1 Index: linux-2.6.23-rc6/include/linux/netfilter_ipv4/ipt_ROUTE.h
2 ===================================================================
3 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
4 +++ linux-2.6.23-rc6/include/linux/netfilter_ipv4/ipt_ROUTE.h 2007-09-21 16:24:03.000000000 +0800
6 +/* Header file for iptables ipt_ROUTE target
8 + * (C) 2002 by Cédric de Launois <delaunois@info.ucl.ac.be>
10 + * This software is distributed under GNU GPL v2, 1991
12 +#ifndef _IPT_ROUTE_H_target
13 +#define _IPT_ROUTE_H_target
15 +#define IPT_ROUTE_IFNAMSIZ 16
17 +struct ipt_route_target_info {
18 + char oif[IPT_ROUTE_IFNAMSIZ]; /* Output Interface Name */
19 + char iif[IPT_ROUTE_IFNAMSIZ]; /* Input Interface Name */
20 + u_int32_t gw; /* IP address of gateway */
24 +/* Values for "flags" field */
25 +#define IPT_ROUTE_CONTINUE 0x01
26 +#define IPT_ROUTE_TEE 0x02
28 +#endif /*_IPT_ROUTE_H_target*/
29 Index: linux-2.6.23-rc6/include/linux/netfilter_ipv6/ip6t_ROUTE.h
30 ===================================================================
31 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
32 +++ linux-2.6.23-rc6/include/linux/netfilter_ipv6/ip6t_ROUTE.h 2007-09-21 16:24:03.000000000 +0800
34 +/* Header file for iptables ip6t_ROUTE target
36 + * (C) 2003 by Cédric de Launois <delaunois@info.ucl.ac.be>
38 + * This software is distributed under GNU GPL v2, 1991
40 +#ifndef _IPT_ROUTE_H_target
41 +#define _IPT_ROUTE_H_target
43 +#define IP6T_ROUTE_IFNAMSIZ 16
45 +struct ip6t_route_target_info {
46 + char oif[IP6T_ROUTE_IFNAMSIZ]; /* Output Interface Name */
47 + char iif[IP6T_ROUTE_IFNAMSIZ]; /* Input Interface Name */
48 + u_int32_t gw[4]; /* IPv6 address of gateway */
52 +/* Values for "flags" field */
53 +#define IP6T_ROUTE_CONTINUE 0x01
54 +#define IP6T_ROUTE_TEE 0x02
56 +#endif /*_IP6T_ROUTE_H_target*/
57 Index: linux-2.6.23-rc6/net/ipv4/netfilter/ipt_ROUTE.c
58 ===================================================================
59 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
60 +++ linux-2.6.23-rc6/net/ipv4/netfilter/ipt_ROUTE.c 2007-09-21 16:24:03.000000000 +0800
63 + * This implements the ROUTE target, which enables you to setup unusual
64 + * routes not supported by the standard kernel routing table.
66 + * Copyright (C) 2002 Cedric de Launois <delaunois@info.ucl.ac.be>
70 + * This software is distributed under GNU GPL v2, 1991
73 +#include <linux/module.h>
74 +#include <linux/skbuff.h>
75 +#include <linux/ip.h>
76 +#include <linux/netfilter_ipv4/ip_tables.h>
77 +#include <net/netfilter/nf_conntrack.h>
78 +#include <linux/netfilter_ipv4/ipt_ROUTE.h>
79 +#include <linux/netdevice.h>
80 +#include <linux/route.h>
81 +#include <linux/version.h>
82 +#include <linux/if_arp.h>
84 +#include <net/route.h>
85 +#include <net/icmp.h>
86 +#include <net/checksum.h>
89 +#define DEBUGP printk
91 +#define DEBUGP(format, args...)
