[mirror_ubuntu-artful-kernel.git] / net / ipv4 / netfilter.c

/* IPv4 specific functions of netfilter core */
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/ip.h>
#include <net/route.h>
#include <net/xfrm.h>
#include <net/ip.h>

/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
int ip_route_me_harder(struct sk_buff **pskb, unsigned addr_type)
{
	struct iphdr *iph = (*pskb)->nh.iph;
	struct rtable *rt;
	struct flowi fl = {};
	struct dst_entry *odst;
	unsigned int hh_len;

	if (addr_type == RTN_UNSPEC)
		addr_type = inet_addr_type(iph->saddr);

	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
	 * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
	 */
	if (addr_type == RTN_LOCAL) {
		fl.nl_u.ip4_u.daddr = iph->daddr;
		fl.nl_u.ip4_u.saddr = iph->saddr;
		fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
		fl.oif = (*pskb)->sk ? (*pskb)->sk->sk_bound_dev_if : 0;
#ifdef CONFIG_IP_ROUTE_FWMARK
		fl.nl_u.ip4_u.fwmark = (*pskb)->nfmark;
#endif
		if (ip_route_output_key(&rt, &fl) != 0)
			return -1;

		/* Drop old route. */
		dst_release((*pskb)->dst);
		(*pskb)->dst = &rt->u.dst;
	} else {
		/* non-local src, find valid iif to satisfy
		 * rp-filter when calling ip_route_input. */
		fl.nl_u.ip4_u.daddr = iph->saddr;
		if (ip_route_output_key(&rt, &fl) != 0)
			return -1;

		odst = (*pskb)->dst;
		if (ip_route_input(*pskb, iph->daddr, iph->saddr,
				   RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
			dst_release(&rt->u.dst);
			return -1;
		}
		dst_release(&rt->u.dst);
		dst_release(odst);
	}
	
	if ((*pskb)->dst->error)
		return -1;

#ifdef CONFIG_XFRM
	if (!(IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED) &&
	    xfrm_decode_session(*pskb, &fl, AF_INET) == 0)
		if (xfrm_lookup(&(*pskb)->dst, &fl, (*pskb)->sk, 0))
			return -1;
#endif

	/* Change in oif may mean change in hh_len. */
	hh_len = (*pskb)->dst->dev->hard_header_len;
	if (skb_headroom(*pskb) < hh_len) {
		struct sk_buff *nskb;

		nskb = skb_realloc_headroom(*pskb, hh_len);
		if (!nskb) 
			return -1;
		if ((*pskb)->sk)
			skb_set_owner_w(nskb, (*pskb)->sk);
		kfree_skb(*pskb);
		*pskb = nskb;
	}

	return 0;
}
EXPORT_SYMBOL(ip_route_me_harder);

#ifdef CONFIG_XFRM
int ip_xfrm_me_harder(struct sk_buff **pskb)
{
	struct flowi fl;
	unsigned int hh_len;
	struct dst_entry *dst;

	if (IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED)
		return 0;
	if (xfrm_decode_session(*pskb, &fl, AF_INET) < 0)
		return -1;

	dst = (*pskb)->dst;
	if (dst->xfrm)
		dst = ((struct xfrm_dst *)dst)->route;
	dst_hold(dst);

	if (xfrm_lookup(&dst, &fl, (*pskb)->sk, 0) < 0)
		return -1;

	dst_release((*pskb)->dst);
	(*pskb)->dst = dst;

	/* Change in oif may mean change in hh_len. */
	hh_len = (*pskb)->dst->dev->hard_header_len;
	if (skb_headroom(*pskb) < hh_len) {
		struct sk_buff *nskb;

		nskb = skb_realloc_headroom(*pskb, hh_len);
		if (!nskb)
			return -1;
		if ((*pskb)->sk)
			skb_set_owner_w(nskb, (*pskb)->sk);
		kfree_skb(*pskb);
		*pskb = nskb;
	}
	return 0;
}
EXPORT_SYMBOL(ip_xfrm_me_harder);
#endif

void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
EXPORT_SYMBOL(ip_nat_decode_session);

