[deliverable/linux.git] / net / ipv4 / netfilter / iptable_mangle.c

/*
 * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
 *
 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#include <linux/module.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netdevice.h>
#include <linux/skbuff.h>
#include <net/sock.h>
#include <net/route.h>
#include <linux/ip.h>
#include <net/ip.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
MODULE_DESCRIPTION("iptables mangle table");

#define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
			    (1 << NF_INET_LOCAL_IN) | \
			    (1 << NF_INET_FORWARD) | \
			    (1 << NF_INET_LOCAL_OUT) | \
			    (1 << NF_INET_POST_ROUTING))

/* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
static struct
{
	struct ipt_replace repl;
	struct ipt_standard entries[5];
	struct ipt_error term;
} initial_table __net_initdata = {
	.repl = {
		.name = "mangle",
		.valid_hooks = MANGLE_VALID_HOOKS,
		.num_entries = 6,
		.size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
		.hook_entry = {
			[NF_INET_PRE_ROUTING] 	= 0,
			[NF_INET_LOCAL_IN] 	= sizeof(struct ipt_standard),
			[NF_INET_FORWARD] 	= sizeof(struct ipt_standard) * 2,
			[NF_INET_LOCAL_OUT] 	= sizeof(struct ipt_standard) * 3,
			[NF_INET_POST_ROUTING] 	= sizeof(struct ipt_standard) * 4,
		},
		.underflow = {
			[NF_INET_PRE_ROUTING] 	= 0,
			[NF_INET_LOCAL_IN] 	= sizeof(struct ipt_standard),
			[NF_INET_FORWARD] 	= sizeof(struct ipt_standard) * 2,
			[NF_INET_LOCAL_OUT] 	= sizeof(struct ipt_standard) * 3,
			[NF_INET_POST_ROUTING]	= sizeof(struct ipt_standard) * 4,
		},
	},
	.entries = {
		IPT_STANDARD_INIT(NF_ACCEPT),	/* PRE_ROUTING */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_IN */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* FORWARD */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_OUT */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* POST_ROUTING */
	},
	.term = IPT_ERROR_INIT,			/* ERROR */
};

static struct xt_table packet_mangler = {
	.name		= "mangle",
	.valid_hooks	= MANGLE_VALID_HOOKS,
	.lock		= __RW_LOCK_UNLOCKED(packet_mangler.lock),
	.me		= THIS_MODULE,
	.af		= AF_INET,
};

/* The work comes in here from netfilter.c. */
static unsigned int
ipt_pre_routing_hook(unsigned int hook,
		     struct sk_buff *skb,
		     const struct net_device *in,
		     const struct net_device *out,
		     int (*okfn)(struct sk_buff *))
{
	return ipt_do_table(skb, hook, in, out,
			    nf_pre_routing_net(in, out)->ipv4.iptable_mangle);
}

static unsigned int
ipt_post_routing_hook(unsigned int hook,
		      struct sk_buff *skb,
		      const struct net_device *in,
		      const struct net_device *out,
		      int (*okfn)(struct sk_buff *))
{
	return ipt_do_table(skb, hook, in, out,
			    nf_post_routing_net(in, out)->ipv4.iptable_mangle);
}

static unsigned int
ipt_local_in_hook(unsigned int hook,
		  struct sk_buff *skb,
		  const struct net_device *in,
		  const struct net_device *out,
		  int (*okfn)(struct sk_buff *))
{
	return ipt_do_table(skb, hook, in, out,
			    nf_local_in_net(in, out)->ipv4.iptable_mangle);
}

static unsigned int
ipt_forward_hook(unsigned int hook,
	 struct sk_buff *skb,
	 const struct net_device *in,
	 const struct net_device *out,
	 int (*okfn)(struct sk_buff *))
{
	return ipt_do_table(skb, hook, in, out,
			    nf_forward_net(in, out)->ipv4.iptable_mangle);
}

static unsigned int
ipt_local_hook(unsigned int hook,
		   struct sk_buff *skb,
		   const struct net_device *in,
		   const struct net_device *out,
		   int (*okfn)(struct sk_buff *))
{
	unsigned int ret;
	const struct iphdr *iph;
	u_int8_t tos;
	__be32 saddr, daddr;
	u_int32_t mark;

	/* root is playing with raw sockets. */
	if (skb->len < sizeof(struct iphdr)
	    || ip_hdrlen(skb) < sizeof(struct iphdr)) {
		if (net_ratelimit())
			printk("iptable_mangle: ignoring short SOCK_RAW "
			       "packet.\n");
		return NF_ACCEPT;
	}