94 +MODULE_LICENSE("GPL");
95 +MODULE_AUTHOR("Cedric de Launois <delaunois@info.ucl.ac.be>");
96 +MODULE_DESCRIPTION("iptables ROUTE target module");
98 +/* Try to route the packet according to the routing keys specified in
99 + * route_info. Keys are :
101 + * 0 if no oif preferred,
102 + * otherwise set to the index of the desired oif
103 + * - route_info->gw :
104 + * 0 if no gateway specified,
105 + * otherwise set to the next host to which the pkt must be routed
106 + * If success, skb->dev is the output device to which the packet must
107 + * be sent and skb->dst is not NULL
109 + * RETURN: -1 if an error occured
110 + * 1 if the packet was succesfully routed to the
111 + * destination desired
112 + * 0 if the kernel routing table could not route the packet
113 + * according to the keys specified
115 +static int route(struct sk_buff *skb,
116 + unsigned int ifindex,
117 + const struct ipt_route_target_info *route_info)
121 + struct iphdr *iph = ip_hdr(skb);
122 + struct flowi fl = {
126 + .daddr = iph->daddr,
128 + .tos = RT_TOS(iph->tos),
129 + .scope = RT_SCOPE_UNIVERSE,
134 + /* The destination address may be overloaded by the target */
135 + if (route_info->gw)
136 + fl.fl4_dst = route_info->gw;
138 + /* Trying to route the packet using the standard routing table. */
139 + if ((err = ip_route_output_key(&rt, &fl))) {
140 + if (net_ratelimit())
141 + DEBUGP("ipt_ROUTE: couldn't route pkt (err: %i)",err);
145 + /* Drop old route. */
146 + dst_release(skb->dst);
149 + /* Success if no oif specified or if the oif correspond to the
151 + if (!ifindex || rt->u.dst.dev->ifindex == ifindex) {
152 + skb->dst = &rt->u.dst;
153 + skb->dev = skb->dst->dev;
154 + skb->protocol = htons(ETH_P_IP);
158 + /* The interface selected by the routing table is not the one
159 + * specified by the user. This may happen because the dst address
160 + * is one of our own addresses.
162 + if (net_ratelimit())
163 + DEBUGP("ipt_ROUTE: failed to route as desired gw=%u.%u.%u.%u oif=%i (got oif=%i)\n",
164 + NIPQUAD(route_info->gw), ifindex, rt->u.dst.dev->ifindex);
170 +/* Stolen from ip_finish_output2
171 + * PRE : skb->dev is set to the device we are leaving by
172 + * skb->dst is not NULL
173 + * POST: the packet is sent with the link layer header pushed
174 + * the packet is destroyed
176 +static void ip_direct_send(struct sk_buff *skb)
178 + struct dst_entry *dst = skb->dst;
179 + struct hh_cache *hh = dst->hh;
180 + struct net_device *dev = dst->dev;
181 + int hh_len = LL_RESERVED_SPACE(dev);
183 + /* Be paranoid, rather than too clever. */
184 + if (unlikely(skb_headroom(skb) < hh_len && dev->hard_header)) {
185 + struct sk_buff *skb2;
187 + skb2 = skb_realloc_headroom(skb, LL_RESERVED_SPACE(dev));
188 + if (skb2 == NULL) {
193 + skb_set_owner_w(skb2, skb->sk);
201 + read_lock_bh(&hh->hh_lock);
202 + hh_alen = HH_DATA_ALIGN(hh->hh_len);
203 + memcpy(skb->data - hh_alen, hh->hh_data, hh_alen);
204 + read_unlock_bh(&hh->hh_lock);
205 + skb_push(skb, hh->hh_len);
206 + hh->hh_output(skb);
207 + } else if (dst->neighbour)
208 + dst->neighbour->output(skb);
210 + if (net_ratelimit())
211 + DEBUGP(KERN_DEBUG "ipt_ROUTE: no hdr & no neighbour cache!\n");
217 +/* PRE : skb->dev is set to the device we are leaving by
218 + * POST: - the packet is directly sent to the skb->dev device, without
219 + * pushing the link layer header.
220 + * - the packet is destroyed
222 +static inline int dev_direct_send(struct sk_buff *skb)
224 + return dev_queue_xmit(skb);
228 +static unsigned int route_oif(const struct ipt_route_target_info *route_info,
229 + struct sk_buff *skb)
231 + unsigned int ifindex = 0;
232 + struct net_device *dev_out = NULL;
234 + /* The user set the interface name to use.
235 + * Getting the current interface index.
237 + if ((dev_out = dev_get_by_name(route_info->oif))) {
238 + ifindex = dev_out->ifindex;
240 + /* Unknown interface name : packet dropped */
241 + if (net_ratelimit())
242 + DEBUGP("ipt_ROUTE: oif interface %s not found\n", route_info->oif);
246 + /* Trying the standard way of routing packets */
247 + switch (route(skb, ifindex, route_info)) {
250 + if (route_info->flags & IPT_ROUTE_CONTINUE)
251 + return IPT_CONTINUE;
253 + ip_direct_send(skb);
257 + /* Failed to send to oif. Trying the hard way */
258 + if (route_info->flags & IPT_ROUTE_CONTINUE)
261 + if (net_ratelimit())
262 + DEBUGP("ipt_ROUTE: forcing the use of %i\n",
265 + /* We have to force the use of an interface.
