* [PATCH v2 1/3] netfilter: af_info: add network namespace parameter to route hook
@ 2011-03-24 20:29 Florian Westphal
2011-03-24 20:29 ` [PATCH v2 2/3] netfilter: af_info: add 'strict' parameter to limit lookup to .oif Florian Westphal
` (2 more replies)
0 siblings, 3 replies; 9+ messages in thread
From: Florian Westphal @ 2011-03-24 20:29 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
This is required to eventually replace the rt6_lookup call in xt_addrtype.c
with nf_afinfo->route().
Signed-off-by: Florian Westphal <fw@strlen.de>
---
rebased on top of nf-2.6.git.
include/linux/netfilter.h | 3 ++-
net/ipv4/netfilter.c | 5 +++--
net/ipv6/netfilter.c | 5 +++--
net/netfilter/nf_conntrack_h323_main.c | 8 ++++----
net/netfilter/xt_TCPMSS.c | 2 +-
5 files changed, 13 insertions(+), 10 deletions(-)
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index eeec00a..20ed452 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -270,7 +270,8 @@ struct nf_afinfo {
unsigned int dataoff,
unsigned int len,
u_int8_t protocol);
- int (*route)(struct dst_entry **dst, struct flowi *fl);
+ int (*route)(struct net *net, struct dst_entry **dst,
+ struct flowi *fl);
void (*saveroute)(const struct sk_buff *skb,
struct nf_queue_entry *entry);
int (*reroute)(struct sk_buff *skb,
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index f3c0b54..f1035f0 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -221,9 +221,10 @@ static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
return csum;
}
-static int nf_ip_route(struct dst_entry **dst, struct flowi *fl)
+static int nf_ip_route(struct net *net, struct dst_entry **dst,
+ struct flowi *fl)
{
- struct rtable *rt = ip_route_output_key(&init_net, &fl->u.ip4);
+ struct rtable *rt = ip_route_output_key(net, &fl->u.ip4);
if (IS_ERR(rt))
return PTR_ERR(rt);
*dst = &rt->dst;
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 39aaca2..e008b9b 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -90,9 +90,10 @@ static int nf_ip6_reroute(struct sk_buff *skb,
return 0;
}
-static int nf_ip6_route(struct dst_entry **dst, struct flowi *fl)
+static int nf_ip6_route(struct net *net, struct dst_entry **dst,
+ struct flowi *fl)
{
- *dst = ip6_route_output(&init_net, NULL, &fl->u.ip6);
+ *dst = ip6_route_output(net, NULL, &fl->u.ip6);
return (*dst)->error;
}
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 533a183..39a4538 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -731,9 +731,9 @@ static int callforward_do_filter(const union nf_inet_addr *src,
memset(&fl2, 0, sizeof(fl2));
fl2.daddr = dst->ip;
- if (!afinfo->route((struct dst_entry **)&rt1,
+ if (!afinfo->route(&init_net, (struct dst_entry **)&rt1,
flowi4_to_flowi(&fl1))) {
- if (!afinfo->route((struct dst_entry **)&rt2,
+ if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
flowi4_to_flowi(&fl2))) {
if (rt1->rt_gateway == rt2->rt_gateway &&
rt1->dst.dev == rt2->dst.dev)
@@ -755,9 +755,9 @@ static int callforward_do_filter(const union nf_inet_addr *src,
memset(&fl2, 0, sizeof(fl2));
ipv6_addr_copy(&fl2.daddr, &dst->in6);
- if (!afinfo->route((struct dst_entry **)&rt1,
+ if (!afinfo->route(&init_net, (struct dst_entry **)&rt1,
flowi6_to_flowi(&fl1))) {
- if (!afinfo->route((struct dst_entry **)&rt2,
+ if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
flowi6_to_flowi(&fl2))) {
if (!memcmp(&rt1->rt6i_gateway, &rt2->rt6i_gateway,
sizeof(rt1->rt6i_gateway)) &&
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 6e6b46c..8690125 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -166,7 +166,7 @@ static u_int32_t tcpmss_reverse_mtu(const struct sk_buff *skb,
rcu_read_lock();
ai = nf_get_afinfo(family);
if (ai != NULL)
- ai->route((struct dst_entry **)&rt, &fl);
+ ai->route(&init_net, (struct dst_entry **)&rt, &fl);
rcu_read_unlock();
if (rt != NULL) {
--
1.7.3.4
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH v2 2/3] netfilter: af_info: add 'strict' parameter to limit lookup to .oif
2011-03-24 20:29 [PATCH v2 1/3] netfilter: af_info: add network namespace parameter to route hook Florian Westphal
@ 2011-03-24 20:29 ` Florian Westphal
2011-03-24 23:15 ` David Miller
2011-03-24 20:29 ` [PATCH v2 3/3] netfilter: xt_addrtype: replace rt6_lookup with nf_afinfo->route Florian Westphal
2011-03-24 23:15 ` [PATCH v2 1/3] netfilter: af_info: add network namespace parameter to route hook David Miller
2 siblings, 1 reply; 9+ messages in thread
From: Florian Westphal @ 2011-03-24 20:29 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
ipv6 fib lookup can set RT6_LOOKUP_F_IFACE flag to restrict search
to an interface, but this flag cannot be set via struct flowi.
