Blame view
net/ipv6/netfilter.c
4.88 KB
020b4c12d [NETFILTER]: Move... |
1 |
#include <linux/kernel.h> |
bb94aa169 [NETFILTER]: net/... |
2 |
#include <linux/init.h> |
020b4c12d [NETFILTER]: Move... |
3 |
#include <linux/ipv6.h> |
2cc7d5730 [NETFILTER]: Move... |
4 5 |
#include <linux/netfilter.h> #include <linux/netfilter_ipv6.h> |
bc3b2d7fb net: Add export.h... |
6 |
#include <linux/export.h> |
020b4c12d [NETFILTER]: Move... |
7 8 9 |
#include <net/dst.h> #include <net/ipv6.h> #include <net/ip6_route.h> |
3e3850e98 [NETFILTER]: Fix ... |
10 |
#include <net/xfrm.h> |
503e4faad [NETFILTER]: Fix ... |
11 |
#include <net/ip6_checksum.h> |
c01cd429f [NETFILTER]: nf_q... |
12 |
#include <net/netfilter/nf_queue.h> |
020b4c12d [NETFILTER]: Move... |
13 14 15 |
int ip6_route_me_harder(struct sk_buff *skb) { |
adf30907d net: skb->dst acc... |
16 |
struct net *net = dev_net(skb_dst(skb)->dev); |
b71d1d426 inet: constify ip... |
17 |
const struct ipv6hdr *iph = ipv6_hdr(skb); |
020b4c12d [NETFILTER]: Move... |
18 |
struct dst_entry *dst; |
4c9483b2f ipv6: Convert to ... |
19 20 21 22 23 |
struct flowi6 fl6 = { .flowi6_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0, .flowi6_mark = skb->mark, .daddr = iph->daddr, .saddr = iph->saddr, |
020b4c12d [NETFILTER]: Move... |
24 |
}; |
4c9483b2f ipv6: Convert to ... |
25 |
dst = ip6_route_output(net, skb->sk, &fl6); |
020b4c12d [NETFILTER]: Move... |
26 |
if (dst->error) { |
eef9d90dc netns: correct mi... |
27 |
IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES); |
64ce20730 [NET]: Make NETDE... |
28 29 |
LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route. "); |
020b4c12d [NETFILTER]: Move... |
30 31 32 33 34 |
dst_release(dst); return -EINVAL; } /* Drop old route. */ |
adf30907d net: skb->dst acc... |
35 |
skb_dst_drop(skb); |
020b4c12d [NETFILTER]: Move... |
36 |
|
adf30907d net: skb->dst acc... |
37 |
skb_dst_set(skb, dst); |
90348e0ed netfilter: ipv6: ... |
38 39 40 |
#ifdef CONFIG_XFRM if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) && |
4c9483b2f ipv6: Convert to ... |
41 |
xfrm_decode_session(skb, flowi6_to_flowi(&fl6), AF_INET6) == 0) { |
90348e0ed netfilter: ipv6: ... |
42 |
skb_dst_set(skb, NULL); |
4c9483b2f ipv6: Convert to ... |
43 |
dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), skb->sk, 0); |
452edd598 xfrm: Return dst ... |
44 |
if (IS_ERR(dst)) |
90348e0ed netfilter: ipv6: ... |
45 46 47 48 |
return -1; skb_dst_set(skb, dst); } #endif |
020b4c12d [NETFILTER]: Move... |
49 50 51 |
return 0; } EXPORT_SYMBOL(ip6_route_me_harder); |
2cc7d5730 [NETFILTER]: Move... |
52 53 54 55 56 57 58 59 |
/* * Extra routing may needed on local out, as the QUEUE target never * returns control to the table. */ struct ip6_rt_info { struct in6_addr daddr; struct in6_addr saddr; |
9f40ac713 netfilter: nfmark... |
60 |
u_int32_t mark; |
2cc7d5730 [NETFILTER]: Move... |
61 |
}; |
02f014d88 [NETFILTER]: nf_q... |
62 63 |
static void nf_ip6_saveroute(const struct sk_buff *skb, struct nf_queue_entry *entry) |
2cc7d5730 [NETFILTER]: Move... |
64 |
{ |
02f014d88 [NETFILTER]: nf_q... |
65 |
struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry); |
2cc7d5730 [NETFILTER]: Move... |
66 |
|
02f014d88 [NETFILTER]: nf_q... |
67 |
if (entry->hook == NF_INET_LOCAL_OUT) { |
b71d1d426 inet: constify ip... |
68 |
const struct ipv6hdr *iph = ipv6_hdr(skb); |
2cc7d5730 [NETFILTER]: Move... |
69 70 71 |
rt_info->daddr = iph->daddr; rt_info->saddr = iph->saddr; |
9f40ac713 netfilter: nfmark... |
72 |
rt_info->mark = skb->mark; |
2cc7d5730 [NETFILTER]: Move... |
73 74 |
} } |
02f014d88 [NETFILTER]: nf_q... |
75 76 |
static int nf_ip6_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry) |
2cc7d5730 [NETFILTER]: Move... |
77 |
{ |
02f014d88 [NETFILTER]: nf_q... |
78 |
struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry); |
2cc7d5730 [NETFILTER]: Move... |
79 |
|
02f014d88 [NETFILTER]: nf_q... |
80 |
if (entry->hook == NF_INET_LOCAL_OUT) { |
b71d1d426 inet: constify ip... |
81 |
const struct ipv6hdr *iph = ipv6_hdr(skb); |
2cc7d5730 [NETFILTER]: Move... |
82 |
if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) || |
9f40ac713 netfilter: nfmark... |
83 84 |
!ipv6_addr_equal(&iph->saddr, &rt_info->saddr) || skb->mark != rt_info->mark) |