	/* Save things which could affect route */
	mark = skb->mark;
	iph = ip_hdr(skb);
	saddr = iph->saddr;
	daddr = iph->daddr;
	tos = iph->tos;

	ret = ipt_do_table(skb, hook, in, out,
			   nf_local_out_net(in, out)->ipv4.iptable_mangle);
	/* Reroute for ANY change. */
	if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
		iph = ip_hdr(skb);

		if (iph->saddr != saddr ||
		    iph->daddr != daddr ||
		    skb->mark != mark ||
		    iph->tos != tos)
			if (ip_route_me_harder(skb, RTN_UNSPEC))
				ret = NF_DROP;
	}

	return ret;
}

static struct nf_hook_ops ipt_ops[] __read_mostly = {
	{
		.hook		= ipt_pre_routing_hook,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_PRE_ROUTING,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_local_in_hook,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_LOCAL_IN,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_forward_hook,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_FORWARD,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_local_hook,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_LOCAL_OUT,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_post_routing_hook,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_POST_ROUTING,
		.priority	= NF_IP_PRI_MANGLE,
	},
};

static int __net_init iptable_mangle_net_init(struct net *net)
{
	/* Register table */
	net->ipv4.iptable_mangle =
		ipt_register_table(net, &packet_mangler, &initial_table.repl);
	if (IS_ERR(net->ipv4.iptable_mangle))
		return PTR_ERR(net->ipv4.iptable_mangle);
	return 0;
}

static void __net_exit iptable_mangle_net_exit(struct net *net)
{
	ipt_unregister_table(net->ipv4.iptable_mangle);
}

static struct pernet_operations iptable_mangle_net_ops = {
	.init = iptable_mangle_net_init,
	.exit = iptable_mangle_net_exit,
};

static int __init iptable_mangle_init(void)
{
	int ret;

	ret = register_pernet_subsys(&iptable_mangle_net_ops);
	if (ret < 0)
		return ret;

	/* Register hooks */
	ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
	if (ret < 0)
		goto cleanup_table;

	return ret;

 cleanup_table:
	unregister_pernet_subsys(&iptable_mangle_net_ops);
	return ret;
}

static void __exit iptable_mangle_fini(void)
{
	nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
	unregister_pernet_subsys(&iptable_mangle_net_ops);
}

