1;
020b4c12 HW	65
3e3850e9	66	#ifdef CONFIG_XFRM
3db05fea HX	67	if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
	68	xfrm_decode_session(skb, &fl, AF_INET) == 0)
	69	if (xfrm_lookup(&skb->dst, &fl, skb->sk, 0))
3e3850e9 PM	70	return -1;
	71	#endif
	72
020b4c12	73	/* Change in oif may mean change in hh_len. */
3db05fea HX	74	hh_len = skb->dst->dev->hard_header_len;
	75	if (skb_headroom(skb) < hh_len &&
	76	pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
2ca7b0ac	77	return -1;
020b4c12 HW	78
	79	return 0;
	80	}
	81	EXPORT_SYMBOL(ip_route_me_harder);
2cc7d573	82
ee68cea2	83	#ifdef CONFIG_XFRM
3db05fea	84	int ip_xfrm_me_harder(struct sk_buff *skb)
ee68cea2 PM	85	{
	86	struct flowi fl;
	87	unsigned int hh_len;
	88	struct dst_entry *dst;
	89
3db05fea	90	if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
ee68cea2	91	return 0;
3db05fea	92	if (xfrm_decode_session(skb, &fl, AF_INET) < 0)
ee68cea2 PM	93	return -1;
ee68cea2 PM	94
3db05fea	95	dst = skb->dst;
ee68cea2 PM	96	if (dst->xfrm)
	97	dst = ((struct xfrm_dst *)dst)->route;
	98	dst_hold(dst);
	99
3db05fea	100	if (xfrm_lookup(&dst, &fl, skb->sk, 0) < 0)
ee68cea2 PM	101	return -1;
ee68cea2 PM	102
3db05fea HX	103	dst_release(skb->dst);
3db05fea HX	104	skb->dst = dst;
ee68cea2 PM	105
ee68cea2 PM	106	/* Change in oif may mean change in hh_len. */
3db05fea HX	107	hh_len = skb->dst->dev->hard_header_len;
	108	if (skb_headroom(skb) < hh_len &&
	109	pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
2ca7b0ac	110	return -1;
ee68cea2 PM	111	return 0;
	112	}
	113	EXPORT_SYMBOL(ip_xfrm_me_harder);
	114	#endif
	115
eb9c7ebe PM	116	void (ip_nat_decode_session)(struct sk_buff , struct flowi *);
	117	EXPORT_SYMBOL(ip_nat_decode_session);
	118
2cc7d573 HW	119	/*
	120	* Extra routing may needed on local out, as the QUEUE target never
	121	* returns control to the table.
	122	*/
	123
	124	struct ip_rt_info {
59b8bfd8 AV	125	__be32 daddr;
59b8bfd8 AV	126	__be32 saddr;
2cc7d573 HW	127	u_int8_t tos;
	128	};
	129
02f014d8 PM	130	static void nf_ip_saveroute(const struct sk_buff *skb,
02f014d8 PM	131	struct nf_queue_entry *entry)
2cc7d573	132	{
02f014d8	133	struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
2cc7d573	134
02f014d8	135	if (entry->hook == NF_INET_LOCAL_OUT) {
eddc9ec5	136	const struct iphdr *iph = ip_hdr(skb);
2cc7d573 HW	137
	138	rt_info->tos = iph->tos;
	139	rt_info->daddr = iph->daddr;
	140	rt_info->saddr = iph->saddr;
	141	}
	142	}
	143
02f014d8 PM	144	static int nf_ip_reroute(struct sk_buff *skb,
02f014d8 PM	145	const struct nf_queue_entry *entry)
2cc7d573	146	{
02f014d8	147	const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
2cc7d573	148
02f014d8	149	if (entry->hook == NF_INET_LOCAL_OUT) {
3db05fea	150	const struct iphdr *iph = ip_hdr(skb);
2cc7d573 HW	151
	152	if (!(iph->tos == rt_info->tos
	153	&& iph->daddr == rt_info->daddr
	154	&& iph->saddr == rt_info->saddr))
3db05fea	155	return ip_route_me_harder(skb, RTN_UNSPEC);
2cc7d573 HW	156	}
	157	return 0;
	158	}
	159
b51655b9	160	__sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
