2 +++ b/include/linux/netfilter_ipv4/ipt_ROUTE.h
4 +/* Header file for iptables ipt_ROUTE target
6 + * (C) 2002 by Cédric de Launois <delaunois@info.ucl.ac.be>
8 + * This software is distributed under GNU GPL v2, 1991
10 +#ifndef _IPT_ROUTE_H_target
11 +#define _IPT_ROUTE_H_target
13 +#define IPT_ROUTE_IFNAMSIZ 16
15 +struct ipt_route_target_info {
16 + char oif[IPT_ROUTE_IFNAMSIZ]; /* Output Interface Name */
17 + char iif[IPT_ROUTE_IFNAMSIZ]; /* Input Interface Name */
18 + u_int32_t gw; /* IP address of gateway */
22 +/* Values for "flags" field */
23 +#define IPT_ROUTE_CONTINUE 0x01
24 +#define IPT_ROUTE_TEE 0x02
26 +#endif /*_IPT_ROUTE_H_target*/
28 +++ b/include/linux/netfilter_ipv6/ip6t_ROUTE.h
30 +/* Header file for iptables ip6t_ROUTE target
32 + * (C) 2003 by Cédric de Launois <delaunois@info.ucl.ac.be>
34 + * This software is distributed under GNU GPL v2, 1991
36 +#ifndef _IPT_ROUTE_H_target
37 +#define _IPT_ROUTE_H_target
39 +#define IP6T_ROUTE_IFNAMSIZ 16
41 +struct ip6t_route_target_info {
42 + char oif[IP6T_ROUTE_IFNAMSIZ]; /* Output Interface Name */
43 + char iif[IP6T_ROUTE_IFNAMSIZ]; /* Input Interface Name */
44 + u_int32_t gw[4]; /* IPv6 address of gateway */
48 +/* Values for "flags" field */
49 +#define IP6T_ROUTE_CONTINUE 0x01
50 +#define IP6T_ROUTE_TEE 0x02
52 +#endif /*_IP6T_ROUTE_H_target*/
54 +++ b/net/ipv4/netfilter/ipt_ROUTE.c
57 + * This implements the ROUTE target, which enables you to setup unusual
58 + * routes not supported by the standard kernel routing table.
60 + * Copyright (C) 2002 Cedric de Launois <delaunois@info.ucl.ac.be>
64 + * This software is distributed under GNU GPL v2, 1991
67 +#include <linux/module.h>
68 +#include <linux/skbuff.h>
69 +#include <linux/ip.h>
70 +#include <linux/netfilter_ipv4/ip_tables.h>
71 +#include <net/netfilter/nf_conntrack.h>
72 +#include <linux/netfilter_ipv4/ipt_ROUTE.h>
73 +#include <linux/netdevice.h>
74 +#include <linux/route.h>
75 +#include <linux/version.h>
76 +#include <linux/if_arp.h>
78 +#include <net/route.h>
79 +#include <net/icmp.h>
80 +#include <net/checksum.h>
83 +#define DEBUGP printk
85 +#define DEBUGP(format, args...)
