[net-next-2.6.git] / net / ipv4 / netfilter.c

/* IPv4 specific functions of netfilter core */
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/ip.h>
#include <linux/skbuff.h>
#include <linux/gfp.h>
#include <net/route.h>
#include <net/xfrm.h>
#include <net/ip.h>
#include <net/netfilter/nf_queue.h>

/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
{
	struct net *net = dev_net(skb_dst(skb)->dev);
	const struct iphdr *iph = ip_hdr(skb);
	struct rtable *rt;
	struct flowi fl = {};
	unsigned long orefdst;
	unsigned int hh_len;
	unsigned int type;

	type = inet_addr_type(net, iph->saddr);
	if (skb->sk && inet_sk(skb->sk)->transparent)
		type = RTN_LOCAL;
	if (addr_type == RTN_UNSPEC)
		addr_type = type;

	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
	 * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
	 */
	if (addr_type == RTN_LOCAL) {
		fl.fl4_dst = iph->daddr;
		if (type == RTN_LOCAL)
			fl.fl4_src = iph->saddr;
		fl.fl4_tos = RT_TOS(iph->tos);
		fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
		fl.mark = skb->mark;
		fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
		if (ip_route_output_key(net, &rt, &fl) != 0)
			return -1;

		/* Drop old route. */
		skb_dst_drop(skb);
		skb_dst_set(skb, &rt->dst);
	} else {
		/* non-local src, find valid iif to satisfy
		 * rp-filter when calling ip_route_input. */
		fl.fl4_dst = iph->saddr;
		if (ip_route_output_key(net, &rt, &fl) != 0)
			return -1;

		orefdst = skb->_skb_refdst;
		if (ip_route_input(skb, iph->daddr, iph->saddr,
				   RT_TOS(iph->tos), rt->dst.dev) != 0) {
			dst_release(&rt->dst);
			return -1;
		}
		dst_release(&rt->dst);
		refdst_drop(orefdst);
	}

	if (skb_dst(skb)->error)
		return -1;

#ifdef CONFIG_XFRM
	if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
	    xfrm_decode_session(skb, &fl, AF_INET) == 0) {
		struct dst_entry *dst = skb_dst(skb);
		skb_dst_set(skb, NULL);
		if (xfrm_lookup(net, &dst, &fl, skb->sk, 0))
			return -1;
		skb_dst_set(skb, dst);
	}
#endif

	/* Change in oif may mean change in hh_len. */
	hh_len = skb_dst(skb)->dev->hard_header_len;
	if (skb_headroom(skb) < hh_len &&
	    pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
		return -1;

	return 0;
}
EXPORT_SYMBOL(ip_route_me_harder);

#ifdef CONFIG_XFRM
int ip_xfrm_me_harder(struct sk_buff *skb)
{
	struct flowi fl;
	unsigned int hh_len;
	struct dst_entry *dst;

	if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
		return 0;
	if (xfrm_decode_session(skb, &fl, AF_INET) < 0)
		return -1;

	dst = skb_dst(skb);
	if (dst->xfrm)
		dst = ((struct xfrm_dst *)dst)->route;
	dst_hold(dst);

	if (xfrm_lookup(dev_net(dst->dev), &dst, &fl, skb->sk, 0) < 0)
		return -1;

	skb_dst_drop(skb);
	skb_dst_set(skb, dst);

	/* Change in oif may mean change in hh_len. */
	hh_len = skb_dst(skb)->dev->hard_header_len;
	if (skb_headroom(skb) < hh_len &&
	    pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
		return -1;
	return 0;
}
EXPORT_SYMBOL(ip_xfrm_me_harder);
#endif

void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
EXPORT_SYMBOL(ip_nat_decode_session);

