2 * IPv6 packet mangling table, a port of the IPv4 mangle table to IPv6
4 * Copyright (C) 2000-2001 by Harald Welte <laforge@gnumonks.org>
5 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
11 * Extended to all five netfilter hooks by Brad Chapman & Harald Welte
13 #include <linux/module.h>
14 #include <linux/netfilter_ipv6/ip6_tables.h>
16 MODULE_LICENSE("GPL");
17 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
18 MODULE_DESCRIPTION("ip6tables mangle table");
20 #define MANGLE_VALID_HOOKS ((1 << NF_IP6_PRE_ROUTING) | \
21 (1 << NF_IP6_LOCAL_IN) | \
22 (1 << NF_IP6_FORWARD) | \
23 (1 << NF_IP6_LOCAL_OUT) | \
24 (1 << NF_IP6_POST_ROUTING))
27 #define DEBUGP(x, args...) printk(KERN_DEBUG x, ## args)
29 #define DEBUGP(x, args...)
35 struct ip6t_entry entry
;
36 struct ip6t_standard_target target
;
39 struct ip6t_error_target
41 struct ip6t_entry_target target
;
42 char errorname
[IP6T_FUNCTION_MAXNAMELEN
];
47 struct ip6t_entry entry
;
48 struct ip6t_error_target target
;
53 struct ip6t_replace repl
;
54 struct ip6t_standard entries
[5];
55 struct ip6t_error term
;
56 } initial_table __initdata
57 = { { "mangle", MANGLE_VALID_HOOKS
, 6,
58 sizeof(struct ip6t_standard
) * 5 + sizeof(struct ip6t_error
),
59 { [NF_IP6_PRE_ROUTING
] = 0,
60 [NF_IP6_LOCAL_IN
] = sizeof(struct ip6t_standard
),
61 [NF_IP6_FORWARD
] = sizeof(struct ip6t_standard
) * 2,
62 [NF_IP6_LOCAL_OUT
] = sizeof(struct ip6t_standard
) * 3,
63 [NF_IP6_POST_ROUTING
] = sizeof(struct ip6t_standard
) * 4},
64 { [NF_IP6_PRE_ROUTING
] = 0,
65 [NF_IP6_LOCAL_IN
] = sizeof(struct ip6t_standard
),
66 [NF_IP6_FORWARD
] = sizeof(struct ip6t_standard
) * 2,
67 [NF_IP6_LOCAL_OUT
] = sizeof(struct ip6t_standard
) * 3,
68 [NF_IP6_POST_ROUTING
] = sizeof(struct ip6t_standard
) * 4},
72 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
74 sizeof(struct ip6t_entry
),
75 sizeof(struct ip6t_standard
),
77 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target
)), "" } }, { } },
80 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
82 sizeof(struct ip6t_entry
),
83 sizeof(struct ip6t_standard
),
85 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target
)), "" } }, { } },
88 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
90 sizeof(struct ip6t_entry
),
91 sizeof(struct ip6t_standard
),
93 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target
)), "" } }, { } },
96 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
98 sizeof(struct ip6t_entry
),
99 sizeof(struct ip6t_standard
),
101 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target
)), "" } }, { } },
104 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
106 sizeof(struct ip6t_entry
),
107 sizeof(struct ip6t_standard
),
109 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target
)), "" } }, { } },
113 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
115 sizeof(struct ip6t_entry
),
116 sizeof(struct ip6t_error