88 +MODULE_LICENSE("GPL");
89 +MODULE_AUTHOR("Cedric de Launois <delaunois@info.ucl.ac.be>");
90 +MODULE_DESCRIPTION("iptables ROUTE target module");
92 +/* Try to route the packet according to the routing keys specified in
93 + * route_info. Keys are :
95 + * 0 if no oif preferred,
96 + * otherwise set to the index of the desired oif
97 + * - route_info->gw :
98 + * 0 if no gateway specified,
99 + * otherwise set to the next host to which the pkt must be routed
100 + * If success, skb->dev is the output device to which the packet must
101 + * be sent and skb->dst is not NULL
103 + * RETURN: -1 if an error occured
104 + * 1 if the packet was succesfully routed to the
105 + * destination desired
106 + * 0 if the kernel routing table could not route the packet
107 + * according to the keys specified
109 +static int route(struct sk_buff *skb,
110 + unsigned int ifindex,
111 + const struct ipt_route_target_info *route_info)
115 + struct iphdr *iph = ip_hdr(skb);
116 + struct flowi fl = {
120 + .daddr = iph->daddr,
122 + .tos = RT_TOS(iph->tos),
123 + .scope = RT_SCOPE_UNIVERSE,
128 + /* The destination address may be overloaded by the target */
129 + if (route_info->gw)
130 + fl.fl4_dst = route_info->gw;
132 + /* Trying to route the packet using the standard routing table. */
133 + if ((err = ip_route_output_key(&rt, &fl))) {
134 + if (net_ratelimit())
135 + DEBUGP("ipt_ROUTE: couldn't route pkt (err: %i)",err);
139 + /* Drop old route. */
140 + dst_release(skb->dst);
143 + /* Success if no oif specified or if the oif correspond to the
145 + if (!ifindex || rt->u.dst.dev->ifindex == ifindex) {
146 + skb->dst = &rt->u.dst;
147 + skb->dev = skb->dst->dev;
148 + skb->protocol = htons(ETH_P_IP);
152 + /* The interface selected by the routing table is not the one
153 + * specified by the user. This may happen because the dst address
154 + * is one of our own addresses.
156 + if (net_ratelimit())
157 + DEBUGP("ipt_ROUTE: failed to route as desired gw=%u.%u.%u.%u oif=%i (got oif=%i)\n",
158 + NIPQUAD(route_info->gw), ifindex, rt->u.dst.dev->ifindex);
164 +/* Stolen from ip_finish_output2
165 + * PRE : skb->dev is set to the device we are leaving by
166 + * skb->dst is not NULL
167 + * POST: the packet is sent with the link layer header pushed
168 + * the packet is destroyed
170 +static void ip_direct_send(struct sk_buff *skb)
172 + struct dst_entry *dst = skb->dst;
173 + struct hh_cache *hh = dst->hh;
174 + struct net_device *dev = dst->dev;
175 + int hh_len = LL_RESERVED_SPACE(dev);
177 + /* Be paranoid, rather than too clever. */
178 + if (unlikely(skb_headroom(skb) < hh_len && dev->hard_header)) {
179 + struct sk_buff *skb2;
181 + skb2 = skb_realloc_headroom(skb, LL_RESERVED_SPACE(dev));
182 + if (skb2 == NULL) {
187 + skb_set_owner_w(skb2, skb->sk);
195 + read_lock_bh(&hh->hh_lock);
196 + hh_alen = HH_DATA_ALIGN(hh->hh_len);
197 + memcpy(skb->data - hh_alen, hh->hh_data, hh_alen);
198 + read_unlock_bh(&hh->hh_lock);
199 + skb_push(skb, hh->hh_len);
200 + hh->hh_output(skb);
201 + } else if (dst->neighbour)
202 + dst->neighbour->output(skb);
204 + if (net_ratelimit())
205 + DEBUGP(KERN_DEBUG "ipt_ROUTE: no hdr & no neighbour cache!\n");
211 +/* PRE : skb->dev is set to the device we are leaving by
212 + * POST: - the packet is directly sent to the skb->dev device, without
213 + * pushing the link layer header.
214 + * - the packet is destroyed
216 +static inline int dev_direct_send(struct sk_buff *skb)
218 + return dev_queue_xmit(skb);
222 +static unsigned int route_oif(const struct ipt_route_target_info *route_info,
223 + struct sk_buff *skb)
225 + unsigned int ifindex = 0;
226 + struct net_device *dev_out = NULL;
228 + /* The user set the interface name to use.
229 + * Getting the current interface index.
231 + if ((dev_out = dev_get_by_name(route_info->oif))) {
232 + ifindex = dev_out->ifindex;
234 + /* Unknown interface name : packet dropped */
235 + if (net_ratelimit())
236 + DEBUGP("ipt_ROUTE: oif interface %s not found\n", route_info->oif);
240 + /* Trying the standard way of routing packets */
241 + switch (route(skb, ifindex, route_info)) {
244 + if (route_info->flags & IPT_ROUTE_CONTINUE)
245 + return IPT_CONTINUE;
247 + ip_direct_send(skb);
251 + /* Failed to send to oif. Trying the hard way */
252 + if (route_info->flags & IPT_ROUTE_CONTINUE)
255 + if (net_ratelimit())
256 + DEBUGP("ipt_ROUTE: forcing the use of %i\n",
259 + /* We have to force the use of an interface.
