1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * IPv6 packet mangling table, a port of the IPv4 mangle table to IPv6 |
4 | * |
5 | * Copyright (C) 2000-2001 by Harald Welte <laforge@gnumonks.org> |
6 | * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org> |
7 | */ |
8 | #include <linux/module.h> |
9 | #include <linux/netfilter_ipv6/ip6_tables.h> |
10 | #include <linux/slab.h> |
11 | #include <net/ipv6.h> |
12 | |
13 | MODULE_LICENSE("GPL" ); |
14 | MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>" ); |
15 | MODULE_DESCRIPTION("ip6tables mangle table" ); |
16 | |
17 | #define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \ |
18 | (1 << NF_INET_LOCAL_IN) | \ |
19 | (1 << NF_INET_FORWARD) | \ |
20 | (1 << NF_INET_LOCAL_OUT) | \ |
21 | (1 << NF_INET_POST_ROUTING)) |
22 | |
23 | static const struct xt_table packet_mangler = { |
24 | .name = "mangle" , |
25 | .valid_hooks = MANGLE_VALID_HOOKS, |
26 | .me = THIS_MODULE, |
27 | .af = NFPROTO_IPV6, |
28 | .priority = NF_IP6_PRI_MANGLE, |
29 | }; |
30 | |
31 | static unsigned int |
32 | ip6t_mangle_out(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) |
33 | { |
34 | struct in6_addr saddr, daddr; |
35 | unsigned int ret, verdict; |
36 | u32 flowlabel, mark; |
37 | u8 hop_limit; |
38 | int err; |
39 | |
40 | /* save source/dest address, mark, hoplimit, flowlabel, priority, */ |
41 | memcpy(&saddr, &ipv6_hdr(skb)->saddr, sizeof(saddr)); |
42 | memcpy(&daddr, &ipv6_hdr(skb)->daddr, sizeof(daddr)); |
43 | mark = skb->mark; |
44 | hop_limit = ipv6_hdr(skb)->hop_limit; |
45 | |
46 | /* flowlabel and prio (includes version, which shouldn't change either */ |
47 | flowlabel = *((u_int32_t *)ipv6_hdr(skb)); |
48 | |
49 | ret = ip6t_do_table(priv, skb, state); |
50 | verdict = ret & NF_VERDICT_MASK; |
51 | |
52 | if (verdict != NF_DROP && verdict != NF_STOLEN && |
53 | (!ipv6_addr_equal(a1: &ipv6_hdr(skb)->saddr, a2: &saddr) || |
54 | !ipv6_addr_equal(a1: &ipv6_hdr(skb)->daddr, a2: &daddr) || |
55 | skb->mark != mark || |
56 | ipv6_hdr(skb)->hop_limit != hop_limit || |
57 | flowlabel != *((u_int32_t *)ipv6_hdr(skb)))) { |
58 | err = ip6_route_me_harder(net: state->net, sk: state->sk, skb); |
59 | if (err < 0) |
60 | ret = NF_DROP_ERR(err); |
61 | } |
62 | |
63 | return ret; |
64 | } |
65 | |
66 | /* The work comes in here from netfilter.c. */ |
67 | static unsigned int |
68 | ip6table_mangle_hook(void *priv, struct sk_buff *skb, |
69 | const struct nf_hook_state *state) |
70 | { |
71 | if (state->hook == NF_INET_LOCAL_OUT) |
72 | return ip6t_mangle_out(priv, skb, state); |
73 | return ip6t_do_table(priv, skb, state); |
74 | } |
75 | |
76 | static struct nf_hook_ops *mangle_ops __read_mostly; |
77 | static int ip6table_mangle_table_init(struct net *net) |
78 | { |
79 | struct ip6t_replace *repl; |
80 | int ret; |
81 | |
82 | repl = ip6t_alloc_initial_table(&packet_mangler); |
83 | if (repl == NULL) |
84 | return -ENOMEM; |
85 | ret = ip6t_register_table(net, table: &packet_mangler, repl, ops: mangle_ops); |
86 | kfree(objp: repl); |
87 | return ret; |
88 | } |
89 | |
90 | static void __net_exit ip6table_mangle_net_pre_exit(struct net *net) |
91 | { |
92 | ip6t_unregister_table_pre_exit(net, name: "mangle" ); |
93 | } |
94 | |
95 | static void __net_exit ip6table_mangle_net_exit(struct net *net) |
96 | { |
97 | ip6t_unregister_table_exit(net, name: "mangle" ); |
98 | } |
99 | |
100 | static struct pernet_operations ip6table_mangle_net_ops = { |
101 | .pre_exit = ip6table_mangle_net_pre_exit, |
102 | .exit = ip6table_mangle_net_exit, |
103 | }; |
104 | |
105 | static int __init ip6table_mangle_init(void) |
106 | { |
107 | int ret = xt_register_template(t: &packet_mangler, |
108 | table_init: ip6table_mangle_table_init); |
109 | |
110 | if (ret < 0) |
111 | return ret; |
112 | |
113 | mangle_ops = xt_hook_ops_alloc(&packet_mangler, ip6table_mangle_hook); |
114 | if (IS_ERR(ptr: mangle_ops)) { |
115 | xt_unregister_template(t: &packet_mangler); |
116 | return PTR_ERR(ptr: mangle_ops); |
117 | } |
118 | |
119 | ret = register_pernet_subsys(&ip6table_mangle_net_ops); |
120 | if (ret < 0) { |
121 | xt_unregister_template(t: &packet_mangler); |
122 | kfree(objp: mangle_ops); |
123 | return ret; |
124 | } |
125 | |
126 | return ret; |
127 | } |
128 | |
129 | static void __exit ip6table_mangle_fini(void) |
130 | { |
131 | unregister_pernet_subsys(&ip6table_mangle_net_ops); |
132 | xt_unregister_template(t: &packet_mangler); |
133 | kfree(objp: mangle_ops); |
134 | } |
135 | |
136 | module_init(ip6table_mangle_init); |
137 | module_exit(ip6table_mangle_fini); |
138 | |