1 /* IPv4 specific functions of netfilter core */
2 #include <linux/kernel.h>
3 #include <linux/netfilter.h>
4 #include <linux/netfilter_ipv4.h>
6 #include <linux/skbuff.h>
11 /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
12 int ip_route_me_harder(struct sk_buff
*skb
, unsigned addr_type
)
14 const struct iphdr
*iph
= ip_hdr(skb
);
17 struct dst_entry
*odst
;
21 type
= inet_addr_type(iph
->saddr
);
22 if (addr_type
== RTN_UNSPEC
)
25 /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
26 * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
28 if (addr_type
== RTN_LOCAL
) {
29 fl
.nl_u
.ip4_u
.daddr
= iph
->daddr
;
30 if (type
== RTN_LOCAL
)
31 fl
.nl_u
.ip4_u
.saddr
= iph
->saddr
;
32 fl
.nl_u
.ip4_u
.tos
= RT_TOS(iph
->tos
);
33 fl
.oif
= skb
->sk
? skb
->sk
->sk_bound_dev_if
: 0;
35 if (ip_route_output_key(&rt
, &fl
) != 0)
39 dst_release(skb
->dst
);
40 skb
->dst
= &rt
->u
.dst
;
42 /* non-local src, find valid iif to satisfy
43 * rp-filter when calling ip_route_input. */
44 fl
.nl_u
.ip4_u
.daddr
= iph
->saddr
;
45 if (ip_route_output_key(&rt
, &fl
) != 0)
49 if (ip_route_input(skb
, iph
->daddr
, iph
->saddr
,
50 RT_TOS(iph
->tos
), rt
->u
.dst
.dev
) != 0) {
51 dst_release(&rt
->u
.dst
);
54 dst_release(&rt
->u
.dst
);
62 if (!(IPCB(skb
)->flags
& IPSKB_XFRM_TRANSFORMED
) &&
63 xfrm_decode_session(skb
, &fl
, AF_INET
) == 0)
64 if (xfrm_lookup(&skb
->dst
, &fl
, skb
->sk
, 0))
68 /* Change in oif may mean change in hh_len. */
69 hh_len
= skb
->dst
->dev
->hard_header_len
;
70 if (skb_headroom(skb
) < hh_len
&&
71 pskb_expand_head(skb
, HH_DATA_ALIGN(hh_len
- skb_headroom(skb
)),
77 EXPORT_SYMBOL(ip_route_me_harder
);
80 int ip_xfrm_me_harder(struct sk_buff
*skb
)
84 struct dst_entry
*dst
;
86 if (IPCB(skb
)->flags
& IPSKB_XFRM_TRANSFORMED
)
88 if (xfrm_decode_session(skb
, &fl
, AF_INET
) < 0)
93 dst
= ((struct xfrm_dst
*)dst
)->route
;
96 if (xfrm_lookup(&dst
, &fl
, skb
->sk
, 0) < 0)
99 dst_release(skb
->dst
);
102 /* Change in oif may mean change in hh_len. */
103 hh_len
= skb
->dst
->dev
->hard_header_len
;
104 if (skb_headroom(skb
) < hh_len
&&
105 pskb_expand_head(skb
, hh_len
- skb_headroom(skb
), 0, GFP_ATOMIC
))
109 EXPORT_SYMBOL(ip_xfrm_me_harder
);
112 void (*ip_nat_decode_session
)(struct sk_buff
*, struct flowi
*);
113 EXPORT_SYMBOL(ip_nat_decode_session
);
116 * Extra routing may needed on local out, as the QUEUE target never
117 * returns control to the table.
126 static void nf_ip_saveroute(const struct sk_buff
*skb
, struct nf_info
*info
)
128 struct ip_rt_info
*rt_info
= nf_info_reroute(info
);
130 if (info
->hook
== NF_IP_LOCAL_OUT
) {
131 const struct iphdr
*iph
= ip_hdr(skb
);
133 rt_info
->tos
= iph
->tos
;
134 rt_info
->daddr
= iph
->daddr
;
135 rt_info
->saddr
= iph
->saddr
;
139 static int nf_ip_reroute(struct sk_buff
*skb
, const struct nf_info
*info
)
141 const struct ip_rt_info
*rt_info
= nf_info_reroute(info
);
143 if (info
->hook
== NF_IP_LOCAL_OUT
) {
144 const struct iphdr
*iph
= ip_hdr(skb
);
146 if (!(iph
->tos
== rt_info
->tos
147 && iph
->daddr
== rt_info
->daddr
148 && iph
->saddr
== rt_info
->saddr
))
149 return ip_route_me_harder(skb
, RTN_UNSPEC
);
154 __sum16
nf_ip_checksum(struct sk_buff
*skb
, unsigned int hook
,
155 unsigned int dataoff
, u_int8_t protocol
)
157 const struct iphdr
*iph
= ip_hdr(skb
);
160 switch (skb
->ip_summed
) {
161 case CHECKSUM_COMPLETE
:
162 if (hook
!= NF_IP_PRE_ROUTING
&& hook
!= NF_IP_LOCAL_IN
)
164 if ((protocol
== 0 && !csum_fold(skb
->csum
)) ||
165 !csum_tcpudp_magic(iph
->saddr
, iph
->daddr
,
166 skb
->len
- dataoff
, protocol
,
168 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
176 skb
->csum
= csum_tcpudp_nofold(iph
->saddr
, iph
->daddr
,
179 csum
= __skb_checksum_complete(skb
);
184 EXPORT_SYMBOL(nf_ip_checksum
);
186 static int nf_ip_route(struct dst_entry
**dst
, struct flowi
*fl
)
188 return ip_route_output_key((struct rtable
**)dst
, fl
);
191 static struct nf_afinfo nf_ip_afinfo
= {
193 .checksum
= nf_ip_checksum
,
194 .route
= nf_ip_route
,
195 .saveroute
= nf_ip_saveroute
,
196 .reroute
= nf_ip_reroute
,
197 .route_key_size
= sizeof(struct ip_rt_info
),
200 static int ipv4_netfilter_init(void)
202 return nf_register_afinfo(&nf_ip_afinfo
);
205 static void ipv4_netfilter_fini(void)
207 nf_unregister_afinfo(&nf_ip_afinfo
);
210 module_init(ipv4_netfilter_init
);
211 module_exit(ipv4_netfilter_fini
);