[NETFILTER]: nf_nat: remove unused name from struct nf_nat_protocol
[linux-2.6] / net / ipv4 / netfilter / iptable_mangle.c
1 /*
2  * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
3  *
4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5  * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 as
9  * published by the Free Software Foundation.
10  */
11 #include <linux/module.h>
12 #include <linux/netfilter_ipv4/ip_tables.h>
13 #include <linux/netdevice.h>
14 #include <linux/skbuff.h>
15 #include <net/sock.h>
16 #include <net/route.h>
17 #include <linux/ip.h>
18 #include <net/ip.h>
19
20 MODULE_LICENSE("GPL");
21 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
22 MODULE_DESCRIPTION("iptables mangle table");
23
24 #define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
25                             (1 << NF_INET_LOCAL_IN) | \
26                             (1 << NF_INET_FORWARD) | \
27                             (1 << NF_INET_LOCAL_OUT) | \
28                             (1 << NF_INET_POST_ROUTING))
29
30 /* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
31 static struct
32 {
33         struct ipt_replace repl;
34         struct ipt_standard entries[5];
35         struct ipt_error term;
36 } initial_table __net_initdata = {
37         .repl = {
38                 .name = "mangle",
39                 .valid_hooks = MANGLE_VALID_HOOKS,
40                 .num_entries = 6,
41                 .size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
42                 .hook_entry = {
43                         [NF_INET_PRE_ROUTING]   = 0,
44                         [NF_INET_LOCAL_IN]      = sizeof(struct ipt_standard),
45                         [NF_INET_FORWARD]       = sizeof(struct ipt_standard) * 2,
46                         [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 3,
47                         [NF_INET_POST_ROUTING]  = sizeof(struct ipt_standard) * 4,
48                 },
49                 .underflow = {
50                         [NF_INET_PRE_ROUTING]   = 0,
51                         [NF_INET_LOCAL_IN]      = sizeof(struct ipt_standard),
52                         [NF_INET_FORWARD]       = sizeof(struct ipt_standard) * 2,
53                         [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 3,
54                         [NF_INET_POST_ROUTING]  = sizeof(struct ipt_standard) * 4,
55                 },
56         },
57         .entries = {
58                 IPT_STANDARD_INIT(NF_ACCEPT),   /* PRE_ROUTING */
59                 IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_IN */
60                 IPT_STANDARD_INIT(NF_ACCEPT),   /* FORWARD */
61                 IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
62                 IPT_STANDARD_INIT(NF_ACCEPT),   /* POST_ROUTING */
63         },
64         .term = IPT_ERROR_INIT,                 /* ERROR */
65 };
66
67 static struct xt_table packet_mangler = {
68         .name           = "mangle",
69         .valid_hooks    = MANGLE_VALID_HOOKS,
70         .lock           = __RW_LOCK_UNLOCKED(packet_mangler.lock),
71         .me             = THIS_MODULE,
72         .af             = AF_INET,
73 };
74
75 /* The work comes in here from netfilter.c. */
76 static unsigned int
77 ipt_pre_routing_hook(unsigned int hook,
78                      struct sk_buff *skb,
79                      const struct net_device *in,
80                      const struct net_device *out,
81                      int (*okfn)(struct sk_buff *))
82 {
83         return ipt_do_table(skb, hook, in, out,
84                             nf_pre_routing_net(in, out)->ipv4.iptable_mangle);
85 }
86
87 static unsigned int
88 ipt_post_routing_hook(unsigned int hook,
89                       struct sk_buff *skb,
90                       const struct net_device *in,
91                       const struct net_device *out,
92                       int (*okfn)(struct sk_buff *))
93 {
94         return ipt_do_table(skb, hook, in, out,
95                             nf_post_routing_net(in, out)->ipv4.iptable_mangle);
96 }
97
98 static unsigned int
99 ipt_local_in_hook(unsigned int hook,
100                   struct sk_buff *skb,
101                   const struct net_device *in,
102                   const struct net_device *out,
103                   int (*okfn)(struct sk_buff *))
104 {
105         return ipt_do_table(skb, hook, in, out,
106                             nf_local_in_net(in, out)->ipv4.iptable_mangle);
107 }
108
109 static unsigned int
110 ipt_forward_hook(unsigned int hook,
111          struct sk_buff *skb,
112          const struct net_device *in,
113          const struct net_device *out,
114          int (*okfn)(struct sk_buff *))
115 {
116         return ipt_do_table(skb, hook, in, out,