260 + * This interface must be a tunnel interface since
261 + * otherwise we can't guess the hw address for
262 + * the packet. For a tunnel interface, no hw address
265 + if ((dev_out->type != ARPHRD_TUNNEL)
266 + && (dev_out->type != ARPHRD_IPGRE)) {
267 + if (net_ratelimit())
268 + DEBUGP("ipt_ROUTE: can't guess the hw addr !\n");
273 + /* Send the packet. This will also free skb
274 + * Do not go through the POST_ROUTING hook because
275 + * skb->dst is not set and because it will probably
276 + * get confused by the destination IP address.
278 + skb->dev = dev_out;
279 + dev_direct_send(skb);
284 + /* Unexpected error */
291 +static unsigned int route_iif(const struct ipt_route_target_info *route_info,
292 + struct sk_buff *skb)
294 + struct net_device *dev_in = NULL;
296 + /* Getting the current interface index. */
297 + if (!(dev_in = dev_get_by_name(route_info->iif))) {
298 + if (net_ratelimit())
299 + DEBUGP("ipt_ROUTE: iif interface %s not found\n", route_info->iif);
304 + dst_release(skb->dst);
313 +static unsigned int route_gw(const struct ipt_route_target_info *route_info,
314 + struct sk_buff *skb)
316 + if (route(skb, 0, route_info)!=1)
319 + if (route_info->flags & IPT_ROUTE_CONTINUE)
320 + return IPT_CONTINUE;
322 + ip_direct_send(skb);
327 +/* To detect and deter routed packet loopback when using the --tee option,
328 + * we take a page out of the raw.patch book: on the copied skb, we set up
329 + * a fake ->nfct entry, pointing to the local &route_tee_track. We skip
330 + * routing packets when we see they already have that ->nfct.
333 +static struct nf_conn route_tee_track;
335 +static unsigned int ipt_route_target(struct sk_buff **pskb,
336 + const struct net_device *in,
337 + const struct net_device *out,
338 + unsigned int hooknum,
339 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
340 + const struct xt_target *target,
342 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
343 + const void *targinfo,
346 + const void *targinfo)
349 + const struct ipt_route_target_info *route_info = targinfo;
350 + struct sk_buff *skb = *pskb;
353 + if (skb->nfct == &route_tee_track.ct_general) {
354 + /* Loopback - a packet we already routed, is to be
355 + * routed another time. Avoid that, now.
357 + if (net_ratelimit())
358 + DEBUGP(KERN_DEBUG "ipt_ROUTE: loopback - DROP!\n");
362 + /* If we are at PREROUTING or INPUT hook
363 + * the TTL isn't decreased by the IP stack
365 + if (hooknum == NF_IP_PRE_ROUTING ||
366 + hooknum == NF_IP_LOCAL_IN) {
368 + struct iphdr *iph = ip_hdr(skb);
370 + if (iph->ttl <= 1) {
372 + struct flowi fl = {
376 + .daddr = iph->daddr,
377 + .saddr = iph->saddr,
378 + .tos = RT_TOS(iph->tos),
379 + .scope = ((iph->tos & RTO_ONLINK) ?
386 + if (ip_route_output_key(&rt, &fl)) {
390 + if (skb->dev == rt->u.dst.dev) {
391 + /* Drop old route. */
392 + dst_release(skb->dst);
393 + skb->dst = &rt->u.dst;
395 + /* this will traverse normal stack, and
396 + * thus call conntrack on the icmp packet */
397 + icmp_send(skb, ICMP_TIME_EXCEEDED,
405 + * If we are at INPUT the checksum must be recalculated since
406 + * the length could change as the result of a defragmentation.