422c346f PM	161	unsigned int dataoff, u_int8_t protocol)
422c346f PM	162	{
eddc9ec5	163	const struct iphdr *iph = ip_hdr(skb);
b51655b9	164	__sum16 csum = 0;
422c346f PM	165
422c346f PM	166	switch (skb->ip_summed) {
84fa7933	167	case CHECKSUM_COMPLETE:
6e23ae2a	168	if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
422c346f	169	break;
d3bc23e7	170	if ((protocol == 0 && !csum_fold(skb->csum)) \|\|
422c346f	171	!csum_tcpudp_magic(iph->saddr, iph->daddr,
e905a9ed	172	skb->len - dataoff, protocol,
422c346f PM	173	skb->csum)) {
	174	skb->ip_summed = CHECKSUM_UNNECESSARY;
	175	break;
	176	}
	177	/* fall through */
	178	case CHECKSUM_NONE:
	179	if (protocol == 0)
	180	skb->csum = 0;
	181	else
	182	skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
	183	skb->len - dataoff,
	184	protocol, 0);
	185	csum = __skb_checksum_complete(skb);
	186	}
	187	return csum;
	188	}
422c346f PM	189	EXPORT_SYMBOL(nf_ip_checksum);
422c346f PM	190
d63a6507 PM	191	static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
	192	unsigned int dataoff, unsigned int len,
	193	u_int8_t protocol)
	194	{
	195	const struct iphdr *iph = ip_hdr(skb);
	196	__sum16 csum = 0;
	197
	198	switch (skb->ip_summed) {
	199	case CHECKSUM_COMPLETE:
	200	if (len == skb->len - dataoff)
	201	return nf_ip_checksum(skb, hook, dataoff, protocol);
	202	/* fall through */
	203	case CHECKSUM_NONE:
	204	skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, protocol,
	205	skb->len - dataoff, 0);
	206	skb->ip_summed = CHECKSUM_NONE;
	207	csum = __skb_checksum_complete_head(skb, dataoff + len);
	208	if (!csum)
	209	skb->ip_summed = CHECKSUM_UNNECESSARY;
	210	}
	211	return csum;
	212	}
	213
1841a4c7 PM	214	static int nf_ip_route(struct dst_entry *dst, struct flowi fl)
1841a4c7 PM	215	{
f206351a	216	return ip_route_output_key(&init_net, (struct rtable **)dst, fl);
1841a4c7 PM	217	}
1841a4c7 PM	218
1e796fda	219	static const struct nf_afinfo nf_ip_afinfo = {
d63a6507 PM	220	.family = AF_INET,
	221	.checksum = nf_ip_checksum,
	222	.checksum_partial = nf_ip_checksum_partial,
	223	.route = nf_ip_route,
	224	.saveroute = nf_ip_saveroute,
	225	.reroute = nf_ip_reroute,
	226	.route_key_size = sizeof(struct ip_rt_info),
2cc7d573 HW	227	};
2cc7d573 HW	228
65b4b4e8	229	static int ipv4_netfilter_init(void)
2cc7d573	230	{
bce8032e	231	return nf_register_afinfo(&nf_ip_afinfo);
2cc7d573 HW	232	}
2cc7d573 HW	233
65b4b4e8	234	static void ipv4_netfilter_fini(void)
2cc7d573	235	{
bce8032e	236	nf_unregister_afinfo(&nf_ip_afinfo);
2cc7d573 HW	237	}
2cc7d573 HW	238
65b4b4e8 AM	239	module_init(ipv4_netfilter_init);
65b4b4e8 AM	240	module_exit(ipv4_netfilter_fini);
4f536522 PM	241
	242	#ifdef CONFIG_SYSCTL
	243	struct ctl_path nf_net_ipv4_netfilter_sysctl_path[] = {
	244	{ .procname = "net", .ctl_name = CTL_NET, },
	245	{ .procname = "ipv4", .ctl_name = NET_IPV4, },
	246	{ .procname = "netfilter", .ctl_name = NET_IPV4_NETFILTER, },
	247	{ }
	248	};
	249	EXPORT_SYMBOL_GPL(nf_net_ipv4_netfilter_sysctl_path);
	250	#endif /* CONFIG_SYSCTL */