266 + * This interface must be a tunnel interface since
267 + * otherwise we can't guess the hw address for
268 + * the packet. For a tunnel interface, no hw address
271 + if ((dev_out->type != ARPHRD_TUNNEL)
272 + && (dev_out->type != ARPHRD_IPGRE)) {
273 + if (net_ratelimit())
274 + DEBUGP("ipt_ROUTE: can't guess the hw addr !\n");
279 + /* Send the packet. This will also free skb
280 + * Do not go through the POST_ROUTING hook because
281 + * skb->dst is not set and because it will probably
282 + * get confused by the destination IP address.
284 + skb->dev = dev_out;
285 + dev_direct_send(skb);
290 + /* Unexpected error */
297 +static unsigned int route_iif(const struct ipt_route_target_info *route_info,
298 + struct sk_buff *skb)
300 + struct net_device *dev_in = NULL;
302 + /* Getting the current interface index. */
303 + if (!(dev_in = dev_get_by_name(route_info->iif))) {
304 + if (net_ratelimit())
305 + DEBUGP("ipt_ROUTE: iif interface %s not found\n", route_info->iif);
310 + dst_release(skb->dst);
319 +static unsigned int route_gw(const struct ipt_route_target_info *route_info,
320 + struct sk_buff *skb)
322 + if (route(skb, 0, route_info)!=1)
325 + if (route_info->flags & IPT_ROUTE_CONTINUE)
326 + return IPT_CONTINUE;
328 + ip_direct_send(skb);
333 +/* To detect and deter routed packet loopback when using the --tee option,
334 + * we take a page out of the raw.patch book: on the copied skb, we set up
335 + * a fake ->nfct entry, pointing to the local &route_tee_track. We skip
336 + * routing packets when we see they already have that ->nfct.
339 +static struct nf_conn route_tee_track;
341 +static unsigned int ipt_route_target(struct sk_buff **pskb,
342 + const struct net_device *in,
343 + const struct net_device *out,
344 + unsigned int hooknum,
345 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
346 + const struct xt_target *target,
348 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
349 + const void *targinfo,
352 + const void *targinfo)
355 + const struct ipt_route_target_info *route_info = targinfo;
356 + struct sk_buff *skb = *pskb;
359 + if (skb->nfct == &route_tee_track.ct_general) {
360 + /* Loopback - a packet we already routed, is to be
361 + * routed another time. Avoid that, now.
363 + if (net_ratelimit())
364 + DEBUGP(KERN_DEBUG "ipt_ROUTE: loopback - DROP!\n");
368 + /* If we are at PREROUTING or INPUT hook
369 + * the TTL isn't decreased by the IP stack
371 + if (hooknum == NF_IP_PRE_ROUTING ||
372 + hooknum == NF_IP_LOCAL_IN) {
374 + struct iphdr *iph = ip_hdr(skb);
376 + if (iph->ttl <= 1) {
378 + struct flowi fl = {
382 + .daddr = iph->daddr,
383 + .saddr = iph->saddr,
384 + .tos = RT_TOS(iph->tos),
385 + .scope = ((iph->tos & RTO_ONLINK) ?
392 + if (ip_route_output_key(&rt, &fl)) {
396 + if (skb->dev == rt->u.dst.dev) {
397 + /* Drop old route. */
398 + dst_release(skb->dst);
399 + skb->dst = &rt->u.dst;
401 + /* this will traverse normal stack, and
402 + * thus call conntrack on the icmp packet */
403 + icmp_send(skb, ICMP_TIME_EXCEEDED,
411 + * If we are at INPUT the checksum must be recalculated since
412 + * the length could change as the result of a defragmentation.
414 + if(hooknum == NF_IP_LOCAL_IN) {
415 + iph->ttl = iph->ttl - 1;
417 + iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
419 + ip_decrease_ttl(iph);
423 + if ((route_info->flags & IPT_ROUTE_TEE)) {
425 + * Copy the *pskb, and route the copy. Will later return
426 + * IPT_CONTINUE for the original skb, which should continue
427 + * on its way as if nothing happened. The copy should be
428 + * independantly delivered to the ROUTE --gw.
