1 #include <linux/kernel.h>
2 #include <linux/init.h>
3 #include <linux/ipv6.h>
4 #include <linux/netfilter.h>
5 #include <linux/netfilter_ipv6.h>
8 #include <net/ip6_route.h>
10 #include <net/ip6_checksum.h>
11 #include <net/netfilter/nf_queue.h>
13 int ip6_route_me_harder(struct sk_buff
*skb
)
15 struct net
*net
= dev_net(skb
->dst
->dev
);
16 struct ipv6hdr
*iph
= ipv6_hdr(skb
);
17 struct dst_entry
*dst
;
19 .oif
= skb
->sk
? skb
->sk
->sk_bound_dev_if
: 0,
23 { .daddr
= iph
->daddr
,
24 .saddr
= iph
->saddr
, } },
27 dst
= ip6_route_output(net
, skb
->sk
, &fl
);
30 if (!(IP6CB(skb
)->flags
& IP6SKB_XFRM_TRANSFORMED
) &&
31 xfrm_decode_session(skb
, &fl
, AF_INET6
) == 0)
32 if (xfrm_lookup(net
, &skb
->dst
, &fl
, skb
->sk
, 0))
37 IP6_INC_STATS(net
, ip6_dst_idev(dst
), IPSTATS_MIB_OUTNOROUTES
);
38 LIMIT_NETDEBUG(KERN_DEBUG
"ip6_route_me_harder: No more route.\n");
44 dst_release(skb
->dst
);
49 EXPORT_SYMBOL(ip6_route_me_harder
);
52 * Extra routing may needed on local out, as the QUEUE target never
53 * returns control to the table.
57 struct in6_addr daddr
;
58 struct in6_addr saddr
;
62 static void nf_ip6_saveroute(const struct sk_buff
*skb
,
63 struct nf_queue_entry
*entry
)
65 struct ip6_rt_info
*rt_info
= nf_queue_entry_reroute(entry
);
67 if (entry
->hook
== NF_INET_LOCAL_OUT
) {
68 struct ipv6hdr
*iph
= ipv6_hdr(skb
);
70 rt_info
->daddr
= iph
->daddr
;
71 rt_info
->saddr
= iph
->saddr
;
72 rt_info
->mark
= skb
->mark
;
76 static int nf_ip6_reroute(struct sk_buff
*skb
,
77 const struct nf_queue_entry
*entry
)
79 struct ip6_rt_info
*rt_info
= nf_queue_entry_reroute(entry
);
81 if (entry
->hook
== NF_INET_LOCAL_OUT
) {
82 struct ipv6hdr
*iph
= ipv6_hdr(skb
);
83 if (!ipv6_addr_equal(&iph
->daddr
, &rt_info
->daddr
) ||
84 !ipv6_addr_equal(&iph
->saddr
, &rt_info
->saddr
) ||
85 skb
->mark
!= rt_info
->mark
)
86 return ip6_route_me_harder(skb
);
91 static int nf_ip6_route(struct dst_entry
**dst
, struct flowi
*fl
)
93 *dst
= ip6_route_output(&init_net
, NULL
, fl
);
97 __sum16
nf_ip6_checksum(struct sk_buff
*skb
, unsigned int hook
,
98 unsigned int dataoff
, u_int8_t protocol
)
100 struct ipv6hdr
*ip6h
= ipv6_hdr(skb
);
103 switch (skb
->ip_summed
) {
104 case CHECKSUM_COMPLETE
:
105 if (hook
!= NF_INET_PRE_ROUTING
&& hook
!= NF_INET_LOCAL_IN
)
107 if (!csum_ipv6_magic(&ip6h
->saddr
, &ip6h
->daddr
,
108 skb
->len
- dataoff
, protocol
,
112 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
117 skb
->csum
= ~csum_unfold(
118 csum_ipv6_magic(&ip6h
->saddr
, &ip6h
->daddr
,
124 csum
= __skb_checksum_complete(skb
);
128 EXPORT_SYMBOL(nf_ip6_checksum
);
130 static __sum16
nf_ip6_checksum_partial(struct sk_buff
*skb
, unsigned int hook
,
131 unsigned int dataoff
, unsigned int len
,
134 struct ipv6hdr
*ip6h
= ipv6_hdr(skb
);
138 switch (skb
->ip_summed
) {
139 case CHECKSUM_COMPLETE
:
140 if (len
== skb
->len
- dataoff
)
141 return nf_ip6_checksum(skb
, hook
, dataoff
, protocol
);
144 hsum
= skb_checksum(skb
, 0, dataoff
, 0);
145 skb
->csum
= ~csum_unfold(csum_ipv6_magic(&ip6h
->saddr
,
150 skb
->ip_summed
= CHECKSUM_NONE
;
151 csum
= __skb_checksum_complete_head(skb
, dataoff
+ len
);
153 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
158 static const struct nf_afinfo nf_ip6_afinfo
= {
160 .checksum
= nf_ip6_checksum
,
161 .checksum_partial
= nf_ip6_checksum_partial
,
162 .route
= nf_ip6_route
,
163 .saveroute
= nf_ip6_saveroute
,
164 .reroute
= nf_ip6_reroute
,
165 .route_key_size
= sizeof(struct ip6_rt_info
),
168 int __init
ipv6_netfilter_init(void)
170 return nf_register_afinfo(&nf_ip6_afinfo
);
173 /* This can be called from inet6_init() on errors, so it cannot
174 * be marked __exit. -DaveM
176 void ipv6_netfilter_fini(void)
178 nf_unregister_afinfo(&nf_ip6_afinfo
);
This page took 0.034316 seconds and 5 git commands to generate.