/*
 * Extra routing may needed on local out, as the QUEUE target never
 * returns control to the table.
 */

struct ip_rt_info {
	__be32 daddr;
	__be32 saddr;
	u_int8_t tos;
	u_int32_t mark;
};

static void nf_ip_saveroute(const struct sk_buff *skb,
			    struct nf_queue_entry *entry)
{
	struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);

	if (entry->hook == NF_INET_LOCAL_OUT) {
		const struct iphdr *iph = ip_hdr(skb);

		rt_info->tos = iph->tos;
		rt_info->daddr = iph->daddr;
		rt_info->saddr = iph->saddr;
		rt_info->mark = skb->mark;
	}
}

static int nf_ip_reroute(struct sk_buff *skb,
			 const struct nf_queue_entry *entry)
{
	const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);

	if (entry->hook == NF_INET_LOCAL_OUT) {
		const struct iphdr *iph = ip_hdr(skb);

		if (!(iph->tos == rt_info->tos &&
		      skb->mark == rt_info->mark &&
		      iph->daddr == rt_info->daddr &&
		      iph->saddr == rt_info->saddr))
			return ip_route_me_harder(skb, RTN_UNSPEC);
	}
	return 0;
}

__sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
			    unsigned int dataoff, u_int8_t protocol)
{
	const struct iphdr *iph = ip_hdr(skb);
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
			break;
		if ((protocol == 0 && !csum_fold(skb->csum)) ||
		    !csum_tcpudp_magic(iph->saddr, iph->daddr,
				       skb->len - dataoff, protocol,
				       skb->csum)) {
			skb->ip_summed = CHECKSUM_UNNECESSARY;
			break;
		}
		/* fall through */
	case CHECKSUM_NONE:
		if (protocol == 0)
			skb->csum = 0;
		else
			skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
						       skb->len - dataoff,
						       protocol, 0);
		csum = __skb_checksum_complete(skb);
	}
	return csum;
}
EXPORT_SYMBOL(nf_ip_checksum);

static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
				      unsigned int dataoff, unsigned int len,
				      u_int8_t protocol)
{
	const struct iphdr *iph = ip_hdr(skb);
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (len == skb->len - dataoff)
			return nf_ip_checksum(skb, hook, dataoff, protocol);
		/* fall through */
	case CHECKSUM_NONE:
		skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, protocol,
					       skb->len - dataoff, 0);
		skb->ip_summed = CHECKSUM_NONE;
		return __skb_checksum_complete_head(skb, dataoff + len);
	}
	return csum;
}

static int nf_ip_route(struct dst_entry **dst, struct flowi *fl)
{
	return ip_route_output_key(&init_net, (struct rtable **)dst, fl);
}

static const struct nf_afinfo nf_ip_afinfo = {
	.family			= AF_INET,
	.checksum		= nf_ip_checksum,
	.checksum_partial	= nf_ip_checksum_partial,
	.route			= nf_ip_route,
	.saveroute		= nf_ip_saveroute,
	.reroute		= nf_ip_reroute,
	.route_key_size		= sizeof(struct ip_rt_info),
};

static int ipv4_netfilter_init(void)
{
	return nf_register_afinfo(&nf_ip_afinfo);
}

static void ipv4_netfilter_fini(void)
{
	nf_unregister_afinfo(&nf_ip_afinfo);
}

module_init(ipv4_netfilter_init);
module_exit(ipv4_netfilter_fini);