430 + skb = skb_copy(*pskb, GFP_ATOMIC);
432 + if (net_ratelimit())
433 + DEBUGP(KERN_DEBUG "ipt_ROUTE: copy failed!\n");
434 + return IPT_CONTINUE;
438 + /* Tell conntrack to forget this packet since it may get confused
439 + * when a packet is leaving with dst address == our address.
440 + * Good idea ? Dunno. Need advice.
442 + * NEW: mark the skb with our &route_tee_track, so we avoid looping
443 + * on any already routed packet.
445 + if (!(route_info->flags & IPT_ROUTE_CONTINUE)) {
446 + nf_conntrack_put(skb->nfct);
447 + skb->nfct = &route_tee_track.ct_general;
448 + skb->nfctinfo = IP_CT_NEW;
449 + nf_conntrack_get(skb->nfct);
452 + if (route_info->oif[0] != '\0') {
453 + res = route_oif(route_info, skb);
454 + } else if (route_info->iif[0] != '\0') {
455 + res = route_iif(route_info, skb);
456 + } else if (route_info->gw) {
457 + res = route_gw(route_info, skb);
459 + if (net_ratelimit())
460 + DEBUGP(KERN_DEBUG "ipt_ROUTE: no parameter !\n");
461 + res = IPT_CONTINUE;
464 + if ((route_info->flags & IPT_ROUTE_TEE))
465 + res = IPT_CONTINUE;
471 +static bool ipt_route_checkentry(const char *tablename,
473 + const struct xt_target *target,
475 + unsigned int hook_mask)
477 + if (strcmp(tablename, "mangle") != 0) {
478 + printk("ipt_ROUTE: bad table `%s', use the `mangle' table.\n",
483 + if (hook_mask & ~( (1 << NF_IP_PRE_ROUTING)
484 + | (1 << NF_IP_LOCAL_IN)
485 + | (1 << NF_IP_FORWARD)
486 + | (1 << NF_IP_LOCAL_OUT)
487 + | (1 << NF_IP_POST_ROUTING))) {
488 + printk("ipt_ROUTE: bad hook\n");
496 +static struct ipt_target ipt_route_reg = {
498 + .target = ipt_route_target,
499 + .targetsize = sizeof(struct ipt_route_target_info),
500 + .checkentry = ipt_route_checkentry,
504 +static int __init init(void)
506 + /* Set up fake conntrack (stolen from raw.patch):
507 + - to never be deleted, not in any hashes */
508 + atomic_set(&route_tee_track.ct_general.use, 1);
509 + /* - and look it like as a confirmed connection */
510 + set_bit(IPS_CONFIRMED_BIT, &route_tee_track.status);
511 + /* Initialize fake conntrack so that NAT will skip it */
512 + route_tee_track.status |= IPS_NAT_DONE_MASK;
514 + return xt_register_target(&ipt_route_reg);
518 +static void __exit fini(void)
520 + xt_unregister_target(&ipt_route_reg);
525 Index: linux-2.6.23-rc6/net/ipv4/netfilter/Kconfig
526 ===================================================================
527 --- linux-2.6.23-rc6.orig/net/ipv4/netfilter/Kconfig 2007-09-21 16:24:02.000000000 +0800
528 +++ linux-2.6.23-rc6/net/ipv4/netfilter/Kconfig 2007-09-21 16:24:03.000000000 +0800
530 To compile it as a module, choose M here. If unsure, say N.
533 +config IP_NF_TARGET_ROUTE
534 + tristate 'ROUTE target support'
535 + depends on IP_NF_MANGLE
537 + This option adds a `ROUTE' target, which enables you to setup unusual
538 + routes. For example, the ROUTE lets you route a received packet through
539 + an interface or towards a host, even if the regular destination of the
540 + packet is the router itself. The ROUTE target is also able to change the
541 + incoming interface of a packet.
543 + The target can be or not a final target. It has to be used inside the
546 + If you want to compile it as a module, say M here and read
547 + Documentation/modules.txt. The module will be called ipt_ROUTE.o.
548 + If unsure, say `N'.