Also, it cannot be set via ip6_route_output: this function uses the
passed sock struct to determine if this flag is required
(by testing for nonzero sk_bound_dev_if).
Work around this by passing in an artificial struct sk in case
'strict' argument is true.
This is required to replace the rt6_lookup call in xt_addrtype.c with
nf_afinfo->route().
Signed-off-by: Florian Westphal <fw@strlen.de>
---
rebased on top of nf-2.6.git.
include/linux/netfilter.h | 2 +-
net/ipv4/netfilter.c | 2 +-
net/ipv6/netfilter.c | 12 ++++++++++--
net/netfilter/nf_conntrack_h323_main.c | 8 ++++----
net/netfilter/xt_TCPMSS.c | 2 +-
5 files changed, 17 insertions(+), 9 deletions(-)
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 20ed452..7fa95df 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -271,7 +271,7 @@ struct nf_afinfo {
unsigned int len,
u_int8_t protocol);
int (*route)(struct net *net, struct dst_entry **dst,
- struct flowi *fl);
+ struct flowi *fl, bool strict);
void (*saveroute)(const struct sk_buff *skb,
struct nf_queue_entry *entry);
int (*reroute)(struct sk_buff *skb,
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index f1035f0..4614bab 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -222,7 +222,7 @@ static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
}
static int nf_ip_route(struct net *net, struct dst_entry **dst,
- struct flowi *fl)
+ struct flowi *fl, bool strict __always_unused)
{
struct rtable *rt = ip_route_output_key(net, &fl->u.ip4);
if (IS_ERR(rt))
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index e008b9b..28bc1f6 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -91,9 +91,17 @@ static int nf_ip6_reroute(struct sk_buff *skb,
}
static int nf_ip6_route(struct net *net, struct dst_entry **dst,
- struct flowi *fl)
+ struct flowi *fl, bool strict)
{
- *dst = ip6_route_output(net, NULL, &fl->u.ip6);
+ static const struct ipv6_pinfo fake_pinfo;
+ static const struct inet_sock fake_sk = {
+ /* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */
+ .sk.sk_bound_dev_if = 1,
+ .pinet6 = (struct ipv6_pinfo *) &fake_pinfo,
+ };
+ const void *sk = strict ? &fake_sk : NULL;
+
+ *dst = ip6_route_output(net, sk, &fl->u.ip6);
return (*dst)->error;
}
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 39a4538..18b2ce5 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -732,9 +732,9 @@ static int callforward_do_filter(const union nf_inet_addr *src,
memset(&fl2, 0, sizeof(fl2));
fl2.daddr = dst->ip;
if (!afinfo->route(&init_net, (struct dst_entry **)&rt1,
- flowi4_to_flowi(&fl1))) {
+ flowi4_to_flowi(&fl1), false)) {
if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
- flowi4_to_flowi(&fl2))) {
