blob: 8d2e5dc9a827dec61792be581c3407258c324723 [file] [log] [blame]
Patrick McHardyf229f6c2013-04-06 15:24:29 +02001/*
2 * IPv4 specific functions of netfilter core
3 *
4 * Rusty Russell (C) 2000 -- This code is GPL.
5 * Patrick McHardy (C) 2006-2012
6 */
Harald Welte020b4c12005-08-09 19:39:00 -07007#include <linux/kernel.h>
8#include <linux/netfilter.h>
Harald Welte2cc7d572005-08-09 19:42:34 -07009#include <linux/netfilter_ipv4.h>
Patrick McHardy3e3850e2006-01-06 23:04:54 -080010#include <linux/ip.h>
Herbert Xu2ca7b0a2007-10-14 00:39:55 -070011#include <linux/skbuff.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090012#include <linux/gfp.h>
Paul Gortmakerbc3b2d72011-07-15 11:47:34 -040013#include <linux/export.h>
Harald Welte020b4c12005-08-09 19:39:00 -070014#include <net/route.h>
Patrick McHardy3e3850e2006-01-06 23:04:54 -080015#include <net/xfrm.h>
16#include <net/ip.h>
Patrick McHardyc01cd422007-12-05 01:24:48 -080017#include <net/netfilter/nf_queue.h>
Harald Welte020b4c12005-08-09 19:39:00 -070018
19/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
Eric W. Biedermane45f5062015-09-25 15:07:30 -050020int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_type)
Harald Welte020b4c12005-08-09 19:39:00 -070021{
Herbert Xu3db05fea2007-10-15 00:53:15 -070022 const struct iphdr *iph = ip_hdr(skb);
Harald Welte020b4c12005-08-09 19:39:00 -070023 struct rtable *rt;
David S. Miller9d6ec932011-03-12 01:12:47 -050024 struct flowi4 fl4 = {};
Julian Anastasoved6e4ef2011-06-18 07:53:59 +000025 __be32 saddr = iph->saddr;
Florian Westphal29e09222017-02-17 08:39:28 +010026 const struct sock *sk = skb_to_full_sk(skb);
27 __u8 flags = sk ? inet_sk_flowi_flags(sk) : 0;
David Ahern6d8b49c2016-11-09 10:24:40 -080028 struct net_device *dev = skb_dst(skb)->dev;
Harald Welte020b4c12005-08-09 19:39:00 -070029 unsigned int hh_len;
30
Julian Anastasov797fd392011-08-07 09:11:00 +000031 if (addr_type == RTN_UNSPEC)
David Ahern6d8b49c2016-11-09 10:24:40 -080032 addr_type = inet_addr_type_dev_table(net, dev, saddr);
Julian Anastasov797fd392011-08-07 09:11:00 +000033 if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
34 flags |= FLOWI_FLAG_ANYSRC;
35 else
36 saddr = 0;
Simon Hormanb4c4ed12006-10-02 16:11:13 -070037
Harald Welte020b4c12005-08-09 19:39:00 -070038 /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
Patrick McHardy6e23ae22007-11-19 18:53:30 -080039 * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
Harald Welte020b4c12005-08-09 19:39:00 -070040 */
Julian Anastasoved6e4ef2011-06-18 07:53:59 +000041 fl4.daddr = iph->daddr;
42 fl4.saddr = saddr;
43 fl4.flowi4_tos = RT_TOS(iph->tos);
Florian Westphal29e09222017-02-17 08:39:28 +010044 fl4.flowi4_oif = sk ? sk->sk_bound_dev_if : 0;
David Ahern6d8b49c2016-11-09 10:24:40 -080045 if (!fl4.flowi4_oif)
46 fl4.flowi4_oif = l3mdev_master_ifindex(dev);
Julian Anastasoved6e4ef2011-06-18 07:53:59 +000047 fl4.flowi4_mark = skb->mark;
Julian Anastasov797fd392011-08-07 09:11:00 +000048 fl4.flowi4_flags = flags;
Julian Anastasoved6e4ef2011-06-18 07:53:59 +000049 rt = ip_route_output_key(net, &fl4);
50 if (IS_ERR(rt))
Patrick McHardyc9e16732013-04-05 06:41:10 +000051 return PTR_ERR(rt);
Harald Welte020b4c12005-08-09 19:39:00 -070052
Julian Anastasoved6e4ef2011-06-18 07:53:59 +000053 /* Drop old route. */
