[net-next-2.6.git] / net / ipv6 / netfilter.c

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/ipv6.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv6.h>
#include <net/dst.h>
#include <net/ipv6.h>
#include <net/ip6_route.h>
#include <net/xfrm.h>
#include <net/ip6_checksum.h>
#include <net/netfilter/nf_queue.h>

int ip6_route_me_harder(struct sk_buff *skb)
{
	struct net *net = dev_net(skb_dst(skb)->dev);
	struct ipv6hdr *iph = ipv6_hdr(skb);
	struct dst_entry *dst;
	struct flowi fl = {
		.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
		.mark = skb->mark,
		.fl6_dst = iph->daddr,
		.fl6_src = iph->saddr,
	};

	dst = ip6_route_output(net, skb->sk, &fl);
	if (dst->error) {
		IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
		LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
		dst_release(dst);
		return -EINVAL;
	}

	/* Drop old route. */
	skb_dst_drop(skb);

	skb_dst_set(skb, dst);

#ifdef CONFIG_XFRM
	if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
	    xfrm_decode_session(skb, &fl, AF_INET6) == 0) {
		skb_dst_set(skb, NULL);
		if (xfrm_lookup(net, &dst, &fl, skb->sk, 0))
			return -1;
		skb_dst_set(skb, dst);
	}
#endif

	return 0;
}
EXPORT_SYMBOL(ip6_route_me_harder);

/*
 * Extra routing may needed on local out, as the QUEUE target never
 * returns control to the table.
 */

struct ip6_rt_info {
	struct in6_addr daddr;
	struct in6_addr saddr;
	u_int32_t mark;
};

static void nf_ip6_saveroute(const struct sk_buff *skb,
			     struct nf_queue_entry *entry)
{
	struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);

	if (entry->hook == NF_INET_LOCAL_OUT) {
		struct ipv6hdr *iph = ipv6_hdr(skb);

		rt_info->daddr = iph->daddr;
		rt_info->saddr = iph->saddr;
		rt_info->mark = skb->mark;
	}
}

static int nf_ip6_reroute(struct sk_buff *skb,
			  const struct nf_queue_entry *entry)
{
	struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);

	if (entry->hook == NF_INET_LOCAL_OUT) {
		struct ipv6hdr *iph = ipv6_hdr(skb);
		if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
		    !ipv6_addr_equal(&iph->saddr, &rt_info->saddr) ||
		    skb->mark != rt_info->mark)
			return ip6_route_me_harder(skb);
	}
	return 0;
}

static int nf_ip6_route(struct dst_entry **dst, struct flowi *fl)
{
	*dst = ip6_route_output(&init_net, NULL, fl);
	return (*dst)->error;
}

__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
			     unsigned int dataoff, u_int8_t protocol)
{
	struct ipv6hdr *ip6h = ipv6_hdr(skb);
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
			break;
		if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
				     skb->len - dataoff, protocol,
				     csum_sub(skb->csum,
					      skb_checksum(skb, 0,
							   dataoff, 0)))) {
			skb->ip_summed = CHECKSUM_UNNECESSARY;
			break;
		}
		/* fall through */
	case CHECKSUM_NONE:
		skb->csum = ~csum_unfold(
				csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
					     skb->len - dataoff,
					     protocol,
					     csum_sub(0,
						      skb_checksum(skb, 0,
								   dataoff, 0))));
		csum = __skb_checksum_complete(skb);
	}
	return csum;
}
EXPORT_SYMBOL(nf_ip6_checksum);

static __sum16 nf_ip6_checksum_partial(struct sk_buff *skb, unsigned int hook,
				       unsigned int dataoff, unsigned int len,
				       u_int8_t protocol)
{
	struct ipv6hdr *ip6h = ipv6_hdr(skb);
	__wsum hsum;
	__sum16 csum = 0;

