2 * IPv6 packet mangling table, a port of the IPv4 mangle table to IPv6
4 * Copyright (C) 2000-2001 by Harald Welte <laforge@gnumonks.org>
5 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
11 * Extended to all five netfilter hooks by Brad Chapman & Harald Welte
13 #include <linux/module.h>
14 #include <linux/netfilter_ipv6/ip6_tables.h>
16 MODULE_LICENSE("GPL");
17 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
18 MODULE_DESCRIPTION("ip6tables mangle table");
20 #define MANGLE_VALID_HOOKS ((1 << NF_IP6_PRE_ROUTING) | \
21 (1 << NF_IP6_LOCAL_IN) | \
22 (1 << NF_IP6_FORWARD) | \
23 (1 << NF_IP6_LOCAL_OUT) | \
24 (1 << NF_IP6_POST_ROUTING))
27 #define DEBUGP(x, args...) printk(KERN_DEBUG x, ## args)
29 #define DEBUGP(x, args...)
35 struct ip6t_entry entry
;
36 struct ip6t_standard_target target
;
39 struct ip6t_error_target
41 struct ip6t_entry_target target
;
42 char errorname
[IP6T_FUNCTION_MAXNAMELEN
];
47 struct ip6t_entry entry
;
48 struct ip6t_error_target target
;
53 struct ip6t_replace repl
;
54 struct ip6t_standard entries
[5];
55 struct ip6t_error term
;
56 } initial_table __initdata
57 = { { "mangle", MANGLE_VALID_HOOKS
, 6,
58 sizeof(struct ip6t_standard
) * 5 + sizeof(struct ip6t_error
),
59 { [NF_IP6_PRE_ROUTING
] = 0,
60 [NF_IP6_LOCAL_IN
] = sizeof(struct ip6t_standard
),
61 [NF_IP6_FORWARD
] = sizeof(struct ip6t_standard
) * 2,
62 [NF_IP6_LOCAL_OUT
] = sizeof(struct ip6t_standard
) * 3,
63 [NF_IP6_POST_ROUTING
] = sizeof(struct ip6t_standard
) * 4},
64 { [NF_IP6_PRE_ROUTING
] = 0,
65 [NF_IP6_LOCAL_IN
] = sizeof(struct ip6t_standard
),
66 [NF_IP6_FORWARD
] = sizeof(struct ip6t_standard
) * 2,
67 [NF_IP6_LOCAL_OUT
] = sizeof(struct ip6t_standard
) * 3,
68 [NF_IP6_POST_ROUTING
] = sizeof(struct ip6t_standard
) * 4},
72 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
74 sizeof(struct ip6t_entry
),
75 sizeof(struct ip6t_standard
),
77 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target
)), "" } }, { } },
80 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
82 sizeof(struct ip6t_entry
),
83 sizeof(struct ip6t_standard
),
85 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target
)), "" } }, { } },
88 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
90 sizeof(struct ip6t_entry
),
91 sizeof(struct ip6t_standard
),
93 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target
)), "" } }, { } },
96 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
98 sizeof(struct ip6t_entry
),
99 sizeof(struct ip6t_standard
),
101 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target
)), "" } }, { } },
104 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
106 sizeof(struct ip6t_entry
),
107 sizeof(struct ip6t_standard
),
109 { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target
)), "" } }, { } },
113 { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
115 sizeof(struct ip6t_entry
),
116 sizeof(struct ip6t_error
),
118 { { { { IP6T_ALIGN(sizeof(struct ip6t_error_target
)), IP6T_ERROR_TARGET
} },
125 static struct ip6t_table packet_mangler
= {
127 .valid_hooks
