2 * IPv6 packet mangling table, a port of the IPv4 mangle table to IPv6
4 * Copyright (C) 2000-2001 by Harald Welte <laforge@gnumonks.org>
5 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
11 * Extended to all five netfilter hooks by Brad Chapman & Harald Welte
13 #include <linux/module.h>
14 #include <linux/netfilter_ipv6/ip6_tables.h>
16 MODULE_LICENSE("GPL");
17 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
18 MODULE_DESCRIPTION("ip6tables mangle table");
20 #define MANGLE_VALID_HOOKS ((1 << NF_IP6_PRE_ROUTING) | \
21 (1 << NF_IP6_LOCAL_IN) | \
22 (1 << NF_IP6_FORWARD) | \
23 (1 << NF_IP6_LOCAL_OUT) | \
24 (1 << NF_IP6_POST_ROUTING))
27 #define DEBUGP(x, args...) printk(KERN_DEBUG x, ## args)
29 #define DEBUGP(x, args...)
35 struct ip6t_entry entry
;
36 struct ip6t_standard_target target
;
39 struct ip6t_error_target
41 struct ip6t_entry_target target
;
42 char errorname
[IP6T_FUNCTION_MAXNAMELEN
];
47 struct ip6t_entry entry
;
48 struct ip6t_error_target target
;
53 struct ip6t_replace repl
;
54 struct ip6t_standard entries
[5];
55 struct ip6t_error term
;
56 } initial_table __initdata
57 = { { "mangle", MANGLE_VALID_HOOKS
, 6,
58 sizeof(struct ip6t_standard
) * 5 + sizeof(struct ip6t_error
),
59 { [NF_IP6_PRE_ROUTING
] = 0,
60 [NF_IP6_LOCAL_IN
] = sizeof(struct ip6t_standard
),
61 [NF_IP6_FORWARD
] = sizeof(struct ip6t_standard
) * 2,
62 [NF_IP6_LOCAL_OUT
] = sizeof(struct ip6t_standard
) * 3,
63 [NF_IP6_POST_ROUTING
] = sizeof(struct ip6t_standard
) * 4},
64 { [NF_IP6_PRE_ROUTING
] = 0,
65 [NF_IP6_LOCAL_IN
] = sizeof(struct ip6t_standard
),
66 [NF_IP6_FORWARD
] = sizeof(struct ip6t_standard
) * 2,
67 [NF_IP6_LOCAL_OUT
] = sizeof(struct ip6t_standard
) * 3,
68 [NF_IP6_POST_ROUTING
] = sizeof(struct ip6t_standard
) * 4},
72 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
74 sizeof(struct ip6t_entry
),
75 sizeof(struct ip6t_standard
),
77 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target
)), "" } }, { } },
80 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
82 sizeof(struct ip6t_entry
),
83 sizeof(struct ip6t_standard
),
85 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target
)), "" } }, { } },
88 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
90 sizeof(struct ip6t_entry
),
91 sizeof(struct ip6t_standard
),
93 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target
)), "" } }, { } },
96 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
98 sizeof(struct ip6t_entry
),
99 sizeof(struct ip6t_standard
),
101 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target
)), "" } }, { } },
104 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
106 sizeof(struct ip6t_entry
),
107 sizeof(struct ip6t_standard
),
109 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target
)), "" } }, { } },
113 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
115 sizeof(struct ip6t_entry
),
116 sizeof(struct ip6t_error
),
118 { { { { IP6T_ALIGN(sizeof(struct ip6t_error_target
)), IP6T_ERROR_TARGET
} },
125 static struct ip6t_table packet_mangler
= {
127 .table
= &initial_table
.repl
,
128 .valid_hooks
= MANGLE_VALID_HOOKS
,
129 .lock
