Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
[linux-2.6] / net / ipv4 / netfilter / iptable_mangle.c
1 /*
2  * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
3  *
4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5  * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 as
9  * published by the Free Software Foundation.
10  */
11 #include <linux/module.h>
12 #include <linux/netfilter_ipv4/ip_tables.h>
13 #include <linux/netdevice.h>
14 #include <linux/skbuff.h>
15 #include <net/sock.h>
16 #include <net/route.h>
17 #include <linux/ip.h>
18 #include <net/ip.h>
19
20 MODULE_LICENSE("GPL");
21 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
22 MODULE_DESCRIPTION("iptables mangle table");
23
24 #define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
25                             (1 << NF_INET_LOCAL_IN) | \
26                             (1 << NF_INET_FORWARD) | \
27                             (1 << NF_INET_LOCAL_OUT) | \
28                             (1 << NF_INET_POST_ROUTING))
29
30 /* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
31 static struct
32 {
33         struct ipt_replace repl;
34         struct ipt_standard entries[5];
35         struct ipt_error term;
36 } initial_table __net_initdata = {
37         .repl = {
38                 .name = "mangle",
39                 .valid_hooks = MANGLE_VALID_HOOKS,
40                 .num_entries = 6,
41                 .size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
42                 .hook_entry = {
43                         [NF_INET_PRE_ROUTING]   = 0,
44                         [NF_INET_LOCAL_IN]      = sizeof(struct ipt_standard),
45                         [NF_INET_FORWARD]       = sizeof(struct ipt_standard) * 2,
46                         [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 3,
47                         [NF_INET_POST_ROUTING]  = sizeof(struct ipt_standard) * 4,
48                 },
49                 .underflow = {
50                         [NF_INET_PRE_ROUTING]   = 0,
51                         [NF_INET_LOCAL_IN]      = sizeof(struct ipt_standard),
52                         [NF_INET_FORWARD]       = sizeof(struct ipt_standard) * 2,
53                         [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 3,
54                         [NF_INET_POST_ROUTING]  = sizeof(struct ipt_standard) * 4,
55                 },
56         },
57         .entries = {
58                 IPT_STANDARD_INIT(NF_ACCEPT),   /* PRE_ROUTING */
59                 IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_IN */
60                 IPT_STANDARD_INIT(NF_ACCEPT),   /* FORWARD */
61                 IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
62                 IPT_STANDARD_INIT(NF_ACCEPT),   /* POST_ROUTING */
63         },
64         .term = IPT_ERROR_INIT,                 /* ERROR */
65 };
66
67 static struct xt_table packet_mangler = {
68         .name           = "mangle",
69         .valid_hooks    = MANGLE_VALID_HOOKS,
70         .lock           = __RW_LOCK_UNLOCKED(packet_mangler.lock),
71         .me             = THIS_MODULE,
72         .af             = AF_INET,
73 };
74
75 /* The work comes in here from netfilter.c. */
76 static unsigned int
77 ipt_pre_routing_hook(unsigned int hook,
78                      struct sk_buff *skb,
79                      const struct net_device *in,
80                      const struct net_device *out,
81                      int (*okfn)(struct sk_buff *))
82 {
83         return ipt_do_table(skb, hook, in, out,
84                             dev_net(in)->ipv4.iptable_mangle);
85 }
86
87 static unsigned int
88 ipt_post_routing_hook(unsigned int hook,
89                       struct sk_buff *skb,
90                       const struct net_device *in,
91                       const struct net_device *out,
92                       int (*okfn)(struct sk_buff *))
93 {
94         return ipt_do_table(skb, hook, in, out,
95                             dev_net(out)->ipv4.iptable_mangle);
96 }
97
98 static unsigned int
99 ipt_local_in_hook(unsigned int hook,
100                   struct sk_buff *skb,
101                   const struct net_device *in,
102                   const struct net_device *out,
103                   int (*okfn)(struct sk_buff *))
104 {
105         return ipt_do_table(skb, hook, in, out,
106                             dev_net(in)->ipv4.iptable_mangle);
107 }
108
109 static unsigned int
110 ipt_forward_hook(unsigned int hook,
111          struct sk_buff *skb,
112          const struct net_device *in,
113          const struct net_device *out,
114          int (*okfn)(struct sk_buff *))
