Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f34aa80c authored by Jason A. Donenfeld's avatar Jason A. Donenfeld Committed by Greg Kroah-Hartman
Browse files

UPSTREAM: icmp: introduce helper for nat'd source address in network device context 



This introduces a helper function to be called only by network drivers
that wraps calls to icmp[v6]_send in a conntrack transformation, in case
NAT has been used. We don't want to pollute the non-driver path, though,
so we introduce this as a helper to be called by places that actually
make use of this, as suggested by Florian.

Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
(cherry picked from commit 0b41713b606694257b90d61ba7e2712d8457648b)
Bug: 152722841
Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic11fe236d0c404a389017a713b972954ae067439
parent beeb7745

include/linux/icmpv6.h

+10 −0
Original line number Diff line number Diff line
@@ -22,12 +22,22 @@ extern int inet6_unregister_icmp_sender(ip6_icmp_send_t *fn); 
int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type,

			       unsigned int data_len);



#if IS_ENABLED(CONFIG_NF_NAT)

void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info);

#else

#define icmpv6_ndo_send icmpv6_send

#endif



#else



static inline void icmpv6_send(struct sk_buff *skb,

			       u8 type, u8 code, __u32 info)

{

}



static inline void icmpv6_ndo_send(struct sk_buff *skb,

				   u8 type, u8 code, __u32 info)

{

}

#endif

include/net/icmp.h

+6 −0
Original line number Diff line number Diff line
@@ -47,6 +47,12 @@ static inline void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 
	__icmp_send(skb_in, type, code, info, &IPCB(skb_in)->opt);

}



#if IS_ENABLED(CONFIG_NF_NAT)

void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info);

#else

#define icmp_ndo_send icmp_send

#endif



int icmp_rcv(struct sk_buff *skb);

void icmp_err(struct sk_buff *skb, u32 info);

int icmp_init(void);

net/ipv4/icmp.c

+33 −0
Original line number Diff line number Diff line
@@ -752,6 +752,39 @@ out:; 
}

EXPORT_SYMBOL(__icmp_send);



#if IS_ENABLED(CONFIG_NF_NAT)

#include <net/netfilter/nf_conntrack.h>

void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info)

{

	struct sk_buff *cloned_skb = NULL;

	enum ip_conntrack_info ctinfo;

	struct nf_conn *ct;

	__be32 orig_ip;



	ct = nf_ct_get(skb_in, &ctinfo);

	if (!ct || !(ct->status & IPS_SRC_NAT)) {

		icmp_send(skb_in, type, code, info);

		return;

	}



	if (skb_shared(skb_in))

		skb_in = cloned_skb = skb_clone(skb_in, GFP_ATOMIC);



	if (unlikely(!skb_in || skb_network_header(skb_in) < skb_in->head ||

	    (skb_network_header(skb_in) + sizeof(struct iphdr)) >

	    skb_tail_pointer(skb_in) || skb_ensure_writable(skb_in,

	    skb_network_offset(skb_in) + sizeof(struct iphdr))))

		goto out;



	orig_ip = ip_hdr(skb_in)->saddr;

	ip_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.ip;

	icmp_send(skb_in, type, code, info);

	ip_hdr(skb_in)->saddr = orig_ip;

out:

	consume_skb(cloned_skb);

}

EXPORT_SYMBOL(icmp_ndo_send);

#endif



static void icmp_socket_deliver(struct sk_buff *skb, u32 info)

{

net/ipv6/ip6_icmp.c

+34 −0
Original line number Diff line number Diff line
@@ -45,4 +45,38 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info) 
	rcu_read_unlock();

}

EXPORT_SYMBOL(icmpv6_send);



#if IS_ENABLED(CONFIG_NF_NAT)

#include <net/netfilter/nf_conntrack.h>

void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info)

{

	struct sk_buff *cloned_skb = NULL;

	enum ip_conntrack_info ctinfo;

	struct in6_addr orig_ip;

	struct nf_conn *ct;



	ct = nf_ct_get(skb_in, &ctinfo);

	if (!ct || !(ct->status & IPS_SRC_NAT)) {

		icmpv6_send(skb_in, type, code, info);

		return;

	}



	if (skb_shared(skb_in))

		skb_in = cloned_skb = skb_clone(skb_in, GFP_ATOMIC);



	if (unlikely(!skb_in || skb_network_header(skb_in) < skb_in->head ||

	    (skb_network_header(skb_in) + sizeof(struct ipv6hdr)) >

	    skb_tail_pointer(skb_in) || skb_ensure_writable(skb_in,

	    skb_network_offset(skb_in) + sizeof(struct ipv6hdr))))

		goto out;



	orig_ip = ipv6_hdr(skb_in)->saddr;

	ipv6_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.in6;

	icmpv6_send(skb_in, type, code, info);

	ipv6_hdr(skb_in)->saddr = orig_ip;

out:

	consume_skb(cloned_skb);

}

EXPORT_SYMBOL(icmpv6_ndo_send);

#endif

#endif