[deliverable/linux.git] / net / ipv4 / netfilter.c

/* IPv4 specific functions of netfilter core */
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/ip.h>
#include <linux/skbuff.h>
#include <net/route.h>
#include <net/xfrm.h>
#include <net/ip.h>
#include <net/netfilter/nf_queue.h>

/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
{
	struct net *net = dev_net(skb->dst->dev);
	const struct iphdr *iph = ip_hdr(skb);
	struct rtable *rt;
	struct flowi fl = {};
	struct dst_entry *odst;
	unsigned int hh_len;
	unsigned int type;

	type = inet_addr_type(net, iph->saddr);
	if (skb->sk && inet_sk(skb->sk)->transparent)
		type = RTN_LOCAL;
	if (addr_type == RTN_UNSPEC)
		addr_type = type;

	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
	 * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
	 */
	if (addr_type == RTN_LOCAL) {
		fl.nl_u.ip4_u.daddr = iph->daddr;
		if (type == RTN_LOCAL)
			fl.nl_u.ip4_u.saddr = iph->saddr;
		fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
		fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
		fl.mark = skb->mark;
		fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
		if (ip_route_output_key(net, &rt, &fl) != 0)
			return -1;

		/* Drop old route. */
		dst_release(skb->dst);
		skb->dst = &rt->u.dst;
	} else {
		/* non-local src, find valid iif to satisfy
		 * rp-filter when calling ip_route_input. */
		fl.nl_u.ip4_u.daddr = iph->saddr;
		if (ip_route_output_key(net, &rt, &fl) != 0)
			return -1;

		odst = skb->dst;
		if (ip_route_input(skb, iph->daddr, iph->saddr,
				   RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
			dst_release(&rt->u.dst);
			return -1;
		}
		dst_release(&rt->u.dst);
		dst_release(odst);
	}

	if (skb->dst->error)
		return -1;

#ifdef CONFIG_XFRM
	if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
	    xfrm_decode_session(skb, &fl, AF_INET) == 0)
		if (xfrm_lookup(net, &skb->dst, &fl, skb->sk, 0))
			return -1;
#endif

	/* Change in oif may mean change in hh_len. */
	hh_len = skb->dst->dev->hard_header_len;
	if (skb_headroom(skb) < hh_len &&
	    pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
		return -1;

	return 0;
}
EXPORT_SYMBOL(ip_route_me_harder);

#ifdef CONFIG_XFRM
int ip_xfrm_me_harder(struct sk_buff *skb)
{
	struct flowi fl;
	unsigned int hh_len;
	struct dst_entry *dst;

	if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
		return 0;
	if (xfrm_decode_session(skb, &fl, AF_INET) < 0)
		return -1;

	dst = skb->dst;
	if (dst->xfrm)
		dst = ((struct xfrm_dst *)dst)->route;
	dst_hold(dst);

	if (xfrm_lookup(dev_net(dst->dev), &dst, &fl, skb->sk, 0) < 0)
		return -1;

	dst_release(skb->dst);
	skb->dst = dst;

	/* Change in oif may mean change in hh_len. */
	hh_len = skb->dst->dev->hard_header_len;
	if (skb_headroom(skb) < hh_len &&
	    pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
		return -1;
	return 0;
}
EXPORT_SYMBOL(ip_xfrm_me_harder);
#endif

void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
EXPORT_SYMBOL(ip_nat_decode_session);