/*
 * Extra routing may needed on local out, as the QUEUE target never
 * returns control to the table.
 */

struct ip_rt_info {
	__be32 daddr;
	__be32 saddr;
	u_int8_t tos;
};

static void nf_ip_saveroute(const struct sk_buff *skb, struct nf_info *info)
{
	struct ip_rt_info *rt_info = nf_info_reroute(info);

	if (info->hook == NF_IP_LOCAL_OUT) {
		const struct iphdr *iph = skb->nh.iph;

		rt_info->tos = iph->tos;
		rt_info->daddr = iph->daddr;
		rt_info->saddr = iph->saddr;
	}
}

static int nf_ip_reroute(struct sk_buff **pskb, const struct nf_info *info)
{
	const struct ip_rt_info *rt_info = nf_info_reroute(info);

	if (info->hook == NF_IP_LOCAL_OUT) {
		struct iphdr *iph = (*pskb)->nh.iph;

		if (!(iph->tos == rt_info->tos
		      && iph->daddr == rt_info->daddr
		      && iph->saddr == rt_info->saddr))
			return ip_route_me_harder(pskb, RTN_UNSPEC);
	}
	return 0;
}

unsigned int nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
			    unsigned int dataoff, u_int8_t protocol)
{
	struct iphdr *iph = skb->nh.iph;
	unsigned int csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (hook != NF_IP_PRE_ROUTING && hook != NF_IP_LOCAL_IN)
			break;
		if ((protocol == 0 && !(u16)csum_fold(skb->csum)) ||
		    !csum_tcpudp_magic(iph->saddr, iph->daddr,
			    	       skb->len - dataoff, protocol,
				       skb->csum)) {
			skb->ip_summed = CHECKSUM_UNNECESSARY;
			break;
		}
		/* fall through */
	case CHECKSUM_NONE:
		if (protocol == 0)
			skb->csum = 0;
		else
			skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
						       skb->len - dataoff,
						       protocol, 0);
		csum = __skb_checksum_complete(skb);
	}
	return csum;
}

EXPORT_SYMBOL(nf_ip_checksum);

static struct nf_afinfo nf_ip_afinfo = {
	.family		= AF_INET,
	.checksum	= nf_ip_checksum,
	.saveroute	= nf_ip_saveroute,
	.reroute	= nf_ip_reroute,
	.route_key_size	= sizeof(struct ip_rt_info),
};

static int ipv4_netfilter_init(void)
{
	return nf_register_afinfo(&nf_ip_afinfo);
}

