Commit e7165030 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/jesse/openvswitch 



Conflicts:
	net/ipv6/exthdrs_core.c

Jesse Gross says:

====================
This series of improvements for 3.8/net-next contains four components:
 * Support for modifying IPv6 headers
 * Support for matching and setting skb->mark for better integration with
   things like iptables
 * Ability to recognize the EtherType for RARP packets
 * Two small performance enhancements

The movement of ipv6_find_hdr() into exthdrs_core.c causes two small merge
conflicts.  I left it as is but can do the merge if you want.  The conflicts
are:
 * ipv6_find_hdr() and ipv6_find_tlv() were both moved to the bottom of
   exthdrs_core.c.  Both should stay.
 * A new use of ipv6_find_hdr() was added to net/netfilter/ipvs/ip_vs_core.c
   after this patch.  The IPVS user has two instances of the old constant
   name IP6T_FH_F_FRAG which has been renamed to IP6_FH_F_FRAG.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents bb728820 92eb1d47

include/linux/netfilter_ipv6/ip6_tables.h

+0 −9
Original line number Diff line number Diff line
@@ -47,15 +47,6 @@ ip6t_ext_hdr(u8 nexthdr) 
	       (nexthdr == IPPROTO_DSTOPTS);

}



enum {

	IP6T_FH_F_FRAG	= (1 << 0),

	IP6T_FH_F_AUTH	= (1 << 1),

};



/* find specified header and get offset to it */

extern int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,

			 int target, unsigned short *fragoff, int *fragflg);



#ifdef CONFIG_COMPAT

#include <net/compat.h>

include/linux/openvswitch.h

+1 −0
Original line number Diff line number Diff line
@@ -243,6 +243,7 @@ enum ovs_key_attr { 
	OVS_KEY_ATTR_ICMPV6,    /* struct ovs_key_icmpv6 */

	OVS_KEY_ATTR_ARP,       /* struct ovs_key_arp */

	OVS_KEY_ATTR_ND,        /* struct ovs_key_nd */

	OVS_KEY_ATTR_SKB_MARK,  /* u32 skb mark */

	__OVS_KEY_ATTR_MAX

};

include/net/ipv6.h

+10 −0
Original line number Diff line number Diff line
@@ -630,6 +630,16 @@ extern int ipv6_skip_exthdr(const struct sk_buff *, int start, 


extern bool			ipv6_ext_hdr(u8 nexthdr);



enum {

	IP6_FH_F_FRAG		= (1 << 0),

	IP6_FH_F_AUTH		= (1 << 1),

	IP6_FH_F_SKIP_RH	= (1 << 2),

};



/* find specified header and get offset to it */

extern int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,

			 int target, unsigned short *fragoff, int *fragflg);



extern int ipv6_find_tlv(struct sk_buff *skb, int offset, int type);



extern struct in6_addr *fl6_update_dst(struct flowi6 *fl6,

net/ipv6/exthdrs_core.c

+124 −0
Original line number Diff line number Diff line
@@ -155,3 +155,127 @@ int ipv6_find_tlv(struct sk_buff *skb, int offset, int type) 
	return -1;

}

EXPORT_SYMBOL_GPL(ipv6_find_tlv);



/*

 * find the offset to specified header or the protocol number of last header

 * if target < 0. "last header" is transport protocol header, ESP, or

 * "No next header".

 *

 * Note that *offset is used as input/output parameter. an if it is not zero,

 * then it must be a valid offset to an inner IPv6 header. This can be used

 * to explore inner IPv6 header, eg. ICMPv6 error messages.

 *

 * If target header is found, its offset is set in *offset and return protocol

 * number. Otherwise, return -1.

 *

 * If the first fragment doesn't contain the final protocol header or

 * NEXTHDR_NONE it is considered invalid.

 *

 * Note that non-1st fragment is special case that "the protocol number

 * of last header" is "next header" field in Fragment header. In this case,

 * *offset is meaningless and fragment offset is stored in *fragoff if fragoff

 * isn't NULL.

 *

 * if flags is not NULL and it's a fragment, then the frag flag

 * IP6_FH_F_FRAG will be set. If it's an AH header, the

 * IP6_FH_F_AUTH flag is set and target < 0, then this function will

 * stop at the AH header. If IP6_FH_F_SKIP_RH flag was passed, then this

 * function will skip all those routing headers, where segements_left was 0.

 */

int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,

		  int target, unsigned short *fragoff, int *flags)

{

	unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);

	u8 nexthdr = ipv6_hdr(skb)->nexthdr;

	unsigned int len;

	bool found;



	if (fragoff)

		*fragoff = 0;



	if (*offset) {

		struct ipv6hdr _ip6, *ip6;



		ip6 = skb_header_pointer(skb, *offset, sizeof(_ip6), &_ip6);

		if (!ip6 || (ip6->version != 6)) {

			printk(KERN_ERR "IPv6 header not found\n");

			return -EBADMSG;

		}

		start = *offset + sizeof(struct ipv6hdr);

		nexthdr = ip6->nexthdr;

	}

	len = skb->len - start;



	do {

		struct ipv6_opt_hdr _hdr, *hp;

		unsigned int hdrlen;

		found = (nexthdr == target);



		if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {

			if (target < 0)

				break;

			return -ENOENT;

		}



		hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);

		if (hp == NULL)

			return -EBADMSG;



		if (nexthdr == NEXTHDR_ROUTING) {

			struct ipv6_rt_hdr _rh, *rh;



			rh = skb_header_pointer(skb, start, sizeof(_rh),

						&_rh);

			if (rh == NULL)

				return -EBADMSG;



			if (flags && (*flags & IP6_FH_F_SKIP_RH) &&

			    rh->segments_left == 0)

				found = false;

