1// SPDX-License-Identifier: GPL-2.0-only 2/* 3 * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x. 4 * 5 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 6 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org> 7 */ 8#include <linux/module.h> 9#include <linux/netfilter_ipv4/ip_tables.h> 10#include <linux/netdevice.h> 11#include <linux/skbuff.h> 12#include <linux/slab.h> 13#include <net/sock.h> 14#include <net/route.h> 15#include <linux/ip.h> 16#include <net/ip.h> 17 18MODULE_LICENSE("GPL"); 19MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); 20MODULE_DESCRIPTION("iptables mangle table"); 21 22#define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \ 23 (1 << NF_INET_LOCAL_IN) | \ 24 (1 << NF_INET_FORWARD) | \ 25 (1 << NF_INET_LOCAL_OUT) | \ 26 (1 << NF_INET_POST_ROUTING)) 27 28static const struct xt_table packet_mangler = { 29 .name = "mangle", 30 .valid_hooks = MANGLE_VALID_HOOKS, 31 .me = THIS_MODULE, 32 .af = NFPROTO_IPV4, 33 .priority = NF_IP_PRI_MANGLE, 34}; 35 36static unsigned int 37ipt_mangle_out(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) 38{ 39 unsigned int ret, verdict; 40 const struct iphdr *iph; 41 __be32 saddr, daddr; 42 u32 mark; 43 int err; 44 u8 tos; 45 46 /* Save things which could affect route */ 47 mark = skb->mark; 48 iph = ip_hdr(skb); 49 saddr = iph->saddr; 50 daddr = iph->daddr; 51 tos = iph->tos; 52 53 ret = ipt_do_table(priv, skb, state); 54 verdict = ret & NF_VERDICT_MASK; 55 /* Reroute for ANY change. */ 56 if (verdict != NF_DROP && verdict != NF_STOLEN) { 57 iph = ip_hdr(skb); 58 59 if (iph->saddr != saddr || 60 iph->daddr != daddr || 61 skb->mark != mark || 62 iph->tos != tos) { 63 err = ip_route_me_harder(state->net, state->sk, skb, RTN_UNSPEC); 64 if (err < 0) 65 ret = NF_DROP_ERR(err); 66 } 67 } 68 69 return ret; 70} 71 72/* The work comes in here from netfilter.c. */ 73static unsigned int 74iptable_mangle_hook(void *priv, 75 struct sk_buff *skb, 76 const struct nf_hook_state *state) 77{ 78 if (state->hook == NF_INET_LOCAL_OUT) 79 return ipt_mangle_out(priv, skb, state); 80 return ipt_do_table(priv, skb, state); 81} 82 83static struct nf_hook_ops *mangle_ops __read_mostly; 84static int iptable_mangle_table_init(struct net *net) 85{ 86 struct ipt_replace *repl; 87 int ret; 88 89 repl = ipt_alloc_initial_table(&packet_mangler); 90 if (repl == NULL) 91 return -ENOMEM; 92 ret = ipt_register_table(net, &packet_mangler, repl, mangle_ops); 93 kfree(repl); 94 return ret; 95} 96 97static void __net_exit iptable_mangle_net_pre_exit(struct net *net) 98{ 99 ipt_unregister_table_pre_exit(net, "mangle"); 100} 101 102static void __net_exit iptable_mangle_net_exit(struct net *net) 103{ 104 ipt_unregister_table_exit(net, "mangle"); 105} 106 107static struct pernet_operations iptable_mangle_net_ops = { 108 .pre_exit = iptable_mangle_net_pre_exit, 109 .exit = iptable_mangle_net_exit, 110}; 111 112static int __init iptable_mangle_init(void) 113{ 114 int ret = xt_register_template(&packet_mangler, 115 iptable_mangle_table_init); 116 if (ret < 0) 117 return ret; 118 119 mangle_ops = xt_hook_ops_alloc(&packet_mangler, iptable_mangle_hook); 120 if (IS_ERR(mangle_ops)) { 121 xt_unregister_template(&packet_mangler); 122 ret = PTR_ERR(mangle_ops); 123 return ret; 124 } 125 126 ret = register_pernet_subsys(&iptable_mangle_net_ops); 127 if (ret < 0) { 128 xt_unregister_template(&packet_mangler); 129 kfree(mangle_ops); 130 return ret; 131 } 132 133 return ret; 134} 135 136static void __exit iptable_mangle_fini(void) 137{ 138 unregister_pernet_subsys(&iptable_mangle_net_ops); 139 xt_unregister_template(&packet_mangler); 140 kfree(mangle_ops); 141} 142 143module_init(iptable_mangle_init); 144module_exit(iptable_mangle_fini); 145