1/* IPv4 specific functions of netfilter core */ 2#include <linux/kernel.h> 3#include <linux/netfilter.h> 4#include <linux/netfilter_ipv4.h> 5#include <linux/ip.h> 6#include <linux/skbuff.h> 7#include <linux/gfp.h> 8#include <net/route.h> 9#include <net/xfrm.h> 10#include <net/ip.h> 11#include <net/netfilter/nf_queue.h> 12 13/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */ 14int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type) 15{ 16 struct net *net = dev_net(skb_dst(skb)->dev); 17 const struct iphdr *iph = ip_hdr(skb); 18 struct rtable *rt; 19 struct flowi fl = {}; 20 unsigned long orefdst; 21 unsigned int hh_len; 22 unsigned int type; 23 24 type = inet_addr_type(net, iph->saddr); 25 if (skb->sk && inet_sk(skb->sk)->transparent) 26 type = RTN_LOCAL; 27 if (addr_type == RTN_UNSPEC) 28 addr_type = type; 29 30 /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause 31 * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook. 32 */ 33 if (addr_type == RTN_LOCAL) { 34 fl.nl_u.ip4_u.daddr = iph->daddr; 35 if (type == RTN_LOCAL) 36 fl.nl_u.ip4_u.saddr = iph->saddr; 37 fl.nl_u.ip4_u.tos = RT_TOS(iph->tos); 38 fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0; 39 fl.mark = skb->mark; 40 fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0; 41 if (ip_route_output_key(net, &rt, &fl) != 0) 42 return -1; 43 44 /* Drop old route. */ 45 skb_dst_drop(skb); 46 skb_dst_set(skb, &rt->dst); 47 } else { 48 /* non-local src, find valid iif to satisfy 49 * rp-filter when calling ip_route_input. */ 50 fl.nl_u.ip4_u.daddr = iph->saddr; 51 if (ip_route_output_key(net, &rt, &fl) != 0) 52 return -1; 53 54 orefdst = skb->_skb_refdst; 55 if (ip_route_input(skb, iph->daddr, iph->saddr, 56 RT_TOS(iph->tos), rt->dst.dev) != 0) { 57 dst_release(&rt->dst); 58 return -1; 59 } 60 dst_release(&rt->dst); 61 refdst_drop(orefdst); 62 } 63 64 if (skb_dst(skb)->error) 65 return -1; 66 67#ifdef CONFIG_XFRM 68 if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) && 69 xfrm_decode_session(skb, &fl, AF_INET) == 0) { 70 struct dst_entry *dst = skb_dst(skb); 71 skb_dst_set(skb, NULL); 72 if (xfrm_lookup(net, &dst, &fl, skb->sk, 0)) 73 return -1; 74 skb_dst_set(skb, dst); 75 } 76#endif 77 78 /* Change in oif may mean change in hh_len. */ 79 hh_len = skb_dst(skb)->dev->hard_header_len; 80 if (skb_headroom(skb) < hh_len && 81 pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC)) 82 return -1; 83 84 return 0; 85} 86EXPORT_SYMBOL(ip_route_me_harder); 87 88#ifdef CONFIG_XFRM 89int ip_xfrm_me_harder(struct sk_buff *skb) 90{ 91 struct flowi fl; 92 unsigned int hh_len; 93 struct dst_entry *dst; 94 95 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) 96 return 0; 97 if (xfrm_decode_session(skb, &fl, AF_INET) < 0) 98 return -1; 99 100 dst = skb_dst(skb); 101 if (dst->xfrm) 102 dst = ((struct xfrm_dst *)dst)->route; 103 dst_hold(dst); 104 105 if (xfrm_lookup(dev_net(dst->dev), &dst, &fl, skb->sk, 0) < 0) 106 return -1; 107 108 skb_dst_drop(skb); 109 skb_dst_set(skb, dst); 110 111 /* Change in oif may mean change in hh_len. */ 112 hh_len = skb_dst(skb)->dev->hard_header_len; 113 if (skb_headroom(skb) < hh_len && 114 pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC)) 115 return -1; 116 return 0; 117} 118EXPORT_SYMBOL(ip_xfrm_me_harder); 119#endif 120 121void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *); 122EXPORT_SYMBOL(ip_nat_decode_session); 123 124/* 125 * Extra routing may needed on local out, as the QUEUE target never 126 * returns control to the table. 