Commit e45f5066 authored by Eric W. Biederman's avatar Eric W. Biederman Committed by Pablo Neira Ayuso
Browse files

ipv4: Pass struct net into ip_route_me_harder 



Don't make ip_route_me_harder guess which network namespace
it is routing in, pass the network namespace in.

Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 6a1d689d

include/linux/netfilter_ipv4.h

+1 −1
Original line number Diff line number Diff line
@@ -6,7 +6,7 @@ 


#include <uapi/linux/netfilter_ipv4.h>



int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type);

int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned addr_type);

__sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,

		       unsigned int dataoff, u_int8_t protocol);

#endif /*__LINUX_IP_NETFILTER_H*/

net/ipv4/netfilter.c

+2 −3
Original line number Diff line number Diff line
@@ -17,9 +17,8 @@ 
#include <net/netfilter/nf_queue.h>



/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */

int ip_route_me_harder(struct sk_buff *skb, unsigned int addr_type)

int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_type)

{

	struct net *net = dev_net(skb_dst(skb)->dev);

	const struct iphdr *iph = ip_hdr(skb);

	struct rtable *rt;

	struct flowi4 fl4 = {};
@@ -116,7 +115,7 @@ static int nf_ip_reroute(struct net *net, struct sk_buff *skb, 
		      skb->mark == rt_info->mark &&

		      iph->daddr == rt_info->daddr &&

		      iph->saddr == rt_info->saddr))

			return ip_route_me_harder(skb, RTN_UNSPEC);

			return ip_route_me_harder(net, skb, RTN_UNSPEC);

	}

	return 0;

}

net/ipv4/netfilter/ipt_SYNPROXY.c

+3 −1
Original line number Diff line number Diff line
@@ -45,6 +45,8 @@ synproxy_send_tcp(const struct synproxy_net *snet, 
		  struct iphdr *niph, struct tcphdr *nth,

		  unsigned int tcp_hdr_size)

{

	struct net *net = nf_ct_net(snet->tmpl);



	nth->check = ~tcp_v4_check(tcp_hdr_size, niph->saddr, niph->daddr, 0);

	nskb->ip_summed   = CHECKSUM_PARTIAL;

	nskb->csum_start  = (unsigned char *)nth - nskb->head;
@@ -52,7 +54,7 @@ synproxy_send_tcp(const struct synproxy_net *snet, 


	skb_dst_set_noref(nskb, skb_dst(skb));

	nskb->protocol = htons(ETH_P_IP);

	if (ip_route_me_harder(nskb, RTN_UNSPEC))

	if (ip_route_me_harder(net, nskb, RTN_UNSPEC))

		goto free_nskb;



	if (nfct) {

net/ipv4/netfilter/iptable_mangle.c

+1 −1
Original line number Diff line number Diff line
@@ -67,7 +67,7 @@ ipt_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state) 
		    iph->daddr != daddr ||

		    skb->mark != mark ||

		    iph->tos != tos) {

			err = ip_route_me_harder(skb, RTN_UNSPEC);

			err = ip_route_me_harder(state->net, skb, RTN_UNSPEC);

			if (err < 0)

				ret = NF_DROP_ERR(err);

		}

net/ipv4/netfilter/nf_nat_l3proto_ipv4.c

+1 −1
Original line number Diff line number Diff line
@@ -431,7 +431,7 @@ nf_nat_ipv4_local_fn(void *priv, struct sk_buff *skb, 


		if (ct->tuplehash[dir].tuple.dst.u3.ip !=

		    ct->tuplehash[!dir].tuple.src.u3.ip) {

			err = ip_route_me_harder(skb, RTN_UNSPEC);

			err = ip_route_me_harder(state->net, skb, RTN_UNSPEC);

			if (err < 0)

				ret = NF_DROP_ERR(err);

		}

CRA Git | Maintained and supported by SUSTech CRA and CCSE