Blame view
net/ipv6/netfilter.c
4.88 KB
020b4c12d
|
1 |
#include <linux/kernel.h> |
bb94aa169
|
2 |
#include <linux/init.h> |
020b4c12d
|
3 |
#include <linux/ipv6.h> |
2cc7d5730
|
4 5 |
#include <linux/netfilter.h> #include <linux/netfilter_ipv6.h> |
bc3b2d7fb
|
6 |
#include <linux/export.h> |
020b4c12d
|
7 8 9 |
#include <net/dst.h> #include <net/ipv6.h> #include <net/ip6_route.h> |
3e3850e98
|
10 |
#include <net/xfrm.h> |
503e4faad
|
11 |
#include <net/ip6_checksum.h> |
c01cd429f
|
12 |
#include <net/netfilter/nf_queue.h> |
020b4c12d
|
13 14 15 |
int ip6_route_me_harder(struct sk_buff *skb) { |
adf30907d
|
16 |
struct net *net = dev_net(skb_dst(skb)->dev); |
b71d1d426
|
17 |
const struct ipv6hdr *iph = ipv6_hdr(skb); |
020b4c12d
|
18 |
struct dst_entry *dst; |
4c9483b2f
|
19 20 21 22 23 |
struct flowi6 fl6 = { .flowi6_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0, .flowi6_mark = skb->mark, .daddr = iph->daddr, .saddr = iph->saddr, |
020b4c12d
|
24 |
}; |
4c9483b2f
|
25 |
dst = ip6_route_output(net, skb->sk, &fl6); |
020b4c12d
|
26 |
if (dst->error) { |
eef9d90dc
|
27 |
IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES); |
64ce20730
|
28 29 |
LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route. "); |
020b4c12d
|
30 31 32 33 34 |
dst_release(dst); return -EINVAL; } /* Drop old route. */ |
adf30907d
|
35 |
skb_dst_drop(skb); |
020b4c12d
|
36 |
|
adf30907d
|
37 |
skb_dst_set(skb, dst); |
90348e0ed
|
38 39 40 |
#ifdef CONFIG_XFRM if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) && |
4c9483b2f
|
41 |
xfrm_decode_session(skb, flowi6_to_flowi(&fl6), AF_INET6) == 0) { |
90348e0ed
|
42 |
skb_dst_set(skb, NULL); |
4c9483b2f
|
43 |
dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), skb->sk, 0); |
452edd598
|
44 |
if (IS_ERR(dst)) |
90348e0ed
|
45 46 47 48 |
return -1; skb_dst_set(skb, dst); } #endif |
020b4c12d
|
49 50 51 |
return 0; } EXPORT_SYMBOL(ip6_route_me_harder); |
2cc7d5730
|
52 53 54 55 56 57 58 59 |
/* * Extra routing may needed on local out, as the QUEUE target never * returns control to the table. */ struct ip6_rt_info { struct in6_addr daddr; struct in6_addr saddr; |
9f40ac713
|
60 |
u_int32_t mark; |
2cc7d5730
|
61 |
}; |
02f014d88
|
62 63 |
static void nf_ip6_saveroute(const struct sk_buff *skb, struct nf_queue_entry *entry) |
2cc7d5730
|
64 |
{ |
02f014d88
|
65 |
struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry); |
2cc7d5730
|
66 |
|
02f014d88
|
67 |
if (entry->hook == NF_INET_LOCAL_OUT) { |
b71d1d426
|
68 |
const struct ipv6hdr *iph = ipv6_hdr(skb); |
2cc7d5730
|
69 70 71 |
rt_info->daddr = iph->daddr; rt_info->saddr = iph->saddr; |
9f40ac713
|
72 |
rt_info->mark = skb->mark; |
2cc7d5730
|
73 74 |
} } |
02f014d88
|
75 76 |
static int nf_ip6_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry) |
2cc7d5730
|
77 |
{ |
02f014d88
|
78 |
struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry); |
2cc7d5730
|
79 |
|
02f014d88
|
80 |
if (entry->hook == NF_INET_LOCAL_OUT) { |
b71d1d426
|
81 |
const struct ipv6hdr *iph = ipv6_hdr(skb); |
2cc7d5730
|
82 |
if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) || |
9f40ac713
|
83 84 |
!ipv6_addr_equal(&iph->saddr, &rt_info->saddr) || skb->mark != rt_info->mark) |
3db05fea5
|
85 |
return ip6_route_me_harder(skb); |
2cc7d5730
|
86 87 88 |
} return 0; } |
31ad3dd64
|
89 |