module_init(iptable_mangle_init);
module_exit(iptable_mangle_fini);
Commit	Line	Data
1da177e4 LT	1	/*
	2	* This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
	3	*
	4	* Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
	5	* Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
1da177e4	10	*/
1da177e4 LT	11	#include <linux/module.h>
	12	#include <linux/netfilter_ipv4/ip_tables.h>
	13	#include <linux/netdevice.h>
	14	#include <linux/skbuff.h>
	15	#include <net/sock.h>
	16	#include <net/route.h>
	17	#include <linux/ip.h>
c9bdd4b5	18	#include <net/ip.h>
1da177e4 LT	19
	20	MODULE_LICENSE("GPL");
	21	MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
	22	MODULE_DESCRIPTION("iptables mangle table");
	23
6e23ae2a PM	24	#define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) \| \
	25	(1 << NF_INET_LOCAL_IN) \| \
	26	(1 << NF_INET_FORWARD) \| \
	27	(1 << NF_INET_LOCAL_OUT) \| \
	28	(1 << NF_INET_POST_ROUTING))
1da177e4 LT	29
	30	/* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
	31	static struct
	32	{
	33	struct ipt_replace repl;
	34	struct ipt_standard entries[5];
	35	struct ipt_error term;
9335f047	36	} initial_table __net_initdata = {
3c2ad469 PM	37	.repl = {
	38	.name = "mangle",
	39	.valid_hooks = MANGLE_VALID_HOOKS,
	40	.num_entries = 6,
	41	.size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
	42	.hook_entry = {
6e23ae2a PM	43	[NF_INET_PRE_ROUTING] = 0,
	44	[NF_INET_LOCAL_IN] = sizeof(struct ipt_standard),
	45	[NF_INET_FORWARD] = sizeof(struct ipt_standard) * 2,
	46	[NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 3,
	47	[NF_INET_POST_ROUTING] = sizeof(struct ipt_standard) * 4,
3c2ad469 PM	48	},
3c2ad469 PM	49	.underflow = {
6e23ae2a PM	50	[NF_INET_PRE_ROUTING] = 0,
	51	[NF_INET_LOCAL_IN] = sizeof(struct ipt_standard),
	52	[NF_INET_FORWARD] = sizeof(struct ipt_standard) * 2,
	53	[NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 3,
	54	[NF_INET_POST_ROUTING] = sizeof(struct ipt_standard) * 4,
3c2ad469 PM	55	},
	56	},
	57	.entries = {
	58	IPT_STANDARD_INIT(NF_ACCEPT), /* PRE_ROUTING */
	59	IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_IN */
	60	IPT_STANDARD_INIT(NF_ACCEPT), /* FORWARD */
	61	IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_OUT */
	62	IPT_STANDARD_INIT(NF_ACCEPT), /* POST_ROUTING */
	63	},
	64	.term = IPT_ERROR_INIT, /* ERROR */
1da177e4 LT	65	};
1da177e4 LT	66
9335f047	67	static struct xt_table packet_mangler = {
1da177e4 LT	68	.name = "mangle",
1da177e4 LT	69	.valid_hooks = MANGLE_VALID_HOOKS,
fdccecd0	70	.lock = __RW_LOCK_UNLOCKED(packet_mangler.lock),
1da177e4	71	.me = THIS_MODULE,
2e4e6a17	72	.af = AF_INET,
1da177e4 LT	73	};
	74
	75	/* The work comes in here from netfilter.c. */
	76	static unsigned int
666953df AD	77	ipt_pre_routing_hook(unsigned int hook,
	78	struct sk_buff *skb,
	79	const struct net_device *in,
	80	const struct net_device *out,
	81	int (okfn)(struct sk_buff ))
	82	{
	83	return ipt_do_table(skb, hook, in, out,
	84	nf_pre_routing_net(in, out)->ipv4.iptable_mangle);
	85	}
	86
	87	static unsigned int
	88	ipt_post_routing_hook(unsigned int hook,
	89	struct sk_buff *skb,
	90	const struct net_device *in,
	91	const struct net_device *out,
	92	int (okfn)(struct sk_buff ))
	93	{
	94	return ipt_do_table(skb, hook, in, out,
	95	nf_post_routing_net(in, out)->ipv4.iptable_mangle);
	96	}
	97
	98	static unsigned int
	99	ipt_local_in_hook(unsigned int hook,
	100	struct sk_buff *skb,
	101	const struct net_device *in,
	102	const struct net_device *out,
	103	int (okfn)(struct sk_buff ))
	104	{
	105	return ipt_do_table(skb, hook, in, out,
	106	nf_local_in_net(in, out)->ipv4.iptable_mangle);
	107	}
	108
	109	static unsigned int
	110	ipt_forward_hook(unsigned int hook,
3db05fea	111	struct sk_buff *skb,
1da177e4 LT	112	const struct net_device *in,
	113	const struct net_device *out,
	114	int (okfn)(struct sk_buff ))
	115	{
666953df AD	116	return ipt_do_table(skb, hook, in, out,
666953df AD	117	nf_forward_net(in, out)->ipv4.iptable_mangle);
1da177e4 LT	118	}
	119
	120	static unsigned int
	121	ipt_local_hook(unsigned int hook,