= RW_LOCK_UNLOCKED
,
133 /* The work comes in here from netfilter.c. */
135 ip6t_route_hook(unsigned int hook
,
136 struct sk_buff
**pskb
,
137 const struct net_device
*in
,
138 const struct net_device
*out
,
139 int (*okfn
)(struct sk_buff
*))
141 return ip6t_do_table(pskb
, hook
, in
, out
, &packet_mangler
, NULL
);
145 ip6t_local_hook(unsigned int hook
,
146 struct sk_buff
**pskb
,
147 const struct net_device
*in
,
148 const struct net_device
*out
,
149 int (*okfn
)(struct sk_buff
*))
152 unsigned long nfmark
;
154 struct in6_addr saddr
, daddr
;
159 /* root is playing with raw sockets. */
160 if ((*pskb
)->len
< sizeof(struct iphdr
)
161 || (*pskb
)->nh
.iph
->ihl
* 4 < sizeof(struct iphdr
)) {
163 printk("ip6t_hook: happy cracking.\n");
168 /* FIXME: Push down to extensions --RR */
169 if (skb_is_nonlinear(*pskb
) && skb_linearize(*pskb
, GFP_ATOMIC
) != 0)
172 /* save source/dest address, nfmark, hoplimit, flowlabel, priority, */
173 memcpy(&saddr
, &(*pskb
)->nh
.ipv6h
->saddr
, sizeof(saddr
));
174 memcpy(&daddr
, &(*pskb
)->nh
.ipv6h
->daddr
, sizeof(daddr
));
175 nfmark
= (*pskb
)->nfmark
;
176 hop_limit
= (*pskb
)->nh
.ipv6h
->hop_limit
;
178 /* flowlabel and prio (includes version, which shouldn't change either */
179 flowlabel
= *((u_int32_t
*) (*pskb
)->nh
.ipv6h
);
181 ret
= ip6t_do_table(pskb
, hook
, in
, out
, &packet_mangler
, NULL
);
183 if (ret
!= NF_DROP
&& ret
!= NF_STOLEN
184 && (memcmp(&(*pskb
)->nh
.ipv6h
->saddr
, &saddr
, sizeof(saddr
))
185 || memcmp(&(*pskb
)->nh
.ipv6h
->daddr
, &daddr
, sizeof(daddr
))
186 || (*pskb
)->nfmark
!= nfmark
187 || (*pskb
)->nh
.ipv6h
->hop_limit
!= hop_limit
)) {
189 /* something which could affect routing has changed */
191 DEBUGP("ip6table_mangle: we'd need to re-route a packet\n");
197 static struct nf_hook_ops ip6t_ops
[] = {
199 .hook
= ip6t_route_hook
,
200 .owner
= THIS_MODULE
,
202 .hooknum
= NF_IP6_PRE_ROUTING
,
203 .priority
= NF_IP6_PRI_MANGLE
,
206 .hook
= ip6t_local_hook
,
207 .owner
= THIS_MODULE
,
209 .hooknum
= NF_IP6_LOCAL_IN
,
210 .priority
= NF_IP6_PRI_MANGLE
,
213 .hook
= ip6t_route_hook
,
214 .owner
= THIS_MODULE
,
216 .hooknum
= NF_IP6_FORWARD
,
217 .priority
= NF_IP6_PRI_MANGLE
,
220 .hook
= ip6t_local_hook
,
221 .owner
= THIS_MODULE
,
223 .hooknum
= NF_IP6_LOCAL_OUT
,
224 .priority
= NF_IP6_PRI_MANGLE
,
227 .hook
= ip6t_route_hook
,
228 .owner
= THIS_MODULE
,
230 .hooknum
= NF_IP6_POST_ROUTING
,
231 .priority
= NF_IP6_PRI_MANGLE
,
235 static int __init
init(void)
240 ret
= ip6t_register_table(&packet_mangler
);
245 ret
= nf_register_hook(&ip6t_ops
[0]);
249 ret
= nf_register_hook(&ip6t_ops
[1]);
253 ret
= nf_register_hook(&ip6t_ops
[2]);
257 ret
= nf_register_hook(&ip6t_ops
[3]);
261 ret
= nf_register_hook(&ip6t_ops
[4]);
268 nf_unregister_hook(&ip6t_ops
[3]);
270 nf_unregister_hook(&ip6t_ops
[2]);
272 nf_unregister_hook(&ip6t_ops
[1]);
274 nf_unregister_hook(&ip6t_ops
[0]);
276 ip6t_unregister_table(&packet_mangler
);
281 static void __exit
fini(void)
285 for (i
= 0; i
< sizeof(ip6t_ops
)/sizeof(struct nf_hook_ops
); i
++)
286 nf_unregister_hook(&ip6t_ops
[i
]);
288 ip6t_unregister_table(&packet_mangler
);