408 + if(hooknum == NF_IP_LOCAL_IN) {
409 + iph->ttl = iph->ttl - 1;
411 + iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
413 + ip_decrease_ttl(iph);
417 + if ((route_info->flags & IPT_ROUTE_TEE)) {
419 + * Copy the *pskb, and route the copy. Will later return
420 + * IPT_CONTINUE for the original skb, which should continue
421 + * on its way as if nothing happened. The copy should be
422 + * independantly delivered to the ROUTE --gw.
424 + skb = skb_copy(*pskb, GFP_ATOMIC);
426 + if (net_ratelimit())
427 + DEBUGP(KERN_DEBUG "ipt_ROUTE: copy failed!\n");
428 + return IPT_CONTINUE;
432 + /* Tell conntrack to forget this packet since it may get confused
433 + * when a packet is leaving with dst address == our address.
434 + * Good idea ? Dunno. Need advice.
436 + * NEW: mark the skb with our &route_tee_track, so we avoid looping
437 + * on any already routed packet.
439 + if (!(route_info->flags & IPT_ROUTE_CONTINUE)) {
440 + nf_conntrack_put(skb->nfct);
441 + skb->nfct = &route_tee_track.ct_general;
442 + skb->nfctinfo = IP_CT_NEW;
443 + nf_conntrack_get(skb->nfct);
446 + if (route_info->oif[0] != '\0') {
447 + res = route_oif(route_info, skb);
448 + } else if (route_info->iif[0] != '\0') {
449 + res = route_iif(route_info, skb);
450 + } else if (route_info->gw) {
451 + res = route_gw(route_info, skb);
453 + if (net_ratelimit())
454 + DEBUGP(KERN_DEBUG "ipt_ROUTE: no parameter !\n");
455 + res = IPT_CONTINUE;
458 + if ((route_info->flags & IPT_ROUTE_TEE))
459 + res = IPT_CONTINUE;
465 +static bool ipt_route_checkentry(const char *tablename,
467 + const struct xt_target *target,
469 + unsigned int hook_mask)
471 + if (strcmp(tablename, "mangle") != 0) {
472 + printk("ipt_ROUTE: bad table `%s', use the `mangle' table.\n",
477 + if (hook_mask & ~( (1 << NF_IP_PRE_ROUTING)
478 + | (1 << NF_IP_LOCAL_IN)
479 + | (1 << NF_IP_FORWARD)
480 + | (1 << NF_IP_LOCAL_OUT)
481 + | (1 << NF_IP_POST_ROUTING))) {
482 + printk("ipt_ROUTE: bad hook\n");
490 +static struct ipt_target ipt_route_reg = {
492 + .target = ipt_route_target,
493 + .targetsize = sizeof(struct ipt_route_target_info),
494 + .checkentry = ipt_route_checkentry,
498 +static int __init init(void)
500 + /* Set up fake conntrack (stolen from raw.patch):
501 + - to never be deleted, not in any hashes */
502 + atomic_set(&route_tee_track.ct_general.use, 1);
503 + /* - and look it like as a confirmed connection */
504 + set_bit(IPS_CONFIRMED_BIT, &route_tee_track.status);
505 + /* Initialize fake conntrack so that NAT will skip it */
506 + route_tee_track.status |= IPS_NAT_DONE_MASK;
508 + return xt_register_target(&ipt_route_reg);
512 +static void __exit fini(void)
514 + xt_unregister_target(&ipt_route_reg);
519 --- a/net/ipv4/netfilter/Kconfig
520 +++ b/net/ipv4/netfilter/Kconfig
521 @@ -546,5 +546,22 @@ config IP_NF_TARGET_SET
522 To compile it as a module, choose M here. If unsure, say N.
525 +config IP_NF_TARGET_ROUTE
526 + tristate 'ROUTE target support'
527 + depends on IP_NF_MANGLE
529 + This option adds a `ROUTE' target, which enables you to setup unusual
530 + routes. For example, the ROUTE lets you route a received packet through
531 + an interface or towards a host, even if the regular destination of the
532 + packet is the router itself. The ROUTE target is also able to change the
533 + incoming interface of a packet.
535 + The target can be or not a final target. It has to be used inside the
538 + If you want to compile it as a module, say M here and read
539 + Documentation/modules.txt. The module will be called ipt_ROUTE.o.
540 + If unsure, say `N'.
