mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 13:55:32 +00:00
icmp: introduce helper for nat'd source address in network device context
This introduces a helper function to be called only by network drivers that wraps calls to icmp[v6]_send in a conntrack transformation, in case NAT has been used. We don't want to pollute the non-driver path, though, so we introduce this as a helper to be called by places that actually make use of this, as suggested by Florian. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Cc: Florian Westphal <fw@strlen.de> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
07134cf696
commit
0b41713b60
4 changed files with 79 additions and 0 deletions
|
@ -31,6 +31,12 @@ static inline void icmpv6_send(struct sk_buff *skb,
|
|||
}
|
||||
#endif
|
||||
|
||||
#if IS_ENABLED(CONFIG_NF_NAT)
|
||||
void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info);
|
||||
#else
|
||||
#define icmpv6_ndo_send icmpv6_send
|
||||
#endif
|
||||
|
||||
extern int icmpv6_init(void);
|
||||
extern int icmpv6_err_convert(u8 type, u8 code,
|
||||
int *err);
|
||||
|
|
|
@ -43,6 +43,12 @@ static inline void icmp_send(struct sk_buff *skb_in, int type, int code, __be32
|
|||
__icmp_send(skb_in, type, code, info, &IPCB(skb_in)->opt);
|
||||
}
|
||||
|
||||
#if IS_ENABLED(CONFIG_NF_NAT)
|
||||
void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info);
|
||||
#else
|
||||
#define icmp_ndo_send icmp_send
|
||||
#endif
|
||||
|
||||
int icmp_rcv(struct sk_buff *skb);
|
||||
int icmp_err(struct sk_buff *skb, u32 info);
|
||||
int icmp_init(void);
|
||||
|
|
|
@ -748,6 +748,39 @@ out:;
|
|||
}
|
||||
EXPORT_SYMBOL(__icmp_send);
|
||||
|
||||
#if IS_ENABLED(CONFIG_NF_NAT)
|
||||
#include <net/netfilter/nf_conntrack.h>
|
||||
void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info)
|
||||
{
|
||||
struct sk_buff *cloned_skb = NULL;
|
||||
enum ip_conntrack_info ctinfo;
|
||||
struct nf_conn *ct;
|
||||
__be32 orig_ip;
|
||||
|
||||
ct = nf_ct_get(skb_in, &ctinfo);
|
||||
if (!ct || !(ct->status & IPS_SRC_NAT)) {
|
||||
icmp_send(skb_in, type, code, info);
|
||||
return;
|
||||
}
|
||||
|
||||
if (skb_shared(skb_in))
|
||||
skb_in = cloned_skb = skb_clone(skb_in, GFP_ATOMIC);
|
||||
|
||||
if (unlikely(!skb_in || skb_network_header(skb_in) < skb_in->head ||
|
||||
(skb_network_header(skb_in) + sizeof(struct iphdr)) >
|
||||
skb_tail_pointer(skb_in) || skb_ensure_writable(skb_in,
|
||||
skb_network_offset(skb_in) + sizeof(struct iphdr))))
|
||||
goto out;
|
||||
|
||||
orig_ip = ip_hdr(skb_in)->saddr;
|
||||
ip_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.ip;
|
||||
icmp_send(skb_in, type, code, info);
|
||||
ip_hdr(skb_in)->saddr = orig_ip;
|
||||
out:
|
||||
consume_skb(cloned_skb);
|
||||
}
|
||||
EXPORT_SYMBOL(icmp_ndo_send);
|
||||
#endif
|
||||
|
||||
static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
|
||||
{
|
||||
|
|
|
@ -45,4 +45,38 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
|
|||
rcu_read_unlock();
|
||||
}
|
||||
EXPORT_SYMBOL(icmpv6_send);
|
||||
|
||||
#if IS_ENABLED(CONFIG_NF_NAT)
|
||||
#include <net/netfilter/nf_conntrack.h>
|
||||
void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info)
|
||||
{
|
||||
struct sk_buff *cloned_skb = NULL;
|
||||
enum ip_conntrack_info ctinfo;
|
||||
struct in6_addr orig_ip;
|
||||
struct nf_conn *ct;
|
||||
|
||||
ct = nf_ct_get(skb_in, &ctinfo);
|
||||
if (!ct || !(ct->status & IPS_SRC_NAT)) {
|
||||
icmpv6_send(skb_in, type, code, info);
|
||||
return;
|
||||
}
|
||||
|
||||
if (skb_shared(skb_in))
|
||||
skb_in = cloned_skb = skb_clone(skb_in, GFP_ATOMIC);
|
||||
|
||||
if (unlikely(!skb_in || skb_network_header(skb_in) < skb_in->head ||
|
||||
(skb_network_header(skb_in) + sizeof(struct ipv6hdr)) >
|
||||
skb_tail_pointer(skb_in) || skb_ensure_writable(skb_in,
|
||||
skb_network_offset(skb_in) + sizeof(struct ipv6hdr))))
|
||||
goto out;
|
||||
|
||||
orig_ip = ipv6_hdr(skb_in)->saddr;
|
||||
ipv6_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.in6;
|
||||
icmpv6_send(skb_in, type, code, info);
|
||||
ipv6_hdr(skb_in)->saddr = orig_ip;
|
||||
out:
|
||||
consume_skb(cloned_skb);
|
||||
}
|
||||
EXPORT_SYMBOL(icmpv6_ndo_send);
|
||||
#endif
|
||||
#endif
|
||||
|
|
Loading…
Reference in a new issue