[mirror_ubuntu-artful-kernel.git] / net / ipv4 / netfilter / iptable_mangle.c

/*
 * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
 *
 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#include <linux/module.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netdevice.h>
#include <linux/skbuff.h>
#include <net/sock.h>
#include <net/route.h>
#include <linux/ip.h>
#include <net/ip.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
MODULE_DESCRIPTION("iptables mangle table");

#define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
			    (1 << NF_INET_LOCAL_IN) | \
			    (1 << NF_INET_FORWARD) | \
			    (1 << NF_INET_LOCAL_OUT) | \
			    (1 << NF_INET_POST_ROUTING))

/* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
static const struct
{
	struct ipt_replace repl;
	struct ipt_standard entries[5];
	struct ipt_error term;
} initial_table __net_initdata = {
	.repl = {
		.name = "mangle",
		.valid_hooks = MANGLE_VALID_HOOKS,
		.num_entries = 6,
		.size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
		.hook_entry = {
			[NF_INET_PRE_ROUTING] 	= 0,
			[NF_INET_LOCAL_IN] 	= sizeof(struct ipt_standard),
			[NF_INET_FORWARD] 	= sizeof(struct ipt_standard) * 2,
			[NF_INET_LOCAL_OUT] 	= sizeof(struct ipt_standard) * 3,
			[NF_INET_POST_ROUTING] 	= sizeof(struct ipt_standard) * 4,
		},
		.underflow = {
			[NF_INET_PRE_ROUTING] 	= 0,
			[NF_INET_LOCAL_IN] 	= sizeof(struct ipt_standard),
			[NF_INET_FORWARD] 	= sizeof(struct ipt_standard) * 2,
			[NF_INET_LOCAL_OUT] 	= sizeof(struct ipt_standard) * 3,
			[NF_INET_POST_ROUTING]	= sizeof(struct ipt_standard) * 4,
		},
	},
	.entries = {
		IPT_STANDARD_INIT(NF_ACCEPT),	/* PRE_ROUTING */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_IN */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* FORWARD */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_OUT */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* POST_ROUTING */
	},
	.term = IPT_ERROR_INIT,			/* ERROR */
};

static const struct xt_table packet_mangler = {
	.name		= "mangle",
	.valid_hooks	= MANGLE_VALID_HOOKS,
	.me		= THIS_MODULE,
	.af		= NFPROTO_IPV4,
};

/* The work comes in here from netfilter.c. */
static unsigned int
ipt_pre_routing_hook(unsigned int hook,
		     struct sk_buff *skb,
		     const struct net_device *in,
		     const struct net_device *out,
		     int (*okfn)(struct sk_buff *))
{
	return ipt_do_table(skb, hook, in, out,
			    dev_net(in)->ipv4.iptable_mangle);
}

static unsigned int
ipt_post_routing_hook(unsigned int hook,
		      struct sk_buff *skb,
		      const struct net_device *in,
		      const struct net_device *out,
		      int (*okfn)(struct sk_buff *))
{
	return ipt_do_table(skb, hook, in, out,
			    dev_net(out)->ipv4.iptable_mangle);
}

static unsigned int
ipt_local_in_hook(unsigned int hook,
		  struct sk_buff *skb,
		  const struct net_device *in,
		  const struct net_device *out,
		  int (*okfn)(struct sk_buff *))
{
	return ipt_do_table(skb, hook, in, out,
			    dev_net(in)->ipv4.iptable_mangle);
}

static unsigned int
ipt_forward_hook(unsigned int hook,
	 struct sk_buff *skb,
	 const struct net_device *in,
	 const struct net_device *out,
	 int (*okfn)(struct sk_buff *))
{
	return ipt_do_table(skb, hook, in, out,
			    dev_net(in)->ipv4.iptable_mangle);
}

static unsigned int
ipt_local_hook(unsigned int hook,
		   struct sk_buff *skb,
		   const struct net_device *in,
		   const struct net_device *out,
		   int (*okfn)(struct sk_buff *))
{
	unsigned int ret;
	const struct iphdr *iph;
	u_int8_t tos;
	__be32 saddr, daddr;
	u_int32_t mark;

	/* root is playing with raw sockets. */
	if (skb->len < sizeof(struct iphdr)
	    || ip_hdrlen(skb) < sizeof(struct iphdr))
		return NF_ACCEPT;

