[net-next-2.6.git] / net / ipv6 / netfilter.c

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/ipv6.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv6.h>
#include <net/dst.h>
#include <net/ipv6.h>
#include <net/ip6_route.h>
#include <net/xfrm.h>
#include <net/ip6_checksum.h>
#include <net/netfilter/nf_queue.h>

int ip6_route_me_harder(struct sk_buff *skb)
{
	struct ipv6hdr *iph = ipv6_hdr(skb);
	struct dst_entry *dst;
	struct flowi fl = {
		.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
		.mark = skb->mark,
		.nl_u =
		{ .ip6_u =
		  { .daddr = iph->daddr,
		    .saddr = iph->saddr, } },
	};

	dst = ip6_route_output(skb->sk, &fl);

#ifdef CONFIG_XFRM
	if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
	    xfrm_decode_session(skb, &fl, AF_INET6) == 0)
		if (xfrm_lookup(&skb->dst, &fl, skb->sk, 0))
			return -1;
#endif

	if (dst->error) {
		IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
		LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
		dst_release(dst);
		return -EINVAL;
	}

	/* Drop old route. */
	dst_release(skb->dst);

	skb->dst = dst;
	return 0;
}
EXPORT_SYMBOL(ip6_route_me_harder);

/*
 * Extra routing may needed on local out, as the QUEUE target never
 * returns control to the table.
 */

struct ip6_rt_info {
	struct in6_addr daddr;
	struct in6_addr saddr;
};

static void nf_ip6_saveroute(const struct sk_buff *skb,
			     struct nf_queue_entry *entry)
{
	struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);

	if (entry->hook == NF_INET_LOCAL_OUT) {
		struct ipv6hdr *iph = ipv6_hdr(skb);

		rt_info->daddr = iph->daddr;
		rt_info->saddr = iph->saddr;
	}
}

static int nf_ip6_reroute(struct sk_buff *skb,
			  const struct nf_queue_entry *entry)
{
	struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);

	if (entry->hook == NF_INET_LOCAL_OUT) {
		struct ipv6hdr *iph = ipv6_hdr(skb);
		if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
		    !ipv6_addr_equal(&iph->saddr, &rt_info->saddr))
			return ip6_route_me_harder(skb);
	}
	return 0;
}

static int nf_ip6_route(struct dst_entry **dst, struct flowi *fl)
{
	*dst = ip6_route_output(NULL, fl);
	return (*dst)->error;
}

__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
			     unsigned int dataoff, u_int8_t protocol)
{
	struct ipv6hdr *ip6h = ipv6_hdr(skb);
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
			break;
		if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
				     skb->len - dataoff, protocol,
				     csum_sub(skb->csum,
					      skb_checksum(skb, 0,
							   dataoff, 0)))) {
			skb->ip_summed = CHECKSUM_UNNECESSARY;
			break;
		}
		/* fall through */
	case CHECKSUM_NONE:
		skb->csum = ~csum_unfold(
				csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
					     skb->len - dataoff,
					     protocol,
					     csum_sub(0,
						      skb_checksum(skb, 0,
								   dataoff, 0))));
		csum = __skb_checksum_complete(skb);
	}
	return csum;
}

EXPORT_SYMBOL(nf_ip6_checksum);

static struct nf_afinfo nf_ip6_afinfo = {
	.family		= AF_INET6,
	.checksum	= nf_ip6_checksum,
	.route		= nf_ip6_route,
	.saveroute	= nf_ip6_saveroute,
	.reroute	= nf_ip6_reroute,
	.route_key_size	= sizeof(struct ip6_rt_info),
};

int __init ipv6_netfilter_init(void)
{
	return nf_register_afinfo(&nf_ip6_afinfo);
}

