release/src-rt-6.x/linux/linux-2.6/net/ipv6/netfilter/ip6t_ROUTE.c

   1 /*
   2  * This implements the ROUTE v6 target, which enables you to setup unusual
   3  * routes not supported by the standard kernel routing table.
   4  *
   5  * Copyright (C) 2003 Cedric de Launois <delaunois@info.ucl.ac.be>
   6  *
   7  * v 1.1 2004/11/23
   8  *
   9  * This software is distributed under GNU GPL v2, 1991
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/skbuff.h>
  14 #include <linux/version.h>
  15
  16 #include <linux/ipv6.h>
  17 #include <linux/netfilter_ipv6/ip6_tables.h>
  18 #include <linux/netfilter_ipv6/ip6t_ROUTE.h>
  19 #include <linux/netdevice.h>
  20 #include <linux/version.h>
  21 #include <net/ipv6.h>
  22 #include <net/ndisc.h>
  23 #include <net/ip6_route.h>
  24 #include <linux/icmpv6.h>
  25
  26 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)
  27 #define ipv6_hdr(s) (s->nh.ipv6h)
  28 #endif
  29
  30 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
  31 #include <net/net_namespace.h>
  32 #endif
  33
  34 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26)
  35 #define NF_INET_PRE_ROUTING NF_IP6_PRE_ROUTING
  36 #define NF_INET_LOCAL_IN NF_IP6_LOCAL_IN
  37 #define NF_INET_FORWARD NF_IP6_FORWARD
  38 #define NF_INET_LOCAL_OUT NF_IP6_LOCAL_OUT
  39 #define NF_INET_POST_ROUTING NF_IP6_POST_ROUTING
  40 #endif
  41
  42 #if 1
  43 #define DEBUGP printk
  44 #else
  45 #define DEBUGP(format, args...)
  46 #endif
  47
  48 #define NIP6(addr) \
  49         ntohs((addr).s6_addr16[0]), \
  50         ntohs((addr).s6_addr16[1]), \
  51         ntohs((addr).s6_addr16[2]), \
  52         ntohs((addr).s6_addr16[3]), \
  53         ntohs((addr).s6_addr16[4]), \
  54         ntohs((addr).s6_addr16[5]), \
  55         ntohs((addr).s6_addr16[6]), \
  56         ntohs((addr).s6_addr16[7])
  57
  58 /* Route the packet according to the routing keys specified in
  59  * route_info. Keys are :
  60  *  - ifindex :
  61  *      0 if no oif preferred,
  62  *      otherwise set to the index of the desired oif
  63  *  - route_info->gw :
  64  *      0 if no gateway specified,
  65  *      otherwise set to the next host to which the pkt must be routed
  66  * If success, skb->dev is the output device to which the packet must
  67  * be sent and skb->dst is not NULL
  68  *
  69  * RETURN:  1 if the packet was succesfully routed to the
  70  *            destination desired
  71  *          0 if the kernel routing table could not route the packet
  72  *            according to the keys specified
  73  */
  74 static int
  75 route6(struct sk_buff *skb,
  76        unsigned int ifindex,
  77        const struct ip6t_route_target_info *route_info)
  78 {
  79         struct rt6_info *rt = NULL;
  80         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
  81         struct in6_addr *gw = (struct in6_addr*)&route_info->gw;
  82
  83         DEBUGP("ip6t_ROUTE: called with: ");
  84         DEBUGP("DST=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(ipv6h->daddr));
  85         DEBUGP("GATEWAY=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(*gw));
  86         DEBUGP("OUT=%s\n", route_info->oif);
  87
  88 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,26)
