2 * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
11 * Extended to all five netfilter hooks by Brad Chapman & Harald Welte
13 #include <linux/config.h>
14 #include <linux/module.h>
15 #include <linux/netfilter_ipv4/ip_tables.h>
16 #include <linux/netdevice.h>
17 #include <linux/skbuff.h>
19 #include <net/route.h>
22 MODULE_LICENSE("GPL");
23 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
24 MODULE_DESCRIPTION("iptables mangle table");
26 #define MANGLE_VALID_HOOKS ((1 << NF_IP_PRE_ROUTING) | \
27 (1 << NF_IP_LOCAL_IN) | \
28 (1 << NF_IP_FORWARD) | \
29 (1 << NF_IP_LOCAL_OUT) | \
30 (1 << NF_IP_POST_ROUTING))
32 /* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
35 struct ipt_replace repl;
36 struct ipt_standard entries[5];
37 struct ipt_error term;
38 } initial_table __initdata
39 = { { "mangle", MANGLE_VALID_HOOKS, 6,
40 sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
41 { [NF_IP_PRE_ROUTING] = 0,
42 [NF_IP_LOCAL_IN] = sizeof(struct ipt_standard),
43 [NF_IP_FORWARD] = sizeof(struct ipt_standard) * 2,
44 [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 3,
45 [NF_IP_POST_ROUTING] = sizeof(struct ipt_standard) * 4 },
46 { [NF_IP_PRE_ROUTING] = 0,
47 [NF_IP_LOCAL_IN] = sizeof(struct ipt_standard),
48 [NF_IP_FORWARD] = sizeof(struct ipt_standard) * 2,
49 [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 3,
50 [NF_IP_POST_ROUTING] = sizeof(struct ipt_standard) * 4 },
54 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
56 sizeof(struct ipt_entry),
57 sizeof(struct ipt_standard),
59 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
62 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
64 sizeof(struct ipt_entry),
65 sizeof(struct ipt_standard),
67 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
70 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
72 sizeof(struct ipt_entry),
73 sizeof(struct ipt_standard),
75 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
78 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
80 sizeof(struct ipt_entry),
81 sizeof(struct ipt_standard),
83 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
86 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
88 sizeof(struct ipt_entry),
89 sizeof(struct ipt_standard),
91 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
95 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
97 sizeof(struct ipt_entry),
98 sizeof(struct ipt_error),
100 { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } },
107 static struct ipt_table packet_mangler = {
109 .valid_hooks = MANGLE_VALID_HOOKS,
110 .lock = RW_LOCK_UNLOCKED,
115 /* The work comes in here from netfilter.c. */
117 ipt_route_hook(unsigned int hook,
118 struct sk_buff **pskb,
119 const struct net_device *in,
120 const struct net_device *out,
121 int (*okfn)(struct sk_buff *))
123 return ipt_do_table(pskb, hook, in, out, &packet_mangler, NULL);
127 ipt_local_hook(unsigned int hook,
128 struct sk_buff **pskb,
129 const struct net_device *in,
130 const struct net_device *out,
131 int (*okfn)(struct sk_buff *))
135 u_int32_t saddr, daddr;
136 unsigned long nfmark;
138 /* root is playing with raw sockets. */
139 if ((*pskb)->len < sizeof(struct iphdr)
140 || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr)) {
142 printk("ipt_hook: happy cracking.\n");
146 /* Save things which could affect route */
147 nfmark = (*pskb)->nfmark;
148 saddr = (*pskb)->nh.iph->saddr;
149 daddr = (*pskb)->nh.iph->daddr;
150 tos = (*pskb)->nh.iph->tos;
152 ret = ipt_do_table(pskb, hook, in, out, &packet_mangler, NULL);
153 /* Reroute for ANY change. */
154 if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE
155 && ((*pskb)->nh.iph->saddr != saddr
156 || (*pskb)->nh.iph->daddr != daddr
157 #ifdef CONFIG_IP_ROUTE_FWMARK
158 || (*pskb)->nfmark != nfmark
160 || (*pskb)->nh.iph->tos != tos))
161 return ip_route_me_harder(pskb) == 0 ? ret : NF_DROP;
166 static struct nf_hook_ops ipt_ops[] = {
168 .hook = ipt_route_hook,
169 .owner = THIS_MODULE,
171 .hooknum = NF_IP_PRE_ROUTING,
172 .priority = NF_IP_PRI_MANGLE,
175 .hook = ipt_route_hook,
176 .owner = THIS_MODULE,
178 .hooknum = NF_IP_LOCAL_IN,
179 .priority = NF_IP_PRI_MANGLE,
182 .hook = ipt_route_hook,
183 .owner = THIS_MODULE,
185 .hooknum = NF_IP_FORWARD,
186 .priority = NF_IP_PRI_MANGLE,
189 .hook = ipt_local_hook,
190 .owner = THIS_MODULE,
192 .hooknum = NF_IP_LOCAL_OUT,
193 .priority = NF_IP_PRI_MANGLE,
196 .hook = ipt_route_hook,
197 .owner = THIS_MODULE,
199 .hooknum = NF_IP_POST_ROUTING,
200 .priority = NF_IP_PRI_MANGLE,
204 static int __init init(void)
209 ret = ipt_register_table(&packet_mangler, &initial_table.repl);
214 ret = nf_register_hook(&ipt_ops[0]);
218 ret = nf_register_hook(&ipt_ops[1]);
222 ret = nf_register_hook(&ipt_ops[2]);
226 ret = nf_register_hook(&ipt_ops[3]);
230 ret = nf_register_hook(&ipt_ops[4]);
237 nf_unregister_hook(&ipt_ops[3]);
239 nf_unregister_hook(&ipt_ops[2]);
241 nf_unregister_hook(&ipt_ops[1]);
243 nf_unregister_hook(&ipt_ops[0]);
245 ipt_unregister_table(&packet_mangler);
250 static void __exit fini(void)
254 for (i = 0; i < sizeof(ipt_ops)/sizeof(struct nf_hook_ops); i++)
255 nf_unregister_hook(&ipt_ops[i]);
257 ipt_unregister_table(&packet_mangler);