[mirror_ubuntu-hirsute-kernel.git] / net / ipv4 / netfilter.c

/*
 * IPv4 specific functions of netfilter core
 *
 * Rusty Russell (C) 2000 -- This code is GPL.
 * Patrick McHardy (C) 2006-2012
 */
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/ip.h>
#include <linux/skbuff.h>
#include <linux/gfp.h>
#include <linux/export.h>
#include <net/route.h>
#include <net/xfrm.h>
#include <net/ip.h>
#include <net/netfilter/nf_queue.h>

/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
int ip_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb, unsigned int addr_type)
{
	const struct iphdr *iph = ip_hdr(skb);
	struct rtable *rt;
	struct flowi4 fl4 = {};
	__be32 saddr = iph->saddr;
	__u8 flags;
	struct net_device *dev = skb_dst(skb)->dev;
	unsigned int hh_len;

	sk = sk_to_full_sk(sk);
	flags = sk ? inet_sk_flowi_flags(sk) : 0;

	if (addr_type == RTN_UNSPEC)
		addr_type = inet_addr_type_dev_table(net, dev, saddr);
	if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
		flags |= FLOWI_FLAG_ANYSRC;
	else
		saddr = 0;

	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
	 * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
	 */
	fl4.daddr = iph->daddr;
	fl4.saddr = saddr;
	fl4.flowi4_tos = RT_TOS(iph->tos);
	fl4.flowi4_oif = sk ? sk->sk_bound_dev_if : 0;
	if (!fl4.flowi4_oif)
		fl4.flowi4_oif = l3mdev_master_ifindex(dev);
	fl4.flowi4_mark = skb->mark;
	fl4.flowi4_flags = flags;
	rt = ip_route_output_key(net, &fl4);
	if (IS_ERR(rt))
		return PTR_ERR(rt);

	/* Drop old route. */
	skb_dst_drop(skb);
	skb_dst_set(skb, &rt->dst);

	if (skb_dst(skb)->error)
		return skb_dst(skb)->error;

#ifdef CONFIG_XFRM
	if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
	    xfrm_decode_session(skb, flowi4_to_flowi(&fl4), AF_INET) == 0) {
		struct dst_entry *dst = skb_dst(skb);
		skb_dst_set(skb, NULL);
		dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), sk, 0);
		if (IS_ERR(dst))
			return PTR_ERR(dst);
		skb_dst_set(skb, dst);
	}
#endif

	/* Change in oif may mean change in hh_len. */
	hh_len = skb_dst(skb)->dev->hard_header_len;
	if (skb_headroom(skb) < hh_len &&
	    pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)),
				0, GFP_ATOMIC))
		return -ENOMEM;

	return 0;
}
EXPORT_SYMBOL(ip_route_me_harder);

