LXR linux/net/ipv6/netfilter.c

   1/*
   2 * IPv6 specific functions of netfilter core
   3 *
   4 * Rusty Russell (C) 2000 -- This code is GPL.
   5 * Patrick McHardy (C) 2006-2012
   6 */
   7#include <linux/kernel.h>
   8#include <linux/init.h>
   9#include <linux/ipv6.h>
  10#include <linux/netfilter.h>
  11#include <linux/netfilter_ipv6.h>
  12#include <linux/export.h>
  13#include <net/addrconf.h>
  14#include <net/dst.h>
  15#include <net/ipv6.h>
  16#include <net/ip6_route.h>
  17#include <net/xfrm.h>
  18#include <net/netfilter/nf_queue.h>
  19
  20int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
  21{
  22        const struct ipv6hdr *iph = ipv6_hdr(skb);
  23        struct sock *sk = sk_to_full_sk(skb->sk);
  24        unsigned int hh_len;
  25        struct dst_entry *dst;
  26        int strict = (ipv6_addr_type(&iph->daddr) &
  27                      (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL));
  28        struct flowi6 fl6 = {
  29                .flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if :
  30                        strict ? skb_dst(skb)->dev->ifindex : 0,
  31                .flowi6_mark = skb->mark,
  32                .flowi6_uid = sock_net_uid(net, sk),
  33                .daddr = iph->daddr,
  34                .saddr = iph->saddr,
  35        };
  36        int err;
  37
  38        dst = ip6_route_output(net, sk, &fl6);
  39        err = dst->error;
  40        if (err) {
  41                IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
  42                net_dbg_ratelimited("ip6_route_me_harder: No more route\n");
  43                dst_release(dst);
  44                return err;
  45        }
  46
  47        /* Drop old route. */
  48        skb_dst_drop(skb);
  49
  50        skb_dst_set(skb, dst);
  51
  52#ifdef CONFIG_XFRM
  53        if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
  54            xfrm_decode_session(skb, flowi6_to_flowi(&fl6), AF_INET6) == 0) {
  55                skb_dst_set(skb, NULL);
  56                dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
  57                if (IS_ERR(dst))
  58                        return PTR_ERR(dst);
  59                skb_dst_set(skb, dst);
  60        }
  61#endif
  62
  63        /* Change in oif may mean change in hh_len. */
  64        hh_len = skb_dst(skb)->dev->hard_header_len;
  65        if (skb_headroom(skb) < hh_len &&
  66            pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)),
  67                             0, GFP_ATOMIC))
  68                return -ENOMEM;
  69
  70        return 0;
  71}
  72EXPORT_SYMBOL(ip6_route_me_harder);
  73
  74static int nf_ip6_reroute(struct sk_buff *skb,
  75                          const struct nf_queue_entry *entry)
  76{
  77        struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
  78
  79        if (entry->state.hook == NF_INET_LOCAL_OUT) {
  80                const struct ipv6hdr *iph = ipv6_hdr(skb);
  81                if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
  82                    !ipv6_addr_equal(&iph->saddr, &rt_info->saddr) ||
  83                    skb->mark != rt_info->mark)
  84                        return ip6_route_me_harder(entry->state.net, skb);
  85        }
  86        return 0;
  87}
  88
  89int __nf_ip6_route(struct net *net, struct dst_entry **dst,
  90                   struct flowi *fl, bool strict)
  91{
  92        static const struct ipv6_pinfo fake_pinfo;
  93        static const struct inet_sock fake_sk = {
  94                /* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */
  95                .sk.sk_bound_dev_if = 1,
  96                .pinet6 = (struct ipv6_pinfo *) &fake_pinfo,
  97        };
  98        const void *sk = strict ? &fake_sk : NULL;
  99        struct dst_entry *result;
 100        int err;
 101
 102        result = ip6_route_output(net, sk, &fl->u.ip6);
 103        err = result->error;
 104        if (err)
 105                dst_release(result);
 106        else
 107                *dst = result;
 108        return err;
 109}
 110EXPORT_SYMBOL_GPL(__nf_ip6_route);
 111
 112static const struct nf_ipv6_ops ipv6ops = {
 113#if IS_MODULE(CONFIG_IPV6)
 114        .chk_addr               = ipv6_chk_addr,
 115        .route_me_harder        = ip6_route_me_harder,
 116        .dev_get_saddr          = ipv6_dev_get_saddr,
 117        .route                  = __nf_ip6_route,
 118#endif
 119        .route_input            = ip6_route_input,
 120        .fragment               = ip6_fragment,
 121        .reroute                = nf_ip6_reroute,
 122};
 123
 124int __init ipv6_netfilter_init(void)
 125{
 126        RCU_INIT_POINTER(nf_ipv6_ops, &ipv6ops);
 127        return 0;
 128}
 129
 130/* This can be called from inet6_init() on errors, so it cannot
 131 * be marked __exit. -DaveM
 132 */
 133void ipv6_netfilter_fini(void)
 134{
 135        RCU_INIT_POINTER(nf_ipv6_ops, NULL);
 136}
 137