/*
 * Extra routing may needed on local out, as the QUEUE target never
 * returns control to the table.
 */

struct ip_rt_info {
	__be32 daddr;
	__be32 saddr;
	u_int8_t tos;
	u_int32_t mark;
};

static void nf_ip_saveroute(const struct sk_buff *skb,
			    struct nf_queue_entry *entry)
{
	struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);

	if (entry->hook == NF_INET_LOCAL_OUT) {
		const struct iphdr *iph = ip_hdr(skb);

		rt_info->tos = iph->tos;
		rt_info->daddr = iph->daddr;
		rt_info->saddr = iph->saddr;
		rt_info->mark = skb->mark;
	}
}

static int nf_ip_reroute(struct sk_buff *skb,
			 const struct nf_queue_entry *entry)
{
	const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);

	if (entry->hook == NF_INET_LOCAL_OUT) {
		const struct iphdr *iph = ip_hdr(skb);

		if (!(iph->tos == rt_info->tos
		      && skb->mark == rt_info->mark
		      && iph->daddr == rt_info->daddr
		      && iph->saddr == rt_info->saddr))
			return ip_route_me_harder(skb, RTN_UNSPEC);
	}
	return 0;
}

__sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
			    unsigned int dataoff, u_int8_t protocol)
{
	const struct iphdr *iph = ip_hdr(skb);
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
			break;
		if ((protocol == 0 && !csum_fold(skb->csum)) ||
		    !csum_tcpudp_magic(iph->saddr, iph->daddr,
				       skb->len - dataoff, protocol,
				       skb->csum)) {
			skb->ip_summed = CHECKSUM_UNNECESSARY;
			break;
		}
		/* fall through */
	case CHECKSUM_NONE:
		if (protocol == 0)
			skb->csum = 0;
		else
			skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
						       skb->len - dataoff,
						       protocol, 0);
		csum = __skb_checksum_complete(skb);
	}
	return csum;
}
EXPORT_SYMBOL(nf_ip_checksum);

static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
				      unsigned int dataoff, unsigned int len,
				      u_int8_t protocol)
{
	const struct iphdr *iph = ip_hdr(skb);
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (len == skb->len - dataoff)
			return nf_ip_checksum(skb, hook, dataoff, protocol);
		/* fall through */
	case CHECKSUM_NONE:
		skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, protocol,
					       skb->len - dataoff, 0);
		skb->ip_summed = CHECKSUM_NONE;
		csum = __skb_checksum_complete_head(skb, dataoff + len);
		if (!csum)
			skb->ip_summed = CHECKSUM_UNNECESSARY;
	}
	return csum;
}

static int nf_ip_route(struct dst_entry **dst, struct flowi *fl)
{
	return ip_route_output_key(&init_net, (struct rtable **)dst, fl);
}

static const struct nf_afinfo nf_ip_afinfo = {
	.family			= AF_INET,
	.checksum		= nf_ip_checksum,
	.checksum_partial	= nf_ip_checksum_partial,
	.route			= nf_ip_route,
	.saveroute		= nf_ip_saveroute,
	.reroute		= nf_ip_reroute,
	.route_key_size		= sizeof(struct ip_rt_info),
};

static int ipv4_netfilter_init(void)
{
	return nf_register_afinfo(&nf_ip_afinfo);
}

static void ipv4_netfilter_fini(void)
{
	nf_unregister_afinfo(&nf_ip_afinfo);
}

module_init(ipv4_netfilter_init);
module_exit(ipv4_netfilter_fini);