= MANGLE_VALID_HOOKS
,
128 .lock
= RW_LOCK_UNLOCKED
,
132 /* The work comes in here from netfilter.c. */
134 ip6t_route_hook(unsigned int hook
,
135 struct sk_buff
**pskb
,
136 const struct net_device
*in
,
137 const struct net_device
*out
,
138 int (*okfn
)(struct sk_buff
*))
140 return ip6t_do_table(pskb
, hook
, in
, out
, &packet_mangler
, NULL
);
144 ip6t_local_hook(unsigned int hook
,
145 struct sk_buff
**pskb
,
146 const struct net_device
*in
,
147 const struct net_device
*out
,
148 int (*okfn
)(struct sk_buff
*))
151 unsigned long nfmark
;
153 struct in6_addr saddr
, daddr
;
158 /* root is playing with raw sockets. */
159 if ((*pskb
)->len
< sizeof(struct iphdr
)
160 || (*pskb
)->nh
.iph
->ihl
* 4 < sizeof(struct iphdr
)) {
162 printk("ip6t_hook: happy cracking.\n");
167 /* save source/dest address, nfmark, hoplimit, flowlabel, priority, */
168 memcpy(&saddr
, &(*pskb
)->nh
.ipv6h
->saddr
, sizeof(saddr
));
169 memcpy(&daddr
, &(*pskb
)->nh
.ipv6h
->daddr
, sizeof(daddr
));
170 nfmark
= (*pskb
)->nfmark
;
171 hop_limit
= (*pskb
)->nh
.ipv6h
->hop_limit
;
173 /* flowlabel and prio (includes version, which shouldn't change either */
174 flowlabel
= *((u_int32_t
*) (*pskb
)->nh
.ipv6h
);
176 ret
= ip6t_do_table(pskb
, hook
, in
, out
, &packet_mangler
, NULL
);
178 if (ret
!= NF_DROP
&& ret
!= NF_STOLEN
179 && (memcmp(&(*pskb
)->nh
.ipv6h
->saddr
, &saddr
, sizeof(saddr
))
180 || memcmp(&(*pskb
)->nh
.ipv6h
->daddr
, &daddr
, sizeof(daddr
))
181 || (*pskb
)->nfmark
!= nfmark
182 || (*pskb
)->nh
.ipv6h
->hop_limit
!= hop_limit
)) {
184 /* something which could affect routing has changed */
186 DEBUGP("ip6table_mangle: we'd need to re-route a packet\n");
192 static struct nf_hook_ops ip6t_ops
[] = {
194 .hook
= ip6t_route_hook
,
195 .owner
= THIS_MODULE
,
197 .hooknum
= NF_IP6_PRE_ROUTING
,
198 .priority
= NF_IP6_PRI_MANGLE
,
201 .hook
= ip6t_local_hook
,
202 .owner
= THIS_MODULE
,
204 .hooknum
= NF_IP6_LOCAL_IN
,
205 .priority
= NF_IP6_PRI_MANGLE
,
208 .hook
= ip6t_route_hook
,
209 .owner
= THIS_MODULE
,
211 .hooknum
= NF_IP6_FORWARD
,
212 .priority
= NF_IP6_PRI_MANGLE
,
215 .hook
= ip6t_local_hook
,
216 .owner
= THIS_MODULE
,
218 .hooknum
= NF_IP6_LOCAL_OUT
,
219 .priority
= NF_IP6_PRI_MANGLE
,
222 .hook
= ip6t_route_hook
,
223 .owner
= THIS_MODULE
,
225 .hooknum
= NF_IP6_POST_ROUTING
,
226 .priority
= NF_IP6_PRI_MANGLE
,
230 static int __init
init(void)
235 ret
= ip6t_register_table(&packet_mangler
, &initial_table
.repl
);
240 ret
= nf_register_hook(&ip6t_ops
[0]);
244 ret
= nf_register_hook(&ip6t_ops
[1]);
248 ret
= nf_register_hook(&ip6t_ops
[2]);
252 ret
= nf_register_hook(&ip6t_ops
[3]);
256 ret
= nf_register_hook(&ip6t_ops
[4]);
263 nf_unregister_hook(&ip6t_ops
[3]);
265 nf_unregister_hook(&ip6t_ops
[2]);
267 nf_unregister_hook(&ip6t_ops
[1]);
269 nf_unregister_hook(&ip6t_ops
[0]);
271 ip6t_unregister_table(&packet_mangler
);
276 static void __exit
fini(void)
280 for (i
= 0; i
< sizeof(ip6t_ops
)/sizeof(struct nf_hook_ops
); i
++)
281 nf_unregister_hook(&ip6t_ops
[i
]);
283 ip6t_unregister_table(&packet_mangler
);