Commit 74c51a14 authored by Alexey Dobriyan's avatar Alexey Dobriyan Committed by Patrick McHardy
Browse files

netfilter: netns nf_conntrack: pass netns pointer to L4 protocol's ->error hook 



Again, it's deducible from skb, but we're going to use it for
nf_conntrack_checksum and statistics, so just pass it from upper layer.

Signed-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent a702a65f

include/net/netfilter/nf_conntrack_l4proto.h

+1 −1
Original line number Diff line number Diff line
@@ -50,7 +50,7 @@ struct nf_conntrack_l4proto 
	/* Called when a conntrack entry is destroyed */

	void (*destroy)(struct nf_conn *ct);



	int (*error)(struct sk_buff *skb, unsigned int dataoff,

	int (*error)(struct net *net, struct sk_buff *skb, unsigned int dataoff,

		     enum ip_conntrack_info *ctinfo,

		     u_int8_t pf, unsigned int hooknum);

net/ipv4/netfilter/nf_conntrack_proto_icmp.c

+4 −4
Original line number Diff line number Diff line
@@ -123,7 +123,7 @@ static bool icmp_new(struct nf_conn *ct, const struct sk_buff *skb, 


/* Returns conntrack if it dealt with ICMP, and filled in skb fields */

static int

icmp_error_message(struct sk_buff *skb,

icmp_error_message(struct net *net, struct sk_buff *skb,

		 enum ip_conntrack_info *ctinfo,

		 unsigned int hooknum)

{
@@ -155,7 +155,7 @@ icmp_error_message(struct sk_buff *skb, 


	*ctinfo = IP_CT_RELATED;



	h = nf_conntrack_find_get(&init_net, &innertuple);

	h = nf_conntrack_find_get(net, &innertuple);

	if (!h) {

		pr_debug("icmp_error_message: no match\n");

		return -NF_ACCEPT;
@@ -172,7 +172,7 @@ icmp_error_message(struct sk_buff *skb, 


/* Small and modified version of icmp_rcv */

static int

icmp_error(struct sk_buff *skb, unsigned int dataoff,

icmp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,

	   enum ip_conntrack_info *ctinfo, u_int8_t pf, unsigned int hooknum)

{

	const struct icmphdr *icmph;
@@ -217,7 +217,7 @@ icmp_error(struct sk_buff *skb, unsigned int dataoff, 
	    && icmph->type != ICMP_REDIRECT)

		return NF_ACCEPT;



	return icmp_error_message(skb, ctinfo, hooknum);

	return icmp_error_message(net, skb, ctinfo, hooknum);

}



#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)

net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c

+5 −4
Original line number Diff line number Diff line
@@ -122,7 +122,8 @@ static bool icmpv6_new(struct nf_conn *ct, const struct sk_buff *skb, 
}



static int

icmpv6_error_message(struct sk_buff *skb,

icmpv6_error_message(struct net *net,

		     struct sk_buff *skb,

		     unsigned int icmp6off,

		     enum ip_conntrack_info *ctinfo,

		     unsigned int hooknum)
@@ -156,7 +157,7 @@ icmpv6_error_message(struct sk_buff *skb, 


	*ctinfo = IP_CT_RELATED;



	h = nf_conntrack_find_get(&init_net, &intuple);

	h = nf_conntrack_find_get(net, &intuple);

	if (!h) {

		pr_debug("icmpv6_error: no match\n");

		return -NF_ACCEPT;
@@ -172,7 +173,7 @@ icmpv6_error_message(struct sk_buff *skb, 
}



static int

icmpv6_error(struct sk_buff *skb, unsigned int dataoff,

icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,

	     enum ip_conntrack_info *ctinfo, u_int8_t pf, unsigned int hooknum)

{

	const struct icmp6hdr *icmp6h;
@@ -197,7 +198,7 @@ icmpv6_error(struct sk_buff *skb, unsigned int dataoff, 
	if (icmp6h->icmp6_type >= 128)

		return NF_ACCEPT;



	return icmpv6_error_message(skb, dataoff, ctinfo, hooknum);

	return icmpv6_error_message(net, skb, dataoff, ctinfo, hooknum);

}



#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)

net/netfilter/nf_conntrack_core.c

+7 −5
Original line number Diff line number Diff line
@@ -703,12 +703,14 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum, 
	/* It may be an special packet, error, unclean...

	 * inverse of the return code tells to the netfilter

	 * core what to do with the packet. */

	if (l4proto->error != NULL &&

	    (ret = l4proto->error(skb, dataoff, &ctinfo, pf, hooknum)) <= 0) {

	if (l4proto->error != NULL) {

		ret = l4proto->error(net, skb, dataoff, &ctinfo, pf, hooknum);

		if (ret <= 0) {

			NF_CT_STAT_INC_ATOMIC(error);

			NF_CT_STAT_INC_ATOMIC(invalid);

			return -ret;

		}

	}



	ct = resolve_normal_ct(net, skb, dataoff, pf, protonum,

			       l3proto, l4proto, &set_reply, &ctinfo);

net/netfilter/nf_conntrack_proto_dccp.c

+3 −3
Original line number Diff line number Diff line
@@ -545,9 +545,9 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb, 
	return NF_ACCEPT;

}



static int dccp_error(struct sk_buff *skb, unsigned int dataoff,

		      enum ip_conntrack_info *ctinfo, u_int8_t pf,

		      unsigned int hooknum)

static int dccp_error(struct net *net, struct sk_buff *skb,

		      unsigned int dataoff, enum ip_conntrack_info *ctinfo,

		      u_int8_t pf, unsigned int hooknum)

{

	struct dccp_hdr _dh, *dh;

	unsigned int dccp_len = skb->len - dataoff;

CRA Git | Maintained and supported by SUSTech CRA and CCSE