552 Index: linux-2.6.23-rc6/net/ipv4/netfilter/Makefile
553 ===================================================================
554 --- linux-2.6.23-rc6.orig/net/ipv4/netfilter/Makefile 2007-09-21 16:24:02.000000000 +0800
555 +++ linux-2.6.23-rc6/net/ipv4/netfilter/Makefile 2007-09-21 16:24:03.000000000 +0800
557 obj-$(CONFIG_IP_NF_TARGET_IMQ) += ipt_IMQ.o
558 obj-$(CONFIG_IP_NF_TARGET_MASQUERADE) += ipt_MASQUERADE.o
559 obj-$(CONFIG_IP_NF_TARGET_REDIRECT) += ipt_REDIRECT.o
560 +obj-$(CONFIG_IP_NF_TARGET_ROUTE) += ipt_ROUTE.o
561 obj-$(CONFIG_IP_NF_TARGET_NETMAP) += ipt_NETMAP.o
562 obj-$(CONFIG_IP_NF_TARGET_SAME) += ipt_SAME.o
563 obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
564 Index: linux-2.6.23-rc6/net/ipv6/ndisc.c
565 ===================================================================
566 --- linux-2.6.23-rc6.orig/net/ipv6/ndisc.c 2007-09-21 16:23:53.000000000 +0800
567 +++ linux-2.6.23-rc6/net/ipv6/ndisc.c 2007-09-21 16:24:03.000000000 +0800
572 +EXPORT_SYMBOL(nd_tbl);
575 struct ndisc_options {
576 struct nd_opt_hdr *nd_opt_array[__ND_OPT_ARRAY_MAX];
577 Index: linux-2.6.23-rc6/net/ipv6/netfilter/ip6t_ROUTE.c
578 ===================================================================
579 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
580 +++ linux-2.6.23-rc6/net/ipv6/netfilter/ip6t_ROUTE.c 2007-09-21 16:24:03.000000000 +0800
583 + * This implements the ROUTE v6 target, which enables you to setup unusual
584 + * routes not supported by the standard kernel routing table.
586 + * Copyright (C) 2003 Cedric de Launois <delaunois@info.ucl.ac.be>
590 + * This software is distributed under GNU GPL v2, 1991
593 +#include <linux/module.h>
594 +#include <linux/skbuff.h>
595 +#include <linux/ipv6.h>
596 +#include <linux/netfilter_ipv6/ip6_tables.h>
597 +#include <linux/netfilter_ipv6/ip6t_ROUTE.h>
598 +#include <linux/netdevice.h>
599 +#include <linux/version.h>
600 +#include <net/ipv6.h>
601 +#include <net/ndisc.h>
602 +#include <net/ip6_route.h>
603 +#include <linux/icmpv6.h>
606 +#define DEBUGP printk
608 +#define DEBUGP(format, args...)
611 +#define NIP6(addr) \
612 + ntohs((addr).s6_addr16[0]), \
613 + ntohs((addr).s6_addr16[1]), \
614 + ntohs((addr).s6_addr16[2]), \
615 + ntohs((addr).s6_addr16[3]), \
616 + ntohs((addr).s6_addr16[4]), \
617 + ntohs((addr).s6_addr16[5]), \
618 + ntohs((addr).s6_addr16[6]), \
619 + ntohs((addr).s6_addr16[7])
621 +/* Route the packet according to the routing keys specified in
622 + * route_info. Keys are :
624 + * 0 if no oif preferred,
625 + * otherwise set to the index of the desired oif
626 + * - route_info->gw :
627 + * 0 if no gateway specified,
628 + * otherwise set to the next host to which the pkt must be routed
629 + * If success, skb->dev is the output device to which the packet must
630 + * be sent and skb->dst is not NULL
632 + * RETURN: 1 if the packet was succesfully routed to the
633 + * destination desired
634 + * 0 if the kernel routing table could not route the packet
635 + * according to the keys specified
638 +route6(struct sk_buff *skb,
639 + unsigned int ifindex,
640 + const struct ip6t_route_target_info *route_info)
642 + struct rt6_info *rt = NULL;
643 + struct ipv6hdr *ipv6h = ipv6_hdr(skb);
644 + struct in6_addr *gw = (struct in6_addr*)&route_info->gw;
646 + DEBUGP("ip6t_ROUTE: called with: ");
647 + DEBUGP("DST=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(ipv6h->daddr));
648 + DEBUGP("GATEWAY=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(*gw));
649 + DEBUGP("OUT=%s\n", route_info->oif);
651 + if (ipv6_addr_any(gw))
652 + rt = rt6_lookup(&ipv6h->daddr, &ipv6h->saddr, ifindex, 1);
654 + rt = rt6_lookup(gw, &ipv6h->saddr, ifindex, 1);
659 + DEBUGP("ip6t_ROUTE: routing gives: ");
660 + DEBUGP("DST=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(rt->rt6i_dst.addr));
