--- v2.4.14-before-nf_reroute/linux/include/net/route.h Tue Nov 13 01:30:31 2001 +++ linux/include/net/route.h Sat Nov 24 17:25:03 2001 @@ -48,6 +48,8 @@ { __u32 dst; __u32 src; + __u32 lsrc; + __u32 gw; int iif; int oif; #ifdef CONFIG_IP_ROUTE_FWMARK @@ -120,7 +122,7 @@ extern void ip_rt_advice(struct rtable **rp, int advice); extern void rt_cache_flush(int how); extern int ip_route_output_key(struct rtable **, const struct rt_key *key); -extern int ip_route_input(struct sk_buff*, u32 dst, u32 src, u8 tos, struct net_device *devin); +extern int ip_route_input(struct sk_buff*, u32 dst, u32 src, u8 tos, struct net_device *devin, u32 lsrc); extern unsigned short ip_rt_frag_needed(struct iphdr *iph, unsigned short new_mtu); extern void ip_rt_update_pmtu(struct dst_entry *dst, unsigned mtu); extern void ip_rt_send_redirect(struct sk_buff *skb); @@ -133,9 +135,10 @@ /* Deprecated: use ip_route_output_key directly */ static inline int ip_route_output(struct rtable **rp, - u32 daddr, u32 saddr, u32 tos, int oif) + u32 daddr, u32 saddr, u32 tos, int oif, u32 gw) { - struct rt_key key = { dst:daddr, src:saddr, oif:oif, tos:tos }; + struct rt_key key = { dst:daddr, src:saddr, gw:gw, + oif:oif, tos:tos }; return ip_route_output_key(rp, &key); } @@ -159,14 +162,14 @@ static inline int ip_route_connect(struct rtable **rp, u32 dst, u32 src, u32 tos, int oif) { int err; - err = ip_route_output(rp, dst, src, tos, oif); + err = ip_route_output(rp, dst, src, tos, oif, 0); if (err || (dst && src)) return err; dst = (*rp)->rt_dst; src = (*rp)->rt_src; ip_rt_put(*rp); *rp = NULL; - return ip_route_output(rp, dst, src, tos, oif); + return ip_route_output(rp, dst, src, tos, oif, 0); } extern void rt_bind_peer(struct rtable *rt, int create); --- v2.4.14-before-nf_reroute/linux/include/linux/netfilter_ipv4/ip_nat.h Tue Nov 13 01:25:22 2001 +++ linux/include/linux/netfilter_ipv4/ip_nat.h Sat Nov 24 17:25:03 2001 @@ -124,5 +124,13 @@ extern u_int16_t ip_nat_cheat_check(u_int32_t oldvalinv, u_int32_t newval, u_int16_t oldcheck); + +/* Call input routing for SNAT-ed traffic */ +extern unsigned int ip_nat_route_input(unsigned int hooknum, + struct sk_buff **pskb, + const struct net_device *in, + const struct net_device *out, + int (*okfn)(struct sk_buff *)); + #endif /*__KERNEL__*/ #endif --- v2.4.14-before-nf_reroute/linux/net/atm/clip.c Tue Nov 13 01:26:34 2001 +++ linux/net/atm/clip.c Sat Nov 24 17:25:03 2001 @@ -525,7 +525,7 @@ unlink_clip_vcc(clip_vcc); return 0; } - error = ip_route_output(&rt,ip,0,1,0); + error = ip_route_output(&rt,ip,0,1,0,0); if (error) return error; neigh = __neigh_lookup(&clip_tbl,&ip,rt->u.dst.dev,1); ip_rt_put(rt); --- v2.4.14-before-nf_reroute/linux/net/ipv4/arp.c Tue Nov 13 01:36:52 2001 +++ linux/net/ipv4/arp.c Sat Nov 24 17:25:03 2001 @@ -323,7 +323,7 @@ u32 target = *(u32*)neigh->primary_key; int probes = atomic_read(&neigh->probes); - if (ip_route_output(&rt, target, 0, 0, dev->ifindex) < 0) + if (ip_route_output(&rt, target, 0, 0, dev->ifindex, 0) < 0) return; saddr = rt->rt_src; ip_rt_put(rt); @@ -354,7 +354,7 @@ int flag = 