),
118 { { { { IP6T_ALIGN(sizeof(struct ip6t_error_target
)), IP6T_ERROR_TARGET
} },
125 static struct ip6t_table packet_mangler
= {
127 .valid_hooks
= MANGLE_VALID_HOOKS
,
128 .lock
= RW_LOCK_UNLOCKED
,
133 /* The work comes in here from netfilter.c. */
135 ip6t_route_hook(unsigned int hook
,
136 struct sk_buff
**pskb
,
137 const struct net_device
*in
,
138 const struct net_device
*out
,
139 int (*okfn
)(struct sk_buff
*))
141 return ip6t_do_table(pskb
, hook
, in
, out
, &packet_mangler
);
145 ip6t_local_hook(unsigned int hook
,
146 struct sk_buff
**pskb
,
147 const struct net_device
*in
,
148 const struct net_device
*out
,
149 int (*okfn
)(struct sk_buff
*))
153 struct in6_addr saddr
, daddr
;
155 u_int32_t flowlabel
, mark
;
158 /* root is playing with raw sockets. */
159 if ((*pskb
)->len
< sizeof(struct iphdr
)
160 || (*pskb
)->nh
.iph
->ihl
* 4 < sizeof(struct iphdr
)) {
162 printk("ip6t_hook: happy cracking.\n");
167 /* save source/dest address, mark, hoplimit, flowlabel, priority, */
168 memcpy(&saddr
, &(*pskb
)->nh
.ipv6h
->saddr
, sizeof(saddr
));
169 memcpy(&daddr
, &(*pskb
)->nh
.ipv6h
->daddr
, sizeof(daddr
));
170 mark
= (*pskb
)->mark
;
171 hop_limit
= (*pskb
)->nh
.ipv6h
->hop_limit
;
173 /* flowlabel and prio (includes version, which shouldn't change either */
174 flowlabel
= *((u_int32_t
*) (*pskb
)->nh
.ipv6h
);
176 ret
= ip6t_do_table(pskb
, hook
, in
, out
, &packet_mangler
);
178 if (ret
!= NF_DROP
&& ret
!= NF_STOLEN
179 && (memcmp(&(*pskb
)->nh
.ipv6h
->saddr
, &saddr
, sizeof(saddr
))
180 || memcmp(&(*pskb
)->nh
.ipv6h
->daddr
, &daddr
, sizeof(daddr
))
181 || (*pskb
)->mark
!= mark
182 || (*pskb
)->nh
.ipv6h
->hop_limit
!= hop_limit
))
183 return ip6_route_me_harder(*pskb
) == 0 ? ret
: NF_DROP
;
188 static struct nf_hook_ops ip6t_ops
[] = {
190 .hook
= ip6t_route_hook
,
191 .owner
= THIS_MODULE
,
193 .hooknum
= NF_IP6_PRE_ROUTING
,
194 .priority
= NF_IP6_PRI_MANGLE
,
197 .hook
= ip6t_local_hook
,
198 .owner
= THIS_MODULE
,
200 .hooknum
= NF_IP6_LOCAL_IN
,
201 .priority
= NF_IP6_PRI_MANGLE
,
204 .hook
= ip6t_route_hook
,
205 .owner
= THIS_MODULE
,
207 .hooknum
= NF_IP6_FORWARD
,
208 .priority
= NF_IP6_PRI_MANGLE
,
211 .hook
= ip6t_local_hook
,
212 .owner
= THIS_MODULE
,
214 .hooknum
= NF_IP6_LOCAL_OUT
,
215 .priority
= NF_IP6_PRI_MANGLE
,
218 .hook
= ip6t_route_hook
,
219 .owner
= THIS_MODULE
,
221 .hooknum
= NF_IP6_POST_ROUTING
,
222 .priority
= NF_IP6_PRI_MANGLE
,
226 static int __init
ip6table_mangle_init(void)
231 ret
= ip6t_register_table(&packet_mangler
, &initial_table
.repl
);
236 ret
= nf_register_hooks(ip6t_ops
, ARRAY_SIZE(ip6t_ops
));
243 ip6t_unregister_table(&packet_mangler
);
247 static void __exit
ip6table_mangle_fini(void)
249 nf_unregister_hooks(ip6t_ops
, ARRAY_SIZE(ip6t_ops
));
250 ip6t_unregister_table(&packet_mangler
);
253 module_init(ip6table_mangle_init
);
254 module_exit(ip6table_mangle_fini
);