Linux Kernel  3.7.1
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
netfilter.c
Go to the documentation of this file.
1 #include <linux/kernel.h>
2 #include <linux/init.h>
3 #include <linux/ipv6.h>
4 #include <linux/netfilter.h>
5 #include <linux/netfilter_ipv6.h>
6 #include <linux/export.h>
7 #include <net/dst.h>
8 #include <net/ipv6.h>
9 #include <net/ip6_route.h>
10 #include <net/xfrm.h>
11 #include <net/ip6_checksum.h>
12 #include <net/netfilter/nf_queue.h>
13 
15 {
16  struct net *net = dev_net(skb_dst(skb)->dev);
17  const struct ipv6hdr *iph = ipv6_hdr(skb);
18  unsigned int hh_len;
19  struct dst_entry *dst;
20  struct flowi6 fl6 = {
21  .flowi6_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
22  .flowi6_mark = skb->mark,
23  .daddr = iph->daddr,
24  .saddr = iph->saddr,
25  };
26 
27  dst = ip6_route_output(net, skb->sk, &fl6);
28  if (dst->error) {
29  IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
30  LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
31  dst_release(dst);
32  return -EINVAL;
33  }
34 
35  /* Drop old route. */
36  skb_dst_drop(skb);
37 
38  skb_dst_set(skb, dst);
39 
40 #ifdef CONFIG_XFRM
41  if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
42  xfrm_decode_session(skb, flowi6_to_flowi(&fl6), AF_INET6) == 0) {
43  skb_dst_set(skb, NULL);
44  dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), skb->sk, 0);
45  if (IS_ERR(dst))
46  return -1;
47  skb_dst_set(skb, dst);
48  }
49 #endif
50 
51  /* Change in oif may mean change in hh_len. */
52  hh_len = skb_dst(skb)->dev->hard_header_len;
53  if (skb_headroom(skb) < hh_len &&
54  pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)),
55  0, GFP_ATOMIC))
56  return -1;
57 
58  return 0;
59 }
61 
62 /*
63  * Extra routing may needed on local out, as the QUEUE target never
64  * returns control to the table.
65  */
66 
67 struct ip6_rt_info {
68  struct in6_addr daddr;
69  struct in6_addr saddr;
71 };
72 
73 static void nf_ip6_saveroute(const struct sk_buff *skb,
74  struct nf_queue_entry *entry)
75 {
76  struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
77 
78  if (entry->hook == NF_INET_LOCAL_OUT) {
79  const struct ipv6hdr *iph = ipv6_hdr(skb);
80 
81  rt_info->daddr = iph->daddr;
82  rt_info->saddr = iph->saddr;
83  rt_info->mark = skb->mark;
84  }
85 }
86 
87 static int nf_ip6_reroute(struct sk_buff *skb,
88  const struct nf_queue_entry *entry)
89 {
90  struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
91 
92  if (entry->hook == NF_INET_LOCAL_OUT) {
93  const struct ipv6hdr *iph = ipv6_hdr(skb);
94  if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
95  !ipv6_addr_equal(&iph->saddr, &rt_info->saddr) ||
96  skb->mark != rt_info->mark)
97  return ip6_route_me_harder(skb);
98  }
99  return 0;
100 }
101 
102 static int nf_ip6_route(struct net *net, struct dst_entry **dst,
103  struct flowi *fl, bool strict)
104 {
105  static const struct ipv6_pinfo fake_pinfo;
106  static const struct inet_sock fake_sk = {
107  /* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */
108  .sk.sk_bound_dev_if = 1,
109  .pinet6 = (struct ipv6_pinfo *) &fake_pinfo,
110  };
111  const void *sk = strict ? &fake_sk : NULL;
112  struct dst_entry *result;
113  int err;
114 
115  result = ip6_route_output(net, sk, &fl->u.ip6);
116  err = result->error;
117  if (err)
118  dst_release(result);
119  else
120  *dst = result;
121  return err;
122 }
123 
124 __sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
125  unsigned int dataoff, u_int8_t protocol)
126 {
127  const struct ipv6hdr *ip6h = ipv6_hdr(skb);
128  __sum16 csum = 0;
129 
130  switch (skb->ip_summed) {
131  case CHECKSUM_COMPLETE:
132  if (hook != NF_INET_PRE_ROUTING && hook != NF_INET_LOCAL_IN)
133  break;
134  if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
135  skb->len - dataoff, protocol,
136  csum_sub(skb->csum,
137  skb_checksum(skb, 0,
138  dataoff, 0)))) {
140  break;
141  }
142  /* fall through */
143  case CHECKSUM_NONE:
144  skb->csum = ~csum_unfold(
145  csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
146  skb->len - dataoff,
147  protocol,
148  csum_sub(0,
149  skb_checksum(skb, 0,
150  dataoff, 0))));
151  csum = __skb_checksum_complete(skb);
152  }
153  return csum;
154 }
156 
157 static __sum16 nf_ip6_checksum_partial(struct sk_buff *skb, unsigned int hook,
158  unsigned int dataoff, unsigned int len,
160 {
161  const struct ipv6hdr *ip6h = ipv6_hdr(skb);
162  __wsum hsum;
163  __sum16 csum = 0;
164 
165  switch (skb->ip_summed) {
166  case CHECKSUM_COMPLETE:
167  if (len == skb->len - dataoff)
168  return nf_ip6_checksum(skb, hook, dataoff, protocol);
169  /* fall through */
170  case CHECKSUM_NONE:
171  hsum = skb_checksum(skb, 0, dataoff, 0);
172  skb->csum = ~csum_unfold(csum_ipv6_magic(&ip6h->saddr,
173  &ip6h->daddr,
174  skb->len - dataoff,
175  protocol,
176  csum_sub(0, hsum)));
177  skb->ip_summed = CHECKSUM_NONE;
178  return __skb_checksum_complete_head(skb, dataoff + len);
179  }
180  return csum;
181 };
182 
183 static const struct nf_afinfo nf_ip6_afinfo = {
184  .family = AF_INET6,
185  .checksum = nf_ip6_checksum,
186  .checksum_partial = nf_ip6_checksum_partial,
187  .route = nf_ip6_route,
188  .saveroute = nf_ip6_saveroute,
189  .reroute = nf_ip6_reroute,
190  .route_key_size = sizeof(struct ip6_rt_info),
191 };
192 
194 {
195  return nf_register_afinfo(&nf_ip6_afinfo);
196 }
197 
198 /* This can be called from inet6_init() on errors, so it cannot
199  * be marked __exit. -DaveM
200  */
202 {
203  nf_unregister_afinfo(&nf_ip6_afinfo);
204 }