#ifdef CONFIG_SYSCTL
struct ctl_path nf_net_ipv4_netfilter_sysctl_path[] = {
	{ .procname = "net", },
	{ .procname = "ipv4", },
	{ .procname = "netfilter", },
	{ }
};
EXPORT_SYMBOL_GPL(nf_net_ipv4_netfilter_sysctl_path);
#endif /* CONFIG_SYSCTL */
Commit	Line	Data
	1	/* IPv4 specific functions of netfilter core */
	2	#include <linux/kernel.h>
	3	#include <linux/netfilter.h>
	4	#include <linux/netfilter_ipv4.h>
	5	#include <linux/ip.h>
	6	#include <linux/skbuff.h>
	7	#include <linux/gfp.h>
	8	#include <net/route.h>
	9	#include <net/xfrm.h>
	10	#include <net/ip.h>
	11	#include <net/netfilter/nf_queue.h>
	12
	13	/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
	14	int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
	15	{
	16	struct net *net = dev_net(skb_dst(skb)->dev);
	17	const struct iphdr *iph = ip_hdr(skb);
	18	struct rtable *rt;
	19	struct flowi fl = {};
	20	unsigned long orefdst;
	21	unsigned int hh_len;
	22	unsigned int type;
	23
	24	type = inet_addr_type(net, iph->saddr);
	25	if (skb->sk && inet_sk(skb->sk)->transparent)
	26	type = RTN_LOCAL;
	27	if (addr_type == RTN_UNSPEC)
	28	addr_type = type;
	29
	30	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
	31	* packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
	32	*/
	33	if (addr_type == RTN_LOCAL) {
	34	fl.fl4_dst = iph->daddr;
	35	if (type == RTN_LOCAL)
	36	fl.fl4_src = iph->saddr;
	37	fl.fl4_tos = RT_TOS(iph->tos);
	38	fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
	39	fl.mark = skb->mark;
	40	fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
	41	if (ip_route_output_key(net, &rt, &fl) != 0)
	42	return -1;
	43
	44	/* Drop old route. */
	45	skb_dst_drop(skb);
	46	skb_dst_set(skb, &rt->dst);
	47	} else {
	48	/* non-local src, find valid iif to satisfy
	49	* rp-filter when calling ip_route_input. */
	50	fl.fl4_dst = iph->saddr;
	51	if (ip_route_output_key(net, &rt, &fl) != 0)
	52	return -1;
	53
	54	orefdst = skb->_skb_refdst;
	55	if (ip_route_input(skb, iph->daddr, iph->saddr,
	56	RT_TOS(iph->tos), rt->dst.dev) != 0) {
	57	dst_release(&rt->dst);
	58	return -1;
	59	}
	60	dst_release(&rt->dst);
	61	refdst_drop(orefdst);
	62	}
	63
	64	if (skb_dst(skb)->error)
	65	return -1;
	66
	67	#ifdef CONFIG_XFRM
	68	if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
	69	xfrm_decode_session(skb, &fl, AF_INET) == 0) {
	70	struct dst_entry *dst = skb_dst(skb);
	71	skb_dst_set(skb, NULL);
	72	if (xfrm_lookup(net, &dst, &fl, skb->sk, 0))
	73	return -1;
	74	skb_dst_set(skb, dst);
	75	}
	76	#endif
	77
	78	/* Change in oif may mean change in hh_len. */
	79	hh_len = skb_dst(skb)->dev->hard_header_len;
	80	if (skb_headroom(skb) < hh_len &&
	81	pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
	82	return -1;
	83
	84	return 0;
	85	}
	86	EXPORT_SYMBOL(ip_route_me_harder);
	87
	88	#ifdef CONFIG_XFRM
	89	int ip_xfrm_me_harder(struct sk_buff *skb)
	90	{
	91	struct flowi fl;
	92	unsigned int hh_len;
	93	struct dst_entry *dst;
	94
	95	if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
	96	return 0;
	97	if (xfrm_decode_session(skb, &fl, AF_INET) < 0)
	98	return -1;
	99
	100	dst = skb_dst(skb);
	101	if (dst->xfrm)
	102	dst = ((struct xfrm_dst *)dst)->route;
	103	dst_hold(dst);
	104
	105	if (xfrm_lookup(dev_net(dst->dev), &dst, &fl, skb->sk, 0) < 0)
	106	return -1;
	107
	108	skb_dst_drop(skb);
	109	skb_dst_set(skb, dst);
	110
	111	/* Change in oif may mean change in hh_len. */
	112	hh_len = skb_dst(skb)->dev->hard_header_len;
	113	if (skb_headroom(skb) < hh_len &&
	114	pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
	115	return -1;
	116	return 0;
	117	}
	118	EXPORT_SYMBOL(ip_xfrm_me_harder);
	119	#endif
	120
	121	void (ip_nat_decode_session)(struct sk_buff , struct flowi *);
	122	EXPORT_SYMBOL(ip_nat_decode_session);
