2 * IPv6 packet mangling table, a port of the IPv4 mangle table to IPv6
4 * Copyright (C) 2000-2001 by Harald Welte <laforge@gnumonks.org>
5 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/netfilter_ipv6/ip6_tables.h>
14 MODULE_LICENSE("GPL");
15 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
16 MODULE_DESCRIPTION("ip6tables mangle table");
18 #define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
19 (1 << NF_INET_LOCAL_IN) | \
20 (1 << NF_INET_FORWARD) | \
21 (1 << NF_INET_LOCAL_OUT) | \
22 (1 << NF_INET_POST_ROUTING))
26 struct ip6t_replace repl
;
27 struct ip6t_standard entries
[5];
28 struct ip6t_error term
;
29 } initial_table __net_initdata
= {
32 .valid_hooks
= MANGLE_VALID_HOOKS
,
34 .size
= sizeof(struct ip6t_standard
) * 5 + sizeof(struct ip6t_error
),
36 [NF_INET_PRE_ROUTING
] = 0,
37 [NF_INET_LOCAL_IN
] = sizeof(struct ip6t_standard
),
38 [NF_INET_FORWARD
] = sizeof(struct ip6t_standard
) * 2,
39 [NF_INET_LOCAL_OUT
] = sizeof(struct ip6t_standard
) * 3,
40 [NF_INET_POST_ROUTING
] = sizeof(struct ip6t_standard
) * 4,
43 [NF_INET_PRE_ROUTING
] = 0,
44 [NF_INET_LOCAL_IN
] = sizeof(struct ip6t_standard
),
45 [NF_INET_FORWARD
] = sizeof(struct ip6t_standard
) * 2,
46 [NF_INET_LOCAL_OUT
] = sizeof(struct ip6t_standard
) * 3,
47 [NF_INET_POST_ROUTING
] = sizeof(struct ip6t_standard
) * 4,
51 IP6T_STANDARD_INIT(NF_ACCEPT
), /* PRE_ROUTING */
52 IP6T_STANDARD_INIT(NF_ACCEPT
), /* LOCAL_IN */
53 IP6T_STANDARD_INIT(NF_ACCEPT
), /* FORWARD */
54 IP6T_STANDARD_INIT(NF_ACCEPT
), /* LOCAL_OUT */
55 IP6T_STANDARD_INIT(NF_ACCEPT
), /* POST_ROUTING */
57 .term
= IP6T_ERROR_INIT
, /* ERROR */
60 static struct xt_table packet_mangler
= {
62 .valid_hooks
= MANGLE_VALID_HOOKS
,
63 .lock
= __RW_LOCK_UNLOCKED(packet_mangler
.lock
),
68 /* The work comes in here from netfilter.c. */
70 ip6t_in_hook(unsigned int hook
,
72 const struct net_device
*in
,
73 const struct net_device
*out
,
74 int (*okfn
)(struct sk_buff
*))
76 return ip6t_do_table(skb
, hook
, in
, out
,
77 dev_net(in
)->ipv6
.ip6table_mangle
);
81 ip6t_post_routing_hook(unsigned int hook
,
83 const struct net_device
*in
,
84 const struct net_device
*out
,
85 int (*okfn
)(struct sk_buff
*))
87 return ip6t_do_table(skb
, hook
, in
, out
,
88 dev_net(out
)->ipv6
.ip6table_mangle
);
92 ip6t_local_out_hook(unsigned int hook
,
94 const struct net_device
*in
,
95 const struct net_device
*out
,
96 int (*okfn
)(struct sk_buff
*))
100 struct in6_addr saddr
, daddr
;
102 u_int32_t flowlabel
, mark
;
105 /* root is playing with raw sockets. */
106 if (skb
->len
< sizeof(struct iphdr
)
107 || ip_hdrlen(skb
) < sizeof(struct iphdr
)) {
109 printk("ip6t_hook: happy cracking.\n");
114 /* save source/dest address, mark, hoplimit, flowlabel, priority, */
115 memcpy(&saddr
, &ipv6_hdr(skb
)->saddr
, sizeof(saddr
));
116 memcpy(&daddr
, &ipv6_hdr(skb
)->daddr
, sizeof(daddr
));
118 hop_limit
= ipv6_hdr(skb
)->hop_limit
;
120 /* flowlabel and prio (includes version, which shouldn't change either */
121 flowlabel
= *((u_int32_t
*)ipv6_hdr(skb
));
123 ret
= ip6t_do_table(skb
, hook
, in
, out
,
124 dev_net(out
)->ipv6
.ip6table_mangle
);
126 if (ret
!= NF_DROP
&& ret
!= NF_STOLEN
127 && (memcmp(&ipv6_hdr(skb
)->saddr
, &saddr
, sizeof(saddr
))
128 || memcmp(&ipv6_hdr(skb
)->daddr
, &daddr
, sizeof(daddr
))
130 || ipv6_hdr(skb
)->hop_limit
!= hop_limit
))
131 return ip6_route_me_harder(skb
) == 0 ? ret
: NF_DROP
;
136 static struct nf_hook_ops ip6t_ops
[] __read_mostly
= {
138 .hook
= ip6t_in_hook
,
139 .owner
= THIS_MODULE
,
141 .hooknum
= NF_INET_PRE_ROUTING
,
142 .priority
= NF_IP6_PRI_MANGLE
,
145 .hook
= ip6t_in_hook
,
146 .owner
= THIS_MODULE
,
148 .hooknum
= NF_INET_LOCAL_IN
,
149 .priority
= NF_IP6_PRI_MANGLE
,
152 .hook
= ip6t_in_hook
,
153 .owner
= THIS_MODULE
,
155 .hooknum
= NF_INET_FORWARD
,
156 .priority
= NF_IP6_PRI_MANGLE
,
159 .hook
= ip6t_local_out_hook
,
160 .owner
= THIS_MODULE
,
162 .hooknum
= NF_INET_LOCAL_OUT
,
163 .priority
= NF_IP6_PRI_MANGLE
,
166 .hook
= ip6t_post_routing_hook
,
167 .owner
= THIS_MODULE
,
169 .hooknum
= NF_INET_POST_ROUTING
,
170 .priority
= NF_IP6_PRI_MANGLE
,
174 static int __net_init
ip6table_mangle_net_init(struct net
*net
)
177 net
->ipv6
.ip6table_mangle
=
178 ip6t_register_table(net
, &packet_mangler
, &initial_table
.repl
);
179 if (IS_ERR(net
->ipv6
.ip6table_mangle
))
180 return PTR_ERR(net
->ipv6
.ip6table_mangle
);
184 static void __net_exit
ip6table_mangle_net_exit(struct net
*net
)
186 ip6t_unregister_table(net
->ipv6
.ip6table_mangle
);
189 static struct pernet_operations ip6table_mangle_net_ops
= {
190 .init
= ip6table_mangle_net_init
,
191 .exit
= ip6table_mangle_net_exit
,
194 static int __init
ip6table_mangle_init(void)
198 ret
= register_pernet_subsys(&ip6table_mangle_net_ops
);
203 ret
= nf_register_hooks(ip6t_ops
, ARRAY_SIZE(ip6t_ops
));
210 unregister_pernet_subsys(&ip6table_mangle_net_ops
);
214 static void __exit
ip6table_mangle_fini(void)
216 nf_unregister_hooks(ip6t_ops
, ARRAY_SIZE(ip6t_ops
));
217 unregister_pernet_subsys(&ip6table_mangle_net_ops
);
220 module_init(ip6table_mangle_init
);
221 module_exit(ip6table_mangle_fini
);