  89         if (ipv6_addr_any(gw))
  90                 rt = rt6_lookup(&init_net, &ipv6h->daddr, &ipv6h->saddr, ifindex, 1);
  91         else
  92                 rt = rt6_lookup(&init_net, gw, &ipv6h->saddr, ifindex, 1);
  93 #else
  94         if (ipv6_addr_any(gw))
  95                 rt = rt6_lookup(&ipv6h->daddr, &ipv6h->saddr, ifindex, 1);
  96         else
  97                 rt = rt6_lookup(gw, &ipv6h->saddr, ifindex, 1);
  98 #endif
  99
 100         if (!rt)
 101                 goto no_route;
 102
 103         DEBUGP("ip6t_ROUTE: routing gives: ");
 104         DEBUGP("DST=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(rt->rt6i_dst.addr));
 105         DEBUGP("GATEWAY=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(rt->rt6i_gateway));
 106         DEBUGP("OUT=%s\n", rt->rt6i_dev->name);
 107
 108         if (ifindex && rt->rt6i_dev->ifindex!=ifindex)
 109                 goto wrong_route;
 110
 111         if (!rt->rt6i_nexthop) {
 112                 DEBUGP("ip6t_ROUTE: discovering neighbor\n");
 113                 rt->rt6i_nexthop = ndisc_get_neigh(rt->rt6i_dev, &rt->rt6i_dst.addr);
 114         }
 115
 116         /* Drop old route. */
 117         dst_release(skb->dst);
 118         skb->dst = &rt->u.dst;
 119         skb->dev = rt->rt6i_dev;
 120         return 1;
 121
 122  wrong_route:
 123         dst_release(&rt->u.dst);
 124  no_route:
 125         if (!net_ratelimit())
 126                 return 0;
 127
 128         printk("ip6t_ROUTE: no explicit route found ");
 129         if (ifindex)
 130                 printk("via interface %s ", route_info->oif);
 131         if (!ipv6_addr_any(gw))
 132                 printk("via gateway %04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x", NIP6(*gw));
 133         printk("\n");
 134         return 0;
 135 }
 136
 137
 138 /* Stolen from ip6_output_finish
 139  * PRE : skb->dev is set to the device we are leaving by
 140  *       skb->dst is not NULL
 141  * POST: the packet is sent with the link layer header pushed
 142  *       the packet is destroyed
 143  */
 144 static void ip_direct_send(struct sk_buff *skb)
 145 {
 146         struct dst_entry *dst = skb->dst;
 147         struct hh_cache *hh = dst->hh;
 148         unsigned seq;
 149
 150         if (hh) {
 151                 do {
 152                         seq = read_seqbegin(&hh->hh_lock);
 153                         memcpy(skb->data - 16, hh->hh_data, 16);
 154                 } while (read_seqretry(&hh->hh_lock, seq));
 155                 skb_push(skb, hh->hh_len);
 156                 hh->hh_output(skb);
 157         } else if (dst->neighbour)
 158                 dst->neighbour->output(skb);
 159         else {
 160                 if (net_ratelimit())
 161                         DEBUGP(KERN_DEBUG "ip6t_ROUTE: no hdr & no neighbour cache!\n");
 162                 kfree_skb(skb);
 163         }
 164 }
 165
 166
 167 static unsigned int
 168 route6_oif(const struct ip6t_route_target_info *route_info,
 169            struct sk_buff *skb)
 170 {
 171         unsigned int ifindex = 0;
 172         struct net_device *dev_out = NULL;
 173
 174         /* The user set the interface name to use.
 175          * Getting the current interface index.