544 --- a/net/ipv4/netfilter/Makefile
545 +++ b/net/ipv4/netfilter/Makefile
546 @@ -59,6 +59,7 @@ obj-$(CONFIG_IP_NF_TARGET_ECN) += ipt_EC
547 obj-$(CONFIG_IP_NF_TARGET_IMQ) += ipt_IMQ.o
548 obj-$(CONFIG_IP_NF_TARGET_MASQUERADE) += ipt_MASQUERADE.o
549 obj-$(CONFIG_IP_NF_TARGET_REDIRECT) += ipt_REDIRECT.o
550 +obj-$(CONFIG_IP_NF_TARGET_ROUTE) += ipt_ROUTE.o
551 obj-$(CONFIG_IP_NF_TARGET_NETMAP) += ipt_NETMAP.o
552 obj-$(CONFIG_IP_NF_TARGET_SAME) += ipt_SAME.o
553 obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
554 --- a/net/ipv6/ndisc.c
555 +++ b/net/ipv6/ndisc.c
556 @@ -154,6 +154,8 @@ struct neigh_table nd_tbl = {
560 +EXPORT_SYMBOL(nd_tbl);
563 struct ndisc_options {
564 struct nd_opt_hdr *nd_opt_array[__ND_OPT_ARRAY_MAX];
566 +++ b/net/ipv6/netfilter/ip6t_ROUTE.c
569 + * This implements the ROUTE v6 target, which enables you to setup unusual
570 + * routes not supported by the standard kernel routing table.
572 + * Copyright (C) 2003 Cedric de Launois <delaunois@info.ucl.ac.be>
576 + * This software is distributed under GNU GPL v2, 1991
579 +#include <linux/module.h>
580 +#include <linux/skbuff.h>
581 +#include <linux/ipv6.h>
582 +#include <linux/netfilter_ipv6/ip6_tables.h>
583 +#include <linux/netfilter_ipv6/ip6t_ROUTE.h>
584 +#include <linux/netdevice.h>
585 +#include <linux/version.h>
586 +#include <net/ipv6.h>
587 +#include <net/ndisc.h>
588 +#include <net/ip6_route.h>
589 +#include <linux/icmpv6.h>
592 +#define DEBUGP printk
594 +#define DEBUGP(format, args...)
597 +#define NIP6(addr) \
598 + ntohs((addr).s6_addr16[0]), \
599 + ntohs((addr).s6_addr16[1]), \
600 + ntohs((addr).s6_addr16[2]), \
601 + ntohs((addr).s6_addr16[3]), \
602 + ntohs((addr).s6_addr16[4]), \
603 + ntohs((addr).s6_addr16[5]), \
604 + ntohs((addr).s6_addr16[6]), \
605 + ntohs((addr).s6_addr16[7])
607 +/* Route the packet according to the routing keys specified in
608 + * route_info. Keys are :
610 + * 0 if no oif preferred,
611 + * otherwise set to the index of the desired oif
612 + * - route_info->gw :
613 + * 0 if no gateway specified,
614 + * otherwise set to the next host to which the pkt must be routed
615 + * If success, skb->dev is the output device to which the packet must
616 + * be sent and skb->dst is not NULL
618 + * RETURN: 1 if the packet was succesfully routed to the
619 + * destination desired
620 + * 0 if the kernel routing table could not route the packet
621 + * according to the keys specified
624 +route6(struct sk_buff *skb,
625 + unsigned int ifindex,
626 + const struct ip6t_route_target_info *route_info)
628 + struct rt6_info *rt = NULL;
629 + struct ipv6hdr *ipv6h = ipv6_hdr(skb);
630 + struct in6_addr *gw = (struct in6_addr*)&route_info->gw;
632 + DEBUGP("ip6t_ROUTE: called with: ");
633 + DEBUGP("DST=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(ipv6h->daddr));
634 + DEBUGP("GATEWAY=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(*gw));
635 + DEBUGP("OUT=%s\n", route_info->oif);
637 + if (ipv6_addr_any(gw))
638 + rt = rt6_lookup(&ipv6h->daddr, &ipv6h->saddr, ifindex, 1);
640 + rt = rt6_lookup(gw, &ipv6h->saddr, ifindex, 1);
645 + DEBUGP("ip6t_ROUTE: routing gives: ");
646 + DEBUGP("DST=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(rt->rt6i_dst.addr));
647 + DEBUGP("GATEWAY=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(rt->rt6i_gateway));
648 + DEBUGP("OUT=%s\n", rt->rt6i_dev->name);
650 + if (ifindex && rt->rt6i_dev->ifindex!=ifindex)
653 + if (!rt->rt6i_nexthop) {
654 + DEBUGP("ip6t_ROUTE: discovering neighbour\n");
