212 lines · c
1/* IPv6-specific defines for netfilter. 2 * (C)1998 Rusty Russell -- This code is GPL.3 * (C)1999 David Jeffery4 * this header was blatantly ripped from netfilter_ipv4.h5 * it's amazing what adding a bunch of 6s can do =8^)6 */7#ifndef __LINUX_IP6_NETFILTER_H8#define __LINUX_IP6_NETFILTER_H9 10#include <uapi/linux/netfilter_ipv6.h>11#include <net/tcp.h>12 13/* Check for an extension */14static inline int15nf_ip6_ext_hdr(u8 nexthdr)16{ return (nexthdr == IPPROTO_HOPOPTS) ||17 (nexthdr == IPPROTO_ROUTING) ||18 (nexthdr == IPPROTO_FRAGMENT) ||19 (nexthdr == IPPROTO_ESP) ||20 (nexthdr == IPPROTO_AH) ||21 (nexthdr == IPPROTO_NONE) ||22 (nexthdr == IPPROTO_DSTOPTS);23}24 25/* Extra routing may needed on local out, as the QUEUE target never returns26 * control to the table.27 */28struct ip6_rt_info {29 struct in6_addr daddr;30 struct in6_addr saddr;31 u_int32_t mark;32};33 34struct nf_queue_entry;35struct nf_bridge_frag_data;36 37/*38 * Hook functions for ipv6 to allow xt_* modules to be built-in even39 * if IPv6 is a module.40 */41struct nf_ipv6_ops {42#if IS_MODULE(CONFIG_IPV6)43 int (*chk_addr)(struct net *net, const struct in6_addr *addr,44 const struct net_device *dev, int strict);45 int (*route_me_harder)(struct net *net, struct sock *sk, struct sk_buff *skb);46 int (*dev_get_saddr)(struct net *net, const struct net_device *dev,47 const struct in6_addr *daddr, unsigned int srcprefs,48 struct in6_addr *saddr);49 int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl,50 bool strict);51 u32 (*cookie_init_sequence)(const struct ipv6hdr *iph,52 const struct tcphdr *th, u16 *mssp);53 int (*cookie_v6_check)(const struct ipv6hdr *iph,54 const struct tcphdr *th);55#endif56 void (*route_input)(struct sk_buff *skb);57 int (*fragment)(struct net *net, struct sock *sk, struct sk_buff *skb,58 int (*output)(struct net *, struct sock *, struct sk_buff *));59 int (*reroute)(struct sk_buff *skb, const struct nf_queue_entry *entry);60#if IS_MODULE(CONFIG_IPV6)61 int (*br_fragment)(struct net *net, struct sock *sk,62 struct sk_buff *skb,63 struct nf_bridge_frag_data *data,64 int (*output)(struct net *, struct sock *sk,65 const struct nf_bridge_frag_data *data,66 struct sk_buff *));67#endif68};69 70#ifdef CONFIG_NETFILTER71#include <net/addrconf.h>72 73extern const struct nf_ipv6_ops __rcu *nf_ipv6_ops;74static inline const struct nf_ipv6_ops *nf_get_ipv6_ops(void)75{76 return rcu_dereference(nf_ipv6_ops);77}78 79static inline int nf_ipv6_chk_addr(struct net *net, const struct in6_addr *addr,80 const struct net_device *dev, int strict)81{82#if IS_MODULE(CONFIG_IPV6)83 const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();84 85 if (!v6_ops)86 return 1;87 88 return v6_ops->chk_addr(net, addr, dev, strict);89#elif IS_BUILTIN(CONFIG_IPV6)90 return ipv6_chk_addr(net, addr, dev, strict);91#else92 return 1;93#endif94}95 96int __nf_ip6_route(struct net *net, struct dst_entry **dst,97 struct flowi *fl, bool strict);98 99static inline int nf_ip6_route(struct net *net, struct dst_entry **dst,100 struct flowi *fl, bool strict)101{102#if IS_MODULE(CONFIG_IPV6)103 const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();104 105 if (v6ops)106 return v6ops->route(net, dst, fl, strict);107 108 return -EHOSTUNREACH;109#endif110#if IS_BUILTIN(CONFIG_IPV6)111 return __nf_ip6_route(net, dst, fl, strict);112#else113 return -EHOSTUNREACH;114#endif115}116 117#include <net/netfilter/ipv6/nf_defrag_ipv6.h>118 119int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,120 struct nf_bridge_frag_data *data,121 int (*output)(struct net *, struct sock *sk,122 const struct nf_bridge_frag_data *data,123 struct sk_buff *));124 125static inline int nf_br_ip6_fragment(struct net *net, struct sock *sk,126 struct sk_buff *skb,127 struct nf_bridge_frag_data *data,128 int (*output)(struct net *, struct sock *sk,129 const struct nf_bridge_frag_data *data,130 struct sk_buff *))131{132#if IS_MODULE(CONFIG_IPV6)133 const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();134 135 if (!v6_ops)136 return 1;137 138 return v6_ops->br_fragment(net, sk, skb, data, output);139#elif IS_BUILTIN(CONFIG_IPV6)140 return br_ip6_fragment(net, sk, skb, data, output);141#else142 return 1;143#endif144}145 146int ip6_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb);147 148static inline int nf_ip6_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb)149{150#if IS_MODULE(CONFIG_IPV6)151 const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();152 153 if (!v6_ops)154 return -EHOSTUNREACH;155 156 return v6_ops->route_me_harder(net, sk, skb);157#elif IS_BUILTIN(CONFIG_IPV6)158 return ip6_route_me_harder(net, sk, skb);159#else160 return -EHOSTUNREACH;161#endif162}163 164static inline u32 nf_ipv6_cookie_init_sequence(const struct ipv6hdr *iph,165 const struct tcphdr *th,166 u16 *mssp)167{168#if IS_ENABLED(CONFIG_SYN_COOKIES)169#if IS_MODULE(CONFIG_IPV6)170 const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();171 172 if (v6_ops)173 return v6_ops->cookie_init_sequence(iph, th, mssp);174#elif IS_BUILTIN(CONFIG_IPV6)175 return __cookie_v6_init_sequence(iph, th, mssp);176#endif177#endif178 return 0;179}180 181static inline int nf_cookie_v6_check(const struct ipv6hdr *iph,182 const struct tcphdr *th)183{184#if IS_ENABLED(CONFIG_SYN_COOKIES)185#if IS_MODULE(CONFIG_IPV6)186 const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();187 188 if (v6_ops)189 return v6_ops->cookie_v6_check(iph, th);190#elif IS_BUILTIN(CONFIG_IPV6)191 return __cookie_v6_check(iph, th);192#endif193#endif194 return 0;195}196 197__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,198 unsigned int dataoff, u_int8_t protocol);199 200int nf_ip6_check_hbh_len(struct sk_buff *skb, u32 *plen);201 202int ipv6_netfilter_init(void);203void ipv6_netfilter_fini(void);204 205#else /* CONFIG_NETFILTER */206static inline int ipv6_netfilter_init(void) { return 0; }207static inline void ipv6_netfilter_fini(void) { return; }208static inline const struct nf_ipv6_ops *nf_get_ipv6_ops(void) { return NULL; }209#endif /* CONFIG_NETFILTER */210 211#endif /*__LINUX_IP6_NETFILTER_H*/212