 176          */
 177 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
 178         if ((dev_out = dev_get_by_name(&init_net, route_info->oif))) {
 179 #else
 180         if ((dev_out = dev_get_by_name(route_info->oif))) {
 181 #endif
 182                 ifindex = dev_out->ifindex;
 183         } else {
 184                 /* Unknown interface name : packet dropped */
 185                 if (net_ratelimit())
 186                         DEBUGP("ip6t_ROUTE: oif interface %s not found\n", route_info->oif);
 187
 188                 if (route_info->flags & IP6T_ROUTE_CONTINUE)
 189                         return IP6T_CONTINUE;
 190                 else
 191                         return NF_DROP;
 192         }
 193
 194         /* Trying the standard way of routing packets */
 195         if (route6(skb, ifindex, route_info)) {
 196                 dev_put(dev_out);
 197                 if (route_info->flags & IP6T_ROUTE_CONTINUE)
 198                         return IP6T_CONTINUE;
 199
 200                 ip_direct_send(skb);
 201                 return NF_STOLEN;
 202         } else
 203                 return NF_DROP;
 204 }
 205
 206
 207 static unsigned int
 208 route6_gw(const struct ip6t_route_target_info *route_info,
 209           struct sk_buff *skb)
 210 {
 211         if (route6(skb, 0, route_info)) {
 212                 if (route_info->flags & IP6T_ROUTE_CONTINUE)
 213                         return IP6T_CONTINUE;
 214
 215                 ip_direct_send(skb);
 216                 return NF_STOLEN;
 217         } else
 218                 return NF_DROP;
 219 }
 220
 221 static unsigned int
 222 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
 223 target(struct sk_buff **pskb,
 224        unsigned int hooknum,
 225        const struct net_device *in,
 226        const struct net_device *out,
 227        const void *targinfo,
 228        void *userinfo)
 229 #elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
 230 target(struct sk_buff **pskb,
 231        const struct net_device *in,
 232        const struct net_device *out,
 233        unsigned int hooknum,
 234        const void *targinfo,
 235        void *userinfo)
 236 #elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
 237 target(struct sk_buff **pskb,
 238        const struct net_device *in,
 239        const struct net_device *out,
 240        unsigned int hooknum,
 241        const struct xt_target *target,
 242        const void *targinfo,
 243        void *userinfo)
 244 #elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)
 245 target(struct sk_buff **pskb,
 246        const struct net_device *in,
 247        const struct net_device *out,
 248        unsigned int hooknum,
 249        const struct xt_target *target,
 250        const void *targinfo)
 251 #elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
 252 target(struct sk_buff *skb,
 253        const struct net_device *in,
 254        const struct net_device *out,
 255        unsigned int hooknum,
 256        const struct xt_target *target,
 257        const void *targinfo)
 258 #else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28) */
 259 target(struct sk_buff *skb,
 260        const struct xt_target_param *par)
 261 #endif
 262 {
 263 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
 264         const struct ip6t_route_target_info *route_info = targinfo;
 265 #else
 266         const struct ip6t_route_target_info *route_info = par->targinfo;
 267         unsigned int hooknum = par->hooknum;
 268 #endif
 269 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)
 270         struct sk_buff *skb = *pskb;
 271 #endif
 272         struct in6_addr *gw = (struct in6_addr*)&route_info->gw;
 273         unsigned int res;
 274
 275         if (route_info->flags & IP6T_ROUTE_CONTINUE)
 276                 goto do_it;
 277
 278         /* If we are at PREROUTING or INPUT hook
 279          * the TTL isn't decreased by the IP stack
 280          */
 281         if (hooknum == NF_INET_PRE_ROUTING ||
 282             hooknum == NF_INET_LOCAL_IN) {
 283
 284                 struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 285
 286                 if (ipv6h->hop_limit <= 1) {
 287                         /* Force OUTPUT device used as source address */
 288                         skb->dev = skb->dst->dev;
 289
 290                         icmpv6_send(skb, ICMPV6_TIME_EXCEED,
 291                                     ICMPV6_EXC_HOPLIMIT, 0, skb->dev);
 292
 293                         return NF_DROP;
 294                 }
 295
 296                 ipv6h->hop_limit--;
 297         }
 298
 299         if ((route_info->flags & IP6T_ROUTE_TEE)) {
 300                 /*
 301                  * Copy the skb, and route the copy. Will later return
 302                  * IP6T_CONTINUE for the original skb, which should continue
 303                  * on its way as if nothing happened. The copy should be
 304                  * independantly delivered to the ROUTE --gw.