int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
		bool strict __always_unused)
{
	struct rtable *rt = ip_route_output_key(net, &fl->u.ip4);
	if (IS_ERR(rt))
		return PTR_ERR(rt);
	*dst = &rt->dst;
	return 0;
}
EXPORT_SYMBOL_GPL(nf_ip_route);
Commit	Line	Data
f229f6ce PM	1	/*
	2	* IPv4 specific functions of netfilter core
	3	*
	4	* Rusty Russell (C) 2000 -- This code is GPL.
	5	* Patrick McHardy (C) 2006-2012
	6	*/
020b4c12 HW	7	#include <linux/kernel.h>
020b4c12 HW	8	#include <linux/netfilter.h>
2cc7d573	9	#include <linux/netfilter_ipv4.h>
3e3850e9	10	#include <linux/ip.h>
2ca7b0ac	11	#include <linux/skbuff.h>
5a0e3ad6	12	#include <linux/gfp.h>
bc3b2d7f	13	#include <linux/export.h>
020b4c12	14	#include <net/route.h>
3e3850e9 PM	15	#include <net/xfrm.h>
3e3850e9 PM	16	#include <net/ip.h>
c01cd429	17	#include <net/netfilter/nf_queue.h>
020b4c12 HW	18
020b4c12 HW	19	/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
46d6c5ae	20	int ip_route_me_harder(struct net net, struct sock sk, struct sk_buff *skb, unsigned int addr_type)
020b4c12	21	{
3db05fea	22	const struct iphdr *iph = ip_hdr(skb);
020b4c12	23	struct rtable *rt;
9d6ec938	24	struct flowi4 fl4 = {};
ed6e4ef8	25	__be32 saddr = iph->saddr;
46d6c5ae	26	__u8 flags;
6d8b49c3	27	struct net_device *dev = skb_dst(skb)->dev;
020b4c12 HW	28	unsigned int hh_len;
020b4c12 HW	29
46d6c5ae JD	30	sk = sk_to_full_sk(sk);
	31	flags = sk ? inet_sk_flowi_flags(sk) : 0;
	32
797fd391	33	if (addr_type == RTN_UNSPEC)
6d8b49c3	34	addr_type = inet_addr_type_dev_table(net, dev, saddr);
797fd391 JA	35	if (addr_type == RTN_LOCAL \|\| addr_type == RTN_UNICAST)
	36	flags \|= FLOWI_FLAG_ANYSRC;
	37	else
	38	saddr = 0;
b4c4ed17	39
020b4c12	40	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
6e23ae2a	41	* packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
020b4c12	42	*/
ed6e4ef8 JA	43	fl4.daddr = iph->daddr;
	44	fl4.saddr = saddr;
	45	fl4.flowi4_tos = RT_TOS(iph->tos);
29e09229	46	fl4.flowi4_oif = sk ? sk->sk_bound_dev_if : 0;
6d8b49c3 DA	47	if (!fl4.flowi4_oif)
6d8b49c3 DA	48	fl4.flowi4_oif = l3mdev_master_ifindex(dev);
ed6e4ef8	49	fl4.flowi4_mark = skb->mark;
797fd391	50	fl4.flowi4_flags = flags;
ed6e4ef8 JA	51	rt = ip_route_output_key(net, &fl4);
ed6e4ef8 JA	52	if (IS_ERR(rt))
c9e1673a	53	return PTR_ERR(rt);
020b4c12	54
ed6e4ef8 JA	55	/* Drop old route. */
	56	skb_dst_drop(skb);
	57	skb_dst_set(skb, &rt->dst);
e905a9ed	58
adf30907	59	if (skb_dst(skb)->error)
c9e1673a	60	return skb_dst(skb)->error;
020b4c12	61
3e3850e9	62	#ifdef CONFIG_XFRM
3db05fea	63	if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
9d6ec938	64	xfrm_decode_session(skb, flowi4_to_flowi(&fl4), AF_INET) == 0) {
adf30907 ED	65	struct dst_entry *dst = skb_dst(skb);
adf30907 ED	66	skb_dst_set(skb, NULL);
29e09229	67	dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), sk, 0);
452edd59	68	if (IS_ERR(dst))
3d0a0620	69	return PTR_ERR(dst);
adf30907 ED	70	skb_dst_set(skb, dst);
adf30907 ED	71	}
3e3850e9 PM	72	#endif
3e3850e9 PM	73
020b4c12	74	/* Change in oif may mean change in hh_len. */
adf30907	75	hh_len = skb_dst(skb)->dev->hard_header_len;
3db05fea	76	if (skb_headroom(skb) < hh_len &&
5e2afba4 PG	77	pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)),
5e2afba4 PG	78	0, GFP_ATOMIC))
c9e1673a	79	return -ENOMEM;
020b4c12 HW	80
	81	return 0;
	82	}
	83	EXPORT_SYMBOL(ip_route_me_harder);
2cc7d573	84
3f87c08c PNA	85	int nf_ip_route(struct net net, struct dst_entry dst, struct flowi fl,
3f87c08c PNA	86	bool strict __always_unused)
1841a4c7	87	{
31ad3dd6	88	struct rtable *rt = ip_route_output_key(net, &fl->u.ip4);
b23dd4fe DM	89	if (IS_ERR(rt))
	90	return PTR_ERR(rt);
	91	*dst = &rt->dst;
	92	return 0;
1841a4c7	93	}
3f87c08c	94	EXPORT_SYMBOL_GPL(nf_ip_route);