]>
git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/ipv6/netfilter.c
2 * IPv6 specific functions of netfilter core
4 * Rusty Russell (C) 2000 -- This code is GPL.
5 * Patrick McHardy (C) 2006-2012
7 #include <linux/kernel.h>
8 #include <linux/init.h>
9 #include <linux/ipv6.h>
10 #include <linux/netfilter.h>
11 #include <linux/netfilter_ipv6.h>
12 #include <linux/export.h>
13 #include <net/addrconf.h>
16 #include <net/ip6_route.h>
18 #include <net/ip6_checksum.h>
19 #include <net/netfilter/nf_queue.h>
21 int ip6_route_me_harder(struct net
*net
, struct sk_buff
*skb
)
23 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
24 struct sock
*sk
= sk_to_full_sk(skb
->sk
);
26 struct dst_entry
*dst
;
28 .flowi6_oif
= sk
? sk
->sk_bound_dev_if
: 0,
29 .flowi6_mark
= skb
->mark
,
30 .flowi6_uid
= sock_net_uid(net
, sk
),
36 dst
= ip6_route_output(net
, sk
, &fl6
);
39 IP6_INC_STATS(net
, ip6_dst_idev(dst
), IPSTATS_MIB_OUTNOROUTES
);
40 net_dbg_ratelimited("ip6_route_me_harder: No more route\n");
48 skb_dst_set(skb
, dst
);
51 if (!(IP6CB(skb
)->flags
& IP6SKB_XFRM_TRANSFORMED
) &&
52 xfrm_decode_session(skb
, flowi6_to_flowi(&fl6
), AF_INET6
) == 0) {
53 skb_dst_set(skb
, NULL
);
54 dst
= xfrm_lookup(net
, dst
, flowi6_to_flowi(&fl6
), sk
, 0);
57 skb_dst_set(skb
, dst
);
61 /* Change in oif may mean change in hh_len. */
62 hh_len
= skb_dst(skb
)->dev
->hard_header_len
;
63 if (skb_headroom(skb
) < hh_len
&&
64 pskb_expand_head(skb
, HH_DATA_ALIGN(hh_len
- skb_headroom(skb
)),
70 EXPORT_SYMBOL(ip6_route_me_harder
);
73 * Extra routing may needed on local out, as the QUEUE target never
74 * returns control to the table.
78 struct in6_addr daddr
;
79 struct in6_addr saddr
;
83 static void nf_ip6_saveroute(const struct sk_buff
*skb
,
84 struct nf_queue_entry
*entry
)
86 struct ip6_rt_info
*rt_info
= nf_queue_entry_reroute(entry
);
88 if (entry
->state
.hook
== NF_INET_LOCAL_OUT
) {
89 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
91 rt_info
->daddr
= iph
->daddr
;
92 rt_info
->saddr
= iph
->saddr
;
93 rt_info
->mark
= skb
->mark
;
97 static int nf_ip6_reroute(struct net
*net
, struct sk_buff
*skb
,
98 const struct nf_queue_entry
*entry
)
100 struct ip6_rt_info
*rt_info
= nf_queue_entry_reroute(entry
);
102 if (entry
->state
.hook
== NF_INET_LOCAL_OUT
) {
103 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
104 if (!ipv6_addr_equal(&iph
->daddr
, &rt_info
->daddr
) ||
105 !ipv6_addr_equal(&iph
->saddr
, &rt_info
->saddr
) ||
106 skb
->mark
!= rt_info
->mark
)
107 return ip6_route_me_harder(net
, skb
);
112 static int nf_ip6_route(struct net
*net
, struct dst_entry
**dst
,
113 struct flowi
*fl
, bool strict
)
115 static const struct ipv6_pinfo fake_pinfo
;
116 static const struct inet_sock fake_sk
= {
117 /* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */
118 .sk
.sk_bound_dev_if
= 1,
119 .pinet6
= (struct ipv6_pinfo
*) &fake_pinfo
,
121 const void *sk
= strict
? &fake_sk
: NULL
;
122 struct dst_entry
*result
;
125 result
= ip6_route_output(net
, sk
, &fl
->u
.ip6
);
134 __sum16
nf_ip6_checksum(struct sk_buff
*skb
, unsigned int hook
,
135 unsigned int dataoff
, u_int8_t protocol
)
137 const struct ipv6hdr
*ip6h
= ipv6_hdr(skb
);
140 switch (skb
->ip_summed
) {
141 case CHECKSUM_COMPLETE
:
142 if (hook
!= NF_INET_PRE_ROUTING
&& hook
!= NF_INET_LOCAL_IN
)
144 if (!csum_ipv6_magic(&ip6h
->saddr
, &ip6h
->daddr
,
145 skb
->len
- dataoff
, protocol
,
149 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
154 skb
->csum
= ~csum_unfold(
155 csum_ipv6_magic(&ip6h
->saddr
, &ip6h
->daddr
,
161 csum
= __skb_checksum_complete(skb
);
165 EXPORT_SYMBOL(nf_ip6_checksum
);
167 static __sum16
nf_ip6_checksum_partial(struct sk_buff
*skb
, unsigned int hook
,
168 unsigned int dataoff
, unsigned int len
,
171 const struct ipv6hdr
*ip6h
= ipv6_hdr(skb
);
175 switch (skb
->ip_summed
) {
176 case CHECKSUM_COMPLETE
:
177 if (len
== skb
->len
- dataoff
)
178 return nf_ip6_checksum(skb
, hook
, dataoff
, protocol
);
181 hsum
= skb_checksum(skb
, 0, dataoff
, 0);
182 skb
->csum
= ~csum_unfold(csum_ipv6_magic(&ip6h
->saddr
,
187 skb
->ip_summed
= CHECKSUM_NONE
;
188 return __skb_checksum_complete_head(skb
, dataoff
+ len
);
193 static const struct nf_ipv6_ops ipv6ops
= {
194 .chk_addr
= ipv6_chk_addr
,
195 .route_input
= ip6_route_input
,
196 .fragment
= ip6_fragment
199 static const struct nf_afinfo nf_ip6_afinfo
= {
201 .checksum
= nf_ip6_checksum
,
202 .checksum_partial
= nf_ip6_checksum_partial
,
203 .route
= nf_ip6_route
,
204 .saveroute
= nf_ip6_saveroute
,
205 .reroute
= nf_ip6_reroute
,
206 .route_key_size
= sizeof(struct ip6_rt_info
),
209 int __init
ipv6_netfilter_init(void)
211 RCU_INIT_POINTER(nf_ipv6_ops
, &ipv6ops
);
212 return nf_register_afinfo(&nf_ip6_afinfo
);
215 /* This can be called from inet6_init() on errors, so it cannot
216 * be marked __exit. -DaveM
218 void ipv6_netfilter_fini(void)
220 RCU_INIT_POINTER(nf_ipv6_ops
, NULL
);
221 nf_unregister_afinfo(&nf_ip6_afinfo
);