2 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
3 * Copyright (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Development of this code funded by Astaro AG (http://www.astaro.com/)
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/list.h>
15 #include <linux/skbuff.h>
16 #include <linux/netlink.h>
17 #include <linux/netfilter.h>
18 #include <linux/netfilter_ipv6.h>
19 #include <linux/netfilter/nfnetlink.h>
20 #include <linux/netfilter/nf_tables.h>
21 #include <net/netfilter/nf_tables.h>
22 #include <net/netfilter/nf_tables_ipv6.h>
23 #include <net/route.h>
25 static unsigned int nf_route_table_hook(void *priv
,
27 const struct nf_hook_state
*state
)
30 struct nft_pktinfo pkt
;
31 struct in6_addr saddr
, daddr
;
36 /* malformed packet, drop it */
37 if (nft_set_pktinfo_ipv6(&pkt
, skb
, state
) < 0)
40 /* save source/dest address, mark, hoplimit, flowlabel, priority */
41 memcpy(&saddr
, &ipv6_hdr(skb
)->saddr
, sizeof(saddr
));
42 memcpy(&daddr
, &ipv6_hdr(skb
)->daddr
, sizeof(daddr
));
44 hop_limit
= ipv6_hdr(skb
)->hop_limit
;
46 /* flowlabel and prio (includes version, which shouldn't change either */
47 flowlabel
= *((u32
*)ipv6_hdr(skb
));
49 ret
= nft_do_chain(&pkt
, priv
);
50 if (ret
!= NF_DROP
&& ret
!= NF_STOLEN
&&
51 (memcmp(&ipv6_hdr(skb
)->saddr
, &saddr
, sizeof(saddr
)) ||
52 memcmp(&ipv6_hdr(skb
)->daddr
, &daddr
, sizeof(daddr
)) ||
54 ipv6_hdr(skb
)->hop_limit
!= hop_limit
||
55 flowlabel
!= *((u_int32_t
*)ipv6_hdr(skb
)))) {
56 err
= ip6_route_me_harder(state
->net
, skb
);
58 ret
= NF_DROP_ERR(err
);
64 static const struct nf_chain_type nft_chain_route_ipv6
= {
66 .type
= NFT_CHAIN_T_ROUTE
,
67 .family
= NFPROTO_IPV6
,
69 .hook_mask
= (1 << NF_INET_LOCAL_OUT
),
71 [NF_INET_LOCAL_OUT
] = nf_route_table_hook
,
75 static int __init
nft_chain_route_init(void)
77 return nft_register_chain_type(&nft_chain_route_ipv6
);
80 static void __exit
nft_chain_route_exit(void)
82 nft_unregister_chain_type(&nft_chain_route_ipv6
);
85 module_init(nft_chain_route_init
);
86 module_exit(nft_chain_route_exit
);
88 MODULE_LICENSE("GPL");
89 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
90 MODULE_ALIAS_NFT_CHAIN(AF_INET6
, "route");