[linux-block.git] / net / netfilter / utils.c

// SPDX-License-Identifier: GPL-2.0
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/netfilter_ipv6.h>
#include <net/netfilter/nf_queue.h>
#include <net/ip6_checksum.h>

#ifdef CONFIG_INET
__sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
		       unsigned int dataoff, u8 protocol)
{
	const struct iphdr *iph = ip_hdr(skb);
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
			break;
		if ((protocol != IPPROTO_TCP && protocol != IPPROTO_UDP &&
		    !csum_fold(skb->csum)) ||
		    !csum_tcpudp_magic(iph->saddr, iph->daddr,
				       skb->len - dataoff, protocol,
				       skb->csum)) {
			skb->ip_summed = CHECKSUM_UNNECESSARY;
			break;
		}
		fallthrough;
	case CHECKSUM_NONE:
		if (protocol != IPPROTO_TCP && protocol != IPPROTO_UDP)
			skb->csum = 0;
		else
			skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
						       skb->len - dataoff,
						       protocol, 0);
		csum = __skb_checksum_complete(skb);
	}
	return csum;
}
EXPORT_SYMBOL(nf_ip_checksum);
#endif

static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
				      unsigned int dataoff, unsigned int len,
				      u8 protocol)
{
	const struct iphdr *iph = ip_hdr(skb);
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (len == skb->len - dataoff)
			return nf_ip_checksum(skb, hook, dataoff, protocol);
		fallthrough;
	case CHECKSUM_NONE:
		skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, protocol,
					       skb->len - dataoff, 0);
		skb->ip_summed = CHECKSUM_NONE;
		return __skb_checksum_complete_head(skb, dataoff + len);
	}
	return csum;
}

__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
			unsigned int dataoff, u8 protocol)
{
	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
			break;
		if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
				     skb->len - dataoff, protocol,
				     csum_sub(skb->csum,
					      skb_checksum(skb, 0,
							   dataoff, 0)))) {
			skb->ip_summed = CHECKSUM_UNNECESSARY;
			break;
		}
		fallthrough;
	case CHECKSUM_NONE:
		skb->csum = ~csum_unfold(
				csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
					     skb->len - dataoff,
					     protocol,
					     csum_sub(0,
						      skb_checksum(skb, 0,
								   dataoff, 0))));
		csum = __skb_checksum_complete(skb);
	}
	return csum;
}
EXPORT_SYMBOL(nf_ip6_checksum);

static __sum16 nf_ip6_checksum_partial(struct sk_buff *skb, unsigned int hook,
				       unsigned int dataoff, unsigned int len,
				       u8 protocol)
{
	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
	__wsum hsum;
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (len == skb->len - dataoff)
			return nf_ip6_checksum(skb, hook, dataoff, protocol);
		fallthrough;
	case CHECKSUM_NONE:
		hsum = skb_checksum(skb, 0, dataoff, 0);
		skb->csum = ~csum_unfold(csum_ipv6_magic(&ip6h->saddr,
							 &ip6h->daddr,
							 skb->len - dataoff,
							 protocol,
							 csum_sub(0, hsum)));
		skb->ip_summed = CHECKSUM_NONE;
		return __skb_checksum_complete_head(skb, dataoff + len);
	}
	return csum;
};

__sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
		    unsigned int dataoff, u8 protocol,
		    unsigned short family)
{
	__sum16 csum = 0;

	switch (family) {
	case AF_INET:
		csum = nf_ip_checksum(skb, hook, dataoff, protocol);
		break;
	case AF_INET6:
		csum = nf_ip6_checksum(skb, hook, dataoff, protocol);
		break;
	}

	return csum;
}
EXPORT_SYMBOL_GPL(nf_checksum);

__sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
			    unsigned int dataoff, unsigned int len,
			    u8 protocol, unsigned short family)
{
	__sum16 csum = 0;

	switch (family) {
	case AF_INET:
		csum = nf_ip_checksum_partial(skb, hook, dataoff, len,
					      protocol);
		break;
	case AF_INET6:
		csum = nf_ip6_checksum_partial(skb, hook, dataoff, len,
					       protocol);
		break;
	}

	return csum;
}
EXPORT_SYMBOL_GPL(nf_checksum_partial);

int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
	     bool strict, unsigned short family)
{
	const struct nf_ipv6_ops *v6ops __maybe_unused;
	int ret = 0;

	switch (family) {
	case AF_INET:
		ret = nf_ip_route(net, dst, fl, strict);
		break;
	case AF_INET6:
		ret = nf_ip6_route(net, dst, fl, strict);
		break;
	}

	return ret;
}
EXPORT_SYMBOL_GPL(nf_route);