117                             nf_forward_net(in, out)->ipv4.iptable_mangle);
118 }
119
120 static unsigned int
121 ipt_local_hook(unsigned int hook,
122                    struct sk_buff *skb,
123                    const struct net_device *in,
124                    const struct net_device *out,
125                    int (*okfn)(struct sk_buff *))
126 {
127         unsigned int ret;
128         const struct iphdr *iph;
129         u_int8_t tos;
130         __be32 saddr, daddr;
131         u_int32_t mark;
132
133         /* root is playing with raw sockets. */
134         if (skb->len < sizeof(struct iphdr)
135             || ip_hdrlen(skb) < sizeof(struct iphdr)) {
136                 if (net_ratelimit())
137                         printk("iptable_mangle: ignoring short SOCK_RAW "
138                                "packet.\n");
139                 return NF_ACCEPT;
140         }
141
142         /* Save things which could affect route */
143         mark = skb->mark;
144         iph = ip_hdr(skb);
145         saddr = iph->saddr;
146         daddr = iph->daddr;
147         tos = iph->tos;
148
149         ret = ipt_do_table(skb, hook, in, out,
150                            nf_local_out_net(in, out)->ipv4.iptable_mangle);
151         /* Reroute for ANY change. */
152         if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
153                 iph = ip_hdr(skb);
154
155                 if (iph->saddr != saddr ||
156                     iph->daddr != daddr ||
157                     skb->mark != mark ||
158                     iph->tos != tos)
159                         if (ip_route_me_harder(skb, RTN_UNSPEC))
160                                 ret = NF_DROP;
161         }
162
163         return ret;
164 }
165
166 static struct nf_hook_ops ipt_ops[] __read_mostly = {
167         {
168                 .hook           = ipt_pre_routing_hook,
169                 .owner          = THIS_MODULE,
170                 .pf             = PF_INET,
171                 .hooknum        = NF_INET_PRE_ROUTING,
172                 .priority       = NF_IP_PRI_MANGLE,
173         },
174         {
175                 .hook           = ipt_local_in_hook,
176                 .owner          = THIS_MODULE,
177                 .pf             = PF_INET,
178                 .hooknum        = NF_INET_LOCAL_IN,
179                 .priority       = NF_IP_PRI_MANGLE,
180         },
181         {
182                 .hook           = ipt_forward_hook,
183                 .owner          = THIS_MODULE,
184                 .pf             = PF_INET,
185                 .hooknum        = NF_INET_FORWARD,
186                 .priority       = NF_IP_PRI_MANGLE,
187         },
188         {
189                 .hook           = ipt_local_hook,
190                 .owner          = THIS_MODULE,
191                 .pf             = PF_INET,
192                 .hooknum        = NF_INET_LOCAL_OUT,
193                 .priority       = NF_IP_PRI_MANGLE,
194         },
195         {
196                 .hook           = ipt_post_routing_hook,
197                 .owner          = THIS_MODULE,
198                 .pf             = PF_INET,
199                 .hooknum        = NF_INET_POST_ROUTING,
200                 .priority       = NF_IP_PRI_MANGLE,
201         },
202 };
203
204 static int __net_init iptable_mangle_net_init(struct net *net)
205 {
206         /* Register table */
207         net->ipv4.iptable_mangle =
208                 ipt_register_table(net, &packet_mangler, &initial_table.repl);
209         if (IS_ERR(net->ipv4.iptable_mangle))
210                 return PTR_ERR(net->ipv4.iptable_mangle);
211         return 0;
212 }
213
214 static void __net_exit iptable_mangle_net_exit(struct net *net)
215 {
216         ipt_unregister_table(net->ipv4.iptable_mangle);
217 }
218
219 static struct pernet_operations iptable_mangle_net_ops = {
220         .init = iptable_mangle_net_init,
221         .exit = iptable_mangle_net_exit,
222 };
223
224 static int __init iptable_mangle_init(void)
225 {
226         int ret;
227
228         ret = register_pernet_subsys(&iptable_mangle_net_ops);
229         if (ret < 0)
230                 return ret;
231
232         /* Register hooks */
233         ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
234         if (ret < 0)
235                 goto cleanup_table;
236
237         return ret;
238
239  cleanup_table:
240         unregister_pernet_subsys(&iptable_mangle_net_ops);
241         return ret;
242 }
243
244 static void __exit iptable_mangle_fini(void)
245 {
246         nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
247         unregister_pernet_subsys(&iptable_mangle_net_ops);
248 }
249
250 module_init(iptable_mangle_init);
251 module_exit(iptable_mangle_fini);