2 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
3 * Copyright (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Development of this code funded by Astaro AG (http://www.astaro.com/)
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/list.h>
15 #include <linux/skbuff.h>
16 #include <linux/netlink.h>
17 #include <linux/netfilter.h>
18 #include <linux/netfilter_ipv6.h>
19 #include <linux/netfilter/nfnetlink.h>
20 #include <linux/netfilter/nf_tables.h>
21 #include <net/netfilter/nf_tables.h>
22 #include <net/route.h>
24 static unsigned int nf_route_table_hook(const struct nf_hook_ops
*ops
,
26 const struct net_device
*in
,
27 const struct net_device
*out
,
28 int (*okfn
)(struct sk_buff
*))
31 struct in6_addr saddr
, daddr
;
35 /* save source/dest address, mark, hoplimit, flowlabel, priority */
36 memcpy(&saddr
, &ipv6_hdr(skb
)->saddr
, sizeof(saddr
));
37 memcpy(&daddr
, &ipv6_hdr(skb
)->daddr
, sizeof(daddr
));
39 hop_limit
= ipv6_hdr(skb
)->hop_limit
;
41 /* flowlabel and prio (includes version, which shouldn't change either */
42 flowlabel
= *((u32
*)ipv6_hdr(skb
));
44 ret
= nft_do_chain(ops
, skb
, in
, out
, okfn
);
45 if (ret
!= NF_DROP
&& ret
!= NF_QUEUE
&&
46 (memcmp(&ipv6_hdr(skb
)->saddr
, &saddr
, sizeof(saddr
)) ||
47 memcmp(&ipv6_hdr(skb
)->daddr
, &daddr
, sizeof(daddr
)) ||
49 ipv6_hdr(skb
)->hop_limit
!= hop_limit
||
50 flowlabel
!= *((u_int32_t
*)ipv6_hdr(skb
))))
51 return ip6_route_me_harder(skb
) == 0 ? ret
: NF_DROP
;
56 static struct nf_chain_type nft_chain_route_ipv6
= {
57 .family
= NFPROTO_IPV6
,
59 .type
= NFT_CHAIN_T_ROUTE
,
60 .hook_mask
= (1 << NF_INET_LOCAL_OUT
),
62 [NF_INET_LOCAL_OUT
] = nf_route_table_hook
,
67 static int __init
nft_chain_route_init(void)
69 return nft_register_chain_type(&nft_chain_route_ipv6
);
72 static void __exit
nft_chain_route_exit(void)
74 nft_unregister_chain_type(&nft_chain_route_ipv6
);
77 module_init(nft_chain_route_init
);
78 module_exit(nft_chain_route_exit
);
80 MODULE_LICENSE("GPL");
81 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
82 MODULE_ALIAS_NFT_CHAIN(AF_INET6
, "route");