2 * IPv6 specific functions of netfilter core
4 * Rusty Russell (C) 2000 -- This code is GPL.
5 * Patrick McHardy (C) 2006-2012
7 #include <linux/kernel.h>
8 #include <linux/init.h>
9 #include <linux/ipv6.h>
10 #include <linux/netfilter.h>
11 #include <linux/netfilter_ipv6.h>
12 #include <linux/export.h>
13 #include <net/addrconf.h>
16 #include <net/ip6_route.h>
18 #include <net/ip6_checksum.h>
19 #include <net/netfilter/nf_queue.h>
21 int ip6_route_me_harder(struct net
*net
, struct sk_buff
*skb
)
23 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
24 struct sock
*sk
= sk_to_full_sk(skb
->sk
);
26 struct dst_entry
*dst
;
27 int strict
= (ipv6_addr_type(&iph
->daddr
) &
28 (IPV6_ADDR_MULTICAST
| IPV6_ADDR_LINKLOCAL
));
30 .flowi6_oif
= sk
&& sk
->sk_bound_dev_if
? sk
->sk_bound_dev_if
:
31 strict
? skb_dst(skb
)->dev
->ifindex
: 0,
32 .flowi6_mark
= skb
->mark
,
33 .flowi6_uid
= sock_net_uid(net
, sk
),
39 dst
= ip6_route_output(net
, sk
, &fl6
);
42 IP6_INC_STATS(net
, ip6_dst_idev(dst
), IPSTATS_MIB_OUTNOROUTES
);
43 net_dbg_ratelimited("ip6_route_me_harder: No more route\n");
51 skb_dst_set(skb
, dst
);
54 if (!(IP6CB(skb
)->flags
& IP6SKB_XFRM_TRANSFORMED
) &&
55 xfrm_decode_session(skb
, flowi6_to_flowi(&fl6
), AF_INET6
) == 0) {
56 skb_dst_set(skb
, NULL
);
57 dst
= xfrm_lookup(net
, dst
, flowi6_to_flowi(&fl6
), sk
, 0);
60 skb_dst_set(skb
, dst
);
64 /* Change in oif may mean change in hh_len. */
65 hh_len
= skb_dst(skb
)->dev
->hard_header_len
;
66 if (skb_headroom(skb
) < hh_len
&&
67 pskb_expand_head(skb
, HH_DATA_ALIGN(hh_len
- skb_headroom(skb
)),
73 EXPORT_SYMBOL(ip6_route_me_harder
);
76 * Extra routing may needed on local out, as the QUEUE target never
77 * returns control to the table.
81 struct in6_addr daddr
;
82 struct in6_addr saddr
;
86 static void nf_ip6_saveroute(const struct sk_buff
*skb
,
87 struct nf_queue_entry
*entry
)
89 struct ip6_rt_info
*rt_info
= nf_queue_entry_reroute(entry
);
91 if (entry
->state
.hook
== NF_INET_LOCAL_OUT
) {
92 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
94 rt_info
->daddr
= iph
->daddr
;
95 rt_info
->saddr
= iph
->saddr
;
96 rt_info
->mark
= skb
->mark
;
100 static int nf_ip6_reroute(struct net
*net
, struct sk_buff
*skb
,
101 const struct nf_queue_entry
*entry
)
103 struct ip6_rt_info
*rt_info
= nf_queue_entry_reroute(entry
);
105 if (entry
->state
.hook
== NF_INET_LOCAL_OUT
) {
106 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
107 if (!ipv6_addr_equal(&iph
->daddr
, &rt_info
->daddr
) ||
108 !ipv6_addr_equal(&iph
->saddr
, &rt_info
->saddr
) ||
109 skb
->mark
!= rt_info
->mark
)
110 return ip6_route_me_harder(net
, skb
);
115 static int nf_ip6_route(struct net
*net
, struct dst_entry
**dst
,
116 struct flowi
*fl
, bool strict
)
118 static const struct ipv6_pinfo fake_pinfo
;
119 static const struct inet_sock fake_sk
= {
120 /* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */
121 .sk
.sk_bound_dev_if
= 1,
122 .pinet6
= (struct ipv6_pinfo
*) &fake_pinfo
,
124 const void *sk
= strict
? &fake_sk
: NULL
;
125 struct dst_entry
*result
;
128 result
= ip6_route_output(net
, sk
, &fl
->u
.ip6
);
137 __sum16
nf_ip6_checksum(struct sk_buff
*skb
, unsigned int hook
,
138 unsigned int dataoff
, u_int8_t protocol
)
140 const struct ipv6hdr
*ip6h
= ipv6_hdr(skb
);
143 switch (skb
->ip_summed
) {
144 case CHECKSUM_COMPLETE
:
145 if (hook
!= NF_INET_PRE_ROUTING
&& hook
!= NF_INET_LOCAL_IN
)
147 if (!csum_ipv6_magic(&ip6h
->saddr
, &ip6h
->daddr
,
148 skb
->len
- dataoff
, protocol
,
152 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
157 skb
->csum
= ~csum_unfold(
158 csum_ipv6_magic(&ip6h
->saddr
, &ip6h
->daddr
,
164 csum
= __skb_checksum_complete(skb
);
168 EXPORT_SYMBOL(nf_ip6_checksum
);
170 static __sum16
nf_ip6_checksum_partial(struct sk_buff
*skb
, unsigned int hook
,
171 unsigned int dataoff
, unsigned int len
,
174 const struct ipv6hdr
*ip6h
= ipv6_hdr(skb
);
178 switch (skb
->ip_summed
) {
179 case CHECKSUM_COMPLETE
:
180 if (len
== skb
->len
- dataoff
)
181 return nf_ip6_checksum(skb
, hook
, dataoff
, protocol
);
184 hsum
= skb_checksum(skb
, 0, dataoff
, 0);
185 skb
->csum
= ~csum_unfold(csum_ipv6_magic(&ip6h
->saddr
,
190 skb
->ip_summed
= CHECKSUM_NONE
;
191 return __skb_checksum_complete_head(skb
, dataoff
+ len
);
196 static const struct nf_ipv6_ops ipv6ops
= {
197 .chk_addr
= ipv6_chk_addr
,
198 .route_input
= ip6_route_input
,
199 .fragment
= ip6_fragment
202 static const struct nf_afinfo nf_ip6_afinfo
= {
204 .checksum
= nf_ip6_checksum
,
205 .checksum_partial
= nf_ip6_checksum_partial
,
206 .route
= nf_ip6_route
,
207 .saveroute
= nf_ip6_saveroute
,
208 .reroute
= nf_ip6_reroute
,
209 .route_key_size
= sizeof(struct ip6_rt_info
),
212 int __init
ipv6_netfilter_init(void)
214 RCU_INIT_POINTER(nf_ipv6_ops
, &ipv6ops
);
215 return nf_register_afinfo(&nf_ip6_afinfo
);
218 /* This can be called from inet6_init() on errors, so it cannot
219 * be marked __exit. -DaveM
221 void ipv6_netfilter_fini(void)
223 RCU_INIT_POINTER(nf_ipv6_ops
, NULL
);
224 nf_unregister_afinfo(&nf_ip6_afinfo
);