2 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
3 * Copyright (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Development of this code funded by Astaro AG (http://www.astaro.com/)
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/list.h>
15 #include <linux/skbuff.h>
16 #include <linux/netlink.h>
17 #include <linux/netfilter.h>
18 #include <linux/netfilter_ipv6.h>
19 #include <linux/netfilter/nfnetlink.h>
20 #include <linux/netfilter/nf_tables.h>
21 #include <net/netfilter/nf_tables.h>
22 #include <net/netfilter/nf_tables_ipv6.h>
23 #include <net/route.h>
25 static unsigned int nf_route_table_hook(const struct nf_hook_ops
*ops
,
27 const struct net_device
*in
,
28 const struct net_device
*out
,
29 int (*okfn
)(struct sk_buff
*))
32 struct nft_pktinfo pkt
;
33 struct in6_addr saddr
, daddr
;
37 /* malformed packet, drop it */
38 if (nft_set_pktinfo_ipv6(&pkt
, ops
, skb
, in
, out
) < 0)
41 /* save source/dest address, mark, hoplimit, flowlabel, priority */
42 memcpy(&saddr
, &ipv6_hdr(skb
)->saddr
, sizeof(saddr
));
43 memcpy(&daddr
, &ipv6_hdr(skb
)->daddr
, sizeof(daddr
));
45 hop_limit
= ipv6_hdr(skb
)->hop_limit
;
47 /* flowlabel and prio (includes version, which shouldn't change either */
48 flowlabel
= *((u32
*)ipv6_hdr(skb
));
50 ret
= nft_do_chain_pktinfo(&pkt
, ops
);
51 if (ret
!= NF_DROP
&& ret
!= NF_QUEUE
&&
52 (memcmp(&ipv6_hdr(skb
)->saddr
, &saddr
, sizeof(saddr
)) ||
53 memcmp(&ipv6_hdr(skb
)->daddr
, &daddr
, sizeof(daddr
)) ||
55 ipv6_hdr(skb
)->hop_limit
!= hop_limit
||
56 flowlabel
!= *((u_int32_t
*)ipv6_hdr(skb
))))
57 return ip6_route_me_harder(skb
) == 0 ? ret
: NF_DROP
;
62 static struct nf_chain_type nft_chain_route_ipv6
= {
63 .family
= NFPROTO_IPV6
,
65 .type
= NFT_CHAIN_T_ROUTE
,
66 .hook_mask
= (1 << NF_INET_LOCAL_OUT
),
68 [NF_INET_LOCAL_OUT
] = nf_route_table_hook
,
73 static int __init
nft_chain_route_init(void)
75 return nft_register_chain_type(&nft_chain_route_ipv6
);
78 static void __exit
nft_chain_route_exit(void)
80 nft_unregister_chain_type(&nft_chain_route_ipv6
);
83 module_init(nft_chain_route_init
);
84 module_exit(nft_chain_route_exit
);
86 MODULE_LICENSE("GPL");
87 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
88 MODULE_ALIAS_NFT_CHAIN(AF_INET6
, "route");