 305                  */
 306                 skb = skb_copy(skb, GFP_ATOMIC);
 307                 if (!skb) {
 308                         if (net_ratelimit())
 309                                 DEBUGP(KERN_DEBUG "ip6t_ROUTE: copy failed!\n");
 310                         return IP6T_CONTINUE;
 311                 }
 312         }
 313
 314 do_it:
 315         if (route_info->oif[0]) {
 316                 res = route6_oif(route_info, skb);
 317         } else if (!ipv6_addr_any(gw)) {
 318                 res = route6_gw(route_info, skb);
 319         } else {
 320                 if (net_ratelimit())
 321                         DEBUGP(KERN_DEBUG "ip6t_ROUTE: no parameter !\n");
 322                 res = IP6T_CONTINUE;
 323         }
 324
 325         if ((route_info->flags & IP6T_ROUTE_TEE))
 326                 res = IP6T_CONTINUE;
 327
 328         return res;
 329 }
 330
 331
 332 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16)
 333 static int
 334 checkentry(const char *tablename,
 335            const struct ip6t_entry *e,
 336            void *targinfo,
 337            unsigned int targinfosize,
 338            unsigned int hook_mask)
 339 #elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
 340 static int
 341 checkentry(const char *tablename,
 342            const void *e,
 343            void *targinfo,
 344            unsigned int targinfosize,
 345            unsigned int hook_mask)
 346 #elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
 347 static int
 348 checkentry(const char *tablename,
 349            const void *e,
 350            const struct xt_target *target,
 351            void *targinfo,
 352            unsigned int targinfosize,
 353            unsigned int hook_mask)
 354 #elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,23)
 355 static int
 356 checkentry(const char *tablename,
 357            const void *e,
 358            const struct xt_target *target,
 359            void *targinfo,
 360            unsigned int hook_mask)
 361 #elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
 362 static bool
 363 checkentry(const char *tablename,
 364            const void *e,
 365            const struct xt_target *target,
 366            void *targinfo,
 367            unsigned int hook_mask)
 368 #else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28) */
 369 static bool
 370 checkentry(const struct xt_tgchk_param *par)
 371 #endif
 372 {
 373 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
 374         const char *tablename = par->table;
 375 #endif
 376
 377         if (strcmp(tablename, "mangle") != 0) {
 378                 printk("ip6t_ROUTE: can only be called from \"mangle\" table.\n");
 379                 return 0;
 380         }
 381
 382 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
 383         if (targinfosize != IP6T_ALIGN(sizeof(struct ip6t_route_target_info))) {
 384                 printk(KERN_WARNING "ip6t_ROUTE: targinfosize %u != %Zu\n",
 385                        targinfosize,
 386                        IP6T_ALIGN(sizeof(struct ip6t_route_target_info)));
 387                 return 0;
 388         }
 389 #endif
 390
 391         return 1;
 392 }
 393
 394 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
 395 static struct xt_target ip6t_route_reg = {
 396 #else
 397 static struct ip6t_target ip6t_route_reg = {
 398 #endif
 399         .name           = "ROUTE",
 400 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
 401         .family         = AF_INET6,
 402 #endif
 403         .target         = target,
 404 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
 405         .targetsize     = sizeof(struct ip6t_route_target_info),
 406 #endif
 407         .checkentry     = checkentry,
 408         .me             = THIS_MODULE
 409 };
 410
 411
 412 static int __init init(void)
 413 {
 414         printk(KERN_DEBUG "registering ipv6 ROUTE target\n");
 415 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
 416         if (xt_register_target(&ip6t_route_reg))
 417 #else
 418         if (ip6t_register_target(&ip6t_route_reg))
 419 #endif
 420                 return -EINVAL;
 421
 422         return 0;
 423 }
 424
 425
 426 static void __exit fini(void)
 427 {
 428 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
 429         xt_unregister_target(&ip6t_route_reg);
 430 #else
 431         ip6t_unregister_target(&ip6t_route_reg);
 432 #endif
 433 }
 434
 435 module_init(init);
 436 module_exit(fini);
 437 MODULE_LICENSE("GPL");