static int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry)
{
#ifdef CONFIG_INET
	const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);

	if (entry->state.hook == NF_INET_LOCAL_OUT) {
		const struct iphdr *iph = ip_hdr(skb);

		if (!(iph->tos == rt_info->tos &&
		      skb->mark == rt_info->mark &&
		      iph->daddr == rt_info->daddr &&
		      iph->saddr == rt_info->saddr))
			return ip_route_me_harder(entry->state.net, skb,
						  RTN_UNSPEC);
	}
#endif
	return 0;
}

int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry)
{
	const struct nf_ipv6_ops *v6ops;
	int ret = 0;

	switch (entry->state.pf) {
	case AF_INET:
		ret = nf_ip_reroute(skb, entry);
		break;
	case AF_INET6:
		v6ops = rcu_dereference(nf_ipv6_ops);
		if (v6ops)
			ret = v6ops->reroute(skb, entry);
		break;
	}
	return ret;
}
Commit	Line	Data
d7e5a9a5	1	// SPDX-License-Identifier: GPL-2.0
ef71fe27 PNA	2	#include <linux/kernel.h>
	3	#include <linux/netfilter.h>
	4	#include <linux/netfilter_ipv4.h>
	5	#include <linux/netfilter_ipv6.h>
ce388f45	6	#include <net/netfilter/nf_queue.h>
ebee5a50	7	#include <net/ip6_checksum.h>
ef71fe27	8
d7e5a9a5 FW	9	#ifdef CONFIG_INET
	10	__sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
	11	unsigned int dataoff, u8 protocol)
	12	{
	13	const struct iphdr *iph = ip_hdr(skb);
	14	__sum16 csum = 0;
	15
	16	switch (skb->ip_summed) {
	17	case CHECKSUM_COMPLETE:
	18	if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
	19	break;
5d154984 HZ	20	if ((protocol != IPPROTO_TCP && protocol != IPPROTO_UDP &&
5d154984 HZ	21	!csum_fold(skb->csum)) \|\|
d7e5a9a5 FW	22	!csum_tcpudp_magic(iph->saddr, iph->daddr,
	23	skb->len - dataoff, protocol,
	24	skb->csum)) {
	25	skb->ip_summed = CHECKSUM_UNNECESSARY;
	26	break;
	27	}
954d8297	28	fallthrough;
d7e5a9a5	29	case CHECKSUM_NONE:
5d154984	30	if (protocol != IPPROTO_TCP && protocol != IPPROTO_UDP)
d7e5a9a5 FW	31	skb->csum = 0;
	32	else
	33	skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
	34	skb->len - dataoff,
	35	protocol, 0);
	36	csum = __skb_checksum_complete(skb);
	37	}
	38	return csum;
	39	}
	40	EXPORT_SYMBOL(nf_ip_checksum);
	41	#endif
	42
	43	static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
	44	unsigned int dataoff, unsigned int len,
	45	u8 protocol)
	46	{
	47	const struct iphdr *iph = ip_hdr(skb);
	48	__sum16 csum = 0;
	49
	50	switch (skb->ip_summed) {
	51	case CHECKSUM_COMPLETE:
	52	if (len == skb->len - dataoff)
	53	return nf_ip_checksum(skb, hook, dataoff, protocol);
954d8297	54	fallthrough;
d7e5a9a5 FW	55	case CHECKSUM_NONE:
	56	skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, protocol,
	57	skb->len - dataoff, 0);
	58	skb->ip_summed = CHECKSUM_NONE;
	59	return __skb_checksum_complete_head(skb, dataoff + len);
	60	}
	61	return csum;
	62	}
	63
ebee5a50 FW	64	__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
	65	unsigned int dataoff, u8 protocol)
	66	{
	67	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
	68	__sum16 csum = 0;
	69
	70	switch (skb->ip_summed) {
	71	case CHECKSUM_COMPLETE:
	72	if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
	73	break;
	74	if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
	75	skb->len - dataoff, protocol,
	76	csum_sub(skb->csum,
	77	skb_checksum(skb, 0,
	78	dataoff, 0)))) {
	79	skb->ip_summed = CHECKSUM_UNNECESSARY;
	80	break;
	81	}
954d8297	82	fallthrough;
ebee5a50 FW	83	case CHECKSUM_NONE:
	84	skb->csum = ~csum_unfold(
	85	csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
	86	skb->len - dataoff,
	87	protocol,
	88	csum_sub(0,