655 + rt->rt6i_nexthop = ndisc_get_neigh(rt->rt6i_dev, &rt->rt6i_dst.addr);
658 + /* Drop old route. */
659 + dst_release(skb->dst);
660 + skb->dst = &rt->u.dst;
661 + skb->dev = rt->rt6i_dev;
665 + dst_release(&rt->u.dst);
667 + if (!net_ratelimit())
670 + printk("ip6t_ROUTE: no explicit route found ");
672 + printk("via interface %s ", route_info->oif);
673 + if (!ipv6_addr_any(gw))
674 + printk("via gateway %04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x", NIP6(*gw));
680 +/* Stolen from ip6_output_finish
681 + * PRE : skb->dev is set to the device we are leaving by
682 + * skb->dst is not NULL
683 + * POST: the packet is sent with the link layer header pushed
684 + * the packet is destroyed
686 +static void ip_direct_send(struct sk_buff *skb)
688 + struct dst_entry *dst = skb->dst;
689 + struct hh_cache *hh = dst->hh;
692 + read_lock_bh(&hh->hh_lock);
693 + memcpy(skb->data - 16, hh->hh_data, 16);
694 + read_unlock_bh(&hh->hh_lock);
695 + skb_push(skb, hh->hh_len);
696 + hh->hh_output(skb);
697 + } else if (dst->neighbour)
698 + dst->neighbour->output(skb);
700 + if (net_ratelimit())
701 + DEBUGP(KERN_DEBUG "ip6t_ROUTE: no hdr & no neighbour cache!\n");
708 +route6_oif(const struct ip6t_route_target_info *route_info,
709 + struct sk_buff *skb)
711 + unsigned int ifindex = 0;
712 + struct net_device *dev_out = NULL;
714 + /* The user set the interface name to use.
715 + * Getting the current interface index.
717 + if ((dev_out = dev_get_by_name(route_info->oif))) {
718 + ifindex = dev_out->ifindex;
720 + /* Unknown interface name : packet dropped */
721 + if (net_ratelimit())
722 + DEBUGP("ip6t_ROUTE: oif interface %s not found\n", route_info->oif);
724 + if (route_info->flags & IP6T_ROUTE_CONTINUE)
725 + return IP6T_CONTINUE;
730 + /* Trying the standard way of routing packets */
731 + if (route6(skb, ifindex, route_info)) {
733 + if (route_info->flags & IP6T_ROUTE_CONTINUE)
734 + return IP6T_CONTINUE;
736 + ip_direct_send(skb);
744 +route6_gw(const struct ip6t_route_target_info *route_info,
745 + struct sk_buff *skb)
747 + if (route6(skb, 0, route_info)) {
748 + if (route_info->flags & IP6T_ROUTE_CONTINUE)
749 + return IP6T_CONTINUE;
751 + ip_direct_send(skb);
759 +ip6t_route_target(struct sk_buff **pskb,
760 + const struct net_device *in,
761 + const struct net_device *out,
762 + unsigned int hooknum,
763 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
764 + const struct xt_target *target,
766 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
767 + const void *targinfo,
770 + const void *targinfo)
773 + const struct ip6t_route_target_info *route_info = targinfo;
774 + struct sk_buff *skb = *pskb;
775 + struct in6_addr *gw = (struct in6_addr*)&route_info->gw;
778 + if (route_info->flags & IP6T_ROUTE_CONTINUE)
781 + /* If we are at PREROUTING or INPUT hook
782 + * the TTL isn't decreased by the IP stack
784 + if (hooknum == NF_IP6_PRE_ROUTING ||
785 + hooknum == NF_IP6_LOCAL_IN) {
787 + struct ipv6hdr *ipv6h = ipv6_hdr(skb);
789 + if (ipv6h->hop_limit <= 1) {
790 + /* Force OUTPUT device used as source address */
791 + skb->dev = skb->dst->dev;
793 + icmpv6_send(skb, ICMPV6_TIME_EXCEED,
794 + ICMPV6_EXC_HOPLIMIT, 0, skb->dev);
799 + ipv6h->hop_limit--;
802 + if ((route_info->flags & IP6T_ROUTE_TEE)) {
804 + * Copy the *pskb, and route the copy. Will later return
805 + * IP6T_CONTINUE for the original skb, which should continue
806 + * on its way as if nothing happened. The copy should be
807 + * independantly delivered to the ROUTE --gw.