/* This can be called from inet6_init() on errors, so it cannot
 * be marked __exit. -DaveM
 */
void ipv6_netfilter_fini(void)
{
	nf_unregister_afinfo(&nf_ip6_afinfo);
}
Commit	Line	Data
	1	#include <linux/kernel.h>
	2	#include <linux/init.h>
	3	#include <linux/ipv6.h>
	4	#include <linux/netfilter.h>
	5	#include <linux/netfilter_ipv6.h>
	6	#include <net/dst.h>
	7	#include <net/ipv6.h>
	8	#include <net/ip6_route.h>
	9	#include <net/xfrm.h>
	10	#include <net/ip6_checksum.h>
	11	#include <net/netfilter/nf_queue.h>
	12
	13	int ip6_route_me_harder(struct sk_buff *skb)
	14	{
	15	struct ipv6hdr *iph = ipv6_hdr(skb);
	16	struct dst_entry *dst;
	17	struct flowi fl = {
	18	.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
	19	.mark = skb->mark,
	20	.nl_u =
	21	{ .ip6_u =
	22	{ .daddr = iph->daddr,
	23	.saddr = iph->saddr, } },
	24	};
	25
	26	dst = ip6_route_output(skb->sk, &fl);
	27
	28	#ifdef CONFIG_XFRM
	29	if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
	30	xfrm_decode_session(skb, &fl, AF_INET6) == 0)
	31	if (xfrm_lookup(&skb->dst, &fl, skb->sk, 0))
	32	return -1;
	33	#endif
	34
	35	if (dst->error) {
	36	IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
	37	LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
	38	dst_release(dst);
	39	return -EINVAL;
	40	}
	41
	42	/* Drop old route. */
	43	dst_release(skb->dst);
	44
	45	skb->dst = dst;
	46	return 0;
	47	}
	48	EXPORT_SYMBOL(ip6_route_me_harder);
	49
	50	/*
	51	* Extra routing may needed on local out, as the QUEUE target never
	52	* returns control to the table.
	53	*/
	54
	55	struct ip6_rt_info {
	56	struct in6_addr daddr;
	57	struct in6_addr saddr;
	58	};
	59
	60	static void nf_ip6_saveroute(const struct sk_buff *skb,
	61	struct nf_queue_entry *entry)
	62	{
	63	struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
	64
	65	if (entry->hook == NF_INET_LOCAL_OUT) {
	66	struct ipv6hdr *iph = ipv6_hdr(skb);
	67
	68	rt_info->daddr = iph->daddr;
	69	rt_info->saddr = iph->saddr;
	70	}
	71	}
	72
	73	static int nf_ip6_reroute(struct sk_buff *skb,
	74	const struct nf_queue_entry *entry)
	75	{
	76	struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
	77
	78	if (entry->hook == NF_INET_LOCAL_OUT) {
	79	struct ipv6hdr *iph = ipv6_hdr(skb);
	80	if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) \|\|
	81	!ipv6_addr_equal(&iph->saddr, &rt_info->saddr))
	82	return ip6_route_me_harder(skb);
	83	}
	84	return 0;
	85	}
	86
	87	static int nf_ip6_route(struct dst_entry *dst, struct flowi fl)
	88	{
	89	*dst = ip6_route_output(NULL, fl);
	90	return (*dst)->error;
	91	}
	92
	93	__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
	94	unsigned int dataoff, u_int8_t protocol)
	95	{
	96	struct ipv6hdr *ip6h = ipv6_hdr(skb);
	97	__sum16 csum = 0;
	98
	99	switch (skb->ip_summed) {
	100	case CHECKSUM_COMPLETE:
	101	if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
	102	break;
	103	if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
	104	skb->len - dataoff, protocol,
	105	csum_sub(skb->csum,
	106	skb_checksum(skb, 0,
	107	dataoff, 0)))) {
	108	skb->ip_summed = CHECKSUM_UNNECESSARY;
	109	break;
	110	}
	111	/* fall through */
	112	case CHECKSUM_NONE:
	113	skb->csum = ~csum_unfold(
	114	csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
	115	skb->len - dataoff,
	116	protocol,
	117	csum_sub(0,
	118	skb_checksum(skb, 0,
	119	dataoff, 0))));
	120	csum = __skb_checksum_complete(skb);
	121	}
	122	return csum;
	123	}
	124
	125	EXPORT_SYMBOL(nf_ip6_checksum);
	126
	127	static struct nf_afinfo nf_ip6_afinfo = {
	128	.family = AF_INET6,
	129	.checksum = nf_ip6_checksum,
	130	.route = nf_ip6_route,
	131	.saveroute = nf_ip6_saveroute,
	132	.reroute = nf_ip6_reroute,
	133	.route_key_size = sizeof(struct ip6_rt_info),
	134	};
	135
	136	int __init ipv6_netfilter_init(void)
	137	{
	138	return nf_register_afinfo(&nf_ip6_afinfo);
	139	}
	140
	141	/* This can be called from inet6_init() on errors, so it cannot
	142	* be marked __exit. -DaveM
	143	*/
	144	void ipv6_netfilter_fini(void)
	145	{
	146	nf_unregister_afinfo(&nf_ip6_afinfo);
	147	}