[net-next-2.6.git] / net / ipv6 / netfilter.c

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/ipv6.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv6.h>
#include <net/dst.h>
#include <net/ipv6.h>
#include <net/ip6_route.h>
#include <net/xfrm.h>
#include <net/ip6_checksum.h>
#include <net/netfilter/nf_queue.h>

int ip6_route_me_harder(struct sk_buff *skb)
{
	struct ipv6hdr *iph = ipv6_hdr(skb);
	struct dst_entry *dst;
	struct flowi fl = {
		.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
		.mark = skb->mark,
		.nl_u =
		{ .ip6_u =
		  { .daddr = iph->daddr,
		    .saddr = iph->saddr, } },
	};

	dst = ip6_route_output(dev_net(skb->dst->dev), skb->sk, &fl);

#ifdef CONFIG_XFRM
	if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
	    xfrm_decode_session(skb, &fl, AF_INET6) == 0)
		if (xfrm_lookup(&skb->dst, &fl, skb->sk, 0))
			return -1;
#endif

	if (dst->error) {
		IP6_INC_STATS(&init_net, ip6_dst_idev(dst),
			      IPSTATS_MIB_OUTNOROUTES);
		LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
		dst_release(dst);
		return -EINVAL;
	}

	/* Drop old route. */
	dst_release(skb->dst);

	skb->dst = dst;
	return 0;
}
EXPORT_SYMBOL(ip6_route_me_harder);

/*
 * Extra routing may needed on local out, as the QUEUE target never
 * returns control to the table.
 */

struct ip6_rt_info {
	struct in6_addr daddr;
	struct in6_addr saddr;
};

static void nf_ip6_saveroute(const struct sk_buff *skb,
			     struct nf_queue_entry *entry)
{
	struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);

	if (entry->hook == NF_INET_LOCAL_OUT) {
		struct ipv6hdr *iph = ipv6_hdr(skb);

		rt_info->daddr = iph->daddr;
		rt_info->saddr = iph->saddr;
	}
}

static int nf_ip6_reroute(struct sk_buff *skb,
			  const struct nf_queue_entry *entry)
{
	struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);

	if (entry->hook == NF_INET_LOCAL_OUT) {
		struct ipv6hdr *iph = ipv6_hdr(skb);
		if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
		    !ipv6_addr_equal(&iph->saddr, &rt_info->saddr))
			return ip6_route_me_harder(skb);
	}
	return 0;
}

static int nf_ip6_route(struct dst_entry **dst, struct flowi *fl)
{
	*dst = ip6_route_output(&init_net, NULL, fl);
	return (*dst)->error;
}

__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
			     unsigned int dataoff, u_int8_t protocol)
{
	struct ipv6hdr *ip6h = ipv6_hdr(skb);
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
			break;
		if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
				     skb->len - dataoff, protocol,
				     csum_sub(skb->csum,
					      skb_checksum(skb, 0,
							   dataoff, 0)))) {
			skb->ip_summed = CHECKSUM_UNNECESSARY;
			break;
		}
		/* fall through */
	case CHECKSUM_NONE:
		skb->csum = ~csum_unfold(
				csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
					     skb->len - dataoff,
					     protocol,
					     csum_sub(0,
						      skb_checksum(skb, 0,
								   dataoff, 0))));
		csum = __skb_checksum_complete(skb);
	}
	return csum;
}
EXPORT_SYMBOL(nf_ip6_checksum);

