2 * IPv6 specific functions of netfilter core
4 * Rusty Russell (C) 2000 -- This code is GPL.
5 * Patrick McHardy (C) 2006-2012
7 #include <linux/kernel.h>
8 #include <linux/init.h>
9 #include <linux/ipv6.h>
10 #include <linux/netfilter.h>
11 #include <linux/netfilter_ipv6.h>
12 #include <linux/export.h>
15 #include <net/ip6_route.h>
17 #include <net/ip6_checksum.h>
18 #include <net/netfilter/nf_queue.h>
20 int ip6_route_me_harder(struct sk_buff
*skb
)
22 struct net
*net
= dev_net(skb_dst(skb
)->dev
);
23 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
25 struct dst_entry
*dst
;
27 .flowi6_oif
= skb
->sk
? skb
->sk
->sk_bound_dev_if
: 0,
28 .flowi6_mark
= skb
->mark
,
33 dst
= ip6_route_output(net
, skb
->sk
, &fl6
);
35 IP6_INC_STATS(net
, ip6_dst_idev(dst
), IPSTATS_MIB_OUTNOROUTES
);
36 LIMIT_NETDEBUG(KERN_DEBUG
"ip6_route_me_harder: No more route.\n");
44 skb_dst_set(skb
, dst
);
47 if (!(IP6CB(skb
)->flags
& IP6SKB_XFRM_TRANSFORMED
) &&
48 xfrm_decode_session(skb
, flowi6_to_flowi(&fl6
), AF_INET6
) == 0) {
49 skb_dst_set(skb
, NULL
);
50 dst
= xfrm_lookup(net
, dst
, flowi6_to_flowi(&fl6
), skb
->sk
, 0);
53 skb_dst_set(skb
, dst
);
57 /* Change in oif may mean change in hh_len. */
58 hh_len
= skb_dst(skb
)->dev
->hard_header_len
;
59 if (skb_headroom(skb
) < hh_len
&&
60 pskb_expand_head(skb
, HH_DATA_ALIGN(hh_len
- skb_headroom(skb
)),
66 EXPORT_SYMBOL(ip6_route_me_harder
);
69 * Extra routing may needed on local out, as the QUEUE target never
70 * returns control to the table.
74 struct in6_addr daddr
;
75 struct in6_addr saddr
;
79 static void nf_ip6_saveroute(const struct sk_buff
*skb
,
80 struct nf_queue_entry
*entry
)
82 struct ip6_rt_info
*rt_info
= nf_queue_entry_reroute(entry
);
84 if (entry
->hook
== NF_INET_LOCAL_OUT
) {
85 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
87 rt_info
->daddr
= iph
->daddr
;
88 rt_info
->saddr
= iph
->saddr
;
89 rt_info
->mark
= skb
->mark
;
93 static int nf_ip6_reroute(struct sk_buff
*skb
,
94 const struct nf_queue_entry
*entry
)
96 struct ip6_rt_info
*rt_info
= nf_queue_entry_reroute(entry
);
98 if (entry
->hook
== NF_INET_LOCAL_OUT
) {
99 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
100 if (!ipv6_addr_equal(&iph
->daddr
, &rt_info
->daddr
) ||
101 !ipv6_addr_equal(&iph
->saddr
, &rt_info
->saddr
) ||
102 skb
->mark
!= rt_info
->mark
)
103 return ip6_route_me_harder(skb
);
108 static int nf_ip6_route(struct net
*net
, struct dst_entry
**dst
,
109 struct flowi
*fl
, bool strict
)
111 static const struct ipv6_pinfo fake_pinfo
;
112 static const struct inet_sock fake_sk
= {
113 /* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */
114 .sk
.sk_bound_dev_if
= 1,
115 .pinet6
= (struct ipv6_pinfo
*) &fake_pinfo
,
117 const void *sk
= strict
? &fake_sk
: NULL
;
118 struct dst_entry
*result
;
121 result
= ip6_route_output(net
, sk
, &fl
->u
.ip6
);
130 __sum16
nf_ip6_checksum(struct sk_buff
*skb
, unsigned int hook
,
131 unsigned int dataoff
, u_int8_t protocol
)
133 const struct ipv6hdr
*ip6h
= ipv6_hdr(skb
);
136 switch (skb
->ip_summed
) {
137 case CHECKSUM_COMPLETE
:
138 if (hook
!= NF_INET_PRE_ROUTING
&& hook
!= NF_INET_LOCAL_IN
)
140 if (!csum_ipv6_magic(&ip6h
->saddr
, &ip6h
->daddr
,
141 skb
->len
- dataoff
, protocol
,
145 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
150 skb
->csum
= ~csum_unfold(
151 csum_ipv6_magic(&ip6h
->saddr
, &ip6h
->daddr
,
157 csum
= __skb_checksum_complete(skb
);
161 EXPORT_SYMBOL(nf_ip6_checksum
);
163 static __sum16
nf_ip6_checksum_partial(struct sk_buff
*skb
, unsigned int hook
,
164 unsigned int dataoff
, unsigned int len
,
167 const struct ipv6hdr
*ip6h
= ipv6_hdr(skb
);
171 switch (skb
->ip_summed
) {
172 case CHECKSUM_COMPLETE
:
173 if (len
== skb
->len
- dataoff
)
174 return nf_ip6_checksum(skb
, hook
, dataoff
, protocol
);
177 hsum
= skb_checksum(skb
, 0, dataoff
, 0);
178 skb
->csum
= ~csum_unfold(csum_ipv6_magic(&ip6h
->saddr
,
183 skb
->ip_summed
= CHECKSUM_NONE
;
184 return __skb_checksum_complete_head(skb
, dataoff
+ len
);
189 static const struct nf_afinfo nf_ip6_afinfo
= {
191 .checksum
= nf_ip6_checksum
,
192 .checksum_partial
= nf_ip6_checksum_partial
,
193 .route
= nf_ip6_route
,
194 .saveroute
= nf_ip6_saveroute
,
195 .reroute
= nf_ip6_reroute
,
196 .route_key_size
= sizeof(struct ip6_rt_info
),
199 int __init
ipv6_netfilter_init(void)
201 return nf_register_afinfo(&nf_ip6_afinfo
);
204 /* This can be called from inet6_init() on errors, so it cannot
205 * be marked __exit. -DaveM
207 void ipv6_netfilter_fini(void)
209 nf_unregister_afinfo(&nf_ip6_afinfo
);