2 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
3 * Copyright (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Development of this code funded by Astaro AG (http://www.astaro.com/)
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/list.h>
15 #include <linux/skbuff.h>
16 #include <linux/netlink.h>
17 #include <linux/netfilter.h>
18 #include <linux/netfilter_ipv6.h>
19 #include <linux/netfilter/nfnetlink.h>
20 #include <linux/netfilter/nf_tables.h>
21 #include <net/netfilter/nf_tables.h>
22 #include <net/netfilter/nf_tables_ipv6.h>
23 #include <net/route.h>
25 static unsigned int nf_route_table_hook(void *priv
,
27 const struct nf_hook_state
*state
)
30 struct nft_pktinfo pkt
;
31 struct in6_addr saddr
, daddr
;
35 nft_set_pktinfo_ipv6(&pkt
, skb
, state
);
37 /* save source/dest address, mark, hoplimit, flowlabel, priority */
38 memcpy(&saddr
, &ipv6_hdr(skb
)->saddr
, sizeof(saddr
));
39 memcpy(&daddr
, &ipv6_hdr(skb
)->daddr
, sizeof(daddr
));
41 hop_limit
= ipv6_hdr(skb
)->hop_limit
;
43 /* flowlabel and prio (includes version, which shouldn't change either */
44 flowlabel
= *((u32
*)ipv6_hdr(skb
));
46 ret
= nft_do_chain(&pkt
, priv
);
47 if (ret
!= NF_DROP
&& ret
!= NF_QUEUE
&&
48 (memcmp(&ipv6_hdr(skb
)->saddr
, &saddr
, sizeof(saddr
)) ||
49 memcmp(&ipv6_hdr(skb
)->daddr
, &daddr
, sizeof(daddr
)) ||
51 ipv6_hdr(skb
)->hop_limit
!= hop_limit
||
52 flowlabel
!= *((u_int32_t
*)ipv6_hdr(skb
))))
53 return ip6_route_me_harder(state
->net
, skb
) == 0 ? ret
: NF_DROP
;
58 static const struct nf_chain_type nft_chain_route_ipv6
= {
60 .type
= NFT_CHAIN_T_ROUTE
,
61 .family
= NFPROTO_IPV6
,
63 .hook_mask
= (1 << NF_INET_LOCAL_OUT
),
65 [NF_INET_LOCAL_OUT
] = nf_route_table_hook
,
69 static int __init
nft_chain_route_init(void)
71 return nft_register_chain_type(&nft_chain_route_ipv6
);
74 static void __exit
nft_chain_route_exit(void)
76 nft_unregister_chain_type(&nft_chain_route_ipv6
);
79 module_init(nft_chain_route_init
);
80 module_exit(nft_chain_route_exit
);
82 MODULE_LICENSE("GPL");
83 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
84 MODULE_ALIAS_NFT_CHAIN(AF_INET6
, "route");