54 skb_dst_drop(skb);
55 skb_dst_set(skb, &rt->dst);
YOSHIFUJI Hideakie905a9e2007-02-09 23:24:47 +090056
Eric Dumazetadf30902009-06-02 05:19:30 +000057 if (skb_dst(skb)->error)
Patrick McHardyc9e16732013-04-05 06:41:10 +000058 return skb_dst(skb)->error;
Harald Welte020b4c12005-08-09 19:39:00 -070059
Patrick McHardy3e3850e2006-01-06 23:04:54 -080060#ifdef CONFIG_XFRM
Herbert Xu3db05fea2007-10-15 00:53:15 -070061 if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
David S. Miller9d6ec932011-03-12 01:12:47 -050062 xfrm_decode_session(skb, flowi4_to_flowi(&fl4), AF_INET) == 0) {
Eric Dumazetadf30902009-06-02 05:19:30 +000063 struct dst_entry *dst = skb_dst(skb);
64 skb_dst_set(skb, NULL);
Florian Westphal29e09222017-02-17 08:39:28 +010065 dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), sk, 0);
David S. Miller452edd52011-03-02 13:27:41 -080066 if (IS_ERR(dst))
stephen hemminger3d0a0622014-01-15 08:12:50 -080067 return PTR_ERR(dst);
Eric Dumazetadf30902009-06-02 05:19:30 +000068 skb_dst_set(skb, dst);
69 }
Patrick McHardy3e3850e2006-01-06 23:04:54 -080070#endif
71
Harald Welte020b4c12005-08-09 19:39:00 -070072 /* Change in oif may mean change in hh_len. */
Eric Dumazetadf30902009-06-02 05:19:30 +000073 hh_len = skb_dst(skb)->dev->hard_header_len;
Herbert Xu3db05fea2007-10-15 00:53:15 -070074 if (skb_headroom(skb) < hh_len &&
Paul Guo5e2afba2011-11-14 19:00:54 +080075 pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)),
76 0, GFP_ATOMIC))
Patrick McHardyc9e16732013-04-05 06:41:10 +000077 return -ENOMEM;
Harald Welte020b4c12005-08-09 19:39:00 -070078
79 return 0;
80}
81EXPORT_SYMBOL(ip_route_me_harder);
Harald Welte2cc7d572005-08-09 19:42:34 -070082
Pablo Neira Ayusoce388f42017-11-27 22:50:26 +010083int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry)
Harald Welte2cc7d572005-08-09 19:42:34 -070084{
Patrick McHardy02f014d2007-12-05 01:26:33 -080085 const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
Harald Welte2cc7d572005-08-09 19:42:34 -070086
David S. Miller1d1de892015-04-03 16:31:01 -040087 if (entry->state.hook == NF_INET_LOCAL_OUT) {
Herbert Xu3db05fea2007-10-15 00:53:15 -070088 const struct iphdr *iph = ip_hdr(skb);
Harald Welte2cc7d572005-08-09 19:42:34 -070089
Joe Perchesf64f9e72009-11-29 16:55:45 -080090 if (!(iph->tos == rt_info->tos &&
91 skb->mark == rt_info->mark &&
92 iph->daddr == rt_info->daddr &&
93 iph->saddr == rt_info->saddr))
Pablo Neira Ayusoce388f42017-11-27 22:50:26 +010094 return ip_route_me_harder(entry->state.net, skb,
95 RTN_UNSPEC);
Harald Welte2cc7d572005-08-09 19:42:34 -070096 }
97 return 0;
98}
Pablo Neira Ayusoce388f42017-11-27 22:50:26 +010099EXPORT_SYMBOL_GPL(nf_ip_reroute);
Harald Welte2cc7d572005-08-09 19:42:34 -0700100
Pablo Neira Ayuso3f87c082017-11-27 22:29:52 +0100101int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
102 bool strict __always_unused)
Patrick McHardy1841a4c2007-12-05 01:22:05 -0800103{
Florian Westphal31ad3dd2011-04-04 16:56:29 +0200104 struct rtable *rt = ip_route_output_key(net, &fl->u.ip4);
David S. Millerb23dd4f2011-03-02 14:31:35 -0800105 if (IS_ERR(rt))
106 return PTR_ERR(rt);
107 *dst = &rt->dst;
108 return 0;
Patrick McHardy1841a4c2007-12-05 01:22:05 -0800109}
Pablo Neira Ayuso3f87c082017-11-27 22:29:52 +0100110EXPORT_SYMBOL_GPL(nf_ip_route);