netfilter_ipv6.h 5.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212
  1. /* IPv6-specific defines for netfilter.
  2. * (C)1998 Rusty Russell -- This code is GPL.
  3. * (C)1999 David Jeffery
  4. * this header was blatantly ripped from netfilter_ipv4.h
  5. * it's amazing what adding a bunch of 6s can do =8^)
  6. */
  7. #ifndef __LINUX_IP6_NETFILTER_H
  8. #define __LINUX_IP6_NETFILTER_H
  9. #include <linux/android_kabi.h>
  10. #include <uapi/linux/netfilter_ipv6.h>
  11. #include <net/tcp.h>
  12. /* Check for an extension */
  13. static inline int
  14. nf_ip6_ext_hdr(u8 nexthdr)
  15. { return (nexthdr == IPPROTO_HOPOPTS) ||
  16. (nexthdr == IPPROTO_ROUTING) ||
  17. (nexthdr == IPPROTO_FRAGMENT) ||
  18. (nexthdr == IPPROTO_ESP) ||
  19. (nexthdr == IPPROTO_AH) ||
  20. (nexthdr == IPPROTO_NONE) ||
  21. (nexthdr == IPPROTO_DSTOPTS);
  22. }
  23. /* Extra routing may needed on local out, as the QUEUE target never returns
  24. * control to the table.
  25. */
  26. struct ip6_rt_info {
  27. struct in6_addr daddr;
  28. struct in6_addr saddr;
  29. u_int32_t mark;
  30. };
  31. struct nf_queue_entry;
  32. struct nf_bridge_frag_data;
  33. /*
  34. * Hook functions for ipv6 to allow xt_* modules to be built-in even
  35. * if IPv6 is a module.
  36. */
  37. struct nf_ipv6_ops {
  38. #if IS_MODULE(CONFIG_IPV6)
  39. int (*chk_addr)(struct net *net, const struct in6_addr *addr,
  40. const struct net_device *dev, int strict);
  41. int (*route_me_harder)(struct net *net, struct sock *sk, struct sk_buff *skb);
  42. int (*dev_get_saddr)(struct net *net, const struct net_device *dev,
  43. const struct in6_addr *daddr, unsigned int srcprefs,
  44. struct in6_addr *saddr);
  45. int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl,
  46. bool strict);
  47. u32 (*cookie_init_sequence)(const struct ipv6hdr *iph,
  48. const struct tcphdr *th, u16 *mssp);
  49. int (*cookie_v6_check)(const struct ipv6hdr *iph,
  50. const struct tcphdr *th, __u32 cookie);
  51. #endif
  52. void (*route_input)(struct sk_buff *skb);
  53. int (*fragment)(struct net *net, struct sock *sk, struct sk_buff *skb,
  54. int (*output)(struct net *, struct sock *, struct sk_buff *));
  55. int (*reroute)(struct sk_buff *skb, const struct nf_queue_entry *entry);
  56. #if IS_MODULE(CONFIG_IPV6)
  57. int (*br_fragment)(struct net *net, struct sock *sk,
  58. struct sk_buff *skb,
  59. struct nf_bridge_frag_data *data,
  60. int (*output)(struct net *, struct sock *sk,
  61. const struct nf_bridge_frag_data *data,
  62. struct sk_buff *));
  63. #endif
  64. ANDROID_KABI_RESERVE(1);
  65. };
  66. #ifdef CONFIG_NETFILTER
  67. #include <net/addrconf.h>
  68. extern const struct nf_ipv6_ops __rcu *nf_ipv6_ops;
  69. static inline const struct nf_ipv6_ops *nf_get_ipv6_ops(void)
  70. {
  71. return rcu_dereference(nf_ipv6_ops);
  72. }
  73. static inline int nf_ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
  74. const struct net_device *dev, int strict)
  75. {
  76. #if IS_MODULE(CONFIG_IPV6)
  77. const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();
  78. if (!v6_ops)
  79. return 1;
  80. return v6_ops->chk_addr(net, addr, dev, strict);
  81. #elif IS_BUILTIN(CONFIG_IPV6)
  82. return ipv6_chk_addr(net, addr, dev, strict);
  83. #else
  84. return 1;
  85. #endif
  86. }
  87. int __nf_ip6_route(struct net *net, struct dst_entry **dst,
  88. struct flowi *fl, bool strict);