	switch (skb->ip_summed) {
	case CHECKSUM_COMPLETE:
		if (len == skb->len - dataoff)
			return nf_ip6_checksum(skb, hook, dataoff, protocol);
		/* fall through */
	case CHECKSUM_NONE:
		hsum = skb_checksum(skb, 0, dataoff, 0);
		skb->csum = ~csum_unfold(csum_ipv6_magic(&ip6h->saddr,
							 &ip6h->daddr,
							 skb->len - dataoff,
							 protocol,
							 csum_sub(0, hsum)));
		skb->ip_summed = CHECKSUM_NONE;
		return __skb_checksum_complete_head(skb, dataoff + len);
	}
	return csum;
};

static const struct nf_afinfo nf_ip6_afinfo = {
	.family			= AF_INET6,
	.checksum		= nf_ip6_checksum,
	.checksum_partial	= nf_ip6_checksum_partial,
	.route			= nf_ip6_route,
	.saveroute		= nf_ip6_saveroute,
	.reroute		= nf_ip6_reroute,
	.route_key_size		= sizeof(struct ip6_rt_info),
};

int __init ipv6_netfilter_init(void)
{
	return nf_register_afinfo(&nf_ip6_afinfo);
}

/* This can be called from inet6_init() on errors, so it cannot
 * be marked __exit. -DaveM
 */
void ipv6_netfilter_fini(void)
{
	nf_unregister_afinfo(&nf_ip6_afinfo);
}
Commit	Line	Data
	1	#include <linux/kernel.h>
	2	#include <linux/init.h>
	3	#include <linux/ipv6.h>
	4	#include <linux/netfilter.h>
	5	#include <linux/netfilter_ipv6.h>
	6	#include <net/dst.h>
	7	#include <net/ipv6.h>
	8	#include <net/ip6_route.h>
	9	#include <net/xfrm.h>
	10	#include <net/ip6_checksum.h>
	11	#include <net/netfilter/nf_queue.h>
	12
	13	int ip6_route_me_harder(struct sk_buff *skb)
	14	{
	15	struct net *net = dev_net(skb_dst(skb)->dev);
	16	struct ipv6hdr *iph = ipv6_hdr(skb);
	17	struct dst_entry *dst;
	18	struct flowi fl = {
	19	.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
	20	.mark = skb->mark,
	21	.fl6_dst = iph->daddr,
	22	.fl6_src = iph->saddr,
	23	};
	24
	25	dst = ip6_route_output(net, skb->sk, &fl);
	26	if (dst->error) {
	27	IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
	28	LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
	29	dst_release(dst);
	30	return -EINVAL;
	31	}
	32
	33	/* Drop old route. */
	34	skb_dst_drop(skb);
	35
	36	skb_dst_set(skb, dst);
	37
	38	#ifdef CONFIG_XFRM
	39	if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
	40	xfrm_decode_session(skb, &fl, AF_INET6) == 0) {
	41	skb_dst_set(skb, NULL);
	42	if (xfrm_lookup(net, &dst, &fl, skb->sk, 0))
	43	return -1;
	44	skb_dst_set(skb, dst);
	45	}
	46	#endif
	47
	48	return 0;
	49	}
	50	EXPORT_SYMBOL(ip6_route_me_harder);
	51
	52	/*
	53	* Extra routing may needed on local out, as the QUEUE target never
	54	* returns control to the table.
	55	*/
	56
	57	struct ip6_rt_info {
	58	struct in6_addr daddr;
	59	struct in6_addr saddr;
	60	u_int32_t mark;
	61	};
	62
	63	static void nf_ip6_saveroute(const struct sk_buff *skb,
	64	struct nf_queue_entry *entry)
	65	{
	66	struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
	67
	68	if (entry->hook == NF_INET_LOCAL_OUT) {
	69	struct ipv6hdr *iph = ipv6_hdr(skb);
	70
	71	rt_info->daddr = iph->daddr;
	72	rt_info->saddr = iph->saddr;
	73	rt_info->mark = skb->mark;