	89	skb_checksum(skb, 0,
	90	dataoff, 0))));
	91	csum = __skb_checksum_complete(skb);
	92	}
	93	return csum;
	94	}
	95	EXPORT_SYMBOL(nf_ip6_checksum);
	96
	97	static __sum16 nf_ip6_checksum_partial(struct sk_buff *skb, unsigned int hook,
	98	unsigned int dataoff, unsigned int len,
	99	u8 protocol)
	100	{
	101	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
	102	__wsum hsum;
	103	__sum16 csum = 0;
	104
	105	switch (skb->ip_summed) {
	106	case CHECKSUM_COMPLETE:
	107	if (len == skb->len - dataoff)
	108	return nf_ip6_checksum(skb, hook, dataoff, protocol);
954d8297	109	fallthrough;
ebee5a50 FW	110	case CHECKSUM_NONE:
	111	hsum = skb_checksum(skb, 0, dataoff, 0);
	112	skb->csum = ~csum_unfold(csum_ipv6_magic(&ip6h->saddr,
	113	&ip6h->daddr,
	114	skb->len - dataoff,
	115	protocol,
	116	csum_sub(0, hsum)));
	117	skb->ip_summed = CHECKSUM_NONE;
	118	return __skb_checksum_complete_head(skb, dataoff + len);
	119	}
	120	return csum;
	121	};
	122
ef71fe27	123	__sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
ebee5a50	124	unsigned int dataoff, u8 protocol,
ef71fe27 PNA	125	unsigned short family)
ef71fe27 PNA	126	{
ef71fe27 PNA	127	__sum16 csum = 0;
	128
	129	switch (family) {
	130	case AF_INET:
	131	csum = nf_ip_checksum(skb, hook, dataoff, protocol);
	132	break;
	133	case AF_INET6:
ebee5a50	134	csum = nf_ip6_checksum(skb, hook, dataoff, protocol);
ef71fe27 PNA	135	break;
	136	}
	137
	138	return csum;
	139	}
	140	EXPORT_SYMBOL_GPL(nf_checksum);
f7dcbe2f PNA	141
	142	__sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
	143	unsigned int dataoff, unsigned int len,
ebee5a50	144	u8 protocol, unsigned short family)
f7dcbe2f	145	{
f7dcbe2f PNA	146	__sum16 csum = 0;
	147
	148	switch (family) {
	149	case AF_INET:
	150	csum = nf_ip_checksum_partial(skb, hook, dataoff, len,
	151	protocol);
	152	break;
	153	case AF_INET6:
ebee5a50 FW	154	csum = nf_ip6_checksum_partial(skb, hook, dataoff, len,
ebee5a50 FW	155	protocol);
f7dcbe2f PNA	156	break;
	157	}
	158
	159	return csum;
	160	}
	161	EXPORT_SYMBOL_GPL(nf_checksum_partial);
3f87c08c PNA	162
	163	int nf_route(struct net net, struct dst_entry dst, struct flowi fl,
	164	bool strict, unsigned short family)
	165	{
ac02bcf9	166	const struct nf_ipv6_ops *v6ops __maybe_unused;
3f87c08c PNA	167	int ret = 0;
	168
	169	switch (family) {
	170	case AF_INET:
	171	ret = nf_ip_route(net, dst, fl, strict);
	172	break;
	173	case AF_INET6:
ac02bcf9	174	ret = nf_ip6_route(net, dst, fl, strict);
3f87c08c PNA	175	break;
	176	}
	177
	178	return ret;
	179	}
	180	EXPORT_SYMBOL_GPL(nf_route);
ce388f45	181
83f52928 FW	182	static int nf_ip_reroute(struct sk_buff skb, const struct nf_queue_entry entry)
	183	{
	184	#ifdef CONFIG_INET
	185	const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
	186
	187	if (entry->state.hook == NF_INET_LOCAL_OUT) {
	188	const struct iphdr *iph = ip_hdr(skb);
	189
	190	if (!(iph->tos == rt_info->tos &&
	191	skb->mark == rt_info->mark &&
	192	iph->daddr == rt_info->daddr &&
	193	iph->saddr == rt_info->saddr))
	194	return ip_route_me_harder(entry->state.net, skb,
	195	RTN_UNSPEC);
	196	}
	197	#endif
	198	return 0;
	199	}
	200
ce388f45 PNA	201	int nf_reroute(struct sk_buff skb, struct nf_queue_entry entry)
	202	{
	203	const struct nf_ipv6_ops *v6ops;
	204	int ret = 0;
	205
	206	switch (entry->state.pf) {
	207	case AF_INET:
	208	ret = nf_ip_reroute(skb, entry);
	209	break;
	210	case AF_INET6:
	211	v6ops = rcu_dereference(nf_ipv6_ops);
	212	if (v6ops)
	213	ret = v6ops->reroute(skb, entry);
	214	break;
	215	}
	216	return ret;
	217	}