1 /* IPv4 specific functions of netfilter core */
2 #include <linux/kernel.h>
3 #include <linux/netfilter.h>
4 #include <linux/netfilter_ipv4.h>
10 /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
11 int ip_route_me_harder(struct sk_buff
**pskb
)
13 struct iphdr
*iph
= (*pskb
)->nh
.iph
;
16 struct dst_entry
*odst
;
19 /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
20 * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
22 if (inet_addr_type(iph
->saddr
) == RTN_LOCAL
) {
23 fl
.nl_u
.ip4_u
.daddr
= iph
->daddr
;
24 fl
.nl_u
.ip4_u
.saddr
= iph
->saddr
;
25 fl
.nl_u
.ip4_u
.tos
= RT_TOS(iph
->tos
);
26 fl
.oif
= (*pskb
)->sk
? (*pskb
)->sk
->sk_bound_dev_if
: 0;
27 #ifdef CONFIG_IP_ROUTE_FWMARK
28 fl
.nl_u
.ip4_u
.fwmark
= (*pskb
)->nfmark
;
30 if (ip_route_output_key(&rt
, &fl
) != 0)
34 dst_release((*pskb
)->dst
);
35 (*pskb
)->dst
= &rt
->u
.dst
;
37 /* non-local src, find valid iif to satisfy
38 * rp-filter when calling ip_route_input. */
39 fl
.nl_u
.ip4_u
.daddr
= iph
->saddr
;
40 if (ip_route_output_key(&rt
, &fl
) != 0)
44 if (ip_route_input(*pskb
, iph
->daddr
, iph
->saddr
,
45 RT_TOS(iph
->tos
), rt
->u
.dst
.dev
) != 0) {
46 dst_release(&rt
->u
.dst
);
49 dst_release(&rt
->u
.dst
);
53 if ((*pskb
)->dst
->error
)
57 if (!(IPCB(*pskb
)->flags
& IPSKB_XFRM_TRANSFORMED
) &&
58 xfrm_decode_session(*pskb
, &fl
, AF_INET
) == 0)
59 if (xfrm_lookup(&(*pskb
)->dst
, &fl
, (*pskb
)->sk
, 0))
63 /* Change in oif may mean change in hh_len. */
64 hh_len
= (*pskb
)->dst
->dev
->hard_header_len
;
65 if (skb_headroom(*pskb
) < hh_len
) {
68 nskb
= skb_realloc_headroom(*pskb
, hh_len
);
72 skb_set_owner_w(nskb
, (*pskb
)->sk
);
79 EXPORT_SYMBOL(ip_route_me_harder
);
81 void (*ip_nat_decode_session
)(struct sk_buff
*, struct flowi
*);
82 EXPORT_SYMBOL(ip_nat_decode_session
);
85 * Extra routing may needed on local out, as the QUEUE target never
86 * returns control to the table.
95 static void queue_save(const struct sk_buff
*skb
, struct nf_info
*info
)
97 struct ip_rt_info
*rt_info
= nf_info_reroute(info
);
99 if (info
->hook
== NF_IP_LOCAL_OUT
) {
100 const struct iphdr
*iph
= skb
->nh
.iph
;
102 rt_info
->tos
= iph
->tos
;
103 rt_info
->daddr
= iph
->daddr
;
104 rt_info
->saddr
= iph
->saddr
;
108 static int queue_reroute(struct sk_buff
**pskb
, const struct nf_info
*info
)
110 const struct ip_rt_info
*rt_info
= nf_info_reroute(info
);
112 if (info
->hook
== NF_IP_LOCAL_OUT
) {
113 struct iphdr
*iph
= (*pskb
)->nh
.iph
;
115 if (!(iph
->tos
== rt_info
->tos
116 && iph
->daddr
== rt_info
->daddr
117 && iph
->saddr
== rt_info
->saddr
))
118 return ip_route_me_harder(pskb
);
123 static struct nf_queue_rerouter ip_reroute
= {
124 .rer_size
= sizeof(struct ip_rt_info
),
126 .reroute
= queue_reroute
,
129 static int init(void)
131 return nf_register_queue_rerouter(PF_INET
, &ip_reroute
);
134 static void fini(void)
136 nf_unregister_queue_rerouter(PF_INET
);