1 /* IPv4 specific functions of netfilter core */
3 #include <linux/config.h>
4 #ifdef CONFIG_NETFILTER
6 #include <linux/kernel.h>
7 #include <linux/netfilter.h>
8 #include <linux/netfilter_ipv4.h>
11 #include <linux/tcp.h>
12 #include <linux/udp.h>
13 #include <linux/icmp.h>
14 #include <net/route.h>
18 /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
19 int ip_route_me_harder(struct sk_buff
**pskb
)
21 struct iphdr
*iph
= (*pskb
)->nh
.iph
;
24 struct dst_entry
*odst
;
27 /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
28 * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
30 if (inet_addr_type(iph
->saddr
) == RTN_LOCAL
) {
31 fl
.nl_u
.ip4_u
.daddr
= iph
->daddr
;
32 fl
.nl_u
.ip4_u
.saddr
= iph
->saddr
;
33 fl
.nl_u
.ip4_u
.tos
= RT_TOS(iph
->tos
);
34 fl
.oif
= (*pskb
)->sk
? (*pskb
)->sk
->sk_bound_dev_if
: 0;
35 #ifdef CONFIG_IP_ROUTE_FWMARK
36 fl
.nl_u
.ip4_u
.fwmark
= (*pskb
)->nfmark
;
38 if (ip_route_output_key(&rt
, &fl
) != 0)
42 dst_release((*pskb
)->dst
);
43 (*pskb
)->dst
= &rt
->u
.dst
;
45 /* non-local src, find valid iif to satisfy
46 * rp-filter when calling ip_route_input. */
47 fl
.nl_u
.ip4_u
.daddr
= iph
->saddr
;
48 if (ip_route_output_key(&rt
, &fl
) != 0)
52 if (ip_route_input(*pskb
, iph
->daddr
, iph
->saddr
,
53 RT_TOS(iph
->tos
), rt
->u
.dst
.dev
) != 0) {
54 dst_release(&rt
->u
.dst
);
57 dst_release(&rt
->u
.dst
);
61 if ((*pskb
)->dst
->error
)
65 if (!(IPCB(*pskb
)->flags
& IPSKB_XFRM_TRANSFORMED
) &&
66 xfrm_decode_session(*pskb
, &fl
, AF_INET
) == 0)
67 if (xfrm_lookup(&(*pskb
)->dst
, &fl
, (*pskb
)->sk
, 0))
71 /* Change in oif may mean change in hh_len. */
72 hh_len
= (*pskb
)->dst
->dev
->hard_header_len
;
73 if (skb_headroom(*pskb
) < hh_len
) {
76 nskb
= skb_realloc_headroom(*pskb
, hh_len
);
80 skb_set_owner_w(nskb
, (*pskb
)->sk
);
87 EXPORT_SYMBOL(ip_route_me_harder
);
89 void (*ip_nat_decode_session
)(struct sk_buff
*, struct flowi
*);
90 EXPORT_SYMBOL(ip_nat_decode_session
);
93 * Extra routing may needed on local out, as the QUEUE target never
94 * returns control to the table.
103 static void queue_save(const struct sk_buff
*skb
, struct nf_info
*info
)
105 struct ip_rt_info
*rt_info
= nf_info_reroute(info
);
107 if (info
->hook
== NF_IP_LOCAL_OUT
) {
108 const struct iphdr
*iph
= skb
->nh
.iph
;
110 rt_info
->tos
= iph
->tos
;
111 rt_info
->daddr
= iph
->daddr
;
112 rt_info
->saddr
= iph
->saddr
;
116 static int queue_reroute(struct sk_buff
**pskb
, const struct nf_info
*info
)
118 const struct ip_rt_info
*rt_info
= nf_info_reroute(info
);
120 if (info
->hook
== NF_IP_LOCAL_OUT
) {
121 struct iphdr
*iph
= (*pskb
)->nh
.iph
;
123 if (!(iph
->tos
== rt_info
->tos
124 && iph
->daddr
== rt_info
->daddr
125 && iph
->saddr
== rt_info
->saddr
))
126 return ip_route_me_harder(pskb
);
131 static struct nf_queue_rerouter ip_reroute
= {
132 .rer_size
= sizeof(struct ip_rt_info
),
134 .reroute
= queue_reroute
,
137 static int init(void)
139 return nf_register_queue_rerouter(PF_INET
, &ip_reroute
);
142 static void fini(void)
144 nf_unregister_queue_rerouter(PF_INET
);
150 #endif /* CONFIG_NETFILTER */