static void ipv4_netfilter_fini(void)
{
	nf_unregister_afinfo(&nf_ip_afinfo);
}

module_init(ipv4_netfilter_init);
module_exit(ipv4_netfilter_fini);
Commit	Line	Data
2cc7d573	1	/* IPv4 specific functions of netfilter core */
020b4c12 HW	2	#include <linux/kernel.h>
020b4c12 HW	3	#include <linux/netfilter.h>
2cc7d573	4	#include <linux/netfilter_ipv4.h>
3e3850e9	5	#include <linux/ip.h>
020b4c12	6	#include <net/route.h>
3e3850e9 PM	7	#include <net/xfrm.h>
3e3850e9 PM	8	#include <net/ip.h>
020b4c12 HW	9
020b4c12 HW	10	/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
b4c4ed17	11	int ip_route_me_harder(struct sk_buff **pskb, unsigned addr_type)
020b4c12 HW	12	{
	13	struct iphdr iph = (pskb)->nh.iph;
	14	struct rtable *rt;
	15	struct flowi fl = {};
	16	struct dst_entry *odst;
	17	unsigned int hh_len;
	18
b4c4ed17 SH	19	if (addr_type == RTN_UNSPEC)
	20	addr_type = inet_addr_type(iph->saddr);
	21
020b4c12 HW	22	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
	23	* packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
	24	*/
b4c4ed17	25	if (addr_type == RTN_LOCAL) {
020b4c12 HW	26	fl.nl_u.ip4_u.daddr = iph->daddr;
	27	fl.nl_u.ip4_u.saddr = iph->saddr;
	28	fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
	29	fl.oif = (pskb)->sk ? (pskb)->sk->sk_bound_dev_if : 0;
	30	#ifdef CONFIG_IP_ROUTE_FWMARK
	31	fl.nl_u.ip4_u.fwmark = (*pskb)->nfmark;
	32	#endif
020b4c12 HW	33	if (ip_route_output_key(&rt, &fl) != 0)
	34	return -1;
	35
	36	/* Drop old route. */
	37	dst_release((*pskb)->dst);
	38	(*pskb)->dst = &rt->u.dst;
	39	} else {
	40	/* non-local src, find valid iif to satisfy
	41	* rp-filter when calling ip_route_input. */
	42	fl.nl_u.ip4_u.daddr = iph->saddr;
	43	if (ip_route_output_key(&rt, &fl) != 0)
	44	return -1;
	45
	46	odst = (*pskb)->dst;
	47	if (ip_route_input(*pskb, iph->daddr, iph->saddr,
	48	RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
	49	dst_release(&rt->u.dst);
	50	return -1;
	51	}
	52	dst_release(&rt->u.dst);
	53	dst_release(odst);
	54	}
	55
	56	if ((*pskb)->dst->error)
	57	return -1;
	58
3e3850e9 PM	59	#ifdef CONFIG_XFRM
	60	if (!(IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED) &&
	61	xfrm_decode_session(*pskb, &fl, AF_INET) == 0)
	62	if (xfrm_lookup(&(pskb)->dst, &fl, (pskb)->sk, 0))
	63	return -1;
	64	#endif
	65
020b4c12 HW	66	/* Change in oif may mean change in hh_len. */
	67	hh_len = (*pskb)->dst->dev->hard_header_len;
	68	if (skb_headroom(*pskb) < hh_len) {
	69	struct sk_buff *nskb;
	70
	71	nskb = skb_realloc_headroom(*pskb, hh_len);
	72	if (!nskb)
	73	return -1;
	74	if ((*pskb)->sk)
	75	skb_set_owner_w(nskb, (*pskb)->sk);
	76	kfree_skb(*pskb);
	77	*pskb = nskb;
	78	}
	79
	80	return 0;
	81	}
	82	EXPORT_SYMBOL(ip_route_me_harder);
2cc7d573	83
ee68cea2 PM	84	#ifdef CONFIG_XFRM
	85	int ip_xfrm_me_harder(struct sk_buff **pskb)
	86	{
	87	struct flowi fl;
	88	unsigned int hh_len;
	89	struct dst_entry *dst;
	90
	91	if (IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED)
	92	return 0;
	93	if (xfrm_decode_session(*pskb, &fl, AF_INET) < 0)
	94	return -1;
	95
	96	dst = (*pskb)->dst;
	97	if (dst->xfrm)
	98	dst = ((struct xfrm_dst *)dst)->route;
	99	dst_hold(dst);
	100
	101	if (xfrm_lookup(&dst, &fl, (*pskb)->sk, 0) < 0)
	102	return -1;
	103
	104	dst_release((*pskb)->dst);
	105	(*pskb)->dst = dst;
	106