	123
	124	/*
	125	* Extra routing may needed on local out, as the QUEUE target never
	126	* returns control to the table.
	127	*/
	128
	129	struct ip_rt_info {
	130	__be32 daddr;
	131	__be32 saddr;
	132	u_int8_t tos;
	133	u_int32_t mark;
	134	};
	135
	136	static void nf_ip_saveroute(const struct sk_buff *skb,
	137	struct nf_queue_entry *entry)
	138	{
	139	struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
	140
	141	if (entry->hook == NF_INET_LOCAL_OUT) {
	142	const struct iphdr *iph = ip_hdr(skb);
	143
	144	rt_info->tos = iph->tos;
	145	rt_info->daddr = iph->daddr;
	146	rt_info->saddr = iph->saddr;
	147	rt_info->mark = skb->mark;
	148	}
	149	}
	150
	151	static int nf_ip_reroute(struct sk_buff *skb,
	152	const struct nf_queue_entry *entry)
	153	{
	154	const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
	155
	156	if (entry->hook == NF_INET_LOCAL_OUT) {
	157	const struct iphdr *iph = ip_hdr(skb);
	158
	159	if (!(iph->tos == rt_info->tos &&
	160	skb->mark == rt_info->mark &&
	161	iph->daddr == rt_info->daddr &&
	162	iph->saddr == rt_info->saddr))
	163	return ip_route_me_harder(skb, RTN_UNSPEC);
	164	}
	165	return 0;
	166	}
	167
	168	__sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
	169	unsigned int dataoff, u_int8_t protocol)
	170	{
	171	const struct iphdr *iph = ip_hdr(skb);
	172	__sum16 csum = 0;
	173
	174	switch (skb->ip_summed) {
	175	case CHECKSUM_COMPLETE:
	176	if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
	177	break;
	178	if ((protocol == 0 && !csum_fold(skb->csum)) \|\|
	179	!csum_tcpudp_magic(iph->saddr, iph->daddr,
	180	skb->len - dataoff, protocol,
	181	skb->csum)) {
	182	skb->ip_summed = CHECKSUM_UNNECESSARY;
	183	break;
	184	}
	185	/* fall through */
	186	case CHECKSUM_NONE:
	187	if (protocol == 0)
	188	skb->csum = 0;
	189	else
	190	skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
	191	skb->len - dataoff,
	192	protocol, 0);
	193	csum = __skb_checksum_complete(skb);
	194	}
	195	return csum;
	196	}
	197	EXPORT_SYMBOL(nf_ip_checksum);
	198
	199	static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
	200	unsigned int dataoff, unsigned int len,
	201	u_int8_t protocol)
	202	{
	203	const struct iphdr *iph = ip_hdr(skb);
	204	__sum16 csum = 0;
	205
	206	switch (skb->ip_summed) {
	207	case CHECKSUM_COMPLETE:
	208	if (len == skb->len - dataoff)
	209	return nf_ip_checksum(skb, hook, dataoff, protocol);
	210	/* fall through */
	211	case CHECKSUM_NONE:
	212	skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, protocol,
	213	skb->len - dataoff, 0);
	214	skb->ip_summed = CHECKSUM_NONE;
	215	return __skb_checksum_complete_head(skb, dataoff + len);
	216	}
	217	return csum;
	218	}
	219
	220	static int nf_ip_route(struct dst_entry *dst, struct flowi fl)
	221	{
	222	return ip_route_output_key(&init_net, (struct rtable **)dst, fl);
	223	}
	224
	225	static const struct nf_afinfo nf_ip_afinfo = {
	226	.family = AF_INET,
	227	.checksum = nf_ip_checksum,
	228	.checksum_partial = nf_ip_checksum_partial,
	229	.route = nf_ip_route,
	230	.saveroute = nf_ip_saveroute,
	231	.reroute = nf_ip_reroute,
	232	.route_key_size = sizeof(struct ip_rt_info),
	233	};
	234
	235	static int ipv4_netfilter_init(void)
	236	{
	237	return nf_register_afinfo(&nf_ip_afinfo);
	238	}
	239
	240	static void ipv4_netfilter_fini(void)
	241	{
	242	nf_unregister_afinfo(&nf_ip_afinfo);
	243	}
	244
	245	module_init(ipv4_netfilter_init);
	246	module_exit(ipv4_netfilter_fini);
	247
	248	#ifdef CONFIG_SYSCTL
	249	struct ctl_path nf_net_ipv4_netfilter_sysctl_path[] = {
	250	{ .procname = "net", },
	251	{ .procname = "ipv4", },
	252	{ .procname = "netfilter", },
	253	{ }
	254	};
	255	EXPORT_SYMBOL_GPL(nf_net_ipv4_netfilter_sysctl_path);
	256	#endif /* CONFIG_SYSCTL */