Re: [PATCH]Re: NAT before IPsec with 2.6

[Patrick McHardy <kaber@trash.net>]

[-- Attachment #1: Type: text/plain, Size: 1246 bytes --]

Here is another patch on top of the last ones, it makes
incoming packets from transport mode SAs visible to
netfilter hooks and emulates normal behaviour. With this
patch you can share a transport-mode SA between an entire
network using MASQUERADE, but also do weird stuff like
DNAT packets coming from a transport mode SA to remote
hosts ;)

The patch is not exactly nice, but with it, everything should
be working fine except for nested tunnels. I would really
appreciate if I can get some comments for this part and the
other ones so I can prepare some final patches to discuss
with davem.

Regards
Patrick

Patrick McHardy wrote:

> There are 4 patches:
> 
> 01-nf_reset.diff
>     Move common nf_conntrack_put/nfct=NULL/nf_debug=0 code to
>     new inline function nf_reset.
> 
> 02-hooks.diff
>     Make packets to be encrypted visible on POST_ROUTING hook
>     and encrypted packets on LOCAL_OUT. Reset nfct etc. before
>     reposting the packet into the stack on reception.
> 
> 03-nat-policy-lookup.diff
>     Add policy lookups to ip_route_me_harder and change NAT to
>     reroute for any change that affects routing or policy lookups
> 
> 04-nat-policy-checks.diff
>     Make xfrm_policy_check find correct policy for NATed packets

[-- Attachment #2: 05-transport-mode-hooks.diff --]
[-- Type: text/plain, Size: 2092 bytes --]

# This is a BitKeeper generated diff -Nru style patch.
#
# ChangeSet
#   2004/02/18 15:42:49+01:00 kaber@trash.net 
#   Emulate netfilter hooks for transport mode packets
# 
# net/ipv4/xfrm4_input.c
#   2004/02/18 15:42:42+01:00 kaber@trash.net +46 -1
#   Emulate netfilter hooks for transport mode packets
# 
diff -Nru a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
--- a/net/ipv4/xfrm4_input.c	Wed Feb 18 15:45:17 2004
+++ b/net/ipv4/xfrm4_input.c	Wed Feb 18 15:45:17 2004
@@ -9,10 +9,53 @@
  * 	
  */
 
+#include <linux/config.h>
+#include <linux/skbuff.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv4.h>
 #include <net/inet_ecn.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 
+#ifdef CONFIG_NETFILTER
+static inline int emulate_nf_done(struct sk_buff *skb)
+{
+	return 0;
+}
+
+static inline int emulate_nf_hooks2(struct sk_buff *skb)
+{
+	if (inet_addr_type(skb->nh.iph->daddr) != RTN_LOCAL) {
+		if (ip_route_me_harder(&skb) == 0)
+			dst_input(skb);
+		else
+			kfree_skb(skb);
+		return -1;
+	}
+		
+	return NF_HOOK(PF_INET, NF_IP_LOCAL_IN, skb, skb->dev, NULL,
+	               emulate_nf_done);
+}
+
+static inline int emulate_nf_hooks(struct sk_buff *skb)
+{
+	int off = skb->data - skb->nh.raw;
+		
+	skb_push(skb, off);
+	skb->nh.iph->tot_len = htons(skb->len);
+	ip_send_check(skb->nh.iph);
+
+	if (NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL,
+	            emulate_nf_hooks2) != 0)
+		return -1;
+
+	skb_pull(skb, off);
+	return 0;
+}
+#else /* CONFIG_NETFILTER */
+static inline int emulate_nf_hooks(struct sk_buff *skb) {}
+#endif /* CONFIG_NETFILTER */
+
 int xfrm4_rcv(struct sk_buff *skb)
 {
 	return xfrm4_rcv_encap(skb, 0);
@@ -125,15 +168,17 @@
 	memcpy(skb->sp->x+skb->sp->len, xfrm_vec, xfrm_nr*sizeof(struct sec_decap_state));
 	skb->sp->len += xfrm_nr;
 
+	nf_reset(skb);
 	if (decaps) {
 		if (!(skb->dev->flags&IFF_LOOPBACK)) {
 			dst_release(skb->dst);
 			skb->dst = NULL;
 		}
-		nf_reset(skb);
 		netif_rx(skb);
 		return 0;
 	} else {
+		if (emulate_nf_hooks(skb) != 0)
+			return 0;
 		return -skb->nh.iph->protocol;
 	}