#ifdef CONFIG_SYSCTL
struct ctl_path nf_net_ipv4_netfilter_sysctl_path[] = {
	{ .procname = "net", .ctl_name = CTL_NET, },
	{ .procname = "ipv4", .ctl_name = NET_IPV4, },
	{ .procname = "netfilter", .ctl_name = NET_IPV4_NETFILTER, },
	{ }
};
EXPORT_SYMBOL_GPL(nf_net_ipv4_netfilter_sysctl_path);
#endif /* CONFIG_SYSCTL */
Commit	Line	Data
2cc7d573	1	/* IPv4 specific functions of netfilter core */
020b4c12 HW	2	#include <linux/kernel.h>
020b4c12 HW	3	#include <linux/netfilter.h>
2cc7d573	4	#include <linux/netfilter_ipv4.h>
3e3850e9	5	#include <linux/ip.h>
2ca7b0ac	6	#include <linux/skbuff.h>
020b4c12	7	#include <net/route.h>
3e3850e9 PM	8	#include <net/xfrm.h>
3e3850e9 PM	9	#include <net/ip.h>
c01cd429	10	#include <net/netfilter/nf_queue.h>
020b4c12 HW	11
020b4c12 HW	12	/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
3db05fea	13	int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
020b4c12	14	{
b21f8901	15	struct net *net = dev_net(skb->dst->dev);
3db05fea	16	const struct iphdr *iph = ip_hdr(skb);
020b4c12 HW	17	struct rtable *rt;
	18	struct flowi fl = {};
	19	struct dst_entry *odst;
	20	unsigned int hh_len;
c68b8b68	21	unsigned int type;
020b4c12	22
b21f8901	23	type = inet_addr_type(net, iph->saddr);
86b08d86 KK	24	if (skb->sk && inet_sk(skb->sk)->transparent)
86b08d86 KK	25	type = RTN_LOCAL;
b4c4ed17	26	if (addr_type == RTN_UNSPEC)
c68b8b68	27	addr_type = type;
b4c4ed17	28
020b4c12	29	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
6e23ae2a	30	* packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
020b4c12	31	*/
b4c4ed17	32	if (addr_type == RTN_LOCAL) {
020b4c12	33	fl.nl_u.ip4_u.daddr = iph->daddr;
c68b8b68 PM	34	if (type == RTN_LOCAL)
c68b8b68 PM	35	fl.nl_u.ip4_u.saddr = iph->saddr;
020b4c12	36	fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
3db05fea HX	37	fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
3db05fea HX	38	fl.mark = skb->mark;
86b08d86	39	fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
b21f8901	40	if (ip_route_output_key(net, &rt, &fl) != 0)
020b4c12 HW	41	return -1;
	42
	43	/* Drop old route. */
3db05fea HX	44	dst_release(skb->dst);
3db05fea HX	45	skb->dst = &rt->u.dst;
020b4c12 HW	46	} else {
	47	/* non-local src, find valid iif to satisfy
	48	* rp-filter when calling ip_route_input. */
	49	fl.nl_u.ip4_u.daddr = iph->saddr;
b21f8901	50	if (ip_route_output_key(net, &rt, &fl) != 0)
020b4c12 HW	51	return -1;
020b4c12 HW	52
3db05fea HX	53	odst = skb->dst;
3db05fea HX	54	if (ip_route_input(skb, iph->daddr, iph->saddr,
020b4c12 HW	55	RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
	56	dst_release(&rt->u.dst);
	57	return -1;
	58	}
	59	dst_release(&rt->u.dst);
	60	dst_release(odst);
	61	}
e905a9ed	62
3db05fea	63	if (skb->dst->error)
020b4c12 HW	64	return -1;
020b4c12 HW	65
3e3850e9	66	#ifdef CONFIG_XFRM
3db05fea HX	67	if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
3db05fea HX	68	xfrm_decode_session(skb, &fl, AF_INET) == 0)
52479b62	69	if (xfrm_lookup(net, &skb->dst, &fl, skb->sk, 0))
3e3850e9 PM	70	return -1;
	71	#endif
	72
020b4c12	73	/* Change in oif may mean change in hh_len. */
3db05fea HX	74	hh_len = skb->dst->dev->hard_header_len;
	75	if (skb_headroom(skb) < hh_len &&
	76	pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
2ca7b0ac	77	return -1;
020b4c12 HW	78
	79	return 0;
	80	}
	81	EXPORT_SYMBOL(ip_route_me_harder);
2cc7d573	82
ee68cea2	83	#ifdef CONFIG_XFRM
3db05fea	84	int ip_xfrm_me_harder(struct sk_buff *skb)
ee68cea2 PM	85	{
	86	struct flowi fl;
	87	unsigned int hh_len;
	88	struct dst_entry *dst;
	89
3db05fea	90	if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
ee68cea2	91	return 0;
3db05fea	92	if (xfrm_decode_session(skb, &fl, AF_INET) < 0)
ee68cea2 PM	93	return -1;
ee68cea2 PM	94
3db05fea	95	dst = skb->dst;
ee68cea2 PM	96	if (dst->xfrm)
	97	dst = ((struct xfrm_dst *)dst)->route;
	98	dst_hold(dst);
	99
52479b62	100	if (xfrm_lookup(dev_net(dst->dev), &dst, &fl, skb->sk, 0) < 0)
ee68cea2 PM	101	return -1;
ee68cea2 PM	102
3db05fea HX	103	dst_release(skb->dst);
3db05fea HX	104	skb->dst = dst;
ee68cea2 PM	105
ee68cea2 PM	106	/* Change in oif may mean change in hh_len. */
3db05fea HX	107	hh_len = skb->dst->dev->hard_header_len;
	108	if (skb_headroom(skb) < hh_len &&
	109	pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
2ca7b0ac	110	return -1;
ee68cea2 PM	111	return 0;
	112	}
	113	EXPORT_SYMBOL(ip_xfrm_me_harder);
	114	#endif
	115
eb9c7ebe PM	116	void (ip_nat_decode_session)(struct sk_buff , struct flowi *);
	117	EXPORT_SYMBOL(ip_nat_decode_session);
	118
2cc7d573 HW	119	/*
	120	* Extra routing may needed on local out, as the QUEUE target never
	121	* returns control to the table.
	122	*/
	123
	124	struct ip_rt_info {
59b8bfd8 AV	125	__be32 daddr;
59b8bfd8 AV	126	__be32 saddr;
2cc7d573	127	u_int8_t tos;
5f145e44	128	u_int32_t mark;
2cc7d573 HW	129	};
2cc7d573 HW	130
02f014d8 PM	131	static void nf_ip_saveroute(const struct sk_buff *skb,
02f014d8 PM	132	struct nf_queue_entry *entry)
2cc7d573	133	{
02f014d8	134	struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
2cc7d573	135
02f014d8	136	if (entry->hook == NF_INET_LOCAL_OUT) {
eddc9ec5	137	const struct iphdr *iph = ip_hdr(skb);
2cc7d573 HW	138
	139	rt_info->tos = iph->tos;
	140	rt_info->daddr = iph->daddr;
	141	rt_info->saddr = iph->saddr;
5f145e44	142	rt_info->mark = skb->mark;
2cc7d573 HW	143	}
	144	}
	145
02f014d8 PM	146	static int nf_ip_reroute(struct sk_buff *skb,
02f014d8 PM	147	const struct nf_queue_entry *entry)
2cc7d573	148	{
02f014d8	149	const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
2cc7d573	150
02f014d8	151	if (entry->hook == NF_INET_LOCAL_OUT) {
3db05fea	152	const struct iphdr *iph = ip_hdr(skb);
2cc7d573 HW	153
2cc7d573 HW	154	if (!(iph->tos == rt_info->tos
5f145e44	155	&& skb->mark == rt_info->mark
2cc7d573 HW	156	&& iph->daddr == rt_info->daddr
2cc7d573 HW	157	&& iph->saddr == rt_info->saddr))
3db05fea	158	return ip_route_me_harder(skb, RTN_UNSPEC);
2cc7d573 HW	159	}
	160	return 0;
	161	}
	162
b51655b9	163	__sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