		}



		if (nexthdr == NEXTHDR_FRAGMENT) {

			unsigned short _frag_off;

			__be16 *fp;



			if (flags)	/* Indicate that this is a fragment */

				*flags |= IP6_FH_F_FRAG;

			fp = skb_header_pointer(skb,

						start+offsetof(struct frag_hdr,

							       frag_off),

						sizeof(_frag_off),

						&_frag_off);

			if (fp == NULL)

				return -EBADMSG;



			_frag_off = ntohs(*fp) & ~0x7;

			if (_frag_off) {

				if (target < 0 &&

				    ((!ipv6_ext_hdr(hp->nexthdr)) ||

				     hp->nexthdr == NEXTHDR_NONE)) {

					if (fragoff)

						*fragoff = _frag_off;

					return hp->nexthdr;

				}

				return -ENOENT;

			}

			hdrlen = 8;

		} else if (nexthdr == NEXTHDR_AUTH) {

			if (flags && (*flags & IP6_FH_F_AUTH) && (target < 0))

				break;

			hdrlen = (hp->hdrlen + 2) << 2;

		} else

			hdrlen = ipv6_optlen(hp);



		if (!found) {

			nexthdr = hp->nexthdr;

			len -= hdrlen;

			start += hdrlen;

		}

	} while (!found);



	*offset = start;

	return nexthdr;

}

EXPORT_SYMBOL(ipv6_find_hdr);

net/ipv6/netfilter/ip6_tables.c

+0 −103
Original line number Diff line number Diff line
@@ -2271,112 +2271,9 @@ static void __exit ip6_tables_fini(void) 
	unregister_pernet_subsys(&ip6_tables_net_ops);

}



/*

 * find the offset to specified header or the protocol number of last header

 * if target < 0. "last header" is transport protocol header, ESP, or

 * "No next header".

 *

 * Note that *offset is used as input/output parameter. an if it is not zero,

 * then it must be a valid offset to an inner IPv6 header. This can be used

 * to explore inner IPv6 header, eg. ICMPv6 error messages.

 *

 * If target header is found, its offset is set in *offset and return protocol

 * number. Otherwise, return -1.

 *

 * If the first fragment doesn't contain the final protocol header or

 * NEXTHDR_NONE it is considered invalid.

 *

 * Note that non-1st fragment is special case that "the protocol number

 * of last header" is "next header" field in Fragment header. In this case,

 * *offset is meaningless and fragment offset is stored in *fragoff if fragoff

 * isn't NULL.

 *

 * if flags is not NULL and it's a fragment, then the frag flag IP6T_FH_F_FRAG

 * will be set. If it's an AH header, the IP6T_FH_F_AUTH flag is set and

 * target < 0, then this function will stop at the AH header.

 */

int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,

		  int target, unsigned short *fragoff, int *flags)

{

	unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);

	u8 nexthdr = ipv6_hdr(skb)->nexthdr;

	unsigned int len;



	if (fragoff)

		*fragoff = 0;



	if (*offset) {

		struct ipv6hdr _ip6, *ip6;



		ip6 = skb_header_pointer(skb, *offset, sizeof(_ip6), &_ip6);

		if (!ip6 || (ip6->version != 6)) {

			printk(KERN_ERR "IPv6 header not found\n");

			return -EBADMSG;

		}

		start = *offset + sizeof(struct ipv6hdr);

		nexthdr = ip6->nexthdr;

	}

	len = skb->len - start;



	while (nexthdr != target) {

		struct ipv6_opt_hdr _hdr, *hp;

		unsigned int hdrlen;



		if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {

			if (target < 0)

				break;

			return -ENOENT;

		}



		hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);

		if (hp == NULL)

			return -EBADMSG;

		if (nexthdr == NEXTHDR_FRAGMENT) {

			unsigned short _frag_off;

			__be16 *fp;



			if (flags)	/* Indicate that this is a fragment */

				*flags |= IP6T_FH_F_FRAG;

			fp = skb_header_pointer(skb,

						start+offsetof(struct frag_hdr,

							       frag_off),

						sizeof(_frag_off),

						&_frag_off);

			if (fp == NULL)

				return -EBADMSG;



			_frag_off = ntohs(*fp) & ~0x7;

			if (_frag_off) {

				if (target < 0 &&

				    ((!ipv6_ext_hdr(hp->nexthdr)) ||

				     hp->nexthdr == NEXTHDR_NONE)) {

					if (fragoff)

						*fragoff = _frag_off;

					return hp->nexthdr;

				}

				return -ENOENT;

			}

			hdrlen = 8;

		} else if (nexthdr == NEXTHDR_AUTH) {

			if (flags && (*flags & IP6T_FH_F_AUTH) && (target < 0))

				break;

			hdrlen = (hp->hdrlen + 2) << 2;

		} else

			hdrlen = ipv6_optlen(hp);



		nexthdr = hp->nexthdr;

		len -= hdrlen;

		start += hdrlen;

	}



	*offset = start;

	return nexthdr;

}



EXPORT_SYMBOL(ip6t_register_table);

EXPORT_SYMBOL(ip6t_unregister_table);

EXPORT_SYMBOL(ip6t_do_table);

EXPORT_SYMBOL(ipv6_find_hdr);



module_init(ip6_tables_init);

module_exit(ip6_tables_fini);

CRA Git | Maintained and supported by SUSTech CRA and CCSE