Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e7ac05f3 authored by Yasuyuki Kozakai's avatar Yasuyuki Kozakai Committed by David S. Miller
Browse files

[NETFILTER]: nf_conntrack: add nf_copy() to safely copy members in skb 



This unifies the codes to copy netfilter related datas. Before copying,
nf_copy() puts original members in destination skb.

Signed-off-by: default avatarYasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent edda553c

include/linux/skbuff.h

+13 −0
Original line number Diff line number Diff line
@@ -1514,9 +1514,22 @@ static inline void __nf_copy(struct sk_buff *dst, const struct sk_buff *src) 
#endif

}



static inline void nf_copy(struct sk_buff *dst, const struct sk_buff *src)

{

	nf_conntrack_put(dst->nfct);

#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)

	nf_conntrack_put_reasm(dst->nfct_reasm);

#endif

#ifdef CONFIG_BRIDGE_NETFILTER

	nf_bridge_put(dst->nf_bridge);

#endif

	__nf_copy(dst, src);

}



#else /* CONFIG_NETFILTER */

static inline void nf_reset(struct sk_buff *skb) {}

static inline void __nf_copy(struct sk_buff *dst, const struct sk_buff *src) {}

static inline void nf_copy(struct sk_buff *dst, const struct sk_buff *src) {}

#endif /* CONFIG_NETFILTER */



#ifdef CONFIG_NETWORK_SECMARK

net/ipv4/ip_output.c

+1 −12
Original line number Diff line number Diff line
@@ -384,20 +384,9 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from) 
#ifdef CONFIG_NET_SCHED

	to->tc_index = from->tc_index;

#endif

#ifdef CONFIG_NETFILTER

	/* Connection association is same as pre-frag packet */

	nf_conntrack_put(to->nfct);

	to->nfct = from->nfct;

	nf_conntrack_get(to->nfct);

	to->nfctinfo = from->nfctinfo;

	nf_copy(to, from);

#if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)

	to->ipvs_property = from->ipvs_property;

#endif

#ifdef CONFIG_BRIDGE_NETFILTER

	nf_bridge_put(to->nf_bridge);

	to->nf_bridge = from->nf_bridge;

	nf_bridge_get(to->nf_bridge);

#endif

#endif

	skb_copy_secmark(to, from);

}

net/ipv6/ip6_output.c

+1 −17
Original line number Diff line number Diff line
@@ -504,23 +504,7 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from) 
#ifdef CONFIG_NET_SCHED

	to->tc_index = from->tc_index;

#endif

#ifdef CONFIG_NETFILTER

	/* Connection association is same as pre-frag packet */

	nf_conntrack_put(to->nfct);

	to->nfct = from->nfct;

	nf_conntrack_get(to->nfct);

	to->nfctinfo = from->nfctinfo;

#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)

	nf_conntrack_put_reasm(to->nfct_reasm);

	to->nfct_reasm = from->nfct_reasm;

	nf_conntrack_get_reasm(to->nfct_reasm);

#endif

#ifdef CONFIG_BRIDGE_NETFILTER

	nf_bridge_put(to->nf_bridge);

	to->nf_bridge = from->nf_bridge;

	nf_bridge_get(to->nf_bridge);

#endif

#endif

	nf_copy(to, from);

	skb_copy_secmark(to, from);

}