115 {
116         return ipt_do_table(skb, hook, in, out,
117                             dev_net(in)->ipv4.iptable_mangle);
118 }
119
120 static unsigned int
121 ipt_local_hook(unsigned int hook,
122                    struct sk_buff *skb,
123                    const struct net_device *in,
124                    const struct net_device *out,
125                    int (*okfn)(struct sk_buff *))
126 {
127         unsigned int ret;
128         const struct iphdr *iph;
129         u_int8_t tos;
130         __be32 saddr, daddr;
131         u_int32_t mark;
132
133         /* root is playing with raw sockets. */
134         if (skb->len < sizeof(struct iphdr)
135             || ip_hdrlen(skb) < sizeof(struct iphdr))
136                 return NF_ACCEPT;
137
138         /* Save things which could affect route */
139         mark = skb->mark;
140         iph = ip_hdr(skb);
141         saddr = iph->saddr;
142         daddr = iph->daddr;
143         tos = iph->tos;
144
145         ret = ipt_do_table(skb, hook, in, out,
146                            dev_net(out)->ipv4.iptable_mangle);
147         /* Reroute for ANY change. */
148         if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
149                 iph = ip_hdr(skb);
150
151                 if (iph->saddr != saddr ||
152                     iph->daddr != daddr ||
153                     skb->mark != mark ||
154                     iph->tos != tos)
155                         if (ip_route_me_harder(skb, RTN_UNSPEC))
156                                 ret = NF_DROP;
157         }
158
159         return ret;
160 }
161
162 static struct nf_hook_ops ipt_ops[] __read_mostly = {
163         {
164                 .hook           = ipt_pre_routing_hook,
165                 .owner          = THIS_MODULE,
166                 .pf             = PF_INET,
167                 .hooknum        = NF_INET_PRE_ROUTING,
168                 .priority       = NF_IP_PRI_MANGLE,
169         },
170         {
171                 .hook           = ipt_local_in_hook,
172                 .owner          = THIS_MODULE,
173                 .pf             = PF_INET,
174                 .hooknum        = NF_INET_LOCAL_IN,
175                 .priority       = NF_IP_PRI_MANGLE,
176         },
177         {
178                 .hook           = ipt_forward_hook,
179                 .owner          = THIS_MODULE,
180                 .pf             = PF_INET,
181                 .hooknum        = NF_INET_FORWARD,
182                 .priority       = NF_IP_PRI_MANGLE,
183         },
184         {
185                 .hook           = ipt_local_hook,
186                 .owner          = THIS_MODULE,
187                 .pf             = PF_INET,
188                 .hooknum        = NF_INET_LOCAL_OUT,
189                 .priority       = NF_IP_PRI_MANGLE,
190         },
191         {
192                 .hook           = ipt_post_routing_hook,
193                 .owner          = THIS_MODULE,
194                 .pf             = PF_INET,
195                 .hooknum        = NF_INET_POST_ROUTING,
196                 .priority       = NF_IP_PRI_MANGLE,
197         },
198 };
199
200 static int __net_init iptable_mangle_net_init(struct net *net)
201 {
202         /* Register table */
203         net->ipv4.iptable_mangle =
204                 ipt_register_table(net, &packet_mangler, &initial_table.repl);
205         if (IS_ERR(net->ipv4.iptable_mangle))
206                 return PTR_ERR(net->ipv4.iptable_mangle);
207         return 0;
208 }
209
210 static void __net_exit iptable_mangle_net_exit(struct net *net)
211 {
212         ipt_unregister_table(net->ipv4.iptable_mangle);
213 }
214
215 static struct pernet_operations iptable_mangle_net_ops = {
216         .init = iptable_mangle_net_init,
217         .exit = iptable_mangle_net_exit,
218 };
219
220 static int __init iptable_mangle_init(void)
221 {
222         int ret;
223
224         ret = register_pernet_subsys(&iptable_mangle_net_ops);
225         if (ret < 0)
226                 return ret;
227
228         /* Register hooks */
229         ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
230         if (ret < 0)
231                 goto cleanup_table;
232
233         return ret;
234
235  cleanup_table:
236         unregister_pernet_subsys(&iptable_mangle_net_ops);
237         return ret;
238 }
239
240 static void __exit iptable_mangle_fini(void)
241 {
242         nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
243         unregister_pernet_subsys(&iptable_mangle_net_ops);
244 }
245
246 module_init(iptable_mangle_init);
247 module_exit(iptable_mangle_fini);