Commit d24f22f3 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

ip6_tunnel: add optional fwmark inherit 



Add IP6_TNL_F_USE_ORIG_FWMARK to ip6_tunnel, so that ip6_tnl_xmit2()
makes a route lookup taking into account skb->fwmark and doesnt cache
lookup result.

This permits more flexibility in policies and firewall setups.

To setup such a tunnel, "fwmark inherit" option should be added to "ip
-f inet6 tunnel" command.

Reported-by: default avatarAnders Franzen <Anders.Franzen@ericsson.com>
CC: Hans Schillström <hans.schillstrom@ericsson.com>
Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 46151ae8

include/linux/ip6_tunnel.h

+2 −0
Original line number Diff line number Diff line
@@ -16,6 +16,8 @@ 
#define IP6_TNL_F_MIP6_DEV 0x8

/* copy DSCP from the outer packet */

#define IP6_TNL_F_RCV_DSCP_COPY 0x10

/* copy fwmark from inner packet */

#define IP6_TNL_F_USE_ORIG_FWMARK 0x20



struct ip6_tnl_parm {

	char name[IFNAMSIZ];	/* name of tunnel device */

net/ipv6/ip6_tunnel.c

+16 −7
Original line number Diff line number Diff line
@@ -889,7 +889,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb, 
	struct net_device_stats *stats = &t->dev->stats;

	struct ipv6hdr *ipv6h = ipv6_hdr(skb);

	struct ipv6_tel_txoption opt;

	struct dst_entry *dst, *ndst = NULL;

	struct dst_entry *dst = NULL, *ndst = NULL;

	struct net_device *tdev;

	int mtu;

	unsigned int max_headroom = sizeof(struct ipv6hdr);
@@ -897,6 +897,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb, 
	int err = -1;

	int pkt_len;



	if (!fl6->flowi6_mark)

		dst = ip6_tnl_dst_check(t);

	if (!dst) {

		ndst = ip6_route_output(net, NULL, fl6);
@@ -955,8 +956,12 @@ static int ip6_tnl_xmit2(struct sk_buff *skb, 
		skb = new_skb;

	}

	skb_dst_drop(skb);

	if (fl6->flowi6_mark) {

		skb_dst_set(skb, dst);

		ndst = NULL;

	} else {

		skb_dst_set_noref(skb, dst);



	}

	skb->transport_header = skb->network_header;



	proto = fl6->flowi6_proto;
@@ -1021,9 +1026,11 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) 


	dsfield = ipv4_get_dsfield(iph);



	if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))

	if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)

		fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)

					  & IPV6_TCLASS_MASK;

	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)

		fl6.flowi6_mark = skb->mark;



	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);

	if (err != 0) {
@@ -1070,10 +1077,12 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) 
	fl6.flowi6_proto = IPPROTO_IPV6;



	dsfield = ipv6_get_dsfield(ipv6h);

	if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))

	if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)

		fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);

	if ((t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL))

	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)

		fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);

	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)

		fl6.flowi6_mark = skb->mark;



	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);

	if (err != 0) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE