[linux-2.6-block.git] / net / ipv4 / netfilter / iptable_mangle.c

/*
 * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
 *
 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#include <linux/module.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netdevice.h>
#include <linux/skbuff.h>
#include <net/sock.h>
#include <net/route.h>
#include <linux/ip.h>
#include <net/ip.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
MODULE_DESCRIPTION("iptables mangle table");

#define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
			    (1 << NF_INET_LOCAL_IN) | \
			    (1 << NF_INET_FORWARD) | \
			    (1 << NF_INET_LOCAL_OUT) | \
			    (1 << NF_INET_POST_ROUTING))

/* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
static struct
{
	struct ipt_replace repl;
	struct ipt_standard entries[5];
	struct ipt_error term;
} initial_table __net_initdata = {
	.repl = {
		.name = "mangle",
		.valid_hooks = MANGLE_VALID_HOOKS,
		.num_entries = 6,
		.size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
		.hook_entry = {
			[NF_INET_PRE_ROUTING] 	= 0,
			[NF_INET_LOCAL_IN] 	= sizeof(struct ipt_standard),
			[NF_INET_FORWARD] 	= sizeof(struct ipt_standard) * 2,
			[NF_INET_LOCAL_OUT] 	= sizeof(struct ipt_standard) * 3,
			[NF_INET_POST_ROUTING] 	= sizeof(struct ipt_standard) * 4,
		},
		.underflow = {
			[NF_INET_PRE_ROUTING] 	= 0,
			[NF_INET_LOCAL_IN] 	= sizeof(struct ipt_standard),
			[NF_INET_FORWARD] 	= sizeof(struct ipt_standard) * 2,
			[NF_INET_LOCAL_OUT] 	= sizeof(struct ipt_standard) * 3,
			[NF_INET_POST_ROUTING]	= sizeof(struct ipt_standard) * 4,
		},
	},
	.entries = {
		IPT_STANDARD_INIT(NF_ACCEPT),	/* PRE_ROUTING */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_IN */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* FORWARD */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_OUT */
		IPT_STANDARD_INIT(NF_ACCEPT),	/* POST_ROUTING */
	},
	.term = IPT_ERROR_INIT,			/* ERROR */
};

static struct xt_table packet_mangler = {
	.name		= "mangle",
	.valid_hooks	= MANGLE_VALID_HOOKS,
	.lock		= __RW_LOCK_UNLOCKED(packet_mangler.lock),
	.me		= THIS_MODULE,
	.af		= AF_INET,
};

/* The work comes in here from netfilter.c. */
static unsigned int
ipt_pre_routing_hook(unsigned int hook,
		     struct sk_buff *skb,
		     const struct net_device *in,
		     const struct net_device *out,
		     int (*okfn)(struct sk_buff *))
{
	return ipt_do_table(skb, hook, in, out,
			    dev_net(in)->ipv4.iptable_mangle);
}

static unsigned int
ipt_post_routing_hook(unsigned int hook,
		      struct sk_buff *skb,
		      const struct net_device *in,
		      const struct net_device *out,
		      int (*okfn)(struct sk_buff *))
{
	return ipt_do_table(skb, hook, in, out,
			    dev_net(out)->ipv4.iptable_mangle);
}

static unsigned int
ipt_local_in_hook(unsigned int hook,
		  struct sk_buff *skb,
		  const struct net_device *in,
		  const struct net_device *out,
		  int (*okfn)(struct sk_buff *))
{
	return ipt_do_table(skb, hook, in, out,
			    dev_net(in)->ipv4.iptable_mangle);
}

static unsigned int
ipt_forward_hook(unsigned int hook,
	 struct sk_buff *skb,
	 const struct net_device *in,
	 const struct net_device *out,
	 int (*okfn)(struct sk_buff *))
{
	return ipt_do_table(skb, hook, in, out,
			    dev_net(in)->ipv4.iptable_mangle);
}

static unsigned int
ipt_local_hook(unsigned int hook,
		   struct sk_buff *skb,
		   const struct net_device *in,
		   const struct net_device *out,
		   int (*okfn)(struct sk_buff *))
{
	unsigned int ret;
	const struct iphdr *iph;
	u_int8_t tos;
	__be32 saddr, daddr;
	u_int32_t mark;

	/* root is playing with raw sockets. */
	if (skb->len < sizeof(struct iphdr)
	    || ip_hdrlen(skb) < sizeof(struct iphdr))
		return NF_ACCEPT;

	/* Save things which could affect route */
	mark = skb->mark;
	iph = ip_hdr(skb);
	saddr = iph->saddr;
	daddr = iph->daddr;
	tos = iph->tos;

	ret = ipt_do_table(skb, hook, in, out,
			   dev_net(out)->ipv4.iptable_mangle);
	/* Reroute for ANY change. */
	if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
		iph = ip_hdr(skb);

		if (iph->saddr != saddr ||
		    iph->daddr != daddr ||
		    skb->mark != mark ||
		    iph->tos != tos)
			if (ip_route_me_harder(skb, RTN_UNSPEC))
				ret = NF_DROP;
	}

	return ret;
}

static struct nf_hook_ops ipt_ops[] __read_mostly = {
	{
		.hook		= ipt_pre_routing_hook,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_PRE_ROUTING,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_local_in_hook,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_LOCAL_IN,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_forward_hook,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_FORWARD,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_local_hook,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_LOCAL_OUT,
		.priority	= NF_IP_PRI_MANGLE,
	},
	{
		.hook		= ipt_post_routing_hook,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_POST_ROUTING,
		.priority	= NF_IP_PRI_MANGLE,
	},
};

static int __net_init iptable_mangle_net_init(struct net *net)
{
	/* Register table */
	net->ipv4.iptable_mangle =
		ipt_register_table(net, &packet_mangler, &initial_table.repl);
	if (IS_ERR(net->ipv4.iptable_mangle))
		return PTR_ERR(net->ipv4.iptable_mangle);
	return 0;
}

static void __net_exit iptable_mangle_net_exit(struct net *net)
{
	ipt_unregister_table(net->ipv4.iptable_mangle);
}

static struct pernet_operations iptable_mangle_net_ops = {
	.init = iptable_mangle_net_init,
	.exit = iptable_mangle_net_exit,
};

static int __init iptable_mangle_init(void)
{
	int ret;

	ret = register_pernet_subsys(&iptable_mangle_net_ops);
	if (ret < 0)
		return ret;

	/* Register hooks */
	ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
	if (ret < 0)
		goto cleanup_table;

	return ret;

 cleanup_table:
	unregister_pernet_subsys(&iptable_mangle_net_ops);
	return ret;
}

static void __exit iptable_mangle_fini(void)
{
	nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
	unregister_pernet_subsys(&iptable_mangle_net_ops);
}

