[net-next-2.6.git] / net / ipv4 / netfilter.c

/* IPv4 specific functions of netfilter core */
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/ip.h>
#include <net/route.h>
#include <net/xfrm.h>
#include <net/ip.h>

/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
int ip_route_me_harder(struct sk_buff **pskb, unsigned addr_type)
{
	struct iphdr *iph = (*pskb)->nh.iph;
	struct rtable *rt;
	struct flowi fl = {};
	struct dst_entry *odst;
	unsigned int hh_len;
	unsigned int type;

	type = inet_addr_type(iph->saddr);
	if (addr_type == RTN_UNSPEC)
		addr_type = type;

	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
	 * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
	 */
	if (addr_type == RTN_LOCAL) {
		fl.nl_u.ip4_u.daddr = iph->daddr;
		if (type == RTN_LOCAL)
			fl.nl_u.ip4_u.saddr = iph->saddr;
		fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
		fl.oif = (*pskb)->sk ? (*pskb)->sk->sk_bound_dev_if : 0;
		fl.mark = (*pskb)->mark;
		if (ip_route_output_key(&rt, &fl) != 0)
			return -1;

		/* Drop old route. */
		dst_release((*pskb)->dst);
		(*pskb)->dst = &rt->u.dst;
	} else {
		/* non-local src, find valid iif to satisfy
		 * rp-filter when calling ip_route_input. */
		fl.nl_u.ip4_u.daddr = iph->saddr;
		if (ip_route_output_key(&rt, &fl) != 0)
			return -1;

		odst = (*pskb)->dst;
		if (ip_route_input(*pskb, iph->daddr, iph->saddr,
				   RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
			dst_release(&rt->u.dst);
			return -1;
		}
		dst_release(&rt->u.dst);
		dst_release(odst);
	}

	if ((*pskb)->dst->error)
		return -1;

#ifdef CONFIG_XFRM
	if (!(IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED) &&
	    xfrm_decode_session(*pskb, &fl, AF_INET) == 0)
		if (xfrm_lookup(&(*pskb)->dst, &fl, (*pskb)->sk, 0))
			return -1;
#endif

	/* Change in oif may mean change in hh_len. */
	hh_len = (*pskb)->dst->dev->hard_header_len;
	if (skb_headroom(*pskb) < hh_len) {
		struct sk_buff *nskb;

		nskb = skb_realloc_headroom(*pskb, hh_len);
		if (!nskb)
			return -1;
		if ((*pskb)->sk)
			skb_set_owner_w(nskb, (*pskb)->sk);
		kfree_skb(*pskb);
		*pskb = nskb;
	}

	return 0;
}
EXPORT_SYMBOL(ip_route_me_harder);

#ifdef CONFIG_XFRM
int ip_xfrm_me_harder(struct sk_buff **pskb)
{
	struct flowi fl;
	unsigned int hh_len;
	struct dst_entry *dst;

	if (IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED)
		return 0;
	if (xfrm_decode_session(*pskb, &fl, AF_INET) < 0)
		return -1;

	dst = (*pskb)->dst;
	if (dst->xfrm)
		dst = ((struct xfrm_dst *)dst)->route;
	dst_hold(dst);

	if (xfrm_lookup(&dst, &fl, (*pskb)->sk, 0) < 0)
		return -1;

	dst_release((*pskb)->dst);
	(*pskb)->dst = dst;

	/* Change in oif may mean change in hh_len. */
	hh_len = (*pskb)->dst->dev->hard_header_len;
	if (skb_headroom(*pskb) < hh_len) {
		struct sk_buff *nskb;

		nskb = skb_realloc_headroom(*pskb, hh_len);
		if (!nskb)
			return -1;
		if ((*pskb)->sk)
			skb_set_owner_w(nskb, (*pskb)->sk);
		kfree_skb(*pskb);
		*pskb = nskb;
	}
	return 0;
}
EXPORT_SYMBOL(ip_xfrm_me_harder);
#endif

void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
EXPORT_SYMBOL(ip_nat_decode_session);

