netfilter.c 5.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219
  1. /* IPv4 specific functions of netfilter core */
  2. #include <linux/kernel.h>
  3. #include <linux/netfilter.h>
  4. #include <linux/netfilter_ipv4.h>
  5. #include <linux/ip.h>
  6. #include <net/route.h>
  7. #include <net/xfrm.h>
  8. #include <net/ip.h>
  9. /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
  10. int ip_route_me_harder(struct sk_buff **pskb, unsigned addr_type)
  11. {
  12. struct iphdr *iph = (*pskb)->nh.iph;
  13. struct rtable *rt;
  14. struct flowi fl = {};
  15. struct dst_entry *odst;
  16. unsigned int hh_len;
  17. unsigned int type;
  18. type = inet_addr_type(iph->saddr);
  19. if (addr_type == RTN_UNSPEC)
  20. addr_type = type;
  21. /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
  22. * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
  23. */
  24. if (addr_type == RTN_LOCAL) {
  25. fl.nl_u.ip4_u.daddr = iph->daddr;
  26. if (type == RTN_LOCAL)
  27. fl.nl_u.ip4_u.saddr = iph->saddr;
  28. fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
  29. fl.oif = (*pskb)->sk ? (*pskb)->sk->sk_bound_dev_if : 0;
  30. fl.mark = (*pskb)->mark;
  31. if (ip_route_output_key(&rt, &fl) != 0)
  32. return -1;
  33. /* Drop old route. */
  34. dst_release((*pskb)->dst);
  35. (*pskb)->dst = &rt->u.dst;
  36. } else {
  37. /* non-local src, find valid iif to satisfy
  38. * rp-filter when calling ip_route_input. */
  39. fl.nl_u.ip4_u.daddr = iph->saddr;
  40. if (ip_route_output_key(&rt, &fl) != 0)
  41. return -1;
  42. odst = (*pskb)->dst;
  43. if (ip_route_input(*pskb, iph->daddr, iph->saddr,
  44. RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
  45. dst_release(&rt->u.dst);
  46. return -1;
  47. }
  48. dst_release(&rt->u.dst);
  49. dst_release(odst);
  50. }
  51. if ((*pskb)->dst->error)
  52. return -1;
  53. #ifdef CONFIG_XFRM
  54. if (!(IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED) &&
  55. xfrm_decode_session(*pskb, &fl, AF_INET) == 0)
  56. if (xfrm_lookup(&(*pskb)->dst, &fl, (*pskb)->sk, 0))
  57. return -1;
  58. #endif
  59. /* Change in oif may mean change in hh_len. */
  60. hh_len = (*pskb)->dst->dev->hard_header_len;
  61. if (skb_headroom(*pskb) < hh_len) {
  62. struct sk_buff *nskb;
  63. nskb = skb_realloc_headroom(*pskb, hh_len);
  64. if (!nskb)
  65. return -1;
  66. if ((*pskb)->sk)
  67. skb_set_owner_w(nskb, (*pskb)->sk);
  68. kfree_skb(*pskb);
  69. *pskb = nskb;
  70. }
  71. return 0;
  72. }
  73. EXPORT_SYMBOL(ip_route_me_harder);
  74. #ifdef CONFIG_XFRM
  75. int ip_xfrm_me_harder(struct sk_buff **pskb)
  76. {
  77. struct flowi fl;
  78. unsigned int hh_len;
  79. struct dst_entry *dst;
  80. if (IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED)
  81. return 0;
  82. if (xfrm_decode_session(*pskb, &fl, AF_INET) < 0)
  83. return -1;
  84. dst = (*pskb)->dst;
  85. if (dst->xfrm)
  86. dst = ((struct xfrm_dst *)dst)->route;
  87. dst_hold(dst);
  88. if (xfrm_lookup(&dst, &fl, (*pskb)->sk, 0) < 0)
  89. return -1;
  90. dst_release((*pskb)->dst);
  91. (*pskb)->dst = dst;
  92. /* Change in oif may mean change in hh_len. */
  93. hh_len = (*pskb)->dst->dev->hard_header_len;
  94. if (skb_headroom(*pskb) < hh_len) {
  95. struct sk_buff *nskb;
  96. nskb = skb_realloc_headroom(*pskb, hh_len);
  97. if (!nskb)
  98. return -1;
  99. if ((*pskb)->sk)
  100. skb_set_owner_w(nskb, (*pskb)->sk);
  101. kfree_skb(*pskb);
  102. *pskb = nskb;
  103. }
  104. return 0;
  105. }
  106. EXPORT_SYMBOL(ip_xfrm_me_harder);
  107. #endif
  108. void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
  109. EXPORT_SYMBOL(ip_nat_decode_session);
  110. /*
  111. * Extra routing may needed on local out, as the QUEUE target never
  112. * returns control to the table.
