2 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
11 #include <linux/module.h>
12 #include <linux/init.h>
13 #include <linux/list.h>
14 #include <linux/skbuff.h>
15 #include <linux/netlink.h>
16 #include <linux/netfilter.h>
17 #include <linux/netfilter_ipv6.h>
18 #include <linux/netfilter/nfnetlink.h>
19 #include <linux/netfilter/nf_tables.h>
20 #include <net/netfilter/nf_tables.h>
21 #include <net/route.h>
23 static unsigned int nf_route_table_hook(const struct nf_hook_ops
*ops
,
25 const struct net_device
*in
,
26 const struct net_device
*out
,
27 int (*okfn
)(struct sk_buff
*))
30 struct in6_addr saddr
, daddr
;
34 /* save source/dest address, mark, hoplimit, flowlabel, priority */
35 memcpy(&saddr
, &ipv6_hdr(skb
)->saddr
, sizeof(saddr
));
36 memcpy(&daddr
, &ipv6_hdr(skb
)->daddr
, sizeof(daddr
));
38 hop_limit
= ipv6_hdr(skb
)->hop_limit
;
40 /* flowlabel and prio (includes version, which shouldn't change either */
41 flowlabel
= *((u32
*)ipv6_hdr(skb
));
43 ret
= nft_do_chain(ops
, skb
, in
, out
, okfn
);
44 if (ret
!= NF_DROP
&& ret
!= NF_QUEUE
&&
45 (memcmp(&ipv6_hdr(skb
)->saddr
, &saddr
, sizeof(saddr
)) ||
46 memcmp(&ipv6_hdr(skb
)->daddr
, &daddr
, sizeof(daddr
)) ||
48 ipv6_hdr(skb
)->hop_limit
!= hop_limit
||
49 flowlabel
!= *((u_int32_t
*)ipv6_hdr(skb
))))
50 return ip6_route_me_harder(skb
) == 0 ? ret
: NF_DROP
;
55 static struct nft_base_chain nf_chain_route_output __read_mostly
= {
58 .rules
= LIST_HEAD_INIT(nf_chain_route_output
.chain
.rules
),
59 .flags
= NFT_BASE_CHAIN
| NFT_CHAIN_BUILTIN
,
62 .hook
= nf_route_table_hook
,
65 .hooknum
= NF_INET_LOCAL_OUT
,
66 .priority
= NF_IP6_PRI_MANGLE
,
67 .priv
= &nf_chain_route_output
.chain
,
71 static struct nft_table nf_table_route_ipv6 __read_mostly
= {
73 .chains
= LIST_HEAD_INIT(nf_table_route_ipv6
.chains
),
76 static int __init
nf_table_route_init(void)
78 list_add_tail(&nf_chain_route_output
.chain
.list
,
79 &nf_table_route_ipv6
.chains
);
80 return nft_register_table(&nf_table_route_ipv6
, NFPROTO_IPV6
);
83 static void __exit
nf_table_route_exit(void)
85 nft_unregister_table(&nf_table_route_ipv6
, NFPROTO_IPV6
);
88 module_init(nf_table_route_init
);
89 module_exit(nf_table_route_exit
);
91 MODULE_LICENSE("GPL");
92 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
93 MODULE_ALIAS_NFT_TABLE(AF_INET6
, "route");