1 /* IPv4 specific functions of netfilter core */ 2 #include <linux/kernel.h> 3 #include <linux/netfilter.h> 4 #include <linux/netfilter_ipv4.h> 5 #include <linux/ip.h> 6 #include <net/route.h> 7 #include <net/xfrm.h> 8 #include <net/ip.h> 9 10 /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */ 11 int ip_route_me_harder(struct sk_buff **pskb) 12 { 13 struct iphdr *iph = (*pskb)->nh.iph; 14 struct rtable *rt; 15 struct flowi fl = {}; 16 struct dst_entry *odst; 17 unsigned int hh_len; 18 19 /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause 20 * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook. 21 */ 22 if (inet_addr_type(iph->saddr) == RTN_LOCAL) { 23 fl.nl_u.ip4_u.daddr = iph->daddr; 24 fl.nl_u.ip4_u.saddr = iph->saddr; 25 fl.nl_u.ip4_u.tos = RT_TOS(iph->tos); 26 fl.oif = (*pskb)->sk ? (*pskb)->sk->sk_bound_dev_if : 0; 27 #ifdef CONFIG_IP_ROUTE_FWMARK 28 fl.nl_u.ip4_u.fwmark = (*pskb)->nfmark; 29 #endif 30 if (ip_route_output_key(&rt, &fl) != 0) 31 return -1; 32 33 /* Drop old route. */ 34 dst_release((*pskb)->dst); 35 (*pskb)->dst = &rt->u.dst; 36 } else { 37 /* non-local src, find valid iif to satisfy 38 * rp-filter when calling ip_route_input. */ 39 fl.nl_u.ip4_u.daddr = iph->saddr; 40 if (ip_route_output_key(&rt, &fl) != 0) 41 return -1; 42 43 odst = (*pskb)->dst; 44 if (ip_route_input(*pskb, iph->daddr, iph->saddr, 45 RT_TOS(iph->tos), rt->u.dst.dev) != 0) { 46 dst_release(&rt->u.dst); 47 return -1; 48 } 49 dst_release(&rt->u.dst); 50 dst_release(odst); 51 } 52 53 if ((*pskb)->dst->error) 54 return -1; 55 56 #ifdef CONFIG_XFRM 57 if (!(IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED) && 58 xfrm_decode_session(*pskb, &fl, AF_INET) == 0) 59 if (xfrm_lookup(&(*pskb)->dst, &fl, (*pskb)->sk, 0)) 60 return -1; 61 #endif 62 63 /* Change in oif may mean change in hh_len. */ 64 hh_len = (*pskb)->dst->dev->hard_header_len; 65 if (skb_headroom(*pskb) < hh_len) { 66 struct sk_buff *nskb; 67 68 nskb = skb_realloc_headroom(*pskb, hh_len); 69 if (!nskb) 70 return -1; 71 if ((*pskb)->sk) 72 skb_set_owner_w(nskb, (*pskb)->sk); 73 kfree_skb(*pskb); 74 *pskb = nskb; 75 } 76 77 return 0; 78 } 79 EXPORT_SYMBOL(ip_route_me_harder); 80 81 #ifdef CONFIG_XFRM 82 int ip_xfrm_me_harder(struct sk_buff **pskb) 83 { 84 struct flowi fl; 85 unsigned int hh_len; 86 struct dst_entry *dst; 87 88 if (IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED) 89 return 0; 90 if (xfrm_decode_session(*pskb, &fl, AF_INET) < 0) 91 return -1; 92 93 dst = (*pskb)->dst; 94 if (dst->xfrm) 95 dst = ((struct xfrm_dst *)dst)->route; 96 dst_hold(dst); 97 98 if (xfrm_lookup(&dst, &fl, (*pskb)->sk, 0) < 0) 99 return -1; 100 101 dst_release((*pskb)->dst); 102 (*pskb)->dst = dst; 103 104 /* Change in oif may mean change in hh_len. */ 105 hh_len = (*pskb)->dst->dev->hard_header_len; 106 if (skb_headroom(*pskb) < hh_len) { 107 struct sk_buff *nskb; 108 109 nskb = skb_realloc_headroom(*pskb, hh_len); 110 if (!nskb) 111 return -1; 112 if ((*pskb)->sk) 113 skb_set_owner_w(nskb, (*pskb)->sk); 114 kfree_skb(*pskb); 115 *pskb = nskb; 116 } 117 return 0; 118 } 119 EXPORT_SYMBOL(ip_xfrm_me_harder); 120 #endif 121 122 void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *); 123 EXPORT_SYMBOL(ip_nat_decode_session); 124 125 /* 126 * Extra routing may needed on local out, as the QUEUE target never 127 * returns control to the table. 128 */ 129 130 struct ip_rt_info { 131 u_int32_t daddr; 132 u_int32_t saddr; 133 u_int8_t tos; 134 }; 135 136 static void nf_ip_saveroute(const struct sk_buff *skb, struct nf_info *info) 137 { 138 struct ip_rt_info *rt_info = nf_info_reroute(info); 139 140 if (info->hook == NF_IP_LOCAL_OUT) { 141 const struct iphdr *iph = skb->nh.iph; 142 143 rt_info->tos = iph->tos; 144 rt_info->daddr = iph->daddr; 145 rt_info->saddr = iph->saddr; 146 } 147 } 148 149 static int nf_ip_reroute(struct sk_buff **pskb, const struct nf_info *info) 150 { 151 const struct ip_rt_info *rt_info = nf_info_reroute(info); 152 153 if (info->hook == NF_IP_LOCAL_OUT) { 154 struct iphdr *iph = (*pskb)->nh.iph; 155 156 if (!(iph->tos == rt_info->tos 157 && iph->daddr == rt_info->daddr 158 && iph->saddr == rt_info->saddr)) 159 return ip_route_me_harder(pskb); 160 } 161 return 0; 162 } 163 164 unsigned int nf_ip_checksum(struct sk_buff *skb, unsigned int hook, 165 unsigned int dataoff, u_int8_t protocol) 166 { 167 struct iphdr *iph = skb->nh.iph; 168 unsigned int csum = 0; 169 170 switch (skb->ip_summed) { 171 case CHECKSUM_HW: 172 if (hook != NF_IP_PRE_ROUTING && hook != NF_IP_LOCAL_IN) 173 break; 174 if ((protocol == 0 && !(u16)csum_fold(skb->csum)) || 175 !csum_tcpudp_magic(iph->saddr, iph->daddr, 176 skb->len - dataoff, protocol, 177 skb->csum)) { 178 skb->ip_summed = CHECKSUM_UNNECESSARY; 179 break; 180 } 181 /* fall through */ 182 case CHECKSUM_NONE: 183 if (protocol == 0) 184 skb->csum = 0; 185 else 186 skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, 187 skb->len - dataoff, 188 protocol, 0); 189 csum = __skb_checksum_complete(skb); 190 } 191 return csum; 192 } 193 194 EXPORT_SYMBOL(nf_ip_checksum); 195 196 static struct nf_afinfo nf_ip_afinfo = { 197 .family = AF_INET, 198 .checksum = nf_ip_checksum, 199 .saveroute = nf_ip_saveroute, 200 .reroute = nf_ip_reroute, 201 .route_key_size = sizeof(struct ip_rt_info), 202 }; 203 204 static int ipv4_netfilter_init(void) 205 { 206 return nf_register_afinfo(&nf_ip_afinfo); 207 } 208 209 static void ipv4_netfilter_fini(void) 210 { 211 nf_unregister_afinfo(&nf_ip_afinfo); 212 } 213 214 module_init(ipv4_netfilter_init); 215 module_exit(ipv4_netfilter_fini); 216