Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 206e8c00 authored by Eric W. Biederman's avatar Eric W. Biederman Committed by Pablo Neira Ayuso
Browse files

netfilter: Pass net to nf_dup_ipv4 and nf_dup_ipv6 



This allows them to stop guessing the network namespace with pick_net.

Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 88182a0e

include/net/netfilter/ipv4/nf_dup_ipv4.h

+1 −1
Original line number Diff line number Diff line 
#ifndef _NF_DUP_IPV4_H_

#define _NF_DUP_IPV4_H_



void nf_dup_ipv4(struct sk_buff *skb, unsigned int hooknum,

void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum,

		 const struct in_addr *gw, int oif);



#endif /* _NF_DUP_IPV4_H_ */

include/net/netfilter/ipv6/nf_dup_ipv6.h

+1 −1
Original line number Diff line number Diff line 
#ifndef _NF_DUP_IPV6_H_

#define _NF_DUP_IPV6_H_



void nf_dup_ipv6(struct sk_buff *skb, unsigned int hooknum,

void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum,

		 const struct in6_addr *gw, int oif);



#endif /* _NF_DUP_IPV6_H_ */

net/ipv4/netfilter/nf_dup_ipv4.c

+4 −19
Original line number Diff line number Diff line
@@ -23,25 +23,10 @@ 
#include <net/netfilter/nf_conntrack.h>

#endif



static struct net *pick_net(struct sk_buff *skb)

{

#ifdef CONFIG_NET_NS

	const struct dst_entry *dst;



	if (skb->dev != NULL)

		return dev_net(skb->dev);

	dst = skb_dst(skb);

	if (dst != NULL && dst->dev != NULL)

		return dev_net(dst->dev);

#endif

	return &init_net;

}



static bool nf_dup_ipv4_route(struct sk_buff *skb, const struct in_addr *gw,

			      int oif)

static bool nf_dup_ipv4_route(struct net *net, struct sk_buff *skb,

			      const struct in_addr *gw, int oif)

{

	const struct iphdr *iph = ip_hdr(skb);

	struct net *net = pick_net(skb);

	struct rtable *rt;

	struct flowi4 fl4;
@@ -65,7 +50,7 @@ static bool nf_dup_ipv4_route(struct sk_buff *skb, const struct in_addr *gw, 
	return true;

}



void nf_dup_ipv4(struct sk_buff *skb, unsigned int hooknum,

void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum,

		 const struct in_addr *gw, int oif)

{

	struct iphdr *iph;
@@ -105,7 +90,7 @@ void nf_dup_ipv4(struct sk_buff *skb, unsigned int hooknum, 
		--iph->ttl;

	ip_send_check(iph);



	if (nf_dup_ipv4_route(skb, gw, oif)) {

	if (nf_dup_ipv4_route(net, skb, gw, oif)) {

		__this_cpu_write(nf_skb_duplicated, true);

		ip_local_out(skb);

		__this_cpu_write(nf_skb_duplicated, false);

net/ipv4/netfilter/nft_dup_ipv4.c

+1 −1
Original line number Diff line number Diff line
@@ -30,7 +30,7 @@ static void nft_dup_ipv4_eval(const struct nft_expr *expr, 
	};

	int oif = regs->data[priv->sreg_dev];



	nf_dup_ipv4(pkt->skb, pkt->hook, &gw, oif);

	nf_dup_ipv4(pkt->net, pkt->skb, pkt->hook, &gw, oif);

}



static int nft_dup_ipv4_init(const struct nft_ctx *ctx,

net/ipv6/netfilter/nf_dup_ipv6.c

+4 −19
Original line number Diff line number Diff line
@@ -19,25 +19,10 @@ 
#include <net/netfilter/nf_conntrack.h>

#endif



static struct net *pick_net(struct sk_buff *skb)

{

#ifdef CONFIG_NET_NS

	const struct dst_entry *dst;



	if (skb->dev != NULL)

		return dev_net(skb->dev);

	dst = skb_dst(skb);

	if (dst != NULL && dst->dev != NULL)

		return dev_net(dst->dev);

#endif

	return &init_net;

}



static bool nf_dup_ipv6_route(struct sk_buff *skb, const struct in6_addr *gw,

			      int oif)

static bool nf_dup_ipv6_route(struct net *net, struct sk_buff *skb,

			      const struct in6_addr *gw, int oif)

{

	const struct ipv6hdr *iph = ipv6_hdr(skb);

	struct net *net = pick_net(skb);

	struct dst_entry *dst;

	struct flowi6 fl6;
@@ -61,7 +46,7 @@ static bool nf_dup_ipv6_route(struct sk_buff *skb, const struct in6_addr *gw, 
	return true;

}



void nf_dup_ipv6(struct sk_buff *skb, unsigned int hooknum,

void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum,

		 const struct in6_addr *gw, int oif)

{

	if (this_cpu_read(nf_skb_duplicated))
@@ -81,7 +66,7 @@ void nf_dup_ipv6(struct sk_buff *skb, unsigned int hooknum, 
		struct ipv6hdr *iph = ipv6_hdr(skb);

		--iph->hop_limit;

	}

	if (nf_dup_ipv6_route(skb, gw, oif)) {

	if (nf_dup_ipv6_route(net, skb, gw, oif)) {

		__this_cpu_write(nf_skb_duplicated, true);

		ip6_local_out(skb);

		__this_cpu_write(nf_skb_duplicated, false);