	/* Save things which could affect route */
	mark = skb->mark;
	iph = ip_hdr(skb);
	saddr = iph->saddr;
	daddr = iph->daddr;
	tos = iph->tos;

	ret = ipt_do_table(skb, hook, in, out,
			   dev_net(out)->ipv4.iptable_mangle);
	/* Reroute for ANY change. */
	if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
		iph = ip_hdr(skb);

		if (iph->saddr != saddr ||
		    iph->daddr != daddr ||
		    skb->mark != mark ||
		    iph->tos != tos)
			if (ip_route_me_harder(skb, RTN_UNSPEC))
				ret = NF_DROP;
	}

	return ret;
}

static struct nf_hook_ops ipt_ops[] __read_mostly = {
	{
		.hook		= ipt_pre_routing_hook,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_PRE_ROUTING,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_local_in_hook,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_LOCAL_IN,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_forward_hook,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_FORWARD,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_local_hook,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_LOCAL_OUT,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_post_routing_hook,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_POST_ROUTING,
		.priority	= NF_IP_PRI_MANGLE,
	},
};

static int __net_init iptable_mangle_net_init(struct net *net)
{
	/* Register table */
	net->ipv4.iptable_mangle =
		ipt_register_table(net, &packet_mangler, &initial_table.repl);
	if (IS_ERR(net->ipv4.iptable_mangle))
		return PTR_ERR(net->ipv4.iptable_mangle);
	return 0;
}

static void __net_exit iptable_mangle_net_exit(struct net *net)
{
	ipt_unregister_table(net->ipv4.iptable_mangle);
}

static struct pernet_operations iptable_mangle_net_ops = {
	.init = iptable_mangle_net_init,
	.exit = iptable_mangle_net_exit,
};

static int __init iptable_mangle_init(void)
{
	int ret;

	ret = register_pernet_subsys(&iptable_mangle_net_ops);
	if (ret < 0)
		return ret;

	/* Register hooks */
	ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
	if (ret < 0)
		goto cleanup_table;

	return ret;

 cleanup_table:
	unregister_pernet_subsys(&iptable_mangle_net_ops);
	return ret;
}

static void __exit iptable_mangle_fini(void)
{
	nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
	unregister_pernet_subsys(&iptable_mangle_net_ops);
}