0; /*unsigned long now; */ - if (ip_route_output(&rt, sip, tip, 0, 0) < 0) + if (ip_route_output(&rt, sip, tip, 0, 0, 0) < 0) return 1; if (rt->u.dst.dev != dev) { NET_INC_STATS_BH(ArpFilter); @@ -751,7 +751,7 @@ } if (arp->ar_op == __constant_htons(ARPOP_REQUEST) && - ip_route_input(skb, tip, sip, 0, dev) == 0) { + ip_route_input(skb, tip, sip, 0, dev, 0) == 0) { rt = (struct rtable*)skb->dst; addr_type = rt->rt_type; @@ -881,7 +881,7 @@ r->arp_flags |= ATF_COM; if (dev == NULL) { struct rtable * rt; - if ((err = ip_route_output(&rt, ip, 0, RTO_ONLINK, 0)) != 0) + if ((err = ip_route_output(&rt, ip, 0, RTO_ONLINK, 0, 0)) != 0) return err; dev = rt->u.dst.dev; ip_rt_put(rt); @@ -964,7 +964,7 @@ if (dev == NULL) { struct rtable * rt; - if ((err = ip_route_output(&rt, ip, 0, RTO_ONLINK, 0)) != 0) + if ((err = ip_route_output(&rt, ip, 0, RTO_ONLINK, 0, 0)) != 0) return err; dev = rt->u.dst.dev; ip_rt_put(rt); --- v2.4.14-before-nf_reroute/linux/net/ipv4/fib_hash.c Tue Nov 13 01:36:44 2001 +++ linux/net/ipv4/fib_hash.c Sat Nov 24 17:25:03 2001 @@ -328,6 +328,8 @@ for (nhsel = 0, nh = fi->fib_nh; nhsel < fi->fib_nhs; nh++, nhsel++) { if (key->oif && key->oif != nh->nh_oif) continue; + if (key->gw && key->gw != nh->nh_gw && nh->nh_gw) + continue; if (nh->nh_flags & RTNH_F_DEAD) continue; --- v2.4.14-before-nf_reroute/linux/net/ipv4/fib_frontend.c Tue Nov 13 01:36:44 2001 +++ linux/net/ipv4/fib_frontend.c Sat Nov 24 17:25:03 2001 @@ -222,6 +222,7 @@ key.src = dst; key.tos = tos; key.oif = 0; + key.gw = 0; key.iif = oif; key.scope = RT_SCOPE_UNIVERSE; --- v2.4.14-before-nf_reroute/linux/net/ipv4/fib_semantics.c Tue Nov 13 01:36:44 2001 +++ linux/net/ipv4/fib_semantics.c Sat Nov 24 17:25:03 2001 @@ -613,8 +613,12 @@ for_nexthops(fi) { if (nh->nh_flags&RTNH_F_DEAD) continue; - if (!key->oif || key->oif == nh->nh_oif) - break; + if (key->oif && key->oif != nh->nh_oif) + continue; + if (key->gw && key->gw != nh->nh_gw && + nh->nh_gw) + continue; + break; } #ifdef CONFIG_IP_ROUTE_MULTIPATH if (nhsel < fi->fib_nhs) { @@ -990,6 +994,9 @@ change_nexthops(fi) { if (key->oif != nh->nh_oif) continue; + if (key->gw && key->gw != nh->nh_gw && + nh->nh_gw) + continue; if (!(nh->nh_flags&RTNH_F_BADSTATE)) { if (nh->nh_power > w) { w = nh->nh_power; @@ -1052,10 +1059,13 @@ for_nexthops(fi) { if (!(nh->nh_flags&RTNH_F_DEAD)) { - if (!key->oif || key->oif == nh->nh_oif) { - res->nh_sel = nhsel; - return; - } + if (key->oif && key->oif != nh->nh_oif) + continue; + if (key->gw && key->gw != nh->nh_gw && + nh->nh_gw) + continue; + res->nh_sel = nhsel; + return; } } endfor_nexthops(fi); --- v2.4.14-before-nf_reroute/linux/net/ipv4/icmp.c Tue Nov 13 01:28:51 2001 +++ linux/net/ipv4/icmp.c Sat Nov 24 17:25:03 2001 @@ -361,7 +361,7 @@ if (ipc.opt->srr) daddr = icmp_param->replyopts.faddr; } - if (ip_route_output(&rt, daddr, rt->rt_spec_dst, RT_TOS(skb->nh.iph->tos), 0)) + if (ip_route_output(&rt, daddr, rt->rt_spec_dst, RT_TOS(skb->nh.iph->tos), 0, 0)) goto out; if (icmpv4_xrlim_allow(rt, icmp_param->data.icmph.type, icmp_param->data.icmph.code)) { @@ -478,7 +478,7 @@ ((iph->tos & IPTOS_TOS_MASK) | IPTOS_PREC_INTERNETCONTROL) : iph->tos; - if (ip_route_output(&rt, iph->saddr, saddr, RT_TOS(tos), 0)) + if (ip_route_output(&rt, iph->saddr, saddr, RT_TOS(tos), 0, 0)) goto out; if (ip_options_echo(&icmp_param.replyopts, skb_in)) @@ -502,7 +502,7 @@ ipc.opt = &icmp_param.replyopts; if (icmp_param.replyopts.srr) { ip_rt_put(rt); - if (ip_route_output(&rt, icmp_param.replyopts.faddr, saddr, RT_TOS(tos), 0)) + if (ip_route_output(&rt, icmp_param.replyopts.faddr, saddr, RT_TOS(tos), 0, 0)) goto out; } --- v2.4.14-before-nf_reroute/linux/net/ipv4/igmp.c Tue Nov 13 01:27:21 2001 +++ linux/net/ipv4/igmp.c Sat Nov 24 17:25:03 2001 @@ -207,7 +207,7 @@ if (type == IGMP_HOST_LEAVE_MESSAGE) dst = IGMP_ALL_ROUTER; - if (ip_route_output(&rt, dst, 0, 0, dev->ifindex)) + if (ip_route_output(&rt, dst, 0, 0, dev->ifindex, 0)) return -1; if (rt->rt_src == 0) { ip_rt_put(rt); @@ -622,7 +622,7 @@ __dev_put(dev); } - if (!dev && !ip_route_output(&rt, imr->imr_multiaddr.s_addr, 0, 0, 0)) { + if (!dev && !ip_route_output(&rt, imr->imr_multiaddr.s_addr, 0, 0, 0, 0)) { dev = rt->u.dst.dev; ip_rt_put(rt); } --- v2.4.14-before-nf_reroute/linux/net/ipv4/ipip.c Tue Nov 13 01:30:08 2001 +++ linux/net/ipv4/ipip.c Sat Nov 24 17:25:03 2001 @@ -417,7 +417,7 @@ skb2->nh.raw = skb2->data; /* Try to guess incoming interface */ - if (ip_route_output(&rt, eiph->saddr, 0, RT_TOS(eiph->tos), 0)) { + if (ip_route_output(&rt, eiph->saddr, 0, RT_TOS(eiph->tos), 0, 0)) { kfree_skb(skb2); return; } @@ -427,7 +427,7 @@ if (rt->rt_flags&RTCF_LOCAL) { ip_rt_put(rt); rt = NULL; - if (ip_route_output(&rt, eiph->daddr, eiph->saddr, eiph->tos, 0) || + if (ip_route_output(&rt, eiph->daddr, eiph->saddr, eiph->tos, 0, 0) || rt->u.dst.dev->type != ARPHRD_IPGRE) { ip_rt_put(rt); kfree_skb(skb2); @@ -435,7 +435,7 @@ } } else { ip_rt_put(rt); - if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos, skb2->dev) || + if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos, skb2->dev, 0) || skb2->dst->dev->type != ARPHRD_IPGRE) { kfree_skb(skb2); return; @@ -560,7 +560,7 @@ goto tx_error_icmp; } - if (ip_route_output(&rt, dst, tiph->saddr, RT_TOS(tos), tunnel->parms.link)) { + if (ip_route_output(&rt, dst, tiph->saddr, RT_TOS(tos), tunnel->parms.link, 0)) { tunnel->stat.tx_carrier_errors++; goto tx_error_icmp; } @@ -819,7 +819,7 @@ if (iph->daddr) { struct rtable *rt; - if (!ip_route_output(&rt, iph->daddr, iph->saddr, RT_TOS(iph->tos), tunnel->parms.link)) { + if (!ip_route_output(&rt, iph->daddr, iph->saddr, RT_TOS(iph->tos), tunnel->parms.link, 0)) { tdev = rt->u.dst.dev; ip_rt_put(rt); } --- v2.4.14-before-nf_reroute/linux/net/ipv4/ipmr.c Tue Nov 13 01:28:51 2001 +++ linux/net/ipv4/ipmr.c Sat Nov 24 17:25:03 2001 @@ -1145,11 +1145,11 @@ #endif if (vif->flags&VIFF_TUNNEL) { - if (ip_route_output(&rt, vif->remote, vif->local, RT_TOS(iph->tos), vif->link)) + if (ip_route_output(&rt, vif->remote, vif->local, RT_TOS(iph->tos), vif->link, 0)) return; encap = sizeof(struct iphdr); } else { - if (ip_route_output(&rt, iph->daddr, 0, RT_TOS(iph->tos), vif->link)) + if (ip_route_output(&rt, iph->daddr, 0, RT_TOS(iph->tos), vif->link, 0)) return; } --- v2.4.14-before-nf_reroute/linux/net/ipv4/ip_gre.c Tue Nov 13 01:30:32 2001 +++ linux/net/ipv4/ip_gre.c Sat Nov 24 17:25:03 2001 @@ -486,7 +486,7 @@ skb2->nh.raw = skb2->data; /* Try to guess incoming interface */ - if (ip_route_output(&rt, eiph->saddr, 0, RT_TOS(eiph->tos), 0)) { + if (ip_route_output(&rt, eiph->saddr, 0, RT_TOS(eiph->tos), 0, 0)) { kfree_skb(skb2); return; } @@ -496,7 +496,7 @@ if (rt->rt_flags&RTCF_LOCAL) { ip_rt_put(rt); rt = NULL; - if (ip_route_output(&rt, eiph->daddr, eiph->saddr, eiph->tos, 0) || + if (ip_route_output(&rt, eiph->daddr, eiph->saddr, eiph->tos, 0, 0) || rt->u.dst.dev->type != ARPHRD_IPGRE) { ip_rt_put(rt); kfree_skb(skb2); @@ -504,7 +504,7 @@ } } else { ip_rt_put(rt); - if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos, skb2->dev) || + if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos, skb2->dev, 0) || skb2->dst->dev->type != ARPHRD_IPGRE) { kfree_skb(skb2); return; @@ -747,7 +747,7 @@ tos &= ~1; } - if (ip_route_output(&rt, dst, tiph->saddr, RT_TOS(tos), tunnel->parms.link)) { + if (ip_route_output(&rt, dst, tiph->saddr, RT_TOS(tos), tunnel->parms.link, 0)) { tunnel->stat.tx_carrier_errors++; goto tx_error; } @@ -1102,7 +1102,7 @@ struct rtable *rt; if (ip_route_output(&rt, t->parms.iph.daddr, t->parms.iph.saddr, RT_TOS(t->parms.iph.tos), - t->parms.link)) { + t->parms.link, 0)) { MOD_DEC_USE_COUNT; return -EADDRNOTAVAIL; } @@ -1173,7 +1173,7 @@ if (iph->daddr) { struct rtable *rt; - if (!ip_route_output(&rt, iph->daddr, iph->saddr, RT_TOS(iph->tos), tunnel->parms.link)) { + if (!ip_route_output(&rt, iph->daddr, iph->saddr, RT_TOS(iph->tos), tunnel->parms.link, 0)) { tdev = rt->u.dst.dev; ip_rt_put(rt); } --- v2.4.14-before-nf_reroute/linux/net/ipv4/ip_input.c Tue Nov 13 01:25:26 2001 +++ linux/net/ipv4/ip_input.c Sat Nov 24 17:25:03 2001 @@ -317,7 +317,7 @@ * how the packet travels inside Linux networking. */ if (skb->dst == NULL) { - if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev)) + if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev, 0)) goto drop; } --- v2.4.14-before-nf_reroute/linux/net/ipv4/ip_nat_dumb.c Tue Nov 13 01:25:26 2001 +++ linux/net/ipv4/ip_nat_dumb.c Sat Nov 24 17:25:03 2001 @@ -124,6 +124,7 @@ key.dst = ciph->saddr; key.iif = skb->dev->ifindex; key.oif = 0; + key.gw = 0; #ifdef CONFIG_IP_ROUTE_TOS key.tos = RT_TOS(ciph->tos); #endif --- v2.4.14-before-nf_reroute/linux/net/ipv4/ip_options.c Tue Nov 13 01:28:51 2001 +++ linux/net/ipv4/ip_options.c Sat Nov 24 17:25:03 2001 @@ -597,7 +597,7 @@ rt = (struct rtable*)skb->dst; skb->dst = NULL; - err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, skb->dev); + err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, skb->dev, 0); rt2 = (struct rtable*)skb->dst; if (err || (rt2->rt_type != RTN_UNICAST && rt2->rt_type != RTN_LOCAL)) { ip_rt_put(rt2); --- v2.4.14-before-nf_reroute/linux/net/ipv4/ip_output.c Tue Nov 13 01:30:08 2001 +++ linux/net/ipv4/ip_output.c Sat Nov 24 17:25:03 2001 @@ -368,7 +368,7 @@ */ if (ip_route_output(&rt, daddr, sk->saddr, RT_CONN_FLAGS(sk), - sk->bound_dev_if)) + sk->bound_dev_if, 0)) goto no_route; __sk_dst_set(sk, &rt->u.dst); sk->route_caps = rt->u.dst.dev->features; @@ -964,7 +964,7 @@ daddr = replyopts.opt.faddr; } - if (ip_route_output(&rt, daddr, rt->rt_spec_dst, RT_TOS(skb->nh.iph->tos), 0)) + if (ip_route_output(&rt, daddr, rt->rt_spec_dst, RT_TOS(skb->nh.iph->tos), 0, 0)) return; /* And let IP do all the hard work. --- v2.4.14-before-nf_reroute/linux/net/ipv4/netfilter/ip_fw_compat.c Tue Nov 13 01:25:26 2001 +++ linux/net/ipv4/netfilter/ip_fw_compat.c Sat Nov 24 17:25:03 2001 @@ -141,7 +141,7 @@ if ((*pskb)->dst != NULL || ip_route_input(*pskb, iph->daddr, iph->saddr, iph->tos, - (struct net_device *)in) == 0) + (struct net_device *)in, 0) == 0) icmp_send(*pskb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0); return NF_DROP; --- v2.4.14-before-nf_reroute/linux/net/ipv4/netfilter/ip_fw_compat_masq.c Tue Nov 13 01:28:51 2001 +++ linux/net/ipv4/netfilter/ip_fw_compat_masq.c Sat Nov 24 17:25:03 2001 @@ -40,6 +40,10 @@ enum ip_conntrack_info ctinfo; struct ip_conntrack *ct; unsigned int ret; + struct rtable *rt, *skb_rt; + struct net_device *skb_dev; + __u32 saddr; + int new; /* Sorry, only ICMP, TCP and UDP. */ if (iph->protocol != IPPROTO_ICMP @@ -63,22 +67,28 @@ } info = &ct->nat.info; + iph = (*pskb)->nh.iph; + saddr = iph->saddr; + new = 0; WRITE_LOCK(&ip_nat_lock); /* Setup the masquerade, if not already */ if (!info->initialized) { u_int32_t newsrc; - struct rtable *rt; struct ip_nat_multi_range range; + skb_rt = (struct rtable *) (*pskb)->dst; + skb_dev = skb_rt->u.dst.dev; /* Pass 0 instead of saddr, since it's going to be changed anyway. */ - if (ip_route_output(&rt, iph->daddr, 0, 0, 0) != 0) { + if (ip_route_output(&rt, iph->daddr, 0, RT_TOS(iph->tos), + skb_dev? skb_dev->ifindex : 0, + skb_dev? skb_rt->rt_gateway : 0) != 0) { + WRITE_UNLOCK(&ip_nat_lock); DEBUGP("ipnat_rule_masquerade: Can't reroute.\n"); return NF_DROP; } - newsrc = inet_select_addr(rt->u.dst.dev, rt->rt_gateway, - RT_SCOPE_UNIVERSE); + newsrc = rt->rt_src; ip_rt_put(rt); range = ((struct ip_nat_multi_range) { 1, @@ -93,12 +103,31 @@ } place_in_hashes(ct, info); - info->initialized = 1; + new = info->initialized = 1; } else DEBUGP("Masquerading already done on this conn.\n"); WRITE_UNLOCK(&ip_nat_lock); - return do_bindings(ct, ctinfo, info, NF_IP_POST_ROUTING, pskb); + ret = do_bindings(ct, ctinfo, info, NF_IP_POST_ROUTING, pskb); + if (ret != NF_ACCEPT || saddr == (*pskb)->nh.iph->saddr || new) + return ret; + + iph = (*pskb)->nh.iph; + if (ip_route_output(&rt, iph->daddr, iph->saddr, RT_TOS(iph->tos), 0, 0) != 0) + return NF_DROP; + + skb_rt = (struct rtable *) (*pskb)->dst; + skb_dev = skb_rt->u.dst.dev; + if (skb_dev != rt->u.dst.dev || rt->rt_gateway != skb_rt->rt_gateway) { + if (skb_dev != rt->u.dst.dev) { + /* TODO: check the new mtu and reply FRAG_NEEDED */ + } + dst_release((*pskb)->dst); + (*pskb)->dst = &rt->u.dst; + } else { + ip_rt_put(rt); + } + return NF_ACCEPT; } void --- v2.4.14-before-nf_reroute/linux/net/ipv4