module_init(iptable_mangle_init);
module_exit(iptable_mangle_fini);
Commit	Line	Data
1da177e4 LT	1	/*
	2	* This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
	3	*
	4	* Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
	5	* Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
1da177e4	10	*/
1da177e4 LT	11	#include <linux/module.h>
	12	#include <linux/netfilter_ipv4/ip_tables.h>
	13	#include <linux/netdevice.h>
	14	#include <linux/skbuff.h>
	15	#include <net/sock.h>
	16	#include <net/route.h>
	17	#include <linux/ip.h>
c9bdd4b5	18	#include <net/ip.h>
1da177e4 LT	19
	20	MODULE_LICENSE("GPL");
	21	MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
	22	MODULE_DESCRIPTION("iptables mangle table");
	23
6e23ae2a PM	24	#define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) \| \
	25	(1 << NF_INET_LOCAL_IN) \| \
	26	(1 << NF_INET_FORWARD) \| \
	27	(1 << NF_INET_LOCAL_OUT) \| \
	28	(1 << NF_INET_POST_ROUTING))
1da177e4 LT	29
	30	/* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
	31	static struct
	32	{
	33	struct ipt_replace repl;
	34	struct ipt_standard entries[5];
	35	struct ipt_error term;
9335f047	36	} initial_table __net_initdata = {
3c2ad469 PM	37	.repl = {
	38	.name = "mangle",
	39	.valid_hooks = MANGLE_VALID_HOOKS,
	40	.num_entries = 6,
	41	.size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
	42	.hook_entry = {
6e23ae2a PM	43	[NF_INET_PRE_ROUTING] = 0,
	44	[NF_INET_LOCAL_IN] = sizeof(struct ipt_standard),
	45	[NF_INET_FORWARD] = sizeof(struct ipt_standard) * 2,
	46	[NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 3,
	47	[NF_INET_POST_ROUTING] = sizeof(struct ipt_standard) * 4,
3c2ad469 PM	48	},
3c2ad469 PM	49	.underflow = {
6e23ae2a PM	50	[NF_INET_PRE_ROUTING] = 0,
	51	[NF_INET_LOCAL_IN] = sizeof(struct ipt_standard),
	52	[NF_INET_FORWARD] = sizeof(struct ipt_standard) * 2,
	53	[NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 3,
	54	[NF_INET_POST_ROUTING] = sizeof(struct ipt_standard) * 4,
3c2ad469 PM	55	},
	56	},
	57	.entries = {
	58	IPT_STANDARD_INIT(NF_ACCEPT), /* PRE_ROUTING */
	59	IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_IN */
	60	IPT_STANDARD_INIT(NF_ACCEPT), /* FORWARD */
	61	IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_OUT */
	62	IPT_STANDARD_INIT(NF_ACCEPT), /* POST_ROUTING */
	63	},
	64	.term = IPT_ERROR_INIT, /* ERROR */
1da177e4 LT	65	};
1da177e4 LT	66
9335f047	67	static struct xt_table packet_mangler = {
1da177e4 LT	68	.name = "mangle",
1da177e4 LT	69	.valid_hooks = MANGLE_VALID_HOOKS,
fdccecd0	70	.lock = __RW_LOCK_UNLOCKED(packet_mangler.lock),
1da177e4	71	.me = THIS_MODULE,
2e4e6a17	72	.af = AF_INET,
1da177e4 LT	73	};
	74
	75	/* The work comes in here from netfilter.c. */
	76	static unsigned int
666953df AD	77	ipt_pre_routing_hook(unsigned int hook,
	78	struct sk_buff *skb,
	79	const struct net_device *in,
	80	const struct net_device *out,
	81	int (okfn)(struct sk_buff ))
	82	{
	83	return ipt_do_table(skb, hook, in, out,
48dc7865	84	dev_net(in)->ipv4.iptable_mangle);
666953df AD	85	}
	86
	87	static unsigned int
	88	ipt_post_routing_hook(unsigned int hook,
	89	struct sk_buff *skb,
	90	const struct net_device *in,
	91	const struct net_device *out,
	92	int (okfn)(struct sk_buff ))
	93	{
	94	return ipt_do_table(skb, hook, in, out,
48dc7865	95	dev_net(out)->ipv4.iptable_mangle);
666953df AD	96	}
	97
	98	static unsigned int
	99	ipt_local_in_hook(unsigned int hook,
	100	struct sk_buff *skb,
	101	const struct net_device *in,
	102	const struct net_device *out,
	103	int (okfn)(struct sk_buff ))
	104	{
	105	return ipt_do_table(skb, hook, in, out,
48dc7865	106	dev_net(in)->ipv4.iptable_mangle);
666953df AD	107	}
	108
	109	static unsigned int
	110	ipt_forward_hook(unsigned int hook,
3db05fea	111	struct sk_buff *skb,
1da177e4 LT	112	const struct net_device *in,
	113	const struct net_device *out,
	114	int (okfn)(struct sk_buff ))
	115	{
666953df	116	return ipt_do_table(skb, hook, in, out,
48dc7865	117	dev_net(in)->ipv4.iptable_mangle);
1da177e4 LT	118	}
	119
