[GitHub/LineageOS/android_kernel_motorola_exynos9610.git] / net / ipv4 / netfilter / iptable_mangle.c

/*
 * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
 *
 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#include <linux/module.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netdevice.h>
#include <linux/skbuff.h>
#include <linux/slab.h>
#include <net/sock.h>
#include <net/route.h>
#include <linux/ip.h>
#include <net/ip.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
MODULE_DESCRIPTION("iptables mangle table");

#define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
			    (1 << NF_INET_LOCAL_IN) | \
			    (1 << NF_INET_FORWARD) | \
			    (1 << NF_INET_LOCAL_OUT) | \
			    (1 << NF_INET_POST_ROUTING))

static int __net_init iptable_mangle_table_init(struct net *net);

static const struct xt_table packet_mangler = {
	.name		= "mangle",
	.valid_hooks	= MANGLE_VALID_HOOKS,
	.me		= THIS_MODULE,
	.af		= NFPROTO_IPV4,
	.priority	= NF_IP_PRI_MANGLE,
	.table_init	= iptable_mangle_table_init,
};

static unsigned int
ipt_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)
{
	unsigned int ret;
	const struct iphdr *iph;
	u_int8_t tos;
	__be32 saddr, daddr;
	u_int32_t mark;
	int err;

	/* root is playing with raw sockets. */
	if (skb->len < sizeof(struct iphdr) ||
	    ip_hdrlen(skb) < sizeof(struct iphdr))
		return NF_ACCEPT;

	/* Save things which could affect route */
	mark = skb->mark;
	iph = ip_hdr(skb);
	saddr = iph->saddr;
	daddr = iph->daddr;
	tos = iph->tos;

	ret = ipt_do_table(skb, state, state->net->ipv4.iptable_mangle);
	/* Reroute for ANY change. */
	if (ret != NF_DROP && ret != NF_STOLEN) {
		iph = ip_hdr(skb);

		if (iph->saddr != saddr ||
		    iph->daddr != daddr ||
		    skb->mark != mark ||
		    iph->tos != tos) {
			err = ip_route_me_harder(state->net, skb, RTN_UNSPEC);
			if (err < 0)
				ret = NF_DROP_ERR(err);
		}
	}

	return ret;
}

/* The work comes in here from netfilter.c. */
static unsigned int
iptable_mangle_hook(void *priv,
		     struct sk_buff *skb,
		     const struct nf_hook_state *state)
{
	if (state->hook == NF_INET_LOCAL_OUT)
		return ipt_mangle_out(skb, state);
	return ipt_do_table(skb, state, state->net->ipv4.iptable_mangle);
}

static struct nf_hook_ops *mangle_ops __read_mostly;
static int __net_init iptable_mangle_table_init(struct net *net)
{
	struct ipt_replace *repl;
	int ret;

	if (net->ipv4.iptable_mangle)
		return 0;

	repl = ipt_alloc_initial_table(&packet_mangler);
	if (repl == NULL)
		return -ENOMEM;
	ret = ipt_register_table(net, &packet_mangler, repl, mangle_ops,
				 &net->ipv4.iptable_mangle);
	kfree(repl);
	return ret;
}

static void __net_exit iptable_mangle_net_exit(struct net *net)
{
	if (!net->ipv4.iptable_mangle)
		return;
	ipt_unregister_table(net, net->ipv4.iptable_mangle, mangle_ops);
	net->ipv4.iptable_mangle = NULL;
}

static struct pernet_operations iptable_mangle_net_ops = {
	.exit = iptable_mangle_net_exit,
};

static int __init iptable_mangle_init(void)
{
	int ret;

	mangle_ops = xt_hook_ops_alloc(&packet_mangler, iptable_mangle_hook);
	if (IS_ERR(mangle_ops)) {
		ret = PTR_ERR(mangle_ops);
		return ret;
	}

	ret = register_pernet_subsys(&iptable_mangle_net_ops);
	if (ret < 0) {
		kfree(mangle_ops);
		return ret;
	}

	ret = iptable_mangle_table_init(&init_net);
	if (ret) {
		unregister_pernet_subsys(&iptable_mangle_net_ops);
		kfree(mangle_ops);
	}

	return ret;
}

static void __exit iptable_mangle_fini(void)
{
	unregister_pernet_subsys(&iptable_mangle_net_ops);
	kfree(mangle_ops);
}