	107	/* Change in oif may mean change in hh_len. */
	108	hh_len = (*pskb)->dst->dev->hard_header_len;
	109	if (skb_headroom(*pskb) < hh_len) {
	110	struct sk_buff *nskb;
	111
	112	nskb = skb_realloc_headroom(*pskb, hh_len);
	113	if (!nskb)
	114	return -1;
	115	if ((*pskb)->sk)
	116	skb_set_owner_w(nskb, (*pskb)->sk);
	117	kfree_skb(*pskb);
	118	*pskb = nskb;
	119	}
	120	return 0;
	121	}
	122	EXPORT_SYMBOL(ip_xfrm_me_harder);
	123	#endif
	124
eb9c7ebe PM	125	void (ip_nat_decode_session)(struct sk_buff , struct flowi *);
	126	EXPORT_SYMBOL(ip_nat_decode_session);
	127
2cc7d573 HW	128	/*
	129	* Extra routing may needed on local out, as the QUEUE target never
	130	* returns control to the table.
	131	*/
	132
	133	struct ip_rt_info {
59b8bfd8 AV	134	__be32 daddr;
59b8bfd8 AV	135	__be32 saddr;
2cc7d573 HW	136	u_int8_t tos;
	137	};
	138
bce8032e	139	static void nf_ip_saveroute(const struct sk_buff skb, struct nf_info info)
2cc7d573 HW	140	{
	141	struct ip_rt_info *rt_info = nf_info_reroute(info);
	142
	143	if (info->hook == NF_IP_LOCAL_OUT) {
	144	const struct iphdr *iph = skb->nh.iph;
	145
	146	rt_info->tos = iph->tos;
	147	rt_info->daddr = iph->daddr;
	148	rt_info->saddr = iph->saddr;
	149	}
	150	}
	151
bce8032e	152	static int nf_ip_reroute(struct sk_buff *pskb, const struct nf_info info)
2cc7d573 HW	153	{
	154	const struct ip_rt_info *rt_info = nf_info_reroute(info);
	155
	156	if (info->hook == NF_IP_LOCAL_OUT) {
	157	struct iphdr iph = (pskb)->nh.iph;
	158
	159	if (!(iph->tos == rt_info->tos
	160	&& iph->daddr == rt_info->daddr
	161	&& iph->saddr == rt_info->saddr))
b4c4ed17	162	return ip_route_me_harder(pskb, RTN_UNSPEC);
2cc7d573 HW	163	}
	164	return 0;
	165	}
	166
422c346f PM	167	unsigned int nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
	168	unsigned int dataoff, u_int8_t protocol)
	169	{
	170	struct iphdr *iph = skb->nh.iph;
	171	unsigned int csum = 0;
	172
	173	switch (skb->ip_summed) {
84fa7933	174	case CHECKSUM_COMPLETE:
422c346f PM	175	if (hook != NF_IP_PRE_ROUTING && hook != NF_IP_LOCAL_IN)
	176	break;
	177	if ((protocol == 0 && !(u16)csum_fold(skb->csum)) \|\|
	178	!csum_tcpudp_magic(iph->saddr, iph->daddr,
	179	skb->len - dataoff, protocol,
	180	skb->csum)) {
	181	skb->ip_summed = CHECKSUM_UNNECESSARY;
	182	break;
	183	}
	184	/* fall through */
	185	case CHECKSUM_NONE:
	186	if (protocol == 0)
	187	skb->csum = 0;
	188	else
	189	skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
	190	skb->len - dataoff,
	191	protocol, 0);
	192	csum = __skb_checksum_complete(skb);
	193	}
	194	return csum;
	195	}
	196
	197	EXPORT_SYMBOL(nf_ip_checksum);
	198
bce8032e PM	199	static struct nf_afinfo nf_ip_afinfo = {
bce8032e PM	200	.family = AF_INET,
422c346f	201	.checksum = nf_ip_checksum,
bce8032e PM	202	.saveroute = nf_ip_saveroute,
	203	.reroute = nf_ip_reroute,
	204	.route_key_size = sizeof(struct ip_rt_info),
2cc7d573 HW	205	};
2cc7d573 HW	206
65b4b4e8	207	static int ipv4_netfilter_init(void)
2cc7d573	208	{
bce8032e	209	return nf_register_afinfo(&nf_ip_afinfo);
2cc7d573 HW	210	}
2cc7d573 HW	211
65b4b4e8	212	static void ipv4_netfilter_fini(void)
2cc7d573	213	{
bce8032e	214	nf_unregister_afinfo(&nf_ip_afinfo);
2cc7d573 HW	215	}
2cc7d573 HW	216
65b4b4e8 AM	217	module_init(ipv4_netfilter_init);
65b4b4e8 AM	218	module_exit(ipv4_netfilter_fini);