include/net/netfilter/nf_tables_ipv6.h

   1 #ifndef _NF_TABLES_IPV6_H_
   2 #define _NF_TABLES_IPV6_H_
   3
   4 #include <linux/netfilter_ipv6/ip6_tables.h>
   5 #include <net/ipv6.h>
   6
   7 static inline void
   8 nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
   9                      struct sk_buff *skb,
  10                      const struct nf_hook_state *state)
  11 {
  12         int protohdr, thoff = 0;
  13         unsigned short frag_off;
  14
  15         nft_set_pktinfo(pkt, skb, state);
  16
  17         protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, NULL);
  18         if (protohdr < 0) {
  19                 nft_set_pktinfo_proto_unspec(pkt, skb);
  20                 return;
  21         }
  22
  23         pkt->tprot_set = true;
  24         pkt->tprot = protohdr;
  25         pkt->xt.thoff = thoff;
  26         pkt->xt.fragoff = frag_off;
  27 }
  28
  29 static inline int
  30 __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
  31                                 struct sk_buff *skb,
  32                                 const struct nf_hook_state *state)
  33 {
  34 #if IS_ENABLED(CONFIG_IPV6)
  35         struct ipv6hdr *ip6h, _ip6h;
  36         unsigned int thoff = 0;
  37         unsigned short frag_off;
  38         int protohdr;
  39         u32 pkt_len;
  40
  41         ip6h = skb_header_pointer(skb, skb_network_offset(skb), sizeof(*ip6h),
  42                                   &_ip6h);
  43         if (!ip6h)
  44                 return -1;
  45
  46         if (ip6h->version != 6)
  47                 return -1;
  48
  49         pkt_len = ntohs(ip6h->payload_len);
  50         if (pkt_len + sizeof(*ip6h) > skb->len)
  51                 return -1;
  52
  53         protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, NULL);
  54         if (protohdr < 0)
  55                 return -1;
  56
  57         pkt->tprot_set = true;
  58         pkt->tprot = protohdr;
  59         pkt->xt.thoff = thoff;
  60         pkt->xt.fragoff = frag_off;
  61
  62         return 0;
  63 #else
  64         return -1;
  65 #endif
  66 }
  67
  68 static inline void
  69 nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
  70                               struct sk_buff *skb,
  71                               const struct nf_hook_state *state)
  72 {
  73         nft_set_pktinfo(pkt, skb, state);
  74         if (__nft_set_pktinfo_ipv6_validate(pkt, skb, state) < 0)
  75                 nft_set_pktinfo_proto_unspec(pkt, skb);
  76 }
  77
  78 extern struct nft_af_info nft_af_ipv6;
  79
  80 #endif