[deliverable/linux.git] / net / ipv4 / netfilter / iptable_mangle.c

/*
 * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
 *
 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#include <linux/module.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netdevice.h>
#include <linux/skbuff.h>
#include <net/sock.h>
#include <net/route.h>
#include <linux/ip.h>
#include <net/ip.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
MODULE_DESCRIPTION("iptables mangle table");

#define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
			    (1 << NF_INET_LOCAL_IN) | \
			    (1 << NF_INET_FORWARD) | \
			    (1 << NF_INET_LOCAL_OUT) | \
			    (1 << NF_INET_POST_ROUTING))

/* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
static struct
{
	struct ipt_replace repl;
	struct ipt_standard entries[5];
	struct ipt_error term;
} initial_table __net_initdata = {
	.repl = {
		.name = "mangle",
		.valid_hooks = MANGLE_VALID_HOOKS,
		.num_entries = 6,
		.size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
		.hook_entry = {
			[NF_INET_PRE_ROUTING] 	= 0,
			[NF_INET_LOCAL_IN] 	= sizeof(struct ipt_standard),
			[NF_INET_FORWARD] 	= sizeof(struct ipt_standard) * 2,
			[NF_INET_LOCAL_OUT] 	= sizeof(struct ipt_standard) * 3,
			[NF_INET_POST_ROUTING] 	= sizeof(struct ipt_standard) * 4,
		},
		.underflow = {
			[NF_INET_PRE_ROUTING] 	= 0,
			[NF_INET_LOCAL_IN] 	= sizeof(struct ipt_standard),
			[NF_INET_FORWARD] 	= sizeof(struct ipt_standard) * 2,
			[NF_INET_LOCAL_OUT] 	= sizeof(struct ipt_standard) * 3,
			[NF_INET_POST_ROUTING]	= sizeof(struct ipt_standard) * 4,
		},
	},
	.entries = {
		IPT_STANDARD_INIT(NF_ACCEPT),	/* PRE_ROUTING */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_IN */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* FORWARD */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_OUT */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* POST_ROUTING */
	},
	.term = IPT_ERROR_INIT,			/* ERROR */
};

static struct xt_table packet_mangler = {
	.name		= "mangle",
	.valid_hooks	= MANGLE_VALID_HOOKS,
	.lock		= RW_LOCK_UNLOCKED,
	.me		= THIS_MODULE,
	.af		= AF_INET,
};

/* The work comes in here from netfilter.c. */
static unsigned int
ipt_route_hook(unsigned int hook,
	 struct sk_buff *skb,
	 const struct net_device *in,
	 const struct net_device *out,
	 int (*okfn)(struct sk_buff *))
{
	return ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_mangle);
}

static unsigned int
ipt_local_hook(unsigned int hook,
		   struct sk_buff *skb,
		   const struct net_device *in,
		   const struct net_device *out,
		   int (*okfn)(struct sk_buff *))
{
	unsigned int ret;
	const struct iphdr *iph;
	u_int8_t tos;
	__be32 saddr, daddr;
	u_int32_t mark;

	/* root is playing with raw sockets. */
	if (skb->len < sizeof(struct iphdr)
	    || ip_hdrlen(skb) < sizeof(struct iphdr)) {
		if (net_ratelimit())
			printk("iptable_mangle: ignoring short SOCK_RAW "
			       "packet.\n");
		return NF_ACCEPT;
	}

	/* Save things which could affect route */
	mark = skb->mark;
	iph = ip_hdr(skb);
	saddr = iph->saddr;
	daddr = iph->daddr;
	tos = iph->tos;

	ret = ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_mangle);
	/* Reroute for ANY change. */
	if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
		iph = ip_hdr(skb);

		if (iph->saddr != saddr ||
		    iph->daddr != daddr ||
		    skb->mark != mark ||
		    iph->tos != tos)
			if (ip_route_me_harder(skb, RTN_UNSPEC))
				ret = NF_DROP;
	}

	return ret;
}

static struct nf_hook_ops ipt_ops[] __read_mostly = {
	{
		.hook		= ipt_route_hook,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_PRE_ROUTING,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_route_hook,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_LOCAL_IN,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_route_hook,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_FORWARD,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_local_hook,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_LOCAL_OUT,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_route_hook,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_POST_ROUTING,
		.priority	= NF_IP_PRI_MANGLE,
	},
};

static int __net_init iptable_mangle_net_init(struct net *net)
{
	/* Register table */
	net->ipv4.iptable_mangle =
		ipt_register_table(net, &packet_mangler, &initial_table.repl);
	if (IS_ERR(net->ipv4.iptable_mangle))
		return PTR_ERR(net->ipv4.iptable_mangle);
	return 0;
}

static void __net_exit iptable_mangle_net_exit(struct net *net)
{
	ipt_unregister_table(net->ipv4.iptable_mangle);
}

static struct pernet_operations iptable_mangle_net_ops = {
	.init = iptable_mangle_net_init,
	.exit = iptable_mangle_net_exit,
};

static int __init iptable_mangle_init(void)
{
	int ret;

	ret = register_pernet_subsys(&iptable_mangle_net_ops);
	if (ret < 0)
		return ret;