/*
 * Extra routing may needed on local out, as the QUEUE target never
 * returns control to the table.
 */

struct ip_rt_info {
	__be32 daddr;
	__be32 saddr;
	u_int8_t tos;
};

static void nf_ip_saveroute(const struct sk_buff *skb, struct nf_info *info)
{
	struct ip_rt_info *rt_info = nf_info_reroute(info);

	if (info->hook == NF_IP_LOCAL_OUT) {
		const struct iphdr *iph = skb->nh.iph;

		rt_info->tos = iph->tos;
		rt_info->daddr = iph->daddr;
		rt_info->saddr = iph->saddr;
	}
}

static int nf_ip_reroute(struct sk_buff **pskb, const struct nf_info *info)
{
	const struct ip_rt_info *rt_info = nf_info_reroute(info);

	if (info->hook == NF_IP_LOCAL_OUT) {
		struct iphdr *iph = (*pskb)->nh.iph;

		if (!(iph->tos == rt_info->tos
		      && iph->daddr == rt_info->daddr
		      && iph->saddr == rt_info->saddr))
			return ip_route_me_harder(pskb, RTN_UNSPEC);
	}
	return 0;
}

__sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
			    unsigned int dataoff, u_int8_t protocol)
{
	struct iphdr *iph = skb->nh.iph;
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (hook != NF_IP_PRE_ROUTING && hook != NF_IP_LOCAL_IN)
			break;
		if ((protocol == 0 && !csum_fold(skb->csum)) ||
		    !csum_tcpudp_magic(iph->saddr, iph->daddr,
				       skb->len - dataoff, protocol,
				       skb->csum)) {
			skb->ip_summed = CHECKSUM_UNNECESSARY;
			break;
		}
		/* fall through */
	case CHECKSUM_NONE:
		if (protocol == 0)
			skb->csum = 0;
		else
			skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
						       skb->len - dataoff,
						       protocol, 0);
		csum = __skb_checksum_complete(skb);
	}
	return csum;
}

EXPORT_SYMBOL(nf_ip_checksum);

static struct nf_afinfo nf_ip_afinfo = {
	.family		= AF_INET,
	.checksum	= nf_ip_checksum,
	.saveroute	= nf_ip_saveroute,
	.reroute	= nf_ip_reroute,
	.route_key_size	= sizeof(struct ip_rt_info),
};

static int ipv4_netfilter_init(void)
{
	return nf_register_afinfo(&nf_ip_afinfo);
}