module_init(iptable_mangle_init);
module_exit(iptable_mangle_fini);
Commit	Line	Data
1da177e4 LT	1	/*
	2	* This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
	3	*
	4	* Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
	5	* Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
1da177e4	10	*/
1da177e4 LT	11	#include <linux/module.h>
	12	#include <linux/netfilter_ipv4/ip_tables.h>
	13	#include <linux/netdevice.h>
	14	#include <linux/skbuff.h>
	15	#include <net/sock.h>
	16	#include <net/route.h>
	17	#include <linux/ip.h>
c9bdd4b5	18	#include <net/ip.h>
1da177e4 LT	19
	20	MODULE_LICENSE("GPL");
	21	MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
	22	MODULE_DESCRIPTION("iptables mangle table");
	23
6e23ae2a PM	24	#define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) \| \
	25	(1 << NF_INET_LOCAL_IN) \| \
	26	(1 << NF_INET_FORWARD) \| \
	27	(1 << NF_INET_LOCAL_OUT) \| \
	28	(1 << NF_INET_POST_ROUTING))
1da177e4 LT	29
1da177e4 LT	30	/* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
35aad0ff	31	static const struct
1da177e4 LT	32	{
	33	struct ipt_replace repl;
	34	struct ipt_standard entries[5];
	35	struct ipt_error term;
9335f047	36	} initial_table __net_initdata = {
3c2ad469 PM	37	.repl = {
	38	.name = "mangle",
	39	.valid_hooks = MANGLE_VALID_HOOKS,
	40	.num_entries = 6,
	41	.size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
	42	.hook_entry = {
6e23ae2a PM	43	[NF_INET_PRE_ROUTING] = 0,
	44	[NF_INET_LOCAL_IN] = sizeof(struct ipt_standard),
	45	[NF_INET_FORWARD] = sizeof(struct ipt_standard) * 2,
	46	[NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 3,
	47	[NF_INET_POST_ROUTING] = sizeof(struct ipt_standard) * 4,
3c2ad469 PM	48	},
3c2ad469 PM	49	.underflow = {
6e23ae2a PM	50	[NF_INET_PRE_ROUTING] = 0,
	51	[NF_INET_LOCAL_IN] = sizeof(struct ipt_standard),
	52	[NF_INET_FORWARD] = sizeof(struct ipt_standard) * 2,
	53	[NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 3,
	54	[NF_INET_POST_ROUTING] = sizeof(struct ipt_standard) * 4,
3c2ad469 PM	55	},
	56	},
	57	.entries = {
	58	IPT_STANDARD_INIT(NF_ACCEPT), /* PRE_ROUTING */
	59	IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_IN */
	60	IPT_STANDARD_INIT(NF_ACCEPT), /* FORWARD */
	61	IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_OUT */
	62	IPT_STANDARD_INIT(NF_ACCEPT), /* POST_ROUTING */
	63	},
	64	.term = IPT_ERROR_INIT, /* ERROR */
1da177e4 LT	65	};
1da177e4 LT	66
35aad0ff	67	static const struct xt_table packet_mangler = {
1da177e4 LT	68	.name = "mangle",
1da177e4 LT	69	.valid_hooks = MANGLE_VALID_HOOKS,
1da177e4	70	.me = THIS_MODULE,
f88e6a8a	71	.af = NFPROTO_IPV4,
1da177e4 LT	72	};
	73
	74	/* The work comes in here from netfilter.c. */
	75	static unsigned int
666953df AD	76	ipt_pre_routing_hook(unsigned int hook,
	77	struct sk_buff *skb,
	78	const struct net_device *in,
	79	const struct net_device *out,
	80	int (okfn)(struct sk_buff ))
	81	{
	82	return ipt_do_table(skb, hook, in, out,
48dc7865	83	dev_net(in)->ipv4.iptable_mangle);
666953df AD	84	}
	85
	86	static unsigned int
	87	ipt_post_routing_hook(unsigned int hook,
	88	struct sk_buff *skb,
	89	const struct net_device *in,
	90	const struct net_device *out,
	91	int (okfn)(struct sk_buff ))
	92	{
	93	return ipt_do_table(skb, hook, in, out,
48dc7865	94	dev_net(out)->ipv4.iptable_mangle);
666953df AD	95	}
	96
	97	static unsigned int
	98	ipt_local_in_hook(unsigned int hook,
	99	struct sk_buff *skb,
	100	const struct net_device *in,
	101	const struct net_device *out,
	102	int (okfn)(struct sk_buff ))
	103	{
	104	return ipt_do_table(skb, hook, in, out,
48dc7865	105	dev_net(in)->ipv4.iptable_mangle);
666953df AD	106	}
	107
	108	static unsigned int
	109	ipt_forward_hook(unsigned int hook,
3db05fea	110	struct sk_buff *skb,
1da177e4 LT	111	const struct net_device *in,
	112	const struct net_device *out,
	113	int (okfn)(struct sk_buff ))
	114	{
666953df	115	return ipt_do_table(skb, hook, in, out,
48dc7865	116	dev_net(in)->ipv4.iptable_mangle);
1da177e4 LT	117	}
	118
	119	static unsigned int
