Merge branch 'audit.b38' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit...

[~andy/linux] / net / ipv4 / netfilter / iptable_mangle.c

diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index a532e4d843326c33babab65e949cd03741e8bfe4..902446f7cbca8ae630677eb423ae1f0c9540ef56 100644 (file)
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -7,8 +7,6 @@
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
- *
- * Extended to all five netfilter hooks by Brad Chapman & Harald Welte
  */
 #include <linux/module.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
@@ -17,6 +15,7 @@
 #include <net/sock.h>
 #include <net/route.h>
 #include <linux/ip.h>
+#include <net/ip.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
@@ -34,73 +33,35 @@ static struct
        struct ipt_replace repl;
        struct ipt_standard entries[5];
        struct ipt_error term;
-} initial_table __initdata
-= { { "mangle", MANGLE_VALID_HOOKS, 6,
-      sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
-      { [NF_IP_PRE_ROUTING]    = 0,
-       [NF_IP_LOCAL_IN]        = sizeof(struct ipt_standard),
-       [NF_IP_FORWARD]         = sizeof(struct ipt_standard) * 2,
-       [NF_IP_LOCAL_OUT]       = sizeof(struct ipt_standard) * 3,
-       [NF_IP_POST_ROUTING]    = sizeof(struct ipt_standard) * 4 },
-      { [NF_IP_PRE_ROUTING]    = 0,
-       [NF_IP_LOCAL_IN]        = sizeof(struct ipt_standard),
-       [NF_IP_FORWARD]         = sizeof(struct ipt_standard) * 2,
-       [NF_IP_LOCAL_OUT]       = sizeof(struct ipt_standard) * 3,
-       [NF_IP_POST_ROUTING]    = sizeof(struct ipt_standard) * 4 },
-      0, NULL, { } },
-    {
-           /* PRE_ROUTING */
-           { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
-               0,
-               sizeof(struct ipt_entry),
-               sizeof(struct ipt_standard),
-               0, { 0, 0 }, { } },
-             { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
-               -NF_ACCEPT - 1 } },
-           /* LOCAL_IN */
-           { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
-               0,
-               sizeof(struct ipt_entry),
-               sizeof(struct ipt_standard),
-               0, { 0, 0 }, { } },
-             { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
-               -NF_ACCEPT - 1 } },
-           /* FORWARD */
-           { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
-               0,
-               sizeof(struct ipt_entry),
-               sizeof(struct ipt_standard),
-               0, { 0, 0 }, { } },
-             { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
-               -NF_ACCEPT - 1 } },
-           /* LOCAL_OUT */
-           { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
-               0,
-               sizeof(struct ipt_entry),
-               sizeof(struct ipt_standard),
-               0, { 0, 0 }, { } },
-             { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
-               -NF_ACCEPT - 1 } },
-           /* POST_ROUTING */
-           { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
-               0,
-               sizeof(struct ipt_entry),
-               sizeof(struct ipt_standard),
-               0, { 0, 0 }, { } },
-             { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
-               -NF_ACCEPT - 1 } },
-    },
-    /* ERROR */
-    { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
-       0,
-       sizeof(struct ipt_entry),
-       sizeof(struct ipt_error),
-       0, { 0, 0 }, { } },
-      { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } },
-         { } },
-       "ERROR"
-      }
-    }
+} initial_table __initdata = {
+       .repl = {
+               .name = "mangle",
+               .valid_hooks = MANGLE_VALID_HOOKS,
+               .num_entries = 6,
+               .size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
+               .hook_entry = {
+                       [NF_IP_PRE_ROUTING]     = 0,
+                       [NF_IP_LOCAL_IN]        = sizeof(struct ipt_standard),
+                       [NF_IP_FORWARD]         = sizeof(struct ipt_standard) * 2,
+                       [NF_IP_LOCAL_OUT]       = sizeof(struct ipt_standard) * 3,
+                       [NF_IP_POST_ROUTING]    = sizeof(struct ipt_standard) * 4,
+               },
+               .underflow = {
+                       [NF_IP_PRE_ROUTING]     = 0,
+                       [NF_IP_LOCAL_IN]        = sizeof(struct ipt_standard),
+                       [NF_IP_FORWARD]         = sizeof(struct ipt_standard) * 2,
+                       [NF_IP_LOCAL_OUT]       = sizeof(struct ipt_standard) * 3,
+                       [NF_IP_POST_ROUTING]    = sizeof(struct ipt_standard) * 4,
+               },
+       },
+       .entries = {
+               IPT_STANDARD_INIT(NF_ACCEPT),   /* PRE_ROUTING */
+               IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_IN */
+               IPT_STANDARD_INIT(NF_ACCEPT),   /* FORWARD */
+               IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
+               IPT_STANDARD_INIT(NF_ACCEPT),   /* POST_ROUTING */
+       },
+       .term = IPT_ERROR_INIT,                 /* ERROR */
 };
 
 static struct xt_table packet_mangler = {
@@ -130,33 +91,39 @@ ipt_local_hook(unsigned int hook,
                   int (*okfn)(struct sk_buff *))
 {
        unsigned int ret;
+       const struct iphdr *iph;
        u_int8_t tos;
        __be32 saddr, daddr;
        u_int32_t mark;
 
        /* root is playing with raw sockets. */
        if ((*pskb)->len < sizeof(struct iphdr)
-           || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr)) {
+           || ip_hdrlen(*pskb) < sizeof(struct iphdr)) {
                if (net_ratelimit())
-                       printk("ipt_hook: happy cracking.\n");
+                       printk("iptable_mangle: ignoring short SOCK_RAW "
+                              "packet.\n");
                return NF_ACCEPT;
        }
 
        /* Save things which could affect route */
        mark = (*pskb)->mark;
-       saddr = (*pskb)->nh.iph->saddr;
-       daddr = (*pskb)->nh.iph->daddr;
-       tos = (*pskb)->nh.iph->tos;
+       iph = ip_hdr(*pskb);
+       saddr = iph->saddr;
+       daddr = iph->daddr;
+       tos = iph->tos;
 
        ret = ipt_do_table(pskb, hook, in, out, &packet_mangler);
        /* Reroute for ANY change. */
-       if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE
-           && ((*pskb)->nh.iph->saddr != saddr
-               || (*pskb)->nh.iph->daddr != daddr
-               || (*pskb)->mark != mark
-               || (*pskb)->nh.iph->tos != tos))
-               if (ip_route_me_harder(pskb, RTN_UNSPEC))
-                       ret = NF_DROP;
+       if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
+               iph = ip_hdr(*pskb);
+
+               if (iph->saddr != saddr ||
+                   iph->daddr != daddr ||
+                   (*pskb)->mark != mark ||
+                   iph->tos != tos)
+                       if (ip_route_me_harder(pskb, RTN_UNSPEC))
+                               ret = NF_DROP;
+       }
 
        return ret;
 }
@@ -166,7 +133,7 @@ static struct nf_hook_ops ipt_ops[] = {
                .hook           = ipt_route_hook,
                .owner          = THIS_MODULE,
                .pf             = PF_INET,
-               .hooknum        = NF_IP_PRE_ROUTING, 
+               .hooknum        = NF_IP_PRE_ROUTING,
                .priority       = NF_IP_PRI_MANGLE,
        },
        {