ipv6: Pass struct net into ip6_route_me_harder
Don't make ip6_route_me_harder guess which network namespace it is routing in, pass the network namespace in. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
e45f50660e
commit
5f5d74d723
|
@ -22,7 +22,7 @@ struct nf_ipv6_ops {
|
||||||
};
|
};
|
||||||
|
|
||||||
#ifdef CONFIG_NETFILTER
|
#ifdef CONFIG_NETFILTER
|
||||||
int ip6_route_me_harder(struct sk_buff *skb);
|
int ip6_route_me_harder(struct net *net, struct sk_buff *skb);
|
||||||
__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
|
__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
|
||||||
unsigned int dataoff, u_int8_t protocol);
|
unsigned int dataoff, u_int8_t protocol);
|
||||||
|
|
||||||
|
|
|
@ -18,9 +18,8 @@
|
||||||
#include <net/ip6_checksum.h>
|
#include <net/ip6_checksum.h>
|
||||||
#include <net/netfilter/nf_queue.h>
|
#include <net/netfilter/nf_queue.h>
|
||||||
|
|
||||||
int ip6_route_me_harder(struct sk_buff *skb)
|
int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
|
||||||
{
|
{
|
||||||
struct net *net = dev_net(skb_dst(skb)->dev);
|
|
||||||
const struct ipv6hdr *iph = ipv6_hdr(skb);
|
const struct ipv6hdr *iph = ipv6_hdr(skb);
|
||||||
unsigned int hh_len;
|
unsigned int hh_len;
|
||||||
struct dst_entry *dst;
|
struct dst_entry *dst;
|
||||||
|
@ -103,7 +102,7 @@ static int nf_ip6_reroute(struct net *net, struct sk_buff *skb,
|
||||||
if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
|
if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
|
||||||
!ipv6_addr_equal(&iph->saddr, &rt_info->saddr) ||
|
!ipv6_addr_equal(&iph->saddr, &rt_info->saddr) ||
|
||||||
skb->mark != rt_info->mark)
|
skb->mark != rt_info->mark)
|
||||||
return ip6_route_me_harder(skb);
|
return ip6_route_me_harder(net, skb);
|
||||||
}
|
}
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
|
@ -65,7 +65,7 @@ ip6t_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)
|
||||||
skb->mark != mark ||
|
skb->mark != mark ||
|
||||||
ipv6_hdr(skb)->hop_limit != hop_limit ||
|
ipv6_hdr(skb)->hop_limit != hop_limit ||
|
||||||
flowlabel != *((u_int32_t *)ipv6_hdr(skb)))) {
|
flowlabel != *((u_int32_t *)ipv6_hdr(skb)))) {
|
||||||
err = ip6_route_me_harder(skb);
|
err = ip6_route_me_harder(state->net, skb);
|
||||||
if (err < 0)
|
if (err < 0)
|
||||||
ret = NF_DROP_ERR(err);
|
ret = NF_DROP_ERR(err);
|
||||||
}
|
}
|
||||||
|
|
|
@ -437,7 +437,7 @@ nf_nat_ipv6_local_fn(void *priv, struct sk_buff *skb,
|
||||||
|
|
||||||
if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3,
|
if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3,
|
||||||
&ct->tuplehash[!dir].tuple.src.u3)) {
|
&ct->tuplehash[!dir].tuple.src.u3)) {
|
||||||
err = ip6_route_me_harder(skb);
|
err = ip6_route_me_harder(state->net, skb);
|
||||||
if (err < 0)
|
if (err < 0)
|
||||||
ret = NF_DROP_ERR(err);
|
ret = NF_DROP_ERR(err);
|
||||||
}
|
}
|
||||||
|
|
|
@ -52,7 +52,7 @@ static unsigned int nf_route_table_hook(void *priv,
|
||||||
skb->mark != mark ||
|
skb->mark != mark ||
|
||||||
ipv6_hdr(skb)->hop_limit != hop_limit ||
|
ipv6_hdr(skb)->hop_limit != hop_limit ||
|
||||||
flowlabel != *((u_int32_t *)ipv6_hdr(skb))))
|
flowlabel != *((u_int32_t *)ipv6_hdr(skb))))
|
||||||
return ip6_route_me_harder(skb) == 0 ? ret : NF_DROP;
|
return ip6_route_me_harder(state->net, skb) == 0 ? ret : NF_DROP;
|
||||||
|
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
|
@ -715,7 +715,7 @@ static int ip_vs_route_me_harder(struct netns_ipvs *ipvs, int af,
|
||||||
struct dst_entry *dst = skb_dst(skb);
|
struct dst_entry *dst = skb_dst(skb);
|
||||||
|
|
||||||
if (dst->dev && !(dst->dev->flags & IFF_LOOPBACK) &&
|
if (dst->dev && !(dst->dev->flags & IFF_LOOPBACK) &&
|
||||||
ip6_route_me_harder(skb) != 0)
|
ip6_route_me_harder(ipvs->net, skb) != 0)
|
||||||
return 1;
|
return 1;
|
||||||
} else
|
} else
|
||||||
#endif
|
#endif
|
||||||
|
|
Loading…
Reference in New Issue