1/*
2 * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
3 *
4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11#include <linux/module.h>
12#include <linux/netfilter_ipv4/ip_tables.h>
13#include <linux/netdevice.h>
14#include <linux/skbuff.h>
15#include <linux/slab.h>
16#include <net/sock.h>
17#include <net/route.h>
18#include <linux/ip.h>
19#include <net/ip.h>
20
21MODULE_LICENSE("GPL");
22MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
23MODULE_DESCRIPTION("iptables mangle table");
24
25#define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
26 (1 << NF_INET_LOCAL_IN) | \
27 (1 << NF_INET_FORWARD) | \
28 (1 << NF_INET_LOCAL_OUT) | \
29 (1 << NF_INET_POST_ROUTING))
30
31static int __net_init iptable_mangle_table_init(struct net *net);
32
33static const struct xt_table packet_mangler = {
34 .name = "mangle",
35 .valid_hooks = MANGLE_VALID_HOOKS,
36 .me = THIS_MODULE,
37 .af = NFPROTO_IPV4,
38 .priority = NF_IP_PRI_MANGLE,
39 .table_init = iptable_mangle_table_init,
40};
41
42static unsigned int
43ipt_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)
44{
45 unsigned int ret;
46 const struct iphdr *iph;
47 u_int8_t tos;
48 __be32 saddr, daddr;
49 u_int32_t mark;
50 int err;
51
52 /* Save things which could affect route */
53 mark = skb->mark;
54 iph = ip_hdr(skb);
55 saddr = iph->saddr;
56 daddr = iph->daddr;
57 tos = iph->tos;
58
59 ret = ipt_do_table(skb, state, state->net->ipv4.iptable_mangle);
60 /* Reroute for ANY change. */
61 if (ret != NF_DROP && ret != NF_STOLEN) {
62 iph = ip_hdr(skb);
63
64 if (iph->saddr != saddr ||
65 iph->daddr != daddr ||
66 skb->mark != mark ||
67 iph->tos != tos) {
68 err = ip_route_me_harder(state->net, skb, RTN_UNSPEC);
69 if (err < 0)
70 ret = NF_DROP_ERR(err);
71 }
72 }
73
74 return ret;
75}
76
77/* The work comes in here from netfilter.c. */
78static unsigned int
79iptable_mangle_hook(void *priv,
80 struct sk_buff *skb,
81 const struct nf_hook_state *state)
82{
83 if (state->hook == NF_INET_LOCAL_OUT)
84 return ipt_mangle_out(skb, state);
85 return ipt_do_table(skb, state, state->net->ipv4.iptable_mangle);
86}
87
88static struct nf_hook_ops *mangle_ops __read_mostly;
89static int __net_init iptable_mangle_table_init(struct net *net)
90{
91 struct ipt_replace *repl;
92 int ret;
93
94 if (net->ipv4.iptable_mangle)
95 return 0;
96
97 repl = ipt_alloc_initial_table(&packet_mangler);
98 if (repl == NULL)
99 return -ENOMEM;
100 ret = ipt_register_table(net, &packet_mangler, repl, mangle_ops,
101 &net->ipv4.iptable_mangle);
102 kfree(repl);
103 return ret;
104}
105
106static void __net_exit iptable_mangle_net_exit(struct net *net)
107{
108 if (!net->ipv4.iptable_mangle)
109 return;
110 ipt_unregister_table(net, net->ipv4.iptable_mangle, mangle_ops);
111 net->ipv4.iptable_mangle = NULL;
112}
113
114static struct pernet_operations iptable_mangle_net_ops = {
115 .exit = iptable_mangle_net_exit,
116};
117
118static int __init iptable_mangle_init(void)
119{
120 int ret;
121
122 mangle_ops = xt_hook_ops_alloc(&packet_mangler, iptable_mangle_hook);
123 if (IS_ERR(mangle_ops)) {
124 ret = PTR_ERR(mangle_ops);
125 return ret;
126 }
127
128 ret = register_pernet_subsys(&iptable_mangle_net_ops);
129 if (ret < 0) {
130 kfree(mangle_ops);
131 return ret;
132 }
133
134 ret = iptable_mangle_table_init(&init_net);
135 if (ret) {
136 unregister_pernet_subsys(&iptable_mangle_net_ops);
137 kfree(mangle_ops);
138 }
139
140 return ret;
141}
142
143static void __exit iptable_mangle_fini(void)
144{
145 unregister_pernet_subsys(&iptable_mangle_net_ops);
146 kfree(mangle_ops);
147}
148
149module_init(iptable_mangle_init);
150module_exit(iptable_mangle_fini);
151