module_init(iptable_mangle_init);
module_exit(iptable_mangle_fini);
Commit	Line	Data
	1	/*
	2	* This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
	3	*
	4	* Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
	5	* Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
	10	*/
	11	#include <linux/module.h>
	12	#include <linux/netfilter_ipv4/ip_tables.h>
	13	#include <linux/netdevice.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/slab.h>
	16	#include <net/sock.h>
	17	#include <net/route.h>
	18	#include <linux/ip.h>
	19	#include <net/ip.h>
	20
	21	MODULE_LICENSE("GPL");
	22	MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
	23	MODULE_DESCRIPTION("iptables mangle table");
	24
	25	#define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) \| \
	26	(1 << NF_INET_LOCAL_IN) \| \
	27	(1 << NF_INET_FORWARD) \| \
	28	(1 << NF_INET_LOCAL_OUT) \| \
	29	(1 << NF_INET_POST_ROUTING))
	30
	31	static int __net_init iptable_mangle_table_init(struct net *net);
	32
	33	static const struct xt_table packet_mangler = {
	34	.name = "mangle",
	35	.valid_hooks = MANGLE_VALID_HOOKS,
	36	.me = THIS_MODULE,
	37	.af = NFPROTO_IPV4,
	38	.priority = NF_IP_PRI_MANGLE,
	39	.table_init = iptable_mangle_table_init,
	40	};
	41
	42	static unsigned int
	43	ipt_mangle_out(struct sk_buff skb, const struct nf_hook_state state)
	44	{
	45	unsigned int ret;
	46	const struct iphdr *iph;
	47	u_int8_t tos;
	48	__be32 saddr, daddr;
	49	u_int32_t mark;
	50	int err;
	51
	52	/* root is playing with raw sockets. */
	53	if (skb->len < sizeof(struct iphdr) \|\|
	54	ip_hdrlen(skb) < sizeof(struct iphdr))
	55	return NF_ACCEPT;
	56
	57	/* Save things which could affect route */
	58	mark = skb->mark;
	59	iph = ip_hdr(skb);
	60	saddr = iph->saddr;
	61	daddr = iph->daddr;
	62	tos = iph->tos;
	63
	64	ret = ipt_do_table(skb, state, state->net->ipv4.iptable_mangle);
	65	/* Reroute for ANY change. */
	66	if (ret != NF_DROP && ret != NF_STOLEN) {
	67	iph = ip_hdr(skb);
	68
	69	if (iph->saddr != saddr \|\|
	70	iph->daddr != daddr \|\|
	71	skb->mark != mark \|\|
	72	iph->tos != tos) {
	73	err = ip_route_me_harder(state->net, skb, RTN_UNSPEC);
	74	if (err < 0)
	75	ret = NF_DROP_ERR(err);
	76	}
	77	}
	78
	79	return ret;
	80	}
	81
	82	/* The work comes in here from netfilter.c. */
	83	static unsigned int
	84	iptable_mangle_hook(void *priv,
	85	struct sk_buff *skb,
	86	const struct nf_hook_state *state)
	87	{
	88	if (state->hook == NF_INET_LOCAL_OUT)
	89	return ipt_mangle_out(skb, state);
	90	return ipt_do_table(skb, state, state->net->ipv4.iptable_mangle);
	91	}
	92
	93	static struct nf_hook_ops *mangle_ops __read_mostly;
	94	static int __net_init iptable_mangle_table_init(struct net *net)
	95	{
	96	struct ipt_replace *repl;
	97	int ret;
	98
	99	if (net->ipv4.iptable_mangle)
	100	return 0;
	101
	102	repl = ipt_alloc_initial_table(&packet_mangler);
	103	if (repl == NULL)
	104	return -ENOMEM;
	105	ret = ipt_register_table(net, &packet_mangler, repl, mangle_ops,
	106	&net->ipv4.iptable_mangle);
	107	kfree(repl);
	108	return ret;
	109	}
	110
	111	static void __net_exit iptable_mangle_net_exit(struct net *net)
	112	{
	113	if (!net->ipv4.iptable_mangle)
	114	return;
	115	ipt_unregister_table(net, net->ipv4.iptable_mangle, mangle_ops);
	116	net->ipv4.iptable_mangle = NULL;
	117	}
	118
	119	static struct pernet_operations iptable_mangle_net_ops = {
	120	.exit = iptable_mangle_net_exit,
	121	};
	122
	123	static int __init iptable_mangle_init(void)
	124	{
	125	int ret;
	126
	127	mangle_ops = xt_hook_ops_alloc(&packet_mangler, iptable_mangle_hook);
	128	if (IS_ERR(mangle_ops)) {
	129	ret = PTR_ERR(mangle_ops);
	130	return ret;
	131	}
	132
	133	ret = register_pernet_subsys(&iptable_mangle_net_ops);
	134	if (ret < 0) {
	135	kfree(mangle_ops);
	136	return ret;
	137	}
	138
	139	ret = iptable_mangle_table_init(&init_net);
	140	if (ret) {
	141	unregister_pernet_subsys(&iptable_mangle_net_ops);
	142	kfree(mangle_ops);
	143	}
	144
	145	return ret;
	146	}
	147
	148	static void __exit iptable_mangle_fini(void)
	149	{
	150	unregister_pernet_subsys(&iptable_mangle_net_ops);
	151	kfree(mangle_ops);
	152	}
	153
	154	module_init(iptable_mangle_init);
	155	module_exit(iptable_mangle_fini);