  113. */
  114. struct ip_rt_info {
  115. __be32 daddr;
  116. __be32 saddr;
  117. u_int8_t tos;
  118. };
  119. static void nf_ip_saveroute(const struct sk_buff *skb, struct nf_info *info)
  120. {
  121. struct ip_rt_info *rt_info = nf_info_reroute(info);
  122. if (info->hook == NF_IP_LOCAL_OUT) {
  123. const struct iphdr *iph = skb->nh.iph;
  124. rt_info->tos = iph->tos;
  125. rt_info->daddr = iph->daddr;
  126. rt_info->saddr = iph->saddr;
  127. }
  128. }
  129. static int nf_ip_reroute(struct sk_buff **pskb, const struct nf_info *info)
  130. {
  131. const struct ip_rt_info *rt_info = nf_info_reroute(info);
  132. if (info->hook == NF_IP_LOCAL_OUT) {
  133. struct iphdr *iph = (*pskb)->nh.iph;
  134. if (!(iph->tos == rt_info->tos
  135. && iph->daddr == rt_info->daddr
  136. && iph->saddr == rt_info->saddr))
  137. return ip_route_me_harder(pskb, RTN_UNSPEC);
  138. }
  139. return 0;
  140. }
  141. __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
  142. unsigned int dataoff, u_int8_t protocol)
  143. {
  144. struct iphdr *iph = skb->nh.iph;
  145. __sum16 csum = 0;
  146. switch (skb->ip_summed) {
  147. case CHECKSUM_COMPLETE:
  148. if (hook != NF_IP_PRE_ROUTING && hook != NF_IP_LOCAL_IN)
  149. break;
  150. if ((protocol == 0 && !csum_fold(skb->csum)) ||
  151. !csum_tcpudp_magic(iph->saddr, iph->daddr,
  152. skb->len - dataoff, protocol,
  153. skb->csum)) {
  154. skb->ip_summed = CHECKSUM_UNNECESSARY;
  155. break;
  156. }
  157. /* fall through */
  158. case CHECKSUM_NONE:
  159. if (protocol == 0)
  160. skb->csum = 0;
  161. else
  162. skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
  163. skb->len - dataoff,
  164. protocol, 0);
  165. csum = __skb_checksum_complete(skb);
  166. }
  167. return csum;
  168. }
  169. EXPORT_SYMBOL(nf_ip_checksum);
  170. static struct nf_afinfo nf_ip_afinfo = {
  171. .family = AF_INET,
  172. .checksum = nf_ip_checksum,
  173. .saveroute = nf_ip_saveroute,
  174. .reroute = nf_ip_reroute,
  175. .route_key_size = sizeof(struct ip_rt_info),
  176. };
  177. static int ipv4_netfilter_init(void)
  178. {
  179. return nf_register_afinfo(&nf_ip_afinfo);
  180. }
  181. static void ipv4_netfilter_fini(void)
  182. {
  183. nf_unregister_afinfo(&nf_ip_afinfo);
  184. }
  185. module_init(ipv4_netfilter_init);
  186. module_exit(ipv4_netfilter_fini);