2 * Copyright (c) 2011, 2012 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
9 #include <linux/module.h>
10 #include <linux/skbuff.h>
11 #include <linux/ipv6.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter_ipv6.h>
15 #include <linux/netfilter_ipv6/ip6t_NPT.h>
16 #include <linux/netfilter/x_tables.h>
18 static int ip6t_npt_checkentry(const struct xt_tgchk_param
*par
)
20 struct ip6t_npt_tginfo
*npt
= par
->targinfo
;
21 __wsum src_sum
= 0, dst_sum
= 0;
25 if (npt
->src_pfx_len
> 64 || npt
->dst_pfx_len
> 64)
28 /* Ensure that LSB of prefix is zero */
29 ipv6_addr_prefix(&pfx
, &npt
->src_pfx
.in6
, npt
->src_pfx_len
);
30 if (!ipv6_addr_equal(&pfx
, &npt
->src_pfx
.in6
))
32 ipv6_addr_prefix(&pfx
, &npt
->dst_pfx
.in6
, npt
->dst_pfx_len
);
33 if (!ipv6_addr_equal(&pfx
, &npt
->dst_pfx
.in6
))
36 for (i
= 0; i
< ARRAY_SIZE(npt
->src_pfx
.in6
.s6_addr16
); i
++) {
37 src_sum
= csum_add(src_sum
,
38 (__force __wsum
)npt
->src_pfx
.in6
.s6_addr16
[i
]);
39 dst_sum
= csum_add(dst_sum
,
40 (__force __wsum
)npt
->dst_pfx
.in6
.s6_addr16
[i
]);
43 npt
->adjustment
= ~csum_fold(csum_sub(src_sum
, dst_sum
));
47 static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo
*npt
,
48 struct in6_addr
*addr
)
55 pfx_len
= max(npt
->src_pfx_len
, npt
->dst_pfx_len
);
56 for (i
= 0; i
< pfx_len
; i
+= 32) {
57 if (pfx_len
- i
>= 32)
60 mask
= htonl((1 << (i
- pfx_len
+ 32)) - 1);
63 addr
->s6_addr32
[idx
] &= mask
;
64 addr
->s6_addr32
[idx
] |= ~mask
& npt
->dst_pfx
.in6
.s6_addr32
[idx
];
70 for (idx
= 4; idx
< ARRAY_SIZE(addr
->s6_addr16
); idx
++) {
71 if ((__force __sum16
)addr
->s6_addr16
[idx
] !=
75 if (idx
== ARRAY_SIZE(addr
->s6_addr16
))
79 sum
= ~csum_fold(csum_add(csum_unfold((__force __sum16
)addr
->s6_addr16
[idx
]),
80 csum_unfold(npt
->adjustment
)));
81 if (sum
== CSUM_MANGLED_0
)
83 *(__force __sum16
*)&addr
->s6_addr16
[idx
] = sum
;
89 ip6t_snpt_tg(struct sk_buff
*skb
, const struct xt_action_param
*par
)
91 const struct ip6t_npt_tginfo
*npt
= par
->targinfo
;
93 if (!ip6t_npt_map_pfx(npt
, &ipv6_hdr(skb
)->saddr
)) {
94 icmpv6_send(skb
, ICMPV6_PARAMPROB
, ICMPV6_HDR_FIELD
,
95 offsetof(struct ipv6hdr
, saddr
));
102 ip6t_dnpt_tg(struct sk_buff
*skb
, const struct xt_action_param
*par
)
104 const struct ip6t_npt_tginfo
*npt
= par
->targinfo
;
106 if (!ip6t_npt_map_pfx(npt
, &ipv6_hdr(skb
)->daddr
)) {
107 icmpv6_send(skb
, ICMPV6_PARAMPROB
, ICMPV6_HDR_FIELD
,
108 offsetof(struct ipv6hdr
, daddr
));
114 static struct xt_target ip6t_npt_target_reg
[] __read_mostly
= {
118 .target
= ip6t_snpt_tg
,
119 .targetsize
= sizeof(struct ip6t_npt_tginfo
),
120 .checkentry
= ip6t_npt_checkentry
,
121 .family
= NFPROTO_IPV6
,
122 .hooks
= (1 << NF_INET_LOCAL_IN
) |
123 (1 << NF_INET_POST_ROUTING
),
129 .target
= ip6t_dnpt_tg
,
130 .targetsize
= sizeof(struct ip6t_npt_tginfo
),
131 .checkentry
= ip6t_npt_checkentry
,
132 .family
= NFPROTO_IPV6
,
133 .hooks
= (1 << NF_INET_PRE_ROUTING
) |
134 (1 << NF_INET_LOCAL_OUT
),
139 static int __init
ip6t_npt_init(void)
141 return xt_register_targets(ip6t_npt_target_reg
,
142 ARRAY_SIZE(ip6t_npt_target_reg
));
145 static void __exit
ip6t_npt_exit(void)
147 xt_unregister_targets(ip6t_npt_target_reg
,
148 ARRAY_SIZE(ip6t_npt_target_reg
));
151 module_init(ip6t_npt_init
);
152 module_exit(ip6t_npt_exit
);
154 MODULE_LICENSE("GPL");
155 MODULE_DESCRIPTION("IPv6-to-IPv6 Network Prefix Translation (RFC 6296)");
156 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
157 MODULE_ALIAS("ip6t_SNPT");
158 MODULE_ALIAS("ip6t_DNPT");