661 + DEBUGP("GATEWAY=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(rt->rt6i_gateway));
662 + DEBUGP("OUT=%s\n", rt->rt6i_dev->name);
664 + if (ifindex && rt->rt6i_dev->ifindex!=ifindex)
667 + if (!rt->rt6i_nexthop) {
668 + DEBUGP("ip6t_ROUTE: discovering neighbour\n");
669 + rt->rt6i_nexthop = ndisc_get_neigh(rt->rt6i_dev, &rt->rt6i_dst.addr);
672 + /* Drop old route. */
673 + dst_release(skb->dst);
674 + skb->dst = &rt->u.dst;
675 + skb->dev = rt->rt6i_dev;
679 + dst_release(&rt->u.dst);
681 + if (!net_ratelimit())
684 + printk("ip6t_ROUTE: no explicit route found ");
686 + printk("via interface %s ", route_info->oif);
687 + if (!ipv6_addr_any(gw))
688 + printk("via gateway %04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x", NIP6(*gw));
694 +/* Stolen from ip6_output_finish
695 + * PRE : skb->dev is set to the device we are leaving by
696 + * skb->dst is not NULL
697 + * POST: the packet is sent with the link layer header pushed
698 + * the packet is destroyed
700 +static void ip_direct_send(struct sk_buff *skb)
702 + struct dst_entry *dst = skb->dst;
703 + struct hh_cache *hh = dst->hh;
706 + read_lock_bh(&hh->hh_lock);
707 + memcpy(skb->data - 16, hh->hh_data, 16);
708 + read_unlock_bh(&hh->hh_lock);
709 + skb_push(skb, hh->hh_len);
710 + hh->hh_output(skb);
711 + } else if (dst->neighbour)
712 + dst->neighbour->output(skb);
714 + if (net_ratelimit())
715 + DEBUGP(KERN_DEBUG "ip6t_ROUTE: no hdr & no neighbour cache!\n");
722 +route6_oif(const struct ip6t_route_target_info *route_info,
723 + struct sk_buff *skb)
725 + unsigned int ifindex = 0;
726 + struct net_device *dev_out = NULL;
728 + /* The user set the interface name to use.
729 + * Getting the current interface index.
731 + if ((dev_out = dev_get_by_name(route_info->oif))) {
732 + ifindex = dev_out->ifindex;
734 + /* Unknown interface name : packet dropped */
735 + if (net_ratelimit())
736 + DEBUGP("ip6t_ROUTE: oif interface %s not found\n", route_info->oif);
738 + if (route_info->flags & IP6T_ROUTE_CONTINUE)
739 + return IP6T_CONTINUE;
744 + /* Trying the standard way of routing packets */
745 + if (route6(skb, ifindex, route_info)) {
747 + if (route_info->flags & IP6T_ROUTE_CONTINUE)
748 + return IP6T_CONTINUE;
750 + ip_direct_send(skb);
758 +route6_gw(const struct ip6t_route_target_info *route_info,
759 + struct sk_buff *skb)
761 + if (route6(skb, 0, route_info)) {
762 + if (route_info->flags & IP6T_ROUTE_CONTINUE)
763 + return IP6T_CONTINUE;
765 + ip_direct_send(skb);
773 +ip6t_route_target(struct sk_buff **pskb,
774 + const struct net_device *in,
775 + const struct net_device *out,
776 + unsigned int hooknum,
777 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
778 + const struct xt_target *target,
780 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
781 + const void *targinfo,
784 + const void *targinfo)
787 + const struct ip6t_route_target_info *route_info = targinfo;
788 + struct sk_buff *skb = *pskb;
789 + struct in6_addr *gw = (struct in6_addr*)&route_info->gw;
792 + if (route_info->flags & IP6T_ROUTE_CONTINUE)
795 + /* If we are at PREROUTING or INPUT hook
796 + * the TTL isn't decreased by the IP stack
798 + if (hooknum == NF_IP6_PRE_ROUTING ||
799 + hooknum == NF_IP6_LOCAL_IN) {
801 + struct ipv6hdr *ipv6h = ipv6_hdr(skb);
803 + if (ipv6h->hop_limit <= 1) {
804 + /* Force OUTPUT device used as source address */
805 + skb->dev = skb->dst->dev;
807 + icmpv6_send(skb, ICMPV6_TIME_EXCEED,
808 + ICMPV6_EXC_HOPLIMIT, 0, skb->dev);
813 + ipv6h->hop_limit--;
816 + if ((route_info->flags & IP6T_ROUTE_TEE)) {
818 + * Copy the *pskb, and route the copy. Will later return
819 + * IP6T_CONTINUE for the original skb, which should continue
820 + * on its way as if nothing happened. The copy should be
821 + * independantly delivered to the ROUTE --gw.