static __sum16 nf_ip6_checksum_partial(struct sk_buff *skb, unsigned int hook,
				       unsigned int dataoff, unsigned int len,
				       u_int8_t protocol)
{
	struct ipv6hdr *ip6h = ipv6_hdr(skb);
	__wsum hsum;
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (len == skb->len - dataoff)
			return nf_ip6_checksum(skb, hook, dataoff, protocol);
		/* fall through */
	case CHECKSUM_NONE:
		hsum = skb_checksum(skb, 0, dataoff, 0);
		skb->csum = ~csum_unfold(csum_ipv6_magic(&ip6h->saddr,
							 &ip6h->daddr,
							 skb->len - dataoff,
							 protocol,
							 csum_sub(0, hsum)));
		skb->ip_summed = CHECKSUM_NONE;
		csum = __skb_checksum_complete_head(skb, dataoff + len);
		if (!csum)
			skb->ip_summed = CHECKSUM_UNNECESSARY;
	}
	return csum;
};

static const struct nf_afinfo nf_ip6_afinfo = {
	.family			= AF_INET6,
	.checksum		= nf_ip6_checksum,
	.checksum_partial	= nf_ip6_checksum_partial,
	.route			= nf_ip6_route,
	.saveroute		= nf_ip6_saveroute,
	.reroute		= nf_ip6_reroute,
	.route_key_size		= sizeof(struct ip6_rt_info),
};

int __init ipv6_netfilter_init(void)
{
	return nf_register_afinfo(&nf_ip6_afinfo);
}