	/* Register hooks */
	ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
	if (ret < 0)
		goto cleanup_table;

	return ret;

 cleanup_table:
	unregister_pernet_subsys(&iptable_mangle_net_ops);
	return ret;
}

static void __exit iptable_mangle_fini(void)
{
	nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
	unregister_pernet_subsys(&iptable_mangle_net_ops);
}

module_init(iptable_mangle_init);
module_exit(iptable_mangle_fini);
Commit	Line	Data
1da177e4 LT	1	/*
	2	* This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
	3	*
	4	* Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
	5	* Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
1da177e4	10	*/
1da177e4 LT	11	#include <linux/module.h>
	12	#include <linux/netfilter_ipv4/ip_tables.h>
	13	#include <linux/netdevice.h>
	14	#include <linux/skbuff.h>
	15	#include <net/sock.h>
	16	#include <net/route.h>
	17	#include <linux/ip.h>
c9bdd4b5	18	#include <net/ip.h>
1da177e4 LT	19
	20	MODULE_LICENSE("GPL");
	21	MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
	22	MODULE_DESCRIPTION("iptables mangle table");
	23
6e23ae2a PM	24	#define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) \| \
	25	(1 << NF_INET_LOCAL_IN) \| \
	26	(1 << NF_INET_FORWARD) \| \
	27	(1 << NF_INET_LOCAL_OUT) \| \
	28	(1 << NF_INET_POST_ROUTING))
1da177e4 LT	29
	30	/* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
	31	static struct
	32	{
	33	struct ipt_replace repl;
	34	struct ipt_standard entries[5];
	35	struct ipt_error term;
9335f047	36	} initial_table __net_initdata = {
3c2ad469 PM	37	.repl = {
	38	.name = "mangle",
	39	.valid_hooks = MANGLE_VALID_HOOKS,
	40	.num_entries = 6,
	41	.size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
	42	.hook_entry = {
6e23ae2a PM	43	[NF_INET_PRE_ROUTING] = 0,
	44	[NF_INET_LOCAL_IN] = sizeof(struct ipt_standard),
	45	[NF_INET_FORWARD] = sizeof(struct ipt_standard) * 2,
	46	[NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 3,
	47	[NF_INET_POST_ROUTING] = sizeof(struct ipt_standard) * 4,
3c2ad469 PM	48	},
3c2ad469 PM	49	.underflow = {
6e23ae2a PM	50	[NF_INET_PRE_ROUTING] = 0,
	51	[NF_INET_LOCAL_IN] = sizeof(struct ipt_standard),
	52	[NF_INET_FORWARD] = sizeof(struct ipt_standard) * 2,
	53	[NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 3,
	54	[NF_INET_POST_ROUTING] = sizeof(struct ipt_standard) * 4,
3c2ad469 PM	55	},
	56	},
	57	.entries = {
	58	IPT_STANDARD_INIT(NF_ACCEPT), /* PRE_ROUTING */
	59	IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_IN */
	60	IPT_STANDARD_INIT(NF_ACCEPT), /* FORWARD */
	61	IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_OUT */
	62	IPT_STANDARD_INIT(NF_ACCEPT), /* POST_ROUTING */
	63	},
	64	.term = IPT_ERROR_INIT, /* ERROR */
1da177e4 LT	65	};
1da177e4 LT	66
9335f047	67	static struct xt_table packet_mangler = {
1da177e4 LT	68	.name = "mangle",
	69	.valid_hooks = MANGLE_VALID_HOOKS,
	70	.lock = RW_LOCK_UNLOCKED,
	71	.me = THIS_MODULE,
2e4e6a17	72	.af = AF_INET,
1da177e4 LT	73	};
	74
	75	/* The work comes in here from netfilter.c. */
	76	static unsigned int
	77	ipt_route_hook(unsigned int hook,
3db05fea	78	struct sk_buff *skb,
1da177e4 LT	79	const struct net_device *in,
	80	const struct net_device *out,
	81	int (okfn)(struct sk_buff ))
	82	{
9335f047	83	return ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_mangle);
1da177e4 LT	84	}
	85
	86	static unsigned int
	87	ipt_local_hook(unsigned int hook,
3db05fea	88	struct sk_buff *skb,
1da177e4 LT	89	const struct net_device *in,
	90	const struct net_device *out,
	91	int (okfn)(struct sk_buff ))
	92	{
	93	unsigned int ret;
eddc9ec5	94	const struct iphdr *iph;
1da177e4	95	u_int8_t tos;
6a19d614	96	__be32 saddr, daddr;