3db05fea	122	struct sk_buff *skb,
1da177e4 LT	123	const struct net_device *in,
	124	const struct net_device *out,
	125	int (okfn)(struct sk_buff ))
	126	{
	127	unsigned int ret;
eddc9ec5	128	const struct iphdr *iph;
1da177e4	129	u_int8_t tos;
6a19d614	130	__be32 saddr, daddr;
82e91ffe	131	u_int32_t mark;
1da177e4 LT	132
1da177e4 LT	133	/* root is playing with raw sockets. */
3db05fea HX	134	if (skb->len < sizeof(struct iphdr)
3db05fea HX	135	\|\| ip_hdrlen(skb) < sizeof(struct iphdr)) {
1da177e4	136	if (net_ratelimit())
4a176c1a PM	137	printk("iptable_mangle: ignoring short SOCK_RAW "
4a176c1a PM	138	"packet.\n");
1da177e4 LT	139	return NF_ACCEPT;
	140	}
	141
	142	/* Save things which could affect route */
3db05fea HX	143	mark = skb->mark;
3db05fea HX	144	iph = ip_hdr(skb);
eddc9ec5 ACM	145	saddr = iph->saddr;
	146	daddr = iph->daddr;
	147	tos = iph->tos;
1da177e4	148
666953df AD	149	ret = ipt_do_table(skb, hook, in, out,
666953df AD	150	nf_local_out_net(in, out)->ipv4.iptable_mangle);
1da177e4	151	/* Reroute for ANY change. */
eddc9ec5	152	if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
3db05fea	153	iph = ip_hdr(skb);
eddc9ec5 ACM	154
	155	if (iph->saddr != saddr \|\|
	156	iph->daddr != daddr \|\|
3db05fea	157	skb->mark != mark \|\|
eddc9ec5	158	iph->tos != tos)
3db05fea	159	if (ip_route_me_harder(skb, RTN_UNSPEC))
eddc9ec5 ACM	160	ret = NF_DROP;
eddc9ec5 ACM	161	}
1da177e4 LT	162
	163	return ret;
	164	}
	165
1999414a	166	static struct nf_hook_ops ipt_ops[] __read_mostly = {
1da177e4	167	{
666953df	168	.hook = ipt_pre_routing_hook,
1da177e4 LT	169	.owner = THIS_MODULE,
1da177e4 LT	170	.pf = PF_INET,
6e23ae2a	171	.hooknum = NF_INET_PRE_ROUTING,
1da177e4 LT	172	.priority = NF_IP_PRI_MANGLE,
	173	},
	174	{
666953df	175	.hook = ipt_local_in_hook,
1da177e4 LT	176	.owner = THIS_MODULE,
1da177e4 LT	177	.pf = PF_INET,
6e23ae2a	178	.hooknum = NF_INET_LOCAL_IN,
1da177e4 LT	179	.priority = NF_IP_PRI_MANGLE,
	180	},
	181	{
666953df	182	.hook = ipt_forward_hook,
1da177e4 LT	183	.owner = THIS_MODULE,
1da177e4 LT	184	.pf = PF_INET,
6e23ae2a	185	.hooknum = NF_INET_FORWARD,
1da177e4 LT	186	.priority = NF_IP_PRI_MANGLE,
	187	},
	188	{
	189	.hook = ipt_local_hook,
	190	.owner = THIS_MODULE,
	191	.pf = PF_INET,
6e23ae2a	192	.hooknum = NF_INET_LOCAL_OUT,
1da177e4 LT	193	.priority = NF_IP_PRI_MANGLE,
	194	},
	195	{
666953df	196	.hook = ipt_post_routing_hook,
1da177e4 LT	197	.owner = THIS_MODULE,
1da177e4 LT	198	.pf = PF_INET,
6e23ae2a	199	.hooknum = NF_INET_POST_ROUTING,
1da177e4 LT	200	.priority = NF_IP_PRI_MANGLE,
	201	},
	202	};
	203
9335f047 AD	204	static int __net_init iptable_mangle_net_init(struct net *net)
	205	{
	206	/* Register table */
	207	net->ipv4.iptable_mangle =
	208	ipt_register_table(net, &packet_mangler, &initial_table.repl);
	209	if (IS_ERR(net->ipv4.iptable_mangle))
	210	return PTR_ERR(net->ipv4.iptable_mangle);
	211	return 0;
	212	}
	213
	214	static void __net_exit iptable_mangle_net_exit(struct net *net)
	215	{
	216	ipt_unregister_table(net->ipv4.iptable_mangle);
	217	}
	218
	219	static struct pernet_operations iptable_mangle_net_ops = {
	220	.init = iptable_mangle_net_init,
	221	.exit = iptable_mangle_net_exit,
	222	};
	223
65b4b4e8	224	static int __init iptable_mangle_init(void)
1da177e4 LT	225	{
	226	int ret;
	227
9335f047 AD	228	ret = register_pernet_subsys(&iptable_mangle_net_ops);
	229	if (ret < 0)
	230	return ret;
1da177e4 LT	231
1da177e4 LT	232	/* Register hooks */
964ddaa1	233	ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
1da177e4 LT	234	if (ret < 0)
	235	goto cleanup_table;
	236
1da177e4 LT	237	return ret;
1da177e4 LT	238
1da177e4	239	cleanup_table:
9335f047	240	unregister_pernet_subsys(&iptable_mangle_net_ops);
1da177e4 LT	241	return ret;
	242	}
	243
65b4b4e8	244	static void __exit iptable_mangle_fini(void)
1da177e4	245	{
964ddaa1	246	nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
9335f047	247	unregister_pernet_subsys(&iptable_mangle_net_ops);
1da177e4 LT	248	}
1da177e4 LT	249
65b4b4e8 AM	250	module_init(iptable_mangle_init);
65b4b4e8 AM	251	module_exit(iptable_mangle_fini);