+ flowi4_to_flowi(&fl2), false)) {
if (rt1->rt_gateway == rt2->rt_gateway &&
rt1->dst.dev == rt2->dst.dev)
ret = 1;
@@ -756,9 +756,9 @@ static int callforward_do_filter(const union nf_inet_addr *src,
memset(&fl2, 0, sizeof(fl2));
ipv6_addr_copy(&fl2.daddr, &dst->in6);
if (!afinfo->route(&init_net, (struct dst_entry **)&rt1,
- flowi6_to_flowi(&fl1))) {
+ flowi6_to_flowi(&fl1), false)) {
if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
- flowi6_to_flowi(&fl2))) {
+ flowi6_to_flowi(&fl2), false)) {
if (!memcmp(&rt1->rt6i_gateway, &rt2->rt6i_gateway,
sizeof(rt1->rt6i_gateway)) &&
rt1->dst.dev == rt2->dst.dev)
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 8690125..9e63b43 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -166,7 +166,7 @@ static u_int32_t tcpmss_reverse_mtu(const struct sk_buff *skb,
rcu_read_lock();
ai = nf_get_afinfo(family);
if (ai != NULL)
- ai->route(&init_net, (struct dst_entry **)&rt, &fl);
+ ai->route(&init_net, (struct dst_entry **)&rt, &fl, false);
rcu_read_unlock();
if (rt != NULL) {
--
1.7.3.4
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH v2 3/3] netfilter: xt_addrtype: replace rt6_lookup with nf_afinfo->route
2011-03-24 20:29 [PATCH v2 1/3] netfilter: af_info: add network namespace parameter to route hook Florian Westphal
2011-03-24 20:29 ` [PATCH v2 2/3] netfilter: af_info: add 'strict' parameter to limit lookup to .oif Florian Westphal
@ 2011-03-24 20:29 ` Florian Westphal
2011-03-24 23:15 ` David Miller
2011-03-24 23:15 ` [PATCH v2 1/3] netfilter: af_info: add network namespace parameter to route hook David Miller
2 siblings, 1 reply; 9+ messages in thread
From: Florian Westphal @ 2011-03-24 20:29 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
This avoids pulling in the ipv6 module when using (ipv4-only) iptables -m addrtype.
Signed-off-by: Florian Westphal <fw@strlen.de>
---
rebased on top of nf-2.6.git.
Tested briefly with:
[0:0] -A INPUT -m addrtype --src-type LOCAL
[16:1552] -A INPUT -m addrtype --dst-type LOCAL
[10:928] -A INPUT -m addrtype --dst-type LOCAL --limit-iface-in
net/netfilter/Kconfig | 1 -
net/netfilter/xt_addrtype.c | 42 ++++++++++++++++++++++++++++--------------
2 files changed, 28 insertions(+), 15 deletions(-)
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index c3f988a..32bff6d 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -652,7 +652,6 @@ comment "Xtables matches"
config NETFILTER_XT_MATCH_ADDRTYPE
tristate '"addrtype" address type match support'
depends on NETFILTER_ADVANCED
- depends on (IPV6 || IPV6=n)
---help---
This option allows you to match what routing thinks of an address,
eg. UNICAST, LOCAL, BROADCAST, ...
