123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500 |
- #define pr_fmt(fmt) "IPv4: " fmt
- #include <linux/module.h>
- #include <linux/types.h>
- #include <linux/kernel.h>
- #include <linux/string.h>
- #include <linux/errno.h>
- #include <linux/slab.h>
- #include <linux/net.h>
- #include <linux/socket.h>
- #include <linux/sockios.h>
- #include <linux/in.h>
- #include <linux/inet.h>
- #include <linux/inetdevice.h>
- #include <linux/netdevice.h>
- #include <linux/etherdevice.h>
- #include <net/snmp.h>
- #include <net/ip.h>
- #include <net/protocol.h>
- #include <net/route.h>
- #include <linux/skbuff.h>
- #include <net/sock.h>
- #include <net/arp.h>
- #include <net/icmp.h>
- #include <net/raw.h>
- #include <net/checksum.h>
- #include <net/inet_ecn.h>
- #include <linux/netfilter_ipv4.h>
- #include <net/xfrm.h>
- #include <linux/mroute.h>
- #include <linux/netlink.h>
- #include <net/dst_metadata.h>
- bool ip_call_ra_chain(struct sk_buff *skb)
- {
- struct ip_ra_chain *ra;
- u8 protocol = ip_hdr(skb)->protocol;
- struct sock *last = NULL;
- struct net_device *dev = skb->dev;
- struct net *net = dev_net(dev);
- for (ra = rcu_dereference(ip_ra_chain); ra; ra = rcu_dereference(ra->next)) {
- struct sock *sk = ra->sk;
-
- if (sk && inet_sk(sk)->inet_num == protocol &&
- (!sk->sk_bound_dev_if ||
- sk->sk_bound_dev_if == dev->ifindex) &&
- net_eq(sock_net(sk), net)) {
- if (ip_is_fragment(ip_hdr(skb))) {
- if (ip_defrag(net, skb, IP_DEFRAG_CALL_RA_CHAIN))
- return true;
- }
- if (last) {
- struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
- if (skb2)
- raw_rcv(last, skb2);
- }
- last = sk;
- }
- }
- if (last) {
- raw_rcv(last, skb);
- return true;
- }
- return false;
- }
- static int ip_local_deliver_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
- {
- __skb_pull(skb, skb_network_header_len(skb));
- rcu_read_lock();
- {
- int protocol = ip_hdr(skb)->protocol;
- const struct net_protocol *ipprot;
- int raw;
- resubmit:
- raw = raw_local_deliver(skb, protocol);
- ipprot = rcu_dereference(inet_protos[protocol]);
- if (ipprot) {
- int ret;
- if (!ipprot->no_policy) {
- if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
- kfree_skb(skb);
- goto out;
- }
- nf_reset(skb);
- }
- ret = ipprot->handler(skb);
- if (ret < 0) {
- protocol = -ret;
- goto resubmit;
- }
- __IP_INC_STATS(net, IPSTATS_MIB_INDELIVERS);
- } else {
- if (!raw) {
- if (xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
- __IP_INC_STATS(net, IPSTATS_MIB_INUNKNOWNPROTOS);
- icmp_send(skb, ICMP_DEST_UNREACH,
- ICMP_PROT_UNREACH, 0);
- }
- kfree_skb(skb);
- } else {
- __IP_INC_STATS(net, IPSTATS_MIB_INDELIVERS);
- consume_skb(skb);
- }
- }
- }
- out:
- rcu_read_unlock();
- return 0;
- }
- int ip_local_deliver(struct sk_buff *skb)
- {
-
- struct net *net = dev_net(skb->dev);
- if (ip_is_fragment(ip_hdr(skb))) {
- if (ip_defrag(net, skb, IP_DEFRAG_LOCAL_DELIVER))
- return 0;
- }
- return NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_IN,
- net, NULL, skb, skb->dev, NULL,
- ip_local_deliver_finish);
- }
- static inline bool ip_rcv_options(struct sk_buff *skb)
- {
- struct ip_options *opt;
- const struct iphdr *iph;
- struct net_device *dev = skb->dev;
-
- if (skb_cow(skb, skb_headroom(skb))) {
- __IP_INC_STATS(dev_net(dev), IPSTATS_MIB_INDISCARDS);
- goto drop;
- }
- iph = ip_hdr(skb);
- opt = &(IPCB(skb)->opt);
- opt->optlen = iph->ihl*4 - sizeof(struct iphdr);
- if (ip_options_compile(dev_net(dev), opt, skb)) {
- __IP_INC_STATS(dev_net(dev), IPSTATS_MIB_INHDRERRORS);
- goto drop;
- }
- if (unlikely(opt->srr)) {
- struct in_device *in_dev = __in_dev_get_rcu(dev);
- if (in_dev) {
- if (!IN_DEV_SOURCE_ROUTE(in_dev)) {
- if (IN_DEV_LOG_MARTIANS(in_dev))