/* This can be called from inet6_init() on errors, so it cannot
 * be marked __exit. -DaveM
 */
void ipv6_netfilter_fini(void)
{
	nf_unregister_afinfo(&nf_ip6_afinfo);
}
Commit	Line	Data
	1	#include <linux/kernel.h>
	2	#include <linux/init.h>
	3	#include <linux/ipv6.h>
	4	#include <linux/netfilter.h>
	5	#include <linux/netfilter_ipv6.h>
	6	#include <net/dst.h>
	7	#include <net/ipv6.h>
	8	#include <net/ip6_route.h>
	9	#include <net/xfrm.h>
	10	#include <net/ip6_checksum.h>
	11	#include <net/netfilter/nf_queue.h>
	12
	13	int ip6_route_me_harder(struct sk_buff *skb)
	14	{
	15	struct ipv6hdr *iph = ipv6_hdr(skb);
	16	struct dst_entry *dst;
	17	struct flowi fl = {
	18	.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
	19	.mark = skb->mark,
	20	.nl_u =
	21	{ .ip6_u =
	22	{ .daddr = iph->daddr,
	23	.saddr = iph->saddr, } },
	24	};
	25
	26	dst = ip6_route_output(dev_net(skb->dst->dev), skb->sk, &fl);
	27
	28	#ifdef CONFIG_XFRM
	29	if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
	30	xfrm_decode_session(skb, &fl, AF_INET6) == 0)
	31	if (xfrm_lookup(&skb->dst, &fl, skb->sk, 0))
	32	return -1;
	33	#endif
	34
	35	if (dst->error) {
	36	IP6_INC_STATS(&init_net, ip6_dst_idev(dst),
	37	IPSTATS_MIB_OUTNOROUTES);
	38	LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
	39	dst_release(dst);
	40	return -EINVAL;
	41	}
	42
	43	/* Drop old route. */
	44	dst_release(skb->dst);
	45
	46	skb->dst = dst;
	47	return 0;
	48	}
	49	EXPORT_SYMBOL(ip6_route_me_harder);
	50
	51	/*
	52	* Extra routing may needed on local out, as the QUEUE target never
	53	* returns control to the table.
	54	*/
	55
	56	struct ip6_rt_info {
	57	struct in6_addr daddr;
	58	struct in6_addr saddr;
	59	};
	60
	61	static void nf_ip6_saveroute(const struct sk_buff *skb,
	62	struct nf_queue_entry *entry)
	63	{
	64	struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
	65
	66	if (entry->hook == NF_INET_LOCAL_OUT) {
	67	struct ipv6hdr *iph = ipv6_hdr(skb);
	68
	69	rt_info->daddr = iph->daddr;
	70	rt_info->saddr = iph->saddr;
	71	}
	72	}
	73
	74	static int nf_ip6_reroute(struct sk_buff *skb,
	75	const struct nf_queue_entry *entry)
	76	{
	77	struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
	78
	79	if (entry->hook == NF_INET_LOCAL_OUT) {
	80	struct ipv6hdr *iph = ipv6_hdr(skb);
	81	if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) \|\|
	82	!ipv6_addr_equal(&iph->saddr, &rt_info->saddr))
	83	return ip6_route_me_harder(skb);
	84	}
	85	return 0;
	86	}
	87
	88	static int nf_ip6_route(struct dst_entry *dst, struct flowi fl)
	89	{
	90	*dst = ip6_route_output(&init_net, NULL, fl);
	91	return (*dst)->error;
	92	}
	93
	94	__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
	95	unsigned int dataoff, u_int8_t protocol)
	96	{
	97	struct ipv6hdr *ip6h = ipv6_hdr(skb);
	98	__sum16 csum = 0;
	99
	100	switch (skb->ip_summed) {
	101	case CHECKSUM_COMPLETE:
	102	if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
	103	break;
	104	if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
	105	skb->len - dataoff, protocol,
	106	csum_sub(skb->csum,
	107	skb_checksum(skb, 0,
	108	dataoff, 0)))) {
	109	skb->ip_summed = CHECKSUM_UNNECESSARY;
	110	break;
	111	}
	112	/* fall through */
	113	case CHECKSUM_NONE:
	114	skb->csum = ~csum_unfold(
	115	csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
	116	skb->len - dataoff,
	117	protocol,
	118	csum_sub(0,
	119	skb_checksum(skb, 0,
	120	dataoff, 0))));
	121	csum = __skb_checksum_complete(skb);
	122	}
	123	return csum;
	124	}
	125	EXPORT_SYMBOL(nf_ip6_checksum);
	126
	127	static __sum16 nf_ip6_checksum_partial(struct sk_buff *skb, unsigned int hook,
	128	unsigned int dataoff, unsigned int len,
	129	u_int8_t protocol)
	130	{
	131	struct ipv6hdr *ip6h = ipv6_hdr(skb);
	132	__wsum hsum;
	133	__sum16 csum = 0;
	134
	135	switch (skb->ip_summed) {
	136	case CHECKSUM_COMPLETE:
	137	if (len == skb->len - dataoff)
	138	return nf_ip6_checksum(skb, hook, dataoff, protocol);
	139	/* fall through */
	140	case CHECKSUM_NONE:
	141	hsum = skb_checksum(skb, 0, dataoff, 0);
	142	skb->csum = ~csum_unfold(csum_ipv6_magic(&ip6h->saddr,
	143	&ip6h->daddr,
	144	skb->len - dataoff,
	145	protocol,
	146	csum_sub(0, hsum)));
	147	skb->ip_summed = CHECKSUM_NONE;
	148	csum = __skb_checksum_complete_head(skb, dataoff + len);
	149	if (!csum)
	150	skb->ip_summed = CHECKSUM_UNNECESSARY;
	151	}
	152	return csum;
	153	};
	154
	155	static const struct nf_afinfo nf_ip6_afinfo = {
	156	.family = AF_INET6,
	157	.checksum = nf_ip6_checksum,
	158	.checksum_partial = nf_ip6_checksum_partial,
	159	.route = nf_ip6_route,
	160	.saveroute = nf_ip6_saveroute,
	161	.reroute = nf_ip6_reroute,
	162	.route_key_size = sizeof(struct ip6_rt_info),
	163	};
	164
	165	int __init ipv6_netfilter_init(void)
	166	{
	167	return nf_register_afinfo(&nf_ip6_afinfo);
	168	}
	169
	170	/* This can be called from inet6_init() on errors, so it cannot
	171	* be marked __exit. -DaveM
	172	*/
	173	void ipv6_netfilter_fini(void)
	174	{
	175	nf_unregister_afinfo(&nf_ip6_afinfo);
	176	}