422c346f PM	164	unsigned int dataoff, u_int8_t protocol)
422c346f PM	165	{
eddc9ec5	166	const struct iphdr *iph = ip_hdr(skb);
b51655b9	167	__sum16 csum = 0;
422c346f PM	168
422c346f PM	169	switch (skb->ip_summed) {
84fa7933	170	case CHECKSUM_COMPLETE:
6e23ae2a	171	if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
422c346f	172	break;
d3bc23e7	173	if ((protocol == 0 && !csum_fold(skb->csum)) \|\|
422c346f	174	!csum_tcpudp_magic(iph->saddr, iph->daddr,
e905a9ed	175	skb->len - dataoff, protocol,
422c346f PM	176	skb->csum)) {
	177	skb->ip_summed = CHECKSUM_UNNECESSARY;
	178	break;
	179	}
	180	/* fall through */
	181	case CHECKSUM_NONE:
	182	if (protocol == 0)
	183	skb->csum = 0;
	184	else
	185	skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
	186	skb->len - dataoff,
	187	protocol, 0);
	188	csum = __skb_checksum_complete(skb);
	189	}
	190	return csum;
	191	}
422c346f PM	192	EXPORT_SYMBOL(nf_ip_checksum);
422c346f PM	193
d63a6507 PM	194	static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
	195	unsigned int dataoff, unsigned int len,
	196	u_int8_t protocol)
	197	{
	198	const struct iphdr *iph = ip_hdr(skb);
	199	__sum16 csum = 0;
	200
	201	switch (skb->ip_summed) {
	202	case CHECKSUM_COMPLETE:
	203	if (len == skb->len - dataoff)
	204	return nf_ip_checksum(skb, hook, dataoff, protocol);
	205	/* fall through */
	206	case CHECKSUM_NONE:
	207	skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, protocol,
	208	skb->len - dataoff, 0);
	209	skb->ip_summed = CHECKSUM_NONE;
	210	csum = __skb_checksum_complete_head(skb, dataoff + len);
	211	if (!csum)
	212	skb->ip_summed = CHECKSUM_UNNECESSARY;
	213	}
	214	return csum;
	215	}
	216
1841a4c7 PM	217	static int nf_ip_route(struct dst_entry *dst, struct flowi fl)
1841a4c7 PM	218	{
f206351a	219	return ip_route_output_key(&init_net, (struct rtable **)dst, fl);
1841a4c7 PM	220	}
1841a4c7 PM	221
1e796fda	222	static const struct nf_afinfo nf_ip_afinfo = {
d63a6507 PM	223	.family = AF_INET,
	224	.checksum = nf_ip_checksum,
	225	.checksum_partial = nf_ip_checksum_partial,
	226	.route = nf_ip_route,
	227	.saveroute = nf_ip_saveroute,
	228	.reroute = nf_ip_reroute,
	229	.route_key_size = sizeof(struct ip_rt_info),
2cc7d573 HW	230	};
2cc7d573 HW	231
65b4b4e8	232	static int ipv4_netfilter_init(void)
2cc7d573	233	{
bce8032e	234	return nf_register_afinfo(&nf_ip_afinfo);
2cc7d573 HW	235	}
2cc7d573 HW	236
65b4b4e8	237	static void ipv4_netfilter_fini(void)
2cc7d573	238	{
bce8032e	239	nf_unregister_afinfo(&nf_ip_afinfo);
2cc7d573 HW	240	}
2cc7d573 HW	241
65b4b4e8 AM	242	module_init(ipv4_netfilter_init);
65b4b4e8 AM	243	module_exit(ipv4_netfilter_fini);
4f536522 PM	244
	245	#ifdef CONFIG_SYSCTL
	246	struct ctl_path nf_net_ipv4_netfilter_sysctl_path[] = {
	247	{ .procname = "net", .ctl_name = CTL_NET, },
	248	{ .procname = "ipv4", .ctl_name = NET_IPV4, },
	249	{ .procname = "netfilter", .ctl_name = NET_IPV4_NETFILTER, },
	250	{ }
	251	};
	252	EXPORT_SYMBOL_GPL(nf_net_ipv4_netfilter_sysctl_path);
	253	#endif /* CONFIG_SYSCTL */