- net_info_ratelimited("source route option %pI4 -> %pI4\n",
- &iph->saddr,
- &iph->daddr);
- goto drop;
- }
- }
- if (ip_options_rcv_srr(skb))
- goto drop;
- }
- return false;
- drop:
- return true;
- }
- static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
- {
- const struct iphdr *iph = ip_hdr(skb);
- struct rtable *rt;
- struct net_device *dev = skb->dev;
-
- skb = l3mdev_ip_rcv(skb);
- if (!skb)
- return NET_RX_SUCCESS;
- if (net->ipv4.sysctl_ip_early_demux &&
- !skb_dst(skb) &&
- !skb->sk &&
- !ip_is_fragment(iph)) {
- const struct net_protocol *ipprot;
- int protocol = iph->protocol;
- ipprot = rcu_dereference(inet_protos[protocol]);
- if (ipprot && ipprot->early_demux) {
- ipprot->early_demux(skb);
-
- iph = ip_hdr(skb);
- }
- }
-
- if (!skb_valid_dst(skb)) {
- int err = ip_route_input_noref(skb, iph->daddr, iph->saddr,
- iph->tos, dev);
- if (unlikely(err)) {
- if (err == -EXDEV)
- __NET_INC_STATS(net, LINUX_MIB_IPRPFILTER);
- goto drop;
- }
- }
- #ifdef CONFIG_IP_ROUTE_CLASSID
- if (unlikely(skb_dst(skb)->tclassid)) {
- struct ip_rt_acct *st = this_cpu_ptr(ip_rt_acct);
- u32 idx = skb_dst(skb)->tclassid;
- st[idx&0xFF].o_packets++;
- st[idx&0xFF].o_bytes += skb->len;
- st[(idx>>16)&0xFF].i_packets++;
- st[(idx>>16)&0xFF].i_bytes += skb->len;
- }
- #endif
- if (iph->ihl > 5 && ip_rcv_options(skb))
- goto drop;
- rt = skb_rtable(skb);
- if (rt->rt_type == RTN_MULTICAST) {
- __IP_UPD_PO_STATS(net, IPSTATS_MIB_INMCAST, skb->len);
- } else if (rt->rt_type == RTN_BROADCAST) {
- __IP_UPD_PO_STATS(net, IPSTATS_MIB_INBCAST, skb->len);
- } else if (skb->pkt_type == PACKET_BROADCAST ||
- skb->pkt_type == PACKET_MULTICAST) {
- struct in_device *in_dev = __in_dev_get_rcu(dev);
-
- if (in_dev &&
- IN_DEV_ORCONF(in_dev, DROP_UNICAST_IN_L2_MULTICAST))
- goto drop;
- }
- return dst_input(skb);
- drop:
- kfree_skb(skb);
- return NET_RX_DROP;
- }
- int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
- {
- const struct iphdr *iph;
- struct net *net;
- u32 len;
-
- if (skb->pkt_type == PACKET_OTHERHOST)
- goto drop;
- net = dev_net(dev);
- __IP_UPD_PO_STATS(net, IPSTATS_MIB_IN, skb->len);
- skb = skb_share_check(skb, GFP_ATOMIC);
- if (!skb) {
- __IP_INC_STATS(net, IPSTATS_MIB_INDISCARDS);
- goto out;
- }
- if (!pskb_may_pull(skb, sizeof(struct iphdr)))
- goto inhdr_error;
- iph = ip_hdr(skb);
-
- if (iph->ihl < 5 || iph->version != 4)
- goto inhdr_error;
- BUILD_BUG_ON(IPSTATS_MIB_ECT1PKTS != IPSTATS_MIB_NOECTPKTS + INET_ECN_ECT_1);
- BUILD_BUG_ON(IPSTATS_MIB_ECT0PKTS != IPSTATS_MIB_NOECTPKTS + INET_ECN_ECT_0);
- BUILD_BUG_ON(IPSTATS_MIB_CEPKTS != IPSTATS_MIB_NOECTPKTS + INET_ECN_CE);
- __IP_ADD_STATS(net,
- IPSTATS_MIB_NOECTPKTS + (iph->tos & INET_ECN_MASK),
- max_t(unsigned short, 1, skb_shinfo(skb)->gso_segs));
- if (!pskb_may_pull(skb, iph->ihl*4))
- goto inhdr_error;
- iph = ip_hdr(skb);
- if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
- goto csum_error;
- len = ntohs(iph->tot_len);
- if (skb->len < len) {
- __IP_INC_STATS(net, IPSTATS_MIB_INTRUNCATEDPKTS);
- goto drop;
- } else if (len < (iph->ihl*4))
- goto inhdr_error;
-
- if (pskb_trim_rcsum(skb, len)) {
- __IP_INC_STATS(net, IPSTATS_MIB_INDISCARDS);
- goto drop;
- }
- skb->transport_header = skb->network_header + iph->ihl*4;
-
- memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
- IPCB(skb)->iif = skb->skb_iif;
-
- skb_orphan(skb);
- return NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING,
- net, NULL, skb, dev, NULL,
- ip_rcv_finish);
- csum_error:
- __IP_INC_STATS(net, IPSTATS_MIB_CSUMERRORS);
- inhdr_error:
- __IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
- drop:
- kfree_skb(skb);
- out:
- return NET_RX_DROP;
- }
|