static void ipv4_netfilter_fini(void)
{
	nf_unregister_afinfo(&nf_ip_afinfo);
}

module_init(ipv4_netfilter_init);
module_exit(ipv4_netfilter_fini);
Commit	Line	Data
2cc7d573	1	/* IPv4 specific functions of netfilter core */
020b4c12 HW	2	#include <linux/kernel.h>
020b4c12 HW	3	#include <linux/netfilter.h>
2cc7d573	4	#include <linux/netfilter_ipv4.h>
3e3850e9	5	#include <linux/ip.h>
020b4c12	6	#include <net/route.h>
3e3850e9 PM	7	#include <net/xfrm.h>
3e3850e9 PM	8	#include <net/ip.h>
020b4c12 HW	9
020b4c12 HW	10	/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
b4c4ed17	11	int ip_route_me_harder(struct sk_buff **pskb, unsigned addr_type)
020b4c12 HW	12	{
	13	struct iphdr iph = (pskb)->nh.iph;
	14	struct rtable *rt;
	15	struct flowi fl = {};
	16	struct dst_entry *odst;
	17	unsigned int hh_len;
c68b8b68	18	unsigned int type;
020b4c12	19
c68b8b68	20	type = inet_addr_type(iph->saddr);
b4c4ed17	21	if (addr_type == RTN_UNSPEC)
c68b8b68	22	addr_type = type;
b4c4ed17	23
020b4c12 HW	24	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
	25	* packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
	26	*/
b4c4ed17	27	if (addr_type == RTN_LOCAL) {
020b4c12	28	fl.nl_u.ip4_u.daddr = iph->daddr;
c68b8b68 PM	29	if (type == RTN_LOCAL)
c68b8b68 PM	30	fl.nl_u.ip4_u.saddr = iph->saddr;
020b4c12 HW	31	fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
020b4c12 HW	32	fl.oif = (pskb)->sk ? (pskb)->sk->sk_bound_dev_if : 0;
47dcf0cb	33	fl.mark = (*pskb)->mark;
020b4c12 HW	34	if (ip_route_output_key(&rt, &fl) != 0)
	35	return -1;
	36
	37	/* Drop old route. */
	38	dst_release((*pskb)->dst);
	39	(*pskb)->dst = &rt->u.dst;
	40	} else {
	41	/* non-local src, find valid iif to satisfy
	42	* rp-filter when calling ip_route_input. */
	43	fl.nl_u.ip4_u.daddr = iph->saddr;
	44	if (ip_route_output_key(&rt, &fl) != 0)
	45	return -1;
	46
	47	odst = (*pskb)->dst;
	48	if (ip_route_input(*pskb, iph->daddr, iph->saddr,
	49	RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
	50	dst_release(&rt->u.dst);
	51	return -1;
	52	}
	53	dst_release(&rt->u.dst);
	54	dst_release(odst);
	55	}
e905a9ed	56
020b4c12 HW	57	if ((*pskb)->dst->error)
	58	return -1;
	59
3e3850e9 PM	60	#ifdef CONFIG_XFRM
	61	if (!(IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED) &&
	62	xfrm_decode_session(*pskb, &fl, AF_INET) == 0)
	63	if (xfrm_lookup(&(pskb)->dst, &fl, (pskb)->sk, 0))
	64	return -1;
	65	#endif
	66
020b4c12 HW	67	/* Change in oif may mean change in hh_len. */
	68	hh_len = (*pskb)->dst->dev->hard_header_len;
	69	if (skb_headroom(*pskb) < hh_len) {
	70	struct sk_buff *nskb;
	71
	72	nskb = skb_realloc_headroom(*pskb, hh_len);
e905a9ed	73	if (!nskb)
020b4c12 HW	74	return -1;
	75	if ((*pskb)->sk)
	76	skb_set_owner_w(nskb, (*pskb)->sk);
	77	kfree_skb(*pskb);
	78	*pskb = nskb;
	79	}
	80
	81	return 0;
	82	}
	83	EXPORT_SYMBOL(ip_route_me_harder);
2cc7d573	84
ee68cea2 PM	85	#ifdef CONFIG_XFRM
	86	int ip_xfrm_me_harder(struct sk_buff **pskb)
	87	{
	88	struct flowi fl;
	89	unsigned int hh_len;
	90	struct dst_entry *dst;
	91
	92	if (IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED)
	93	return 0;
	94	if (xfrm_decode_session(*pskb, &fl, AF_INET) < 0)
	95	return -1;
	96
	97	dst = (*pskb)->dst;
	98	if (dst->xfrm)
	99	dst = ((struct xfrm_dst *)dst)->route;
	100	dst_hold(dst);
	101
	102	if (xfrm_lookup(&dst, &fl, (*pskb)->sk, 0) < 0)
	103	return -1;
	104
	105	dst_release((*pskb)->dst);