diff --git a/net/netfilter/xt_addrtype.c b/net/netfilter/xt_addrtype.c
index 2220b85..b77d383 100644
--- a/net/netfilter/xt_addrtype.c
+++ b/net/netfilter/xt_addrtype.c
@@ -32,11 +32,32 @@ MODULE_ALIAS("ipt_addrtype");
MODULE_ALIAS("ip6t_addrtype");
#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
-static u32 xt_addrtype_rt6_to_type(const struct rt6_info *rt)
+static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,
+ const struct in6_addr *addr)
{
+ const struct nf_afinfo *afinfo;
+ struct flowi6 flow;
+ struct rt6_info *rt;
u32 ret;
+ int route_err;
- if (!rt)
+ memset(&flow, 0, sizeof(flow));
+ ipv6_addr_copy(&flow.daddr, addr);
+ if (dev)
+ flow.flowi6_oif = dev->ifindex;
+
+ rcu_read_lock();
+
+ afinfo = nf_get_afinfo(NFPROTO_IPV6);
+ if (afinfo != NULL)
+ route_err = afinfo->route(net, (struct dst_entry **)&rt,
+ flowi6_to_flowi(&flow), !!dev);
+ else
+ route_err = 1;
+
+ rcu_read_unlock();
+
+ if (route_err)
return XT_ADDRTYPE_UNREACHABLE;
if (rt->rt6i_flags & RTF_REJECT)
@@ -48,6 +69,9 @@ static u32 xt_addrtype_rt6_to_type(const struct rt6_info *rt)
ret |= XT_ADDRTYPE_LOCAL;
if (rt->rt6i_flags & RTF_ANYCAST)
ret |= XT_ADDRTYPE_ANYCAST;
+
+
+ dst_release(&rt->dst);
return ret;
}
@@ -65,18 +89,8 @@ static bool match_type6(struct net *net, const struct net_device *dev,
return false;
if ((XT_ADDRTYPE_LOCAL | XT_ADDRTYPE_ANYCAST |
- XT_ADDRTYPE_UNREACHABLE) & mask) {
- struct rt6_info *rt;
- u32 type;
- int ifindex = dev ? dev->ifindex : 0;
-
- rt = rt6_lookup(net, addr, NULL, ifindex, !!dev);
-
- type = xt_addrtype_rt6_to_type(rt);
-
- dst_release(&rt->dst);
- return !!(mask & type);
- }
+ XT_ADDRTYPE_UNREACHABLE) & mask)
+ return !!(mask & match_lookup_rt6(net, dev, addr));
return true;
}
--
1.7.3.4
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/3] netfilter: af_info: add network namespace parameter to route hook
2011-03-24 20:29 [PATCH v2 1/3] netfilter: af_info: add network namespace parameter to route hook Florian Westphal
2011-03-24 20:29 ` [PATCH v2 2/3] netfilter: af_info: add 'strict' parameter to limit lookup to .oif Florian Westphal
2011-03-24 20:29 ` [PATCH v2 3/3] netfilter: xt_addrtype: replace rt6_lookup with nf_afinfo->route Florian Westphal
@ 2011-03-24 23:15 ` David Miller
2011-04-04 14:57 ` Patrick McHardy
2 siblings, 1 reply; 9+ messages in thread
From: David Miller @ 2011-03-24 23:15 UTC (permalink / raw)
To: fw; +Cc: netfilter-devel
From: Florian Westphal <fw@strlen.de>
Date: Thu, 24 Mar 2011 21:29:55 +0100
> This is required to eventually replace the rt6_lookup call in xt_addrtype.c
> with nf_afinfo->route().
>
> Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: David S. Miller <davem@davemloft.net>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 2/3] netfilter: af_info: add 'strict' parameter to limit lookup to .oif
2011-03-24 20:29 ` [PATCH v2 2/3] netfilter: af_info: add 'strict' parameter to limit lookup to .oif Florian Westphal
@ 2011-03-24 23:15 ` David Miller
2011-04-04 15:01 ` Patrick McHardy
0 siblings, 1 reply; 9+ messages in thread
From: David Miller @ 2011-03-24 23:15 UTC (permalink / raw)
To: fw; +Cc: netfilter-devel
From: Florian Westphal <fw@strlen.de>
Date: Thu, 24 Mar 2011 21:29:56 +0100
> ipv6 fib lookup can set RT6_LOOKUP_F_IFACE flag to restrict search
> to an interface, but this flag cannot be set via struct flowi.
>
> Also, it cannot be set via ip6_route_output: this function uses the
> passed sock struct to determine if this flag is required
> (by testing for nonzero sk_bound_dev_if).
>
> Work around this by passing in an artificial struct sk in case
> 'strict' argument is true.
>
> This is required to replace the rt6_lookup call in xt_addrtype.c with
> nf_afinfo->route().