127 */ 128 129struct ip_rt_info { 130 __be32 daddr; 131 __be32 saddr; 132 u_int8_t tos; 133 u_int32_t mark; 134}; 135 136static void nf_ip_saveroute(const struct sk_buff *skb, 137 struct nf_queue_entry *entry) 138{ 139 struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry); 140 141 if (entry->hook == NF_INET_LOCAL_OUT) { 142 const struct iphdr *iph = ip_hdr(skb); 143 144 rt_info->tos = iph->tos; 145 rt_info->daddr = iph->daddr; 146 rt_info->saddr = iph->saddr; 147 rt_info->mark = skb->mark; 148 } 149} 150 151static int nf_ip_reroute(struct sk_buff *skb, 152 const struct nf_queue_entry *entry) 153{ 154 const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry); 155 156 if (entry->hook == NF_INET_LOCAL_OUT) { 157 const struct iphdr *iph = ip_hdr(skb); 158 159 if (!(iph->tos == rt_info->tos && 160 skb->mark == rt_info->mark && 161 iph->daddr == rt_info->daddr && 162 iph->saddr == rt_info->saddr)) 163 return ip_route_me_harder(skb, RTN_UNSPEC); 164 } 165 return 0; 166} 167 168__sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook, 169 unsigned int dataoff, u_int8_t protocol) 170{ 171 const struct iphdr *iph = ip_hdr(skb); 172 __sum16 csum = 0; 173 174 switch (skb->ip_summed) { 175 case CHECKSUM_COMPLETE: 176 if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN) 177 break; 178 if ((protocol == 0 && !csum_fold(skb->csum)) || 179 !csum_tcpudp_magic(iph->saddr, iph->daddr, 180 skb->len - dataoff, protocol, 181 skb->csum)) { 182 skb->ip_summed = CHECKSUM_UNNECESSARY; 183 break; 184 } 185 /* fall through */ 186 case CHECKSUM_NONE: 187 if (protocol == 0) 188 skb->csum = 0; 189 else 190 skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, 191 skb->len - dataoff, 192 protocol, 0); 193 csum = __skb_checksum_complete(skb); 194 } 195 return csum; 196} 197EXPORT_SYMBOL(nf_ip_checksum); 198 199static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook, 200 unsigned int dataoff, unsigned int len, 201 u_int8_t protocol) 202{ 203 const struct iphdr *iph = ip_hdr(skb); 204 __sum16 csum = 0; 205 206 switch (skb->ip_summed) { 207 case CHECKSUM_COMPLETE: 208 if (len == skb->len - dataoff) 209 return nf_ip_checksum(skb, hook, dataoff, protocol); 210 /* fall through */ 211 case CHECKSUM_NONE: 212 skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, protocol, 213 skb->len - dataoff, 0); 214 skb->ip_summed = CHECKSUM_NONE; 215 return __skb_checksum_complete_head(skb, dataoff + len); 216 } 217 return csum; 218} 219 220static int nf_ip_route(struct dst_entry **dst, struct flowi *fl) 221{ 222 return ip_route_output_key(&init_net, (struct rtable **)dst, fl); 223} 224 225static const struct nf_afinfo nf_ip_afinfo = { 226 .family = AF_INET, 227 .checksum = nf_ip_checksum, 228 .checksum_partial = nf_ip_checksum_partial, 229 .route = nf_ip_route, 230 .saveroute = nf_ip_saveroute, 231 .reroute = nf_ip_reroute, 232 .route_key_size = sizeof(struct ip_rt_info), 233}; 234 235static int ipv4_netfilter_init(void) 236{ 237 return nf_register_afinfo(&nf_ip_afinfo); 238} 239 240static void ipv4_netfilter_fini(void) 241{ 242 nf_unregister_afinfo(&nf_ip_afinfo); 243} 244 245module_init(ipv4_netfilter_init); 246module_exit(ipv4_netfilter_fini); 247 248#ifdef CONFIG_SYSCTL 249struct ctl_path nf_net_ipv4_netfilter_sysctl_path[] = { 250 { .procname = "net", }, 251 { .procname = "ipv4", }, 252 { .procname = "netfilter", }, 253 { } 254}; 255EXPORT_SYMBOL_GPL(nf_net_ipv4_netfilter_sysctl_path); 256#endif /* CONFIG_SYSCTL */ 257