3db05fea5 [NETFILTER]: Repl... |
85 |
return ip6_route_me_harder(skb); |
2cc7d5730 [NETFILTER]: Move... |
86 87 88 |
} return 0; } |
31ad3dd64 netfilter: af_inf... |
89 |
static int nf_ip6_route(struct net *net, struct dst_entry **dst, |
0fae2e774 netfilter: af_inf... |
90 |
struct flowi *fl, bool strict) |
1841a4c7a [NETFILTER]: nf_c... |
91 |
{ |
0fae2e774 netfilter: af_inf... |
92 93 94 95 96 97 98 |
static const struct ipv6_pinfo fake_pinfo; static const struct inet_sock fake_sk = { /* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */ .sk.sk_bound_dev_if = 1, .pinet6 = (struct ipv6_pinfo *) &fake_pinfo, }; const void *sk = strict ? &fake_sk : NULL; |
2dad81adf netfilter: ipv6: ... |
99 100 101 102 103 104 105 106 107 108 |
struct dst_entry *result; int err; result = ip6_route_output(net, sk, &fl->u.ip6); err = result->error; if (err) dst_release(result); else *dst = result; return err; |
1841a4c7a [NETFILTER]: nf_c... |
109 |
} |
b51655b95 [NET]: Annotate _... |
110 |
__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook, |
422c346fa [NETFILTER]: Add ... |
111 112 |
unsigned int dataoff, u_int8_t protocol) { |
b71d1d426 inet: constify ip... |
113 |
const struct ipv6hdr *ip6h = ipv6_hdr(skb); |
b51655b95 [NET]: Annotate _... |
114 |
__sum16 csum = 0; |
422c346fa [NETFILTER]: Add ... |
115 116 |
switch (skb->ip_summed) { |
84fa7933a [NET]: Replace CH... |
117 |
case CHECKSUM_COMPLETE: |
6e23ae2a4 [NETFILTER]: Intr... |
118 |
if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN) |
422c346fa [NETFILTER]: Add ... |
119 120 |
break; if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, |
1ab1457c4 [NET] IPV6: Fix w... |
121 |
skb->len - dataoff, protocol, |
422c346fa [NETFILTER]: Add ... |
122 123 124 125 126 127 128 129 |
csum_sub(skb->csum, skb_checksum(skb, 0, dataoff, 0)))) { skb->ip_summed = CHECKSUM_UNNECESSARY; break; } /* fall through */ case CHECKSUM_NONE: |
868c86bcb [NET]: annotate c... |
130 131 |
skb->csum = ~csum_unfold( csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, |
422c346fa [NETFILTER]: Add ... |
132 133 134 135 |
skb->len - dataoff, protocol, csum_sub(0, skb_checksum(skb, 0, |
1ab1457c4 [NET] IPV6: Fix w... |
136 |
dataoff, 0)))); |
422c346fa [NETFILTER]: Add ... |
137 138 139 140 |
csum = __skb_checksum_complete(skb); } return csum; } |
422c346fa [NETFILTER]: Add ... |
141 |
EXPORT_SYMBOL(nf_ip6_checksum); |
d63a65073 [NETFILTER]: Add ... |
142 143 144 145 |
static __sum16 nf_ip6_checksum_partial(struct sk_buff *skb, unsigned int hook, unsigned int dataoff, unsigned int len, u_int8_t protocol) { |
b71d1d426 inet: constify ip... |
146 |
const struct ipv6hdr *ip6h = ipv6_hdr(skb); |
d63a65073 [NETFILTER]: Add ... |
147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 |
__wsum hsum; __sum16 csum = 0; switch (skb->ip_summed) { case CHECKSUM_COMPLETE: if (len == skb->len - dataoff) return nf_ip6_checksum(skb, hook, dataoff, protocol); /* fall through */ case CHECKSUM_NONE: hsum = skb_checksum(skb, 0, dataoff, 0); skb->csum = ~csum_unfold(csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, skb->len - dataoff, protocol, csum_sub(0, hsum))); skb->ip_summed = CHECKSUM_NONE; |
c86ee67c7 netfilter: kill r... |
163 |
return __skb_checksum_complete_head(skb, dataoff + len); |
d63a65073 [NETFILTER]: Add ... |
164 165 166 |
} return csum; }; |
1e796fda0 [NETFILTER]: cons... |
167 |
static const struct nf_afinfo nf_ip6_afinfo = { |
d63a65073 [NETFILTER]: Add ... |
168 169 170 171 172 173 174 |
.family = AF_INET6, .checksum = nf_ip6_checksum, .checksum_partial = nf_ip6_checksum_partial, .route = nf_ip6_route, .saveroute = nf_ip6_saveroute, .reroute = nf_ip6_reroute, .route_key_size = sizeof(struct ip6_rt_info), |
2cc7d5730 [NETFILTER]: Move... |
175 176 177 178 |
}; int __init ipv6_netfilter_init(void) { |
bce8032ef [NETFILTER]: Intr... |
179 |
return nf_register_afinfo(&nf_ip6_afinfo); |
2cc7d5730 [NETFILTER]: Move... |
180 |
} |
5bf887f2f [IPV6]: Fix modul... |
181 182 183 184 |
/* This can be called from inet6_init() on errors, so it cannot * be marked __exit. -DaveM */ void ipv6_netfilter_fini(void) |
2cc7d5730 [NETFILTER]: Move... |
185 |
{ |
bce8032ef [NETFILTER]: Intr... |
186 |
nf_unregister_afinfo(&nf_ip6_afinfo); |
2cc7d5730 [NETFILTER]: Move... |
187 |
} |