2 * IPv6 specific functions of netfilter core
4 * Rusty Russell (C) 2000 -- This code is GPL.
5 * Patrick McHardy (C) 2006-2012
7 #include <linux/kernel.h>
8 #include <linux/init.h>
9 #include <linux/ipv6.h>
10 #include <linux/netfilter.h>
11 #include <linux/netfilter_ipv6.h>
12 #include <linux/export.h>
13 #include <net/addrconf.h>
16 #include <net/ip6_route.h>
18 #include <net/ip6_checksum.h>
19 #include <net/netfilter/nf_queue.h>
21 int ip6_route_me_harder(struct sk_buff
*skb
)
23 struct net
*net
= dev_net(skb_dst(skb
)->dev
);
24 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
26 struct dst_entry
*dst
;
28 .flowi6_oif
= skb
->sk
? skb
->sk
->sk_bound_dev_if
: 0,
29 .flowi6_mark
= skb
->mark
,
35 dst
= ip6_route_output(net
, skb
->sk
, &fl6
);
38 IP6_INC_STATS(net
, ip6_dst_idev(dst
), IPSTATS_MIB_OUTNOROUTES
);
39 LIMIT_NETDEBUG(KERN_DEBUG
"ip6_route_me_harder: No more route.\n");
47 skb_dst_set(skb
, dst
);
50 if (!(IP6CB(skb
)->flags
& IP6SKB_XFRM_TRANSFORMED
) &&
51 xfrm_decode_session(skb
, flowi6_to_flowi(&fl6
), AF_INET6
) == 0) {
52 skb_dst_set(skb
, NULL
);
53 dst
= xfrm_lookup(net
, dst
, flowi6_to_flowi(&fl6
), skb
->sk
, 0);
56 skb_dst_set(skb
, dst
);
60 /* Change in oif may mean change in hh_len. */
61 hh_len
= skb_dst(skb
)->dev
->hard_header_len
;
62 if (skb_headroom(skb
) < hh_len
&&
63 pskb_expand_head(skb
, HH_DATA_ALIGN(hh_len
- skb_headroom(skb
)),
69 EXPORT_SYMBOL(ip6_route_me_harder
);
72 * Extra routing may needed on local out, as the QUEUE target never
73 * returns control to the table.
77 struct in6_addr daddr
;
78 struct in6_addr saddr
;
82 static void nf_ip6_saveroute(const struct sk_buff
*skb
,
83 struct nf_queue_entry
*entry
)
85 struct ip6_rt_info
*rt_info
= nf_queue_entry_reroute(entry
);
87 if (entry
->hook
== NF_INET_LOCAL_OUT
) {
88 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
90 rt_info
->daddr
= iph
->daddr
;
91 rt_info
->saddr
= iph
->saddr
;
92 rt_info
->mark
= skb
->mark
;
96 static int nf_ip6_reroute(struct sk_buff
*skb
,
97 const struct nf_queue_entry
*entry
)
99 struct ip6_rt_info
*rt_info
= nf_queue_entry_reroute(entry
);
101 if (entry
->hook
== NF_INET_LOCAL_OUT
) {
102 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
103 if (!ipv6_addr_equal(&iph
->daddr
, &rt_info
->daddr
) ||
104 !ipv6_addr_equal(&iph
->saddr
, &rt_info
->saddr
) ||
105 skb
->mark
!= rt_info
->mark
)
106 return ip6_route_me_harder(skb
);
111 static int nf_ip6_route(struct net
*net
, struct dst_entry
**dst
,
112 struct flowi
*fl
, bool strict
)
114 static const struct ipv6_pinfo fake_pinfo
;
115 static const struct inet_sock fake_sk
= {
116 /* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */
117 .sk
.sk_bound_dev_if
= 1,
118 .pinet6
= (struct ipv6_pinfo
*) &fake_pinfo
,
120 const void *sk
= strict
? &fake_sk
: NULL
;
121 struct dst_entry
*result
;
124 result
= ip6_route_output(net
, sk
, &fl
->u
.ip6
);
133 __sum16
nf_ip6_checksum(struct sk_buff
*skb
, unsigned int hook
,
134 unsigned int dataoff
, u_int8_t protocol
)
136 const struct ipv6hdr
*ip6h
= ipv6_hdr(skb
);
139 switch (skb
->ip_summed
) {
140 case CHECKSUM_COMPLETE
:
141 if (hook
!= NF_INET_PRE_ROUTING
&& hook
!= NF_INET_LOCAL_IN
)
143 if (!csum_ipv6_magic(&ip6h
->saddr
, &ip6h
->daddr
,
144 skb
->len
- dataoff
, protocol
,
148 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
153 skb
->csum
= ~csum_unfold(
154 csum_ipv6_magic(&ip6h
->saddr
, &ip6h
->daddr
,
160 csum
= __skb_checksum_complete(skb
);
164 EXPORT_SYMBOL(nf_ip6_checksum
);
166 static __sum16
nf_ip6_checksum_partial(struct sk_buff
*skb
, unsigned int hook
,
167 unsigned int dataoff
, unsigned int len
,
170 const struct ipv6hdr
*ip6h
= ipv6_hdr(skb
);
174 switch (skb
->ip_summed
) {
175 case CHECKSUM_COMPLETE
:
176 if (len
== skb
->len
- dataoff
)
177 return nf_ip6_checksum(skb
, hook
, dataoff
, protocol
);
180 hsum
= skb_checksum(skb
, 0, dataoff
, 0);
181 skb
->csum
= ~csum_unfold(csum_ipv6_magic(&ip6h
->saddr
,
186 skb
->ip_summed
= CHECKSUM_NONE
;
187 return __skb_checksum_complete_head(skb
, dataoff
+ len
);
192 static const struct nf_ipv6_ops ipv6ops
= {
193 .chk_addr
= ipv6_chk_addr
,
196 static const struct nf_afinfo nf_ip6_afinfo
= {
198 .checksum
= nf_ip6_checksum
,
199 .checksum_partial
= nf_ip6_checksum_partial
,
200 .route
= nf_ip6_route
,
201 .saveroute
= nf_ip6_saveroute
,
202 .reroute
= nf_ip6_reroute
,
203 .route_key_size
= sizeof(struct ip6_rt_info
),
206 int __init
ipv6_netfilter_init(void)
208 RCU_INIT_POINTER(nf_ipv6_ops
, &ipv6ops
);
209 return nf_register_afinfo(&nf_ip6_afinfo
);
212 /* This can be called from inet6_init() on errors, so it cannot
213 * be marked __exit. -DaveM
215 void ipv6_netfilter_fini(void)
217 RCU_INIT_POINTER(nf_ipv6_ops
, NULL
);
218 nf_unregister_afinfo(&nf_ip6_afinfo
);
This page took 0.035403 seconds and 6 git commands to generate.