	120	static unsigned int
	121	ipt_local_hook(unsigned int hook,
3db05fea	122	struct sk_buff *skb,
1da177e4 LT	123	const struct net_device *in,
	124	const struct net_device *out,
	125	int (okfn)(struct sk_buff ))
	126	{
	127	unsigned int ret;
eddc9ec5	128	const struct iphdr *iph;
1da177e4	129	u_int8_t tos;
6a19d614	130	__be32 saddr, daddr;
82e91ffe	131	u_int32_t mark;
1da177e4 LT	132
1da177e4 LT	133	/* root is playing with raw sockets. */
3db05fea	134	if (skb->len < sizeof(struct iphdr)
88843104	135	\|\| ip_hdrlen(skb) < sizeof(struct iphdr))
1da177e4	136	return NF_ACCEPT;
1da177e4 LT	137
1da177e4 LT	138	/* Save things which could affect route */
3db05fea HX	139	mark = skb->mark;
3db05fea HX	140	iph = ip_hdr(skb);
eddc9ec5 ACM	141	saddr = iph->saddr;
	142	daddr = iph->daddr;
	143	tos = iph->tos;
1da177e4	144
666953df	145	ret = ipt_do_table(skb, hook, in, out,
48dc7865	146	dev_net(out)->ipv4.iptable_mangle);
1da177e4	147	/* Reroute for ANY change. */
eddc9ec5	148	if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
3db05fea	149	iph = ip_hdr(skb);
eddc9ec5 ACM	150
	151	if (iph->saddr != saddr \|\|
	152	iph->daddr != daddr \|\|
3db05fea	153	skb->mark != mark \|\|
eddc9ec5	154	iph->tos != tos)
3db05fea	155	if (ip_route_me_harder(skb, RTN_UNSPEC))
eddc9ec5 ACM	156	ret = NF_DROP;
eddc9ec5 ACM	157	}
1da177e4 LT	158
	159	return ret;
	160	}
	161
1999414a	162	static struct nf_hook_ops ipt_ops[] __read_mostly = {
1da177e4	163	{
666953df	164	.hook = ipt_pre_routing_hook,
1da177e4 LT	165	.owner = THIS_MODULE,
1da177e4 LT	166	.pf = PF_INET,
6e23ae2a	167	.hooknum = NF_INET_PRE_ROUTING,
1da177e4 LT	168	.priority = NF_IP_PRI_MANGLE,
	169	},
	170	{
666953df	171	.hook = ipt_local_in_hook,
1da177e4 LT	172	.owner = THIS_MODULE,
1da177e4 LT	173	.pf = PF_INET,
6e23ae2a	174	.hooknum = NF_INET_LOCAL_IN,
1da177e4 LT	175	.priority = NF_IP_PRI_MANGLE,
	176	},
	177	{
666953df	178	.hook = ipt_forward_hook,
1da177e4 LT	179	.owner = THIS_MODULE,
1da177e4 LT	180	.pf = PF_INET,
6e23ae2a	181	.hooknum = NF_INET_FORWARD,
1da177e4 LT	182	.priority = NF_IP_PRI_MANGLE,
	183	},
	184	{
	185	.hook = ipt_local_hook,
	186	.owner = THIS_MODULE,
	187	.pf = PF_INET,
6e23ae2a	188	.hooknum = NF_INET_LOCAL_OUT,
1da177e4 LT	189	.priority = NF_IP_PRI_MANGLE,
	190	},
	191	{
666953df	192	.hook = ipt_post_routing_hook,
1da177e4 LT	193	.owner = THIS_MODULE,
1da177e4 LT	194	.pf = PF_INET,
6e23ae2a	195	.hooknum = NF_INET_POST_ROUTING,
1da177e4 LT	196	.priority = NF_IP_PRI_MANGLE,
	197	},
	198	};
	199
9335f047 AD	200	static int __net_init iptable_mangle_net_init(struct net *net)
	201	{
	202	/* Register table */
	203	net->ipv4.iptable_mangle =
	204	ipt_register_table(net, &packet_mangler, &initial_table.repl);
	205	if (IS_ERR(net->ipv4.iptable_mangle))
	206	return PTR_ERR(net->ipv4.iptable_mangle);
	207	return 0;
	208	}
	209
	210	static void __net_exit iptable_mangle_net_exit(struct net *net)
	211	{
	212	ipt_unregister_table(net->ipv4.iptable_mangle);
	213	}
	214
	215	static struct pernet_operations iptable_mangle_net_ops = {
	216	.init = iptable_mangle_net_init,
	217	.exit = iptable_mangle_net_exit,
	218	};
	219
65b4b4e8	220	static int __init iptable_mangle_init(void)
1da177e4 LT	221	{
	222	int ret;
	223
9335f047 AD	224	ret = register_pernet_subsys(&iptable_mangle_net_ops);
	225	if (ret < 0)
	226	return ret;
1da177e4 LT	227
1da177e4 LT	228	/* Register hooks */
964ddaa1	229	ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
1da177e4 LT	230	if (ret < 0)
	231	goto cleanup_table;
	232
1da177e4 LT	233	return ret;
1da177e4 LT	234
1da177e4	235	cleanup_table:
9335f047	236	unregister_pernet_subsys(&iptable_mangle_net_ops);
1da177e4 LT	237	return ret;
	238	}
	239
65b4b4e8	240	static void __exit iptable_mangle_fini(void)
1da177e4	241	{
964ddaa1	242	nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
9335f047	243	unregister_pernet_subsys(&iptable_mangle_net_ops);
1da177e4 LT	244	}
1da177e4 LT	245
65b4b4e8 AM	246	module_init(iptable_mangle_init);
65b4b4e8 AM	247	module_exit(iptable_mangle_fini);