	106	(*pskb)->dst = dst;
	107
	108	/* Change in oif may mean change in hh_len. */
	109	hh_len = (*pskb)->dst->dev->hard_header_len;
	110	if (skb_headroom(*pskb) < hh_len) {
	111	struct sk_buff *nskb;
	112
	113	nskb = skb_realloc_headroom(*pskb, hh_len);
	114	if (!nskb)
	115	return -1;
	116	if ((*pskb)->sk)
	117	skb_set_owner_w(nskb, (*pskb)->sk);
	118	kfree_skb(*pskb);
	119	*pskb = nskb;
	120	}
	121	return 0;
	122	}
	123	EXPORT_SYMBOL(ip_xfrm_me_harder);
	124	#endif
	125
eb9c7ebe PM	126	void (ip_nat_decode_session)(struct sk_buff , struct flowi *);
	127	EXPORT_SYMBOL(ip_nat_decode_session);
	128
2cc7d573 HW	129	/*
	130	* Extra routing may needed on local out, as the QUEUE target never
	131	* returns control to the table.
	132	*/
	133
	134	struct ip_rt_info {
59b8bfd8 AV	135	__be32 daddr;
59b8bfd8 AV	136	__be32 saddr;
2cc7d573 HW	137	u_int8_t tos;
	138	};
	139
bce8032e	140	static void nf_ip_saveroute(const struct sk_buff skb, struct nf_info info)
2cc7d573 HW	141	{
	142	struct ip_rt_info *rt_info = nf_info_reroute(info);
	143
	144	if (info->hook == NF_IP_LOCAL_OUT) {
	145	const struct iphdr *iph = skb->nh.iph;
	146
	147	rt_info->tos = iph->tos;
	148	rt_info->daddr = iph->daddr;
	149	rt_info->saddr = iph->saddr;
	150	}
	151	}
	152
bce8032e	153	static int nf_ip_reroute(struct sk_buff *pskb, const struct nf_info info)
2cc7d573 HW	154	{
	155	const struct ip_rt_info *rt_info = nf_info_reroute(info);
	156
	157	if (info->hook == NF_IP_LOCAL_OUT) {
	158	struct iphdr iph = (pskb)->nh.iph;
	159
	160	if (!(iph->tos == rt_info->tos
	161	&& iph->daddr == rt_info->daddr
	162	&& iph->saddr == rt_info->saddr))
b4c4ed17	163	return ip_route_me_harder(pskb, RTN_UNSPEC);
2cc7d573 HW	164	}
	165	return 0;
	166	}
	167
b51655b9	168	__sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
422c346f PM	169	unsigned int dataoff, u_int8_t protocol)
	170	{
	171	struct iphdr *iph = skb->nh.iph;
b51655b9	172	__sum16 csum = 0;
422c346f PM	173
422c346f PM	174	switch (skb->ip_summed) {
84fa7933	175	case CHECKSUM_COMPLETE:
422c346f PM	176	if (hook != NF_IP_PRE_ROUTING && hook != NF_IP_LOCAL_IN)
422c346f PM	177	break;
d3bc23e7	178	if ((protocol == 0 && !csum_fold(skb->csum)) \|\|
422c346f	179	!csum_tcpudp_magic(iph->saddr, iph->daddr,
e905a9ed	180	skb->len - dataoff, protocol,
422c346f PM	181	skb->csum)) {
	182	skb->ip_summed = CHECKSUM_UNNECESSARY;
	183	break;
	184	}
	185	/* fall through */
	186	case CHECKSUM_NONE:
	187	if (protocol == 0)
	188	skb->csum = 0;
	189	else
	190	skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
	191	skb->len - dataoff,
	192	protocol, 0);
	193	csum = __skb_checksum_complete(skb);
	194	}
	195	return csum;
	196	}
	197
	198	EXPORT_SYMBOL(nf_ip_checksum);
	199
bce8032e PM	200	static struct nf_afinfo nf_ip_afinfo = {
bce8032e PM	201	.family = AF_INET,
422c346f	202	.checksum = nf_ip_checksum,
bce8032e PM	203	.saveroute = nf_ip_saveroute,
	204	.reroute = nf_ip_reroute,
	205	.route_key_size = sizeof(struct ip_rt_info),
2cc7d573 HW	206	};
2cc7d573 HW	207
65b4b4e8	208	static int ipv4_netfilter_init(void)
2cc7d573	209	{
bce8032e	210	return nf_register_afinfo(&nf_ip_afinfo);
2cc7d573 HW	211	}
2cc7d573 HW	212
65b4b4e8	213	static void ipv4_netfilter_fini(void)
2cc7d573	214	{
bce8032e	215	nf_unregister_afinfo(&nf_ip_afinfo);
2cc7d573 HW	216	}
2cc7d573 HW	217
65b4b4e8 AM	218	module_init(ipv4_netfilter_init);
65b4b4e8 AM	219	module_exit(ipv4_netfilter_fini);