static int nf_ip6_route(struct net *net, struct dst_entry **dst, |
0fae2e774
|
90 |
struct flowi *fl, bool strict) |
1841a4c7a
|
91 |
{ |
0fae2e774
|
92 93 94 95 96 97 98 |
static const struct ipv6_pinfo fake_pinfo; static const struct inet_sock fake_sk = { /* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */ .sk.sk_bound_dev_if = 1, .pinet6 = (struct ipv6_pinfo *) &fake_pinfo, }; const void *sk = strict ? &fake_sk : NULL; |
2dad81adf
|
99 100 101 102 103 104 105 106 107 108 |
struct dst_entry *result; int err; result = ip6_route_output(net, sk, &fl->u.ip6); err = result->error; if (err) dst_release(result); else *dst = result; return err; |
1841a4c7a
|
109 |
} |
b51655b95
|
110 |
__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook, |
422c346fa
|
111 112 |
unsigned int dataoff, u_int8_t protocol) { |
b71d1d426
|
113 |
const struct ipv6hdr *ip6h = ipv6_hdr(skb); |
b51655b95
|
114 |
__sum16 csum = 0; |
422c346fa
|
115 116 |
switch (skb->ip_summed) { |
84fa7933a
|
117 |
case CHECKSUM_COMPLETE: |
6e23ae2a4
|
118 |
if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN) |
422c346fa
|
119 120 |
break; if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, |
1ab1457c4
|
121 |
skb->len - dataoff, protocol, |
422c346fa
|
122 123 124 125 126 127 128 129 |
csum_sub(skb->csum, skb_checksum(skb, 0, dataoff, 0)))) { skb->ip_summed = CHECKSUM_UNNECESSARY; break; } /* fall through */ case CHECKSUM_NONE: |
868c86bcb
|
130 131 |
skb->csum = ~csum_unfold( csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, |
422c346fa
|
132 133 134 135 |
skb->len - dataoff, protocol, csum_sub(0, skb_checksum(skb, 0, |
1ab1457c4
|
136 |
dataoff, 0)))); |
422c346fa
|
137 138 139 140 |
csum = __skb_checksum_complete(skb); } return csum; } |
422c346fa
|
141 |
EXPORT_SYMBOL(nf_ip6_checksum); |
d63a65073
|
142 143 144 145 |
static __sum16 nf_ip6_checksum_partial(struct sk_buff *skb, unsigned int hook, unsigned int dataoff, unsigned int len, u_int8_t protocol) { |
b71d1d426
|
146 |
const struct ipv6hdr *ip6h = ipv6_hdr(skb); |
d63a65073
|
147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 |
__wsum hsum; __sum16 csum = 0; switch (skb->ip_summed) { case CHECKSUM_COMPLETE: if (len == skb->len - dataoff) return nf_ip6_checksum(skb, hook, dataoff, protocol); /* fall through */ case CHECKSUM_NONE: hsum = skb_checksum(skb, 0, dataoff, 0); skb->csum = ~csum_unfold(csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, skb->len - dataoff, protocol, csum_sub(0, hsum))); skb->ip_summed = CHECKSUM_NONE; |
c86ee67c7
|
163 |
return __skb_checksum_complete_head(skb, dataoff + len); |
d63a65073
|
164 165 166 |
} return csum; }; |
1e796fda0
|
167 |
static const struct nf_afinfo nf_ip6_afinfo = { |
d63a65073
|
168 169 170 171 172 173 174 |
.family = AF_INET6, .checksum = nf_ip6_checksum, .checksum_partial = nf_ip6_checksum_partial, .route = nf_ip6_route, .saveroute = nf_ip6_saveroute, .reroute = nf_ip6_reroute, .route_key_size = sizeof(struct ip6_rt_info), |
2cc7d5730
|
175 176 177 178 |
}; int __init ipv6_netfilter_init(void) { |
bce8032ef
|
179 |
return nf_register_afinfo(&nf_ip6_afinfo); |
2cc7d5730
|
180 |
} |
5bf887f2f
|
181 182 183 184 |
/* This can be called from inet6_init() on errors, so it cannot * be marked __exit. -DaveM */ void ipv6_netfilter_fini(void) |
2cc7d5730
|
185 |
{ |
bce8032ef
|
186 |
nf_unregister_afinfo(&nf_ip6_afinfo); |
2cc7d5730
|
187 |
} |