diff options
author | KOVACS Krisztian <hidden@sch.bme.hu> | 2008-10-01 10:44:42 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2008-10-01 10:44:42 -0400 |
commit | 86b08d867d7de001ab224180ed7865fab93fd56e (patch) | |
tree | fc081a9ec0d0107f951cc0270da2865e1e3413e2 /net | |
parent | 88ef4a5a78e63420dd1dd770f1bd1dc198926b04 (diff) |
ipv4: Make Netfilter's ip_route_me_harder() non-local address compatible
Netfilter's ip_route_me_harder() tries to re-route packets either
generated or re-routed by Netfilter. This patch changes
ip_route_me_harder() to handle packets from non-locally-bound sockets
with IP_TRANSPARENT set as local and to set the appropriate flowi
flags when re-doing the routing lookup.
Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r-- | net/ipv4/inet_connection_sock.c | 1 | ||||
-rw-r--r-- | net/ipv4/ip_output.c | 4 | ||||
-rw-r--r-- | net/ipv4/netfilter.c | 3 | ||||
-rw-r--r-- | net/ipv4/syncookies.c | 2 |
4 files changed, 9 insertions, 1 deletions
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index 0c1ae68ee84b..432c570c9f5f 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c | |||
@@ -335,6 +335,7 @@ struct dst_entry* inet_csk_route_req(struct sock *sk, | |||
335 | .saddr = ireq->loc_addr, | 335 | .saddr = ireq->loc_addr, |
336 | .tos = RT_CONN_FLAGS(sk) } }, | 336 | .tos = RT_CONN_FLAGS(sk) } }, |
337 | .proto = sk->sk_protocol, | 337 | .proto = sk->sk_protocol, |
338 | .flags = inet_sk_flowi_flags(sk), | ||
338 | .uli_u = { .ports = | 339 | .uli_u = { .ports = |
339 | { .sport = inet_sk(sk)->sport, | 340 | { .sport = inet_sk(sk)->sport, |
340 | .dport = ireq->rmt_port } } }; | 341 | .dport = ireq->rmt_port } } }; |
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index d533a89e08de..d2a8f8bb78a6 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c | |||
@@ -340,6 +340,7 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok) | |||
340 | .saddr = inet->saddr, | 340 | .saddr = inet->saddr, |
341 | .tos = RT_CONN_FLAGS(sk) } }, | 341 | .tos = RT_CONN_FLAGS(sk) } }, |
342 | .proto = sk->sk_protocol, | 342 | .proto = sk->sk_protocol, |
343 | .flags = inet_sk_flowi_flags(sk), | ||
343 | .uli_u = { .ports = | 344 | .uli_u = { .ports = |
344 | { .sport = inet->sport, | 345 | { .sport = inet->sport, |
345 | .dport = inet->dport } } }; | 346 | .dport = inet->dport } } }; |
@@ -1371,7 +1372,8 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar | |||
1371 | .uli_u = { .ports = | 1372 | .uli_u = { .ports = |
1372 | { .sport = tcp_hdr(skb)->dest, | 1373 | { .sport = tcp_hdr(skb)->dest, |
1373 | .dport = tcp_hdr(skb)->source } }, | 1374 | .dport = tcp_hdr(skb)->source } }, |
1374 | .proto = sk->sk_protocol }; | 1375 | .proto = sk->sk_protocol, |
1376 | .flags = ip_reply_arg_flowi_flags(arg) }; | ||
1375 | security_skb_classify_flow(skb, &fl); | 1377 | security_skb_classify_flow(skb, &fl); |
1376 | if (ip_route_output_key(sock_net(sk), &rt, &fl)) | 1378 | if (ip_route_output_key(sock_net(sk), &rt, &fl)) |
1377 | return; | 1379 | return; |
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c index f8edacdf991d..01671ad51ed3 100644 --- a/net/ipv4/netfilter.c +++ b/net/ipv4/netfilter.c | |||
@@ -20,6 +20,8 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type) | |||
20 | unsigned int type; | 20 | unsigned int type; |
21 | 21 | ||
22 | type = inet_addr_type(&init_net, iph->saddr); | 22 | type = inet_addr_type(&init_net, iph->saddr); |
23 | if (skb->sk && inet_sk(skb->sk)->transparent) | ||
24 | type = RTN_LOCAL; | ||
23 | if (addr_type == RTN_UNSPEC) | 25 | if (addr_type == RTN_UNSPEC) |
24 | addr_type = type; | 26 | addr_type = type; |
25 | 27 | ||
@@ -33,6 +35,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type) | |||
33 | fl.nl_u.ip4_u.tos = RT_TOS(iph->tos); | 35 | fl.nl_u.ip4_u.tos = RT_TOS(iph->tos); |
34 | fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0; | 36 | fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0; |
35 | fl.mark = skb->mark; | 37 | fl.mark = skb->mark; |
38 | fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0; | ||
36 | if (ip_route_output_key(&init_net, &rt, &fl) != 0) | 39 | if (ip_route_output_key(&init_net, &rt, &fl) != 0) |
37 | return -1; | 40 | return -1; |
38 | 41 | ||
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c index 9d38005abbac..929302b2ba94 100644 --- a/net/ipv4/syncookies.c +++ b/net/ipv4/syncookies.c | |||
@@ -16,6 +16,7 @@ | |||
16 | #include <linux/cryptohash.h> | 16 | #include <linux/cryptohash.h> |
17 | #include <linux/kernel.h> | 17 | #include <linux/kernel.h> |
18 | #include <net/tcp.h> | 18 | #include <net/tcp.h> |
19 | #include <net/route.h> | ||
19 | 20 | ||
20 | /* Timestamps: lowest 9 bits store TCP options */ | 21 | /* Timestamps: lowest 9 bits store TCP options */ |
21 | #define TSBITS 9 | 22 | #define TSBITS 9 |
@@ -337,6 +338,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, | |||
337 | .saddr = ireq->loc_addr, | 338 | .saddr = ireq->loc_addr, |
338 | .tos = RT_CONN_FLAGS(sk) } }, | 339 | .tos = RT_CONN_FLAGS(sk) } }, |
339 | .proto = IPPROTO_TCP, | 340 | .proto = IPPROTO_TCP, |
341 | .flags = inet_sk_flowi_flags(sk), | ||
340 | .uli_u = { .ports = | 342 | .uli_u = { .ports = |
341 | { .sport = th->dest, | 343 | { .sport = th->dest, |
342 | .dport = th->source } } }; | 344 | .dport = th->source } } }; |