netfilter.c 5.3 KB
Newer Older
1 2 3 4 5 6
/*
 * IPv4 specific functions of netfilter core
 *
 * Rusty Russell (C) 2000 -- This code is GPL.
 * Patrick McHardy (C) 2006-2012
 */
7 8
#include <linux/kernel.h>
#include <linux/netfilter.h>
9
#include <linux/netfilter_ipv4.h>
10
#include <linux/ip.h>
11
#include <linux/skbuff.h>
12
#include <linux/gfp.h>
13
#include <linux/export.h>
14
#include <net/route.h>
15 16
#include <net/xfrm.h>
#include <net/ip.h>
17
#include <net/netfilter/nf_queue.h>
18 19

/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
20
int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_type)
21
{
22
	const struct iphdr *iph = ip_hdr(skb);
23
	struct rtable *rt;
24
	struct flowi4 fl4 = {};
25
	__be32 saddr = iph->saddr;
26 27
	const struct sock *sk = skb_to_full_sk(skb);
	__u8 flags = sk ? inet_sk_flowi_flags(sk) : 0;
28
	struct net_device *dev = skb_dst(skb)->dev;
29 30
	unsigned int hh_len;

31
	if (addr_type == RTN_UNSPEC)
32
		addr_type = inet_addr_type_dev_table(net, dev, saddr);
33 34 35 36
	if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
		flags |= FLOWI_FLAG_ANYSRC;
	else
		saddr = 0;
37

38
	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
39
	 * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
40
	 */
41 42 43
	fl4.daddr = iph->daddr;
	fl4.saddr = saddr;
	fl4.flowi4_tos = RT_TOS(iph->tos);
44
	fl4.flowi4_oif = sk ? sk->sk_bound_dev_if : 0;
45 46
	if (!fl4.flowi4_oif)
		fl4.flowi4_oif = l3mdev_master_ifindex(dev);
47
	fl4.flowi4_mark = skb->mark;
48
	fl4.flowi4_flags = flags;
49 50
	rt = ip_route_output_key(net, &fl4);
	if (IS_ERR(rt))
51
		return PTR_ERR(rt);
52

53 54 55
	/* Drop old route. */
	skb_dst_drop(skb);
	skb_dst_set(skb, &rt->dst);
56

E
Eric Dumazet 已提交
57
	if (skb_dst(skb)->error)
58
		return skb_dst(skb)->error;
59

60
#ifdef CONFIG_XFRM
61
	if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
62
	    xfrm_decode_session(skb, flowi4_to_flowi(&fl4), AF_INET) == 0) {
E
Eric Dumazet 已提交
63 64
		struct dst_entry *dst = skb_dst(skb);
		skb_dst_set(skb, NULL);
65
		dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), sk, 0);
66
		if (IS_ERR(dst))
67
			return PTR_ERR(dst);
E
Eric Dumazet 已提交
68 69
		skb_dst_set(skb, dst);
	}
70 71
#endif

72
	/* Change in oif may mean change in hh_len. */
E
Eric Dumazet 已提交
73
	hh_len = skb_dst(skb)->dev->hard_header_len;
74
	if (skb_headroom(skb) < hh_len &&
75 76
	    pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)),
				0, GFP_ATOMIC))
77
		return -ENOMEM;
78 79 80 81

	return 0;
}
EXPORT_SYMBOL(ip_route_me_harder);
82 83 84 85 86 87 88

/*
 * Extra routing may needed on local out, as the QUEUE target never
 * returns control to the table.
 */

struct ip_rt_info {
89 90
	__be32 daddr;
	__be32 saddr;
91
	u_int8_t tos;
92
	u_int32_t mark;
93 94
};

95 96
static void nf_ip_saveroute(const struct sk_buff *skb,
			    struct nf_queue_entry *entry)
97
{
98
	struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
99

100
	if (entry->state.hook == NF_INET_LOCAL_OUT) {
101
		const struct iphdr *iph = ip_hdr(skb);
102 103 104 105

		rt_info->tos = iph->tos;
		rt_info->daddr = iph->daddr;
		rt_info->saddr = iph->saddr;
106
		rt_info->mark = skb->mark;
107 108 109
	}
}

110
static int nf_ip_reroute(struct net *net, struct sk_buff *skb,
111
			 const struct nf_queue_entry *entry)
112
{
113
	const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
114

115
	if (entry->state.hook == NF_INET_LOCAL_OUT) {
116
		const struct iphdr *iph = ip_hdr(skb);
117

118 119 120 121
		if (!(iph->tos == rt_info->tos &&
		      skb->mark == rt_info->mark &&
		      iph->daddr == rt_info->daddr &&
		      iph->saddr == rt_info->saddr))
122
			return ip_route_me_harder(net, skb, RTN_UNSPEC);
123 124 125 126
	}
	return 0;
}

127
__sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
128 129
			    unsigned int dataoff, u_int8_t protocol)
{
130
	const struct iphdr *iph = ip_hdr(skb);
131
	__sum16 csum = 0;
132 133

	switch (skb->ip_summed) {
134
	case CHECKSUM_COMPLETE:
135
		if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
136
			break;
137
		if ((protocol == 0 && !csum_fold(skb->csum)) ||
138
		    !csum_tcpudp_magic(iph->saddr, iph->daddr,
139
				       skb->len - dataoff, protocol,
140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157
				       skb->csum)) {
			skb->ip_summed = CHECKSUM_UNNECESSARY;
			break;
		}
		/* fall through */
	case CHECKSUM_NONE:
		if (protocol == 0)
			skb->csum = 0;
		else
			skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
						       skb->len - dataoff,
						       protocol, 0);
		csum = __skb_checksum_complete(skb);
	}
	return csum;
}
EXPORT_SYMBOL(nf_ip_checksum);

158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173
static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
				      unsigned int dataoff, unsigned int len,
				      u_int8_t protocol)
{
	const struct iphdr *iph = ip_hdr(skb);
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (len == skb->len - dataoff)
			return nf_ip_checksum(skb, hook, dataoff, protocol);
		/* fall through */
	case CHECKSUM_NONE:
		skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, protocol,
					       skb->len - dataoff, 0);
		skb->ip_summed = CHECKSUM_NONE;
174
		return __skb_checksum_complete_head(skb, dataoff + len);
175 176 177 178
	}
	return csum;
}

179
static int nf_ip_route(struct net *net, struct dst_entry **dst,
180
		       struct flowi *fl, bool strict __always_unused)
181
{
182
	struct rtable *rt = ip_route_output_key(net, &fl->u.ip4);
183 184 185 186
	if (IS_ERR(rt))
		return PTR_ERR(rt);
	*dst = &rt->dst;
	return 0;
187 188
}

189
static const struct nf_afinfo nf_ip_afinfo = {
190 191 192 193 194 195 196
	.family			= AF_INET,
	.checksum		= nf_ip_checksum,
	.checksum_partial	= nf_ip_checksum_partial,
	.route			= nf_ip_route,
	.saveroute		= nf_ip_saveroute,
	.reroute		= nf_ip_reroute,
	.route_key_size		= sizeof(struct ip_rt_info),
197 198
};

199
static int __init ipv4_netfilter_init(void)
200
{
201
	return nf_register_afinfo(&nf_ip_afinfo);
202
}
203
subsys_initcall(ipv4_netfilter_init);