1 /* 2 * IPv6 specific functions of netfilter core 3 * 4 * Rusty Russell (C) 2000 -- This code is GPL. 5 * Patrick McHardy (C) 2006-2012 6 */ 7 #include <linux/kernel.h> 8 #include <linux/init.h> 9 #include <linux/ipv6.h> 10 #include <linux/netfilter.h> 11 #include <linux/netfilter_ipv6.h> 12 #include <linux/export.h> 13 #include <net/addrconf.h> 14 #include <net/dst.h> 15 #include <net/ipv6.h> 16 #include <net/ip6_route.h> 17 #include <net/xfrm.h> 18 #include <net/netfilter/nf_queue.h> 19 20 int ip6_route_me_harder(struct net *net, struct sk_buff *skb) 21 { 22 const struct ipv6hdr *iph = ipv6_hdr(skb); 23 struct sock *sk = sk_to_full_sk(skb->sk); 24 unsigned int hh_len; 25 struct dst_entry *dst; 26 int strict = (ipv6_addr_type(&iph->daddr) & 27 (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL)); 28 struct flowi6 fl6 = { 29 .flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if : 30 strict ? skb_dst(skb)->dev->ifindex : 0, 31 .flowi6_mark = skb->mark, 32 .flowi6_uid = sock_net_uid(net, sk), 33 .daddr = iph->daddr, 34 .saddr = iph->saddr, 35 }; 36 int err; 37 38 dst = ip6_route_output(net, sk, &fl6); 39 err = dst->error; 40 if (err) { 41 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES); 42 net_dbg_ratelimited("ip6_route_me_harder: No more route\n"); 43 dst_release(dst); 44 return err; 45 } 46 47 /* Drop old route. */ 48 skb_dst_drop(skb); 49 50 skb_dst_set(skb, dst); 51 52 #ifdef CONFIG_XFRM 53 if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) && 54 xfrm_decode_session(skb, flowi6_to_flowi(&fl6), AF_INET6) == 0) { 55 skb_dst_set(skb, NULL); 56 dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0); 57 if (IS_ERR(dst)) 58 return PTR_ERR(dst); 59 skb_dst_set(skb, dst); 60 } 61 #endif 62 63 /* Change in oif may mean change in hh_len. */ 64 hh_len = skb_dst(skb)->dev->hard_header_len; 65 if (skb_headroom(skb) < hh_len && 66 pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)), 67 0, GFP_ATOMIC)) 68 return -ENOMEM; 69 70 return 0; 71 } 72 EXPORT_SYMBOL(ip6_route_me_harder); 73 74 static int nf_ip6_reroute(struct sk_buff *skb, 75 const struct nf_queue_entry *entry) 76 { 77 struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry); 78 79 if (entry->state.hook == NF_INET_LOCAL_OUT) { 80 const struct ipv6hdr *iph = ipv6_hdr(skb); 81 if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) || 82 !ipv6_addr_equal(&iph->saddr, &rt_info->saddr) || 83 skb->mark != rt_info->mark) 84 return ip6_route_me_harder(entry->state.net, skb); 85 } 86 return 0; 87 } 88 89 int __nf_ip6_route(struct net *net, struct dst_entry **dst, 90 struct flowi *fl, bool strict) 91 { 92 static const struct ipv6_pinfo fake_pinfo; 93 static const struct inet_sock fake_sk = { 94 /* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */ 95 .sk.sk_bound_dev_if = 1, 96 .pinet6 = (struct ipv6_pinfo *) &fake_pinfo, 97 }; 98 const void *sk = strict ? &fake_sk : NULL; 99 struct dst_entry *result; 100 int err; 101 102 result = ip6_route_output(net, sk, &fl->u.ip6); 103 err = result->error; 104 if (err) 105 dst_release(result); 106 else 107 *dst = result; 108 return err; 109 } 110 EXPORT_SYMBOL_GPL(__nf_ip6_route); 111 112 static const struct nf_ipv6_ops ipv6ops = { 113 #if IS_MODULE(CONFIG_IPV6) 114 .chk_addr = ipv6_chk_addr, 115 .route_me_harder = ip6_route_me_harder, 116 .dev_get_saddr = ipv6_dev_get_saddr, 117 .route = __nf_ip6_route, 118 #endif 119 .route_input = ip6_route_input, 120 .fragment = ip6_fragment, 121 .reroute = nf_ip6_reroute, 122 }; 123 124 int __init ipv6_netfilter_init(void) 125 { 126 RCU_INIT_POINTER(nf_ipv6_ops, &ipv6ops); 127 return 0; 128 } 129 130 /* This can be called from inet6_init() on errors, so it cannot 131 * be marked __exit. -DaveM 132 */ 133 void ipv6_netfilter_fini(void) 134 { 135 RCU_INIT_POINTER(nf_ipv6_ops, NULL); 136 } 137