823 + skb = skb_copy(*pskb, GFP_ATOMIC);
825 + if (net_ratelimit())
826 + DEBUGP(KERN_DEBUG "ip6t_ROUTE: copy failed!\n");
827 + return IP6T_CONTINUE;
832 + if (route_info->oif[0]) {
833 + res = route6_oif(route_info, skb);
834 + } else if (!ipv6_addr_any(gw)) {
835 + res = route6_gw(route_info, skb);
837 + if (net_ratelimit())
838 + DEBUGP(KERN_DEBUG "ip6t_ROUTE: no parameter !\n");
839 + res = IP6T_CONTINUE;
842 + if ((route_info->flags & IP6T_ROUTE_TEE))
843 + res = IP6T_CONTINUE;
850 +ip6t_route_checkentry(const char *tablename,
851 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
854 + const struct ip6t_entry *entry
856 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
857 + const struct xt_target *target,
860 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
861 + unsigned int targinfosize,
863 + unsigned int hook_mask)
865 + if (strcmp(tablename, "mangle") != 0) {
866 + printk("ip6t_ROUTE: can only be called from \"mangle\" table.\n");
870 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
871 + if (targinfosize != IP6T_ALIGN(sizeof(struct ip6t_route_target_info))) {
872 + printk(KERN_WARNING "ip6t_ROUTE: targinfosize %u != %Zu\n",
874 + IP6T_ALIGN(sizeof(struct ip6t_route_target_info)));
883 +static struct ip6t_target ip6t_route_reg = {
885 + .target = ip6t_route_target,
886 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
887 + .targetsize = sizeof(struct ip6t_route_target_info),
889 + .checkentry = ip6t_route_checkentry,
894 +static int __init init(void)
896 + printk(KERN_DEBUG "registering ipv6 ROUTE target\n");
897 + if (xt_register_target(&ip6t_route_reg))
904 +static void __exit fini(void)
906 + xt_unregister_target(&ip6t_route_reg);
911 +MODULE_LICENSE("GPL");
912 Index: linux-2.6.23-rc6/net/ipv6/netfilter/Kconfig
913 ===================================================================
914 --- linux-2.6.23-rc6.orig/net/ipv6/netfilter/Kconfig 2007-09-21 16:24:02.000000000 +0800
915 +++ linux-2.6.23-rc6/net/ipv6/netfilter/Kconfig 2007-09-21 16:24:03.000000000 +0800
917 If you want to compile it as a module, say M here and read
918 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
920 +config IP6_NF_TARGET_ROUTE
921 + tristate 'ROUTE target support'
922 + depends on IP6_NF_MANGLE
924 + This option adds a `ROUTE' target, which enables you to setup unusual
925 + routes. The ROUTE target is also able to change the incoming interface
928 + The target can be or not a final target. It has to be used inside the
931 + Not working as a module.
935 Index: linux-2.6.23-rc6/net/ipv6/netfilter/Makefile
936 ===================================================================
937 --- linux-2.6.23-rc6.orig/net/ipv6/netfilter/Makefile 2007-09-21 16:24:02.000000000 +0800
938 +++ linux-2.6.23-rc6/net/ipv6/netfilter/Makefile 2007-09-21 16:24:03.000000000 +0800
940 obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
941 obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
942 obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o
943 +obj-$(CONFIG_IP6_NF_TARGET_ROUTE) += ip6t_ROUTE.o
944 obj-$(CONFIG_IP6_NF_MATCH_MH) += ip6t_mh.o
946 # objects for l3 independent conntrack