mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 19:00:25 +00:00
cc41c84b7e
resurrect an old patch from Pablo Neira to remove the untracked objects. Currently, there are four possible states of an skb wrt. conntrack. 1. No conntrack attached, ct is NULL. 2. Normal (kmem cache allocated) ct attached. 3. a template (kmalloc'd), not in any hash tables at any point in time 4. the 'untracked' conntrack, a percpu nf_conn object, tagged via IPS_UNTRACKED_BIT in ct->status. Untracked is supposed to be identical to case 1. It exists only so users can check -m conntrack --ctstate UNTRACKED vs. -m conntrack --ctstate INVALID e.g. attempts to set connmark on INVALID or UNTRACKED conntracks is supposed to be a no-op. Thus currently we need to check ct == NULL || nf_ct_is_untracked(ct) in a lot of places in order to avoid altering untracked objects. The other consequence of the percpu untracked object is that all -j NOTRACK (and, later, kfree_skb of such skbs) result in an atomic op (inc/dec the untracked conntracks refcount). This adds a new kernel-private ctinfo state, IP_CT_UNTRACKED, to make the distinction instead. The (few) places that care about packet invalid (ct is NULL) vs. packet untracked now need to test ct == NULL vs. ctinfo == IP_CT_UNTRACKED, but all other places can omit the nf_ct_is_untracked() check. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
102 lines
2.8 KiB
C
102 lines
2.8 KiB
C
/*
|
|
* (C) 2007 by Sebastian Claßen <sebastian.classen@freenet.ag>
|
|
* (C) 2007-2010 by Jan Engelhardt <jengelh@medozas.de>
|
|
*
|
|
* Extracted from xt_TEE.c
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License version 2 or later, as
|
|
* published by the Free Software Foundation.
|
|
*/
|
|
#include <linux/ip.h>
|
|
#include <linux/module.h>
|
|
#include <linux/percpu.h>
|
|
#include <linux/route.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/netfilter.h>
|
|
#include <net/checksum.h>
|
|
#include <net/icmp.h>
|
|
#include <net/ip.h>
|
|
#include <net/route.h>
|
|
#include <net/netfilter/ipv4/nf_dup_ipv4.h>
|
|
#if IS_ENABLED(CONFIG_NF_CONNTRACK)
|
|
#include <net/netfilter/nf_conntrack.h>
|
|
#endif
|
|
|
|
static bool nf_dup_ipv4_route(struct net *net, struct sk_buff *skb,
|
|
const struct in_addr *gw, int oif)
|
|
{
|
|
const struct iphdr *iph = ip_hdr(skb);
|
|
struct rtable *rt;
|
|
struct flowi4 fl4;
|
|
|
|
memset(&fl4, 0, sizeof(fl4));
|
|
if (oif != -1)
|
|
fl4.flowi4_oif = oif;
|
|
|
|
fl4.daddr = gw->s_addr;
|
|
fl4.flowi4_tos = RT_TOS(iph->tos);
|
|
fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
|
|
fl4.flowi4_flags = FLOWI_FLAG_KNOWN_NH;
|
|
rt = ip_route_output_key(net, &fl4);
|
|
if (IS_ERR(rt))
|
|
return false;
|
|
|
|
skb_dst_drop(skb);
|
|
skb_dst_set(skb, &rt->dst);
|
|
skb->dev = rt->dst.dev;
|
|
skb->protocol = htons(ETH_P_IP);
|
|
|
|
return true;
|
|
}
|
|
|
|
void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum,
|
|
const struct in_addr *gw, int oif)
|
|
{
|
|
struct iphdr *iph;
|
|
|
|
if (this_cpu_read(nf_skb_duplicated))
|
|
return;
|
|
/*
|
|
* Copy the skb, and route the copy. Will later return %XT_CONTINUE for
|
|
* the original skb, which should continue on its way as if nothing has
|
|
* happened. The copy should be independently delivered to the gateway.
|
|
*/
|
|
skb = pskb_copy(skb, GFP_ATOMIC);
|
|
if (skb == NULL)
|
|
return;
|
|
|
|
#if IS_ENABLED(CONFIG_NF_CONNTRACK)
|
|
/* Avoid counting cloned packets towards the original connection. */
|
|
nf_reset(skb);
|
|
nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
|
|
#endif
|
|
/*
|
|
* If we are in PREROUTING/INPUT, decrease the TTL to mitigate potential
|
|
* loops between two hosts.
|
|
*
|
|
* Set %IP_DF so that the original source is notified of a potentially
|
|
* decreased MTU on the clone route. IPv6 does this too.
|
|
*
|
|
* IP header checksum will be recalculated at ip_local_out.
|
|
*/
|
|
iph = ip_hdr(skb);
|
|
iph->frag_off |= htons(IP_DF);
|
|
if (hooknum == NF_INET_PRE_ROUTING ||
|
|
hooknum == NF_INET_LOCAL_IN)
|
|
--iph->ttl;
|
|
|
|
if (nf_dup_ipv4_route(net, skb, gw, oif)) {
|
|
__this_cpu_write(nf_skb_duplicated, true);
|
|
ip_local_out(net, skb->sk, skb);
|
|
__this_cpu_write(nf_skb_duplicated, false);
|
|
} else {
|
|
kfree_skb(skb);
|
|
}
|
|
}
|
|
EXPORT_SYMBOL_GPL(nf_dup_ipv4);
|
|
|
|
MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>");
|
|
MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
|
|
MODULE_DESCRIPTION("nf_dup_ipv4: Duplicate IPv4 packet");
|
|
MODULE_LICENSE("GPL");
|