>
> Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: David S. Miller <davem@davemloft.net>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 3/3] netfilter: xt_addrtype: replace rt6_lookup with nf_afinfo->route
2011-03-24 20:29 ` [PATCH v2 3/3] netfilter: xt_addrtype: replace rt6_lookup with nf_afinfo->route Florian Westphal
@ 2011-03-24 23:15 ` David Miller
2011-04-04 15:02 ` Patrick McHardy
0 siblings, 1 reply; 9+ messages in thread
From: David Miller @ 2011-03-24 23:15 UTC (permalink / raw)
To: fw; +Cc: netfilter-devel
From: Florian Westphal <fw@strlen.de>
Date: Thu, 24 Mar 2011 21:29:57 +0100
> This avoids pulling in the ipv6 module when using (ipv4-only) iptables -m addrtype.
>
> Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: David S. Miller <davem@davemloft.net>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/3] netfilter: af_info: add network namespace parameter to route hook
2011-03-24 23:15 ` [PATCH v2 1/3] netfilter: af_info: add network namespace parameter to route hook David Miller
@ 2011-04-04 14:57 ` Patrick McHardy
0 siblings, 0 replies; 9+ messages in thread
From: Patrick McHardy @ 2011-04-04 14:57 UTC (permalink / raw)
To: David Miller; +Cc: fw, netfilter-devel
On 25.03.2011 00:15, David Miller wrote:
>> > This is required to eventually replace the rt6_lookup call in xt_addrtype.c
>> > with nf_afinfo->route().
>> >
>> > Signed-off-by: Florian Westphal <fw@strlen.de>
> Acked-by: David S. Miller <davem@davemloft.net>
Applied, thanks.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 2/3] netfilter: af_info: add 'strict' parameter to limit lookup to .oif
2011-03-24 23:15 ` David Miller
@ 2011-04-04 15:01 ` Patrick McHardy
0 siblings, 0 replies; 9+ messages in thread
From: Patrick McHardy @ 2011-04-04 15:01 UTC (permalink / raw)
To: David Miller; +Cc: fw, netfilter-devel
On 25.03.2011 00:15, David Miller wrote:
>> > ipv6 fib lookup can set RT6_LOOKUP_F_IFACE flag to restrict search
>> > to an interface, but this flag cannot be set via struct flowi.
>> >
>> > Also, it cannot be set via ip6_route_output: this function uses the
>> > passed sock struct to determine if this flag is required
>> > (by testing for nonzero sk_bound_dev_if).
>> >
>> > Work around this by passing in an artificial struct sk in case
>> > 'strict' argument is true.
>> >
>> > This is required to replace the rt6_lookup call in xt_addrtype.c with
>> > nf_afinfo->route().
>> >
>> > Signed-off-by: Florian Westphal <fw@strlen.de>
> Acked-by: David S. Miller <davem@davemloft.net>
Applied, thanks.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 3/3] netfilter: xt_addrtype: replace rt6_lookup with nf_afinfo->route
2011-03-24 23:15 ` David Miller
@ 2011-04-04 15:02 ` Patrick McHardy
0 siblings, 0 replies; 9+ messages in thread
From: Patrick McHardy @ 2011-04-04 15:02 UTC (permalink / raw)
To: David Miller; +Cc: fw, netfilter-devel
On 25.03.2011 00:15, David Miller wrote:
>> > This avoids pulling in the ipv6 module when using (ipv4-only) iptables -m addrtype.
>> >
>> > Signed-off-by: Florian Westphal <fw@strlen.de>
> Acked-by: David S. Miller <davem@davemloft.net>
Also applied, thanks.
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2011-04-04 15:02 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-03-24 20:29 [PATCH v2 1/3] netfilter: af_info: add network namespace parameter to route hook Florian Westphal
2011-03-24 20:29 ` [PATCH v2 2/3] netfilter: af_info: add 'strict' parameter to limit lookup to .oif Florian Westphal
2011-03-24 23:15 ` David Miller
2011-04-04 15:01 ` Patrick McHardy
2011-03-24 20:29 ` [PATCH v2 3/3] netfilter: xt_addrtype: replace rt6_lookup with nf_afinfo->route Florian Westphal
2011-03-24 23:15 ` David Miller
2011-04-04 15:02 ` Patrick McHardy
2011-03-24 23:15 ` [PATCH v2 1/3] netfilter: af_info: add network namespace parameter to route hook David Miller
2011-04-04 14:57 ` Patrick McHardy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).