	74	}
	75	}
	76
	77	static int nf_ip6_reroute(struct sk_buff *skb,
	78	const struct nf_queue_entry *entry)
	79	{
	80	struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
	81
	82	if (entry->hook == NF_INET_LOCAL_OUT) {
	83	struct ipv6hdr *iph = ipv6_hdr(skb);
	84	if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) \|\|
	85	!ipv6_addr_equal(&iph->saddr, &rt_info->saddr) \|\|
	86	skb->mark != rt_info->mark)
	87	return ip6_route_me_harder(skb);
	88	}
	89	return 0;
	90	}
	91
	92	static int nf_ip6_route(struct dst_entry *dst, struct flowi fl)
	93	{
	94	*dst = ip6_route_output(&init_net, NULL, fl);
	95	return (*dst)->error;
	96	}
	97
	98	__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
	99	unsigned int dataoff, u_int8_t protocol)
	100	{
	101	struct ipv6hdr *ip6h = ipv6_hdr(skb);
	102	__sum16 csum = 0;
	103
	104	switch (skb->ip_summed) {
	105	case CHECKSUM_COMPLETE:
	106	if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
	107	break;
	108	if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
	109	skb->len - dataoff, protocol,
	110	csum_sub(skb->csum,
	111	skb_checksum(skb, 0,
	112	dataoff, 0)))) {
	113	skb->ip_summed = CHECKSUM_UNNECESSARY;
	114	break;
	115	}
	116	/* fall through */
	117	case CHECKSUM_NONE:
	118	skb->csum = ~csum_unfold(
	119	csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
	120	skb->len - dataoff,
	121	protocol,
	122	csum_sub(0,
	123	skb_checksum(skb, 0,
	124	dataoff, 0))));
	125	csum = __skb_checksum_complete(skb);
	126	}
	127	return csum;
	128	}
	129	EXPORT_SYMBOL(nf_ip6_checksum);
	130
	131	static __sum16 nf_ip6_checksum_partial(struct sk_buff *skb, unsigned int hook,
	132	unsigned int dataoff, unsigned int len,
	133	u_int8_t protocol)
	134	{
	135	struct ipv6hdr *ip6h = ipv6_hdr(skb);
	136	__wsum hsum;
	137	__sum16 csum = 0;
	138
	139	switch (skb->ip_summed) {
	140	case CHECKSUM_COMPLETE:
	141	if (len == skb->len - dataoff)
	142	return nf_ip6_checksum(skb, hook, dataoff, protocol);
	143	/* fall through */
	144	case CHECKSUM_NONE:
	145	hsum = skb_checksum(skb, 0, dataoff, 0);
	146	skb->csum = ~csum_unfold(csum_ipv6_magic(&ip6h->saddr,
	147	&ip6h->daddr,
	148	skb->len - dataoff,
	149	protocol,
	150	csum_sub(0, hsum)));
	151	skb->ip_summed = CHECKSUM_NONE;
	152	return __skb_checksum_complete_head(skb, dataoff + len);
	153	}
	154	return csum;
	155	};
	156
	157	static const struct nf_afinfo nf_ip6_afinfo = {
	158	.family = AF_INET6,
	159	.checksum = nf_ip6_checksum,
	160	.checksum_partial = nf_ip6_checksum_partial,
	161	.route = nf_ip6_route,
	162	.saveroute = nf_ip6_saveroute,
	163	.reroute = nf_ip6_reroute,
	164	.route_key_size = sizeof(struct ip6_rt_info),
	165	};
	166
	167	int __init ipv6_netfilter_init(void)
	168	{
	169	return nf_register_afinfo(&nf_ip6_afinfo);
	170	}
	171
	172	/* This can be called from inet6_init() on errors, so it cannot
	173	* be marked __exit. -DaveM
	174	*/
	175	void ipv6_netfilter_fini(void)
	176	{
	177	nf_unregister_afinfo(&nf_ip6_afinfo);
	178	}