82e91ffe	97	u_int32_t mark;
1da177e4 LT	98
1da177e4 LT	99	/* root is playing with raw sockets. */
3db05fea HX	100	if (skb->len < sizeof(struct iphdr)
3db05fea HX	101	\|\| ip_hdrlen(skb) < sizeof(struct iphdr)) {
1da177e4	102	if (net_ratelimit())
4a176c1a PM	103	printk("iptable_mangle: ignoring short SOCK_RAW "
4a176c1a PM	104	"packet.\n");
1da177e4 LT	105	return NF_ACCEPT;
	106	}
	107
	108	/* Save things which could affect route */
3db05fea HX	109	mark = skb->mark;
3db05fea HX	110	iph = ip_hdr(skb);
eddc9ec5 ACM	111	saddr = iph->saddr;
	112	daddr = iph->daddr;
	113	tos = iph->tos;
1da177e4	114
9335f047	115	ret = ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_mangle);
1da177e4	116	/* Reroute for ANY change. */
eddc9ec5	117	if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
3db05fea	118	iph = ip_hdr(skb);
eddc9ec5 ACM	119
	120	if (iph->saddr != saddr \|\|
	121	iph->daddr != daddr \|\|
3db05fea	122	skb->mark != mark \|\|
eddc9ec5	123	iph->tos != tos)
3db05fea	124	if (ip_route_me_harder(skb, RTN_UNSPEC))
eddc9ec5 ACM	125	ret = NF_DROP;
eddc9ec5 ACM	126	}
1da177e4 LT	127
	128	return ret;
	129	}
	130
1999414a	131	static struct nf_hook_ops ipt_ops[] __read_mostly = {
1da177e4 LT	132	{
	133	.hook = ipt_route_hook,
	134	.owner = THIS_MODULE,
	135	.pf = PF_INET,
6e23ae2a	136	.hooknum = NF_INET_PRE_ROUTING,
1da177e4 LT	137	.priority = NF_IP_PRI_MANGLE,
	138	},
	139	{
	140	.hook = ipt_route_hook,
	141	.owner = THIS_MODULE,
	142	.pf = PF_INET,
6e23ae2a	143	.hooknum = NF_INET_LOCAL_IN,
1da177e4 LT	144	.priority = NF_IP_PRI_MANGLE,
	145	},
	146	{
	147	.hook = ipt_route_hook,
	148	.owner = THIS_MODULE,
	149	.pf = PF_INET,
6e23ae2a	150	.hooknum = NF_INET_FORWARD,
1da177e4 LT	151	.priority = NF_IP_PRI_MANGLE,
	152	},
	153	{
	154	.hook = ipt_local_hook,
	155	.owner = THIS_MODULE,
	156	.pf = PF_INET,
6e23ae2a	157	.hooknum = NF_INET_LOCAL_OUT,
1da177e4 LT	158	.priority = NF_IP_PRI_MANGLE,
	159	},
	160	{
	161	.hook = ipt_route_hook,
	162	.owner = THIS_MODULE,
	163	.pf = PF_INET,
6e23ae2a	164	.hooknum = NF_INET_POST_ROUTING,
1da177e4 LT	165	.priority = NF_IP_PRI_MANGLE,
	166	},
	167	};
	168
9335f047 AD	169	static int __net_init iptable_mangle_net_init(struct net *net)
	170	{
	171	/* Register table */
	172	net->ipv4.iptable_mangle =
	173	ipt_register_table(net, &packet_mangler, &initial_table.repl);
	174	if (IS_ERR(net->ipv4.iptable_mangle))
	175	return PTR_ERR(net->ipv4.iptable_mangle);
	176	return 0;
	177	}
	178
	179	static void __net_exit iptable_mangle_net_exit(struct net *net)
	180	{
	181	ipt_unregister_table(net->ipv4.iptable_mangle);
	182	}
	183
	184	static struct pernet_operations iptable_mangle_net_ops = {
	185	.init = iptable_mangle_net_init,
	186	.exit = iptable_mangle_net_exit,
	187	};
	188
65b4b4e8	189	static int __init iptable_mangle_init(void)
1da177e4 LT	190	{
	191	int ret;
	192
9335f047 AD	193	ret = register_pernet_subsys(&iptable_mangle_net_ops);
	194	if (ret < 0)
	195	return ret;
1da177e4 LT	196
1da177e4 LT	197	/* Register hooks */
964ddaa1	198	ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
1da177e4 LT	199	if (ret < 0)
	200	goto cleanup_table;
	201
1da177e4 LT	202	return ret;
1da177e4 LT	203
1da177e4	204	cleanup_table:
9335f047	205	unregister_pernet_subsys(&iptable_mangle_net_ops);
1da177e4 LT	206	return ret;
	207	}
	208
65b4b4e8	209	static void __exit iptable_mangle_fini(void)
1da177e4	210	{
964ddaa1	211	nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
9335f047	212	unregister_pernet_subsys(&iptable_mangle_net_ops);
1da177e4 LT	213	}
1da177e4 LT	214
65b4b4e8 AM	215	module_init(iptable_mangle_init);
65b4b4e8 AM	216	module_exit(iptable_mangle_fini);