	120	ipt_local_hook(unsigned int hook,
3db05fea	121	struct sk_buff *skb,
1da177e4 LT	122	const struct net_device *in,
	123	const struct net_device *out,
	124	int (okfn)(struct sk_buff ))
	125	{
	126	unsigned int ret;
eddc9ec5	127	const struct iphdr *iph;
1da177e4	128	u_int8_t tos;
6a19d614	129	__be32 saddr, daddr;
82e91ffe	130	u_int32_t mark;
1da177e4 LT	131
1da177e4 LT	132	/* root is playing with raw sockets. */
3db05fea	133	if (skb->len < sizeof(struct iphdr)
88843104	134	\|\| ip_hdrlen(skb) < sizeof(struct iphdr))
1da177e4	135	return NF_ACCEPT;
1da177e4 LT	136
1da177e4 LT	137	/* Save things which could affect route */
3db05fea HX	138	mark = skb->mark;
3db05fea HX	139	iph = ip_hdr(skb);
eddc9ec5 ACM	140	saddr = iph->saddr;
	141	daddr = iph->daddr;
	142	tos = iph->tos;
1da177e4	143
666953df	144	ret = ipt_do_table(skb, hook, in, out,
48dc7865	145	dev_net(out)->ipv4.iptable_mangle);
1da177e4	146	/* Reroute for ANY change. */
eddc9ec5	147	if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
3db05fea	148	iph = ip_hdr(skb);
eddc9ec5 ACM	149
	150	if (iph->saddr != saddr \|\|
	151	iph->daddr != daddr \|\|
3db05fea	152	skb->mark != mark \|\|
eddc9ec5	153	iph->tos != tos)
3db05fea	154	if (ip_route_me_harder(skb, RTN_UNSPEC))
eddc9ec5 ACM	155	ret = NF_DROP;
eddc9ec5 ACM	156	}
1da177e4 LT	157
	158	return ret;
	159	}
	160
1999414a	161	static struct nf_hook_ops ipt_ops[] __read_mostly = {
1da177e4	162	{
666953df	163	.hook = ipt_pre_routing_hook,
1da177e4	164	.owner = THIS_MODULE,
24c232d8	165	.pf = NFPROTO_IPV4,
6e23ae2a	166	.hooknum = NF_INET_PRE_ROUTING,
1da177e4 LT	167	.priority = NF_IP_PRI_MANGLE,
	168	},
	169	{
666953df	170	.hook = ipt_local_in_hook,
1da177e4	171	.owner = THIS_MODULE,
24c232d8	172	.pf = NFPROTO_IPV4,
6e23ae2a	173	.hooknum = NF_INET_LOCAL_IN,
1da177e4 LT	174	.priority = NF_IP_PRI_MANGLE,
	175	},
	176	{
666953df	177	.hook = ipt_forward_hook,
1da177e4	178	.owner = THIS_MODULE,
24c232d8	179	.pf = NFPROTO_IPV4,
6e23ae2a	180	.hooknum = NF_INET_FORWARD,
1da177e4 LT	181	.priority = NF_IP_PRI_MANGLE,
	182	},
	183	{
	184	.hook = ipt_local_hook,
	185	.owner = THIS_MODULE,
24c232d8	186	.pf = NFPROTO_IPV4,
6e23ae2a	187	.hooknum = NF_INET_LOCAL_OUT,
1da177e4 LT	188	.priority = NF_IP_PRI_MANGLE,
	189	},
	190	{
666953df	191	.hook = ipt_post_routing_hook,
1da177e4	192	.owner = THIS_MODULE,
24c232d8	193	.pf = NFPROTO_IPV4,
6e23ae2a	194	.hooknum = NF_INET_POST_ROUTING,
1da177e4 LT	195	.priority = NF_IP_PRI_MANGLE,
	196	},
	197	};
	198
9335f047 AD	199	static int __net_init iptable_mangle_net_init(struct net *net)
	200	{
	201	/* Register table */
	202	net->ipv4.iptable_mangle =
	203	ipt_register_table(net, &packet_mangler, &initial_table.repl);
	204	if (IS_ERR(net->ipv4.iptable_mangle))
	205	return PTR_ERR(net->ipv4.iptable_mangle);
	206	return 0;
	207	}
	208
	209	static void __net_exit iptable_mangle_net_exit(struct net *net)
	210	{
	211	ipt_unregister_table(net->ipv4.iptable_mangle);
	212	}
	213
	214	static struct pernet_operations iptable_mangle_net_ops = {
	215	.init = iptable_mangle_net_init,
	216	.exit = iptable_mangle_net_exit,
	217	};
	218
65b4b4e8	219	static int __init iptable_mangle_init(void)
1da177e4 LT	220	{
	221	int ret;
	222
9335f047 AD	223	ret = register_pernet_subsys(&iptable_mangle_net_ops);
	224	if (ret < 0)
	225	return ret;
1da177e4 LT	226
1da177e4 LT	227	/* Register hooks */
964ddaa1	228	ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
1da177e4 LT	229	if (ret < 0)
	230	goto cleanup_table;
	231
1da177e4 LT	232	return ret;
1da177e4 LT	233
1da177e4	234	cleanup_table:
9335f047	235	unregister_pernet_subsys(&iptable_mangle_net_ops);
1da177e4 LT	236	return ret;
	237	}
	238
65b4b4e8	239	static void __exit iptable_mangle_fini(void)
1da177e4	240	{
964ddaa1	241	nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
9335f047	242	unregister_pernet_subsys(&iptable_mangle_net_ops);
1da177e4 LT	243	}
1da177e4 LT	244
65b4b4e8 AM	245	module_init(iptable_mangle_init);
65b4b4e8 AM	246	module_exit(iptable_mangle_fini);