  89. static inline int nf_ip6_route(struct net *net, struct dst_entry **dst,
  90. struct flowi *fl, bool strict)
  91. {
  92. #if IS_MODULE(CONFIG_IPV6)
  93. const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
  94. if (v6ops)
  95. return v6ops->route(net, dst, fl, strict);
  96. return -EHOSTUNREACH;
  97. #endif
  98. #if IS_BUILTIN(CONFIG_IPV6)
  99. return __nf_ip6_route(net, dst, fl, strict);
  100. #else
  101. return -EHOSTUNREACH;
  102. #endif
  103. }
  104. #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
  105. int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
  106. struct nf_bridge_frag_data *data,
  107. int (*output)(struct net *, struct sock *sk,
  108. const struct nf_bridge_frag_data *data,
  109. struct sk_buff *));
  110. static inline int nf_br_ip6_fragment(struct net *net, struct sock *sk,
  111. struct sk_buff *skb,
  112. struct nf_bridge_frag_data *data,
  113. int (*output)(struct net *, struct sock *sk,
  114. const struct nf_bridge_frag_data *data,
  115. struct sk_buff *))
  116. {
  117. #if IS_MODULE(CONFIG_IPV6)
  118. const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();
  119. if (!v6_ops)
  120. return 1;
  121. return v6_ops->br_fragment(net, sk, skb, data, output);
  122. #elif IS_BUILTIN(CONFIG_IPV6)
  123. return br_ip6_fragment(net, sk, skb, data, output);
  124. #else
  125. return 1;
  126. #endif
  127. }
  128. int ip6_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb);
  129. static inline int nf_ip6_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb)
  130. {
  131. #if IS_MODULE(CONFIG_IPV6)
  132. const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();
  133. if (!v6_ops)
  134. return -EHOSTUNREACH;
  135. return v6_ops->route_me_harder(net, sk, skb);
  136. #elif IS_BUILTIN(CONFIG_IPV6)
  137. return ip6_route_me_harder(net, sk, skb);
  138. #else
  139. return -EHOSTUNREACH;
  140. #endif
  141. }
  142. static inline u32 nf_ipv6_cookie_init_sequence(const struct ipv6hdr *iph,
  143. const struct tcphdr *th,
  144. u16 *mssp)
  145. {
  146. #if IS_ENABLED(CONFIG_SYN_COOKIES)
  147. #if IS_MODULE(CONFIG_IPV6)
  148. const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();
  149. if (v6_ops)
  150. return v6_ops->cookie_init_sequence(iph, th, mssp);
  151. #elif IS_BUILTIN(CONFIG_IPV6)
  152. return __cookie_v6_init_sequence(iph, th, mssp);
  153. #endif
  154. #endif
  155. return 0;
  156. }
  157. static inline int nf_cookie_v6_check(const struct ipv6hdr *iph,
  158. const struct tcphdr *th, __u32 cookie)
  159. {
  160. #if IS_ENABLED(CONFIG_SYN_COOKIES)
  161. #if IS_MODULE(CONFIG_IPV6)
  162. const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();
  163. if (v6_ops)
  164. return v6_ops->cookie_v6_check(iph, th, cookie);
  165. #elif IS_BUILTIN(CONFIG_IPV6)
  166. return __cookie_v6_check(iph, th, cookie);
  167. #endif
  168. #endif
  169. return 0;
  170. }
  171. __sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
  172. unsigned int dataoff, u_int8_t protocol);
  173. int ipv6_netfilter_init(void);
  174. void ipv6_netfilter_fini(void);
  175. #else /* CONFIG_NETFILTER */
  176. static inline int ipv6_netfilter_init(void) { return 0; }
  177. static inline void ipv6_netfilter_fini(void) { return; }
  178. static inline const struct nf_ipv6_ops *nf_get_ipv6_ops(void) { return NULL; }
  179. #endif /* CONFIG_NETFILTER */
  180. #endif /*__LINUX_IP6_NETFILTER_H*/