809 + skb = skb_copy(*pskb, GFP_ATOMIC);
811 + if (net_ratelimit())
812 + DEBUGP(KERN_DEBUG "ip6t_ROUTE: copy failed!\n");
813 + return IP6T_CONTINUE;
818 + if (route_info->oif[0]) {
819 + res = route6_oif(route_info, skb);
820 + } else if (!ipv6_addr_any(gw)) {
821 + res = route6_gw(route_info, skb);
823 + if (net_ratelimit())
824 + DEBUGP(KERN_DEBUG "ip6t_ROUTE: no parameter !\n");
825 + res = IP6T_CONTINUE;
828 + if ((route_info->flags & IP6T_ROUTE_TEE))
829 + res = IP6T_CONTINUE;
836 +ip6t_route_checkentry(const char *tablename,
837 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
840 + const struct ip6t_entry *entry
842 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
843 + const struct xt_target *target,
846 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
847 + unsigned int targinfosize,
849 + unsigned int hook_mask)
851 + if (strcmp(tablename, "mangle") != 0) {
852 + printk("ip6t_ROUTE: can only be called from \"mangle\" table.\n");
856 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
857 + if (targinfosize != IP6T_ALIGN(sizeof(struct ip6t_route_target_info))) {
858 + printk(KERN_WARNING "ip6t_ROUTE: targinfosize %u != %Zu\n",
860 + IP6T_ALIGN(sizeof(struct ip6t_route_target_info)));
869 +static struct ip6t_target ip6t_route_reg = {
871 + .target = ip6t_route_target,
872 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
873 + .targetsize = sizeof(struct ip6t_route_target_info),
875 + .checkentry = ip6t_route_checkentry,
880 +static int __init init(void)
882 + printk(KERN_DEBUG "registering ipv6 ROUTE target\n");
883 + if (xt_register_target(&ip6t_route_reg))
890 +static void __exit fini(void)
892 + xt_unregister_target(&ip6t_route_reg);
897 +MODULE_LICENSE("GPL");
898 --- a/net/ipv6/netfilter/Kconfig
899 +++ b/net/ipv6/netfilter/Kconfig
900 @@ -209,5 +209,18 @@ config IP6_NF_RAW
901 If you want to compile it as a module, say M here and read
902 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
904 +config IP6_NF_TARGET_ROUTE
905 + tristate 'ROUTE target support'
906 + depends on IP6_NF_MANGLE
908 + This option adds a `ROUTE' target, which enables you to setup unusual
909 + routes. The ROUTE target is also able to change the incoming interface
912 + The target can be or not a final target. It has to be used inside the
915 + Not working as a module.
919 --- a/net/ipv6/netfilter/Makefile
920 +++ b/net/ipv6/netfilter/Makefile
921 @@ -20,6 +20,7 @@ obj-$(CONFIG_IP6_NF_TARGET_LOG) += ip6t_
922 obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
923 obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
924 obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o
925 +obj-$(CONFIG_IP6_NF_TARGET_ROUTE) += ip6t_ROUTE.o
926 obj-$(CONFIG_IP6_NF_MATCH_MH) += ip6t_mh.o
928 # objects for l3 independent conntrack