]>
git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blob - net/ipv6/netfilter.c
1240ccd57f394463f6bec15babb2f46f710898e3
2 * IPv6 specific functions of netfilter core
4 * Rusty Russell (C) 2000 -- This code is GPL.
5 * Patrick McHardy (C) 2006-2012
7 #include <linux/kernel.h>
8 #include <linux/init.h>
9 #include <linux/ipv6.h>
10 #include <linux/netfilter.h>
11 #include <linux/netfilter_ipv6.h>
12 #include <linux/export.h>
13 #include <net/addrconf.h>
16 #include <net/ip6_route.h>
18 #include <net/netfilter/nf_queue.h>
20 int ip6_route_me_harder(struct net
*net
, struct sk_buff
*skb
)
22 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
23 struct sock
*sk
= sk_to_full_sk(skb
->sk
);
25 struct dst_entry
*dst
;
26 int strict
= (ipv6_addr_type(&iph
->daddr
) &
27 (IPV6_ADDR_MULTICAST
| IPV6_ADDR_LINKLOCAL
));
29 .flowi6_oif
= sk
&& sk
->sk_bound_dev_if
? sk
->sk_bound_dev_if
:
30 strict
? skb_dst(skb
)->dev
->ifindex
: 0,
31 .flowi6_mark
= skb
->mark
,
32 .flowi6_uid
= sock_net_uid(net
, sk
),
38 dst
= ip6_route_output(net
, sk
, &fl6
);
41 IP6_INC_STATS(net
, ip6_dst_idev(dst
), IPSTATS_MIB_OUTNOROUTES
);
42 net_dbg_ratelimited("ip6_route_me_harder: No more route\n");
50 skb_dst_set(skb
, dst
);
53 if (!(IP6CB(skb
)->flags
& IP6SKB_XFRM_TRANSFORMED
) &&
54 xfrm_decode_session(skb
, flowi6_to_flowi(&fl6
), AF_INET6
) == 0) {
55 skb_dst_set(skb
, NULL
);
56 dst
= xfrm_lookup(net
, dst
, flowi6_to_flowi(&fl6
), sk
, 0);
59 skb_dst_set(skb
, dst
);
63 /* Change in oif may mean change in hh_len. */
64 hh_len
= skb_dst(skb
)->dev
->hard_header_len
;
65 if (skb_headroom(skb
) < hh_len
&&
66 pskb_expand_head(skb
, HH_DATA_ALIGN(hh_len
- skb_headroom(skb
)),
72 EXPORT_SYMBOL(ip6_route_me_harder
);
74 static int nf_ip6_reroute(struct sk_buff
*skb
,
75 const struct nf_queue_entry
*entry
)
77 struct ip6_rt_info
*rt_info
= nf_queue_entry_reroute(entry
);
79 if (entry
->state
.hook
== NF_INET_LOCAL_OUT
) {
80 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
81 if (!ipv6_addr_equal(&iph
->daddr
, &rt_info
->daddr
) ||
82 !ipv6_addr_equal(&iph
->saddr
, &rt_info
->saddr
) ||
83 skb
->mark
!= rt_info
->mark
)
84 return ip6_route_me_harder(entry
->state
.net
, skb
);
89 int __nf_ip6_route(struct net
*net
, struct dst_entry
**dst
,
90 struct flowi
*fl
, bool strict
)
92 static const struct ipv6_pinfo fake_pinfo
;
93 static const struct inet_sock fake_sk
= {
94 /* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */
95 .sk
.sk_bound_dev_if
= 1,
96 .pinet6
= (struct ipv6_pinfo
*) &fake_pinfo
,
98 const void *sk
= strict
? &fake_sk
: NULL
;
99 struct dst_entry
*result
;
102 result
= ip6_route_output(net
, sk
, &fl
->u
.ip6
);
110 EXPORT_SYMBOL_GPL(__nf_ip6_route
);
112 static const struct nf_ipv6_ops ipv6ops
= {
113 #if IS_MODULE(CONFIG_IPV6)
114 .chk_addr
= ipv6_chk_addr
,
115 .route_me_harder
= ip6_route_me_harder
,
116 .dev_get_saddr
= ipv6_dev_get_saddr
,
117 .route
= __nf_ip6_route
,
119 .route_input
= ip6_route_input
,
120 .fragment
= ip6_fragment
,
121 .reroute
= nf_ip6_reroute
,
124 int __init
ipv6_netfilter_init(void)
126 RCU_INIT_POINTER(nf_ipv6_ops
, &ipv6ops
);
130 /* This can be called from inet6_init() on errors, so it cannot
131 * be marked __exit. -DaveM
133 void ipv6_netfilter_fini(void)
135 RCU_INIT_POINTER(nf_ipv6_ops
, NULL
);