tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
fork
Configure Feed
Select the types of activity you want to include in your feed.
1/* IPv4 specific functions of netfilter core */
2#include <linux/kernel.h>
3#include <linux/netfilter.h>
4#include <linux/netfilter_ipv4.h>
5#include <linux/ip.h>
6#include <net/route.h>
7#include <net/xfrm.h>
8#include <net/ip.h>
9
10/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
11int ip_route_me_harder(struct sk_buff **pskb, unsigned addr_type)
12{
13 struct iphdr *iph = (*pskb)->nh.iph;
14 struct rtable *rt;
15 struct flowi fl = {};
16 struct dst_entry *odst;
17 unsigned int hh_len;
18
19 if (addr_type == RTN_UNSPEC)
20 addr_type = inet_addr_type(iph->saddr);
21
22 /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
23 * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
24 */
25 if (addr_type == RTN_LOCAL) {
26 fl.nl_u.ip4_u.daddr = iph->daddr;
27 fl.nl_u.ip4_u.saddr = iph->saddr;
28 fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
29 fl.oif = (*pskb)->sk ? (*pskb)->sk->sk_bound_dev_if : 0;
30#ifdef CONFIG_IP_ROUTE_FWMARK
31 fl.nl_u.ip4_u.fwmark = (*pskb)->nfmark;
32#endif
33 if (ip_route_output_key(&rt, &fl) != 0)
34 return -1;
35
36 /* Drop old route. */
37 dst_release((*pskb)->dst);
38 (*pskb)->dst = &rt->u.dst;
39 } else {
40 /* non-local src, find valid iif to satisfy
41 * rp-filter when calling ip_route_input. */
42 fl.nl_u.ip4_u.daddr = iph->saddr;
43 if (ip_route_output_key(&rt, &fl) != 0)
44 return -1;
45
46 odst = (*pskb)->dst;
47 if (ip_route_input(*pskb, iph->daddr, iph->saddr,
48 RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
49 dst_release(&rt->u.dst);
50 return -1;
51 }
52 dst_release(&rt->u.dst);
53 dst_release(odst);
54 }
55
56 if ((*pskb)->dst->error)
57 return -1;
58
59#ifdef CONFIG_XFRM
60 if (!(IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED) &&
61 xfrm_decode_session(*pskb, &fl, AF_INET) == 0)
62 if (xfrm_lookup(&(*pskb)->dst, &fl, (*pskb)->sk, 0))
63 return -1;
64#endif
65
66 /* Change in oif may mean change in hh_len. */
67 hh_len = (*pskb)->dst->dev->hard_header_len;
68 if (skb_headroom(*pskb) < hh_len) {
69 struct sk_buff *nskb;
70
71 nskb = skb_realloc_headroom(*pskb, hh_len);
72 if (!nskb)
73 return -1;
74 if ((*pskb)->sk)
75 skb_set_owner_w(nskb, (*pskb)->sk);
76 kfree_skb(*pskb);
77 *pskb = nskb;
78 }
79
80 return 0;
81}
82EXPORT_SYMBOL(ip_route_me_harder);
83
84#ifdef CONFIG_XFRM
85int ip_xfrm_me_harder(struct sk_buff **pskb)
86{
87 struct flowi fl;
88 unsigned int hh_len;
89 struct dst_entry *dst;
90
91 if (IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED)
92 return 0;
93 if (xfrm_decode_session(*pskb, &fl, AF_INET) < 0)
94 return -1;
95
96 dst = (*pskb)->dst;
97 if (dst->xfrm)
98 dst = ((struct xfrm_dst *)dst)->route;
99 dst_hold(dst);
100
101 if (xfrm_lookup(&dst, &fl, (*pskb)->sk, 0) < 0)
102 return -1;
103
104 dst_release((*pskb)->dst);
105 (*pskb)->dst = dst;
106
107 /* Change in oif may mean change in hh_len. */
108 hh_len = (*pskb)->dst->dev->hard_header_len;
109 if (skb_headroom(*pskb) < hh_len) {
110 struct sk_buff *nskb;
111
112 nskb = skb_realloc_headroom(*pskb, hh_len);
113 if (!nskb)
114 return -1;
115 if ((*pskb)->sk)
116 skb_set_owner_w(nskb, (*pskb)->sk);
117 kfree_skb(*pskb);
118 *pskb = nskb;
119 }
120 return 0;
121}
122EXPORT_SYMBOL(ip_xfrm_me_harder);
123#endif
124
125void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
126EXPORT_SYMBOL(ip_nat_decode_session);
127
128/*
129 * Extra routing may needed on local out, as the QUEUE target never
130 * returns control to the table.
131 */
132
133struct ip_rt_info {
134 __be32 daddr;
135 __be32 saddr;
136 u_int8_t tos;
137};
138
139static void nf_ip_saveroute(const struct sk_buff *skb, struct nf_info *info)
140{
141 struct ip_rt_info *rt_info = nf_info_reroute(info);
142
143 if (info->hook == NF_IP_LOCAL_OUT) {
144 const struct iphdr *iph = skb->nh.iph;
145
146 rt_info->tos = iph->tos;
147 rt_info->daddr = iph->daddr;
148 rt_info->saddr = iph->saddr;
149 }
150}
151
152static int nf_ip_reroute(struct sk_buff **pskb, const struct nf_info *info)
153{
154 const struct ip_rt_info *rt_info = nf_info_reroute(info);
155
156 if (info->hook == NF_IP_LOCAL_OUT) {
157 struct iphdr *iph = (*pskb)->nh.iph;
158
159 if (!(iph->tos == rt_info->tos
160 && iph->daddr == rt_info->daddr
161 && iph->saddr == rt_info->saddr))
162 return ip_route_me_harder(pskb, RTN_UNSPEC);
163 }
164 return 0;
165}
166
167unsigned int nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
168 unsigned int dataoff, u_int8_t protocol)
169{
170 struct iphdr *iph = skb->nh.iph;
171 unsigned int csum = 0;
172
173 switch (skb->ip_summed) {
174 case CHECKSUM_COMPLETE:
175 if (hook != NF_IP_PRE_ROUTING && hook != NF_IP_LOCAL_IN)
176 break;
177 if ((protocol == 0 && !(u16)csum_fold(skb->csum)) ||
178 !csum_tcpudp_magic(iph->saddr, iph->daddr,
179 skb->len - dataoff, protocol,
180 skb->csum)) {
181 skb->ip_summed = CHECKSUM_UNNECESSARY;
182 break;
183 }
184 /* fall through */
185 case CHECKSUM_NONE:
186 if (protocol == 0)
187 skb->csum = 0;
188 else
189 skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
190 skb->len - dataoff,
191 protocol, 0);
192 csum = __skb_checksum_complete(skb);
193 }
194 return csum;
195}
196
197EXPORT_SYMBOL(nf_ip_checksum);
198
199static struct nf_afinfo nf_ip_afinfo = {
200 .family = AF_INET,
201 .checksum = nf_ip_checksum,
202 .saveroute = nf_ip_saveroute,
203 .reroute = nf_ip_reroute,
204 .route_key_size = sizeof(struct ip_rt_info),
205};
206
207static int ipv4_netfilter_init(void)
208{
209 return nf_register_afinfo(&nf_ip_afinfo);
210}
211
212static void ipv4_netfilter_fini(void)
213{
214 nf_unregister_afinfo(&nf_ip_afinfo);
215}
216
217module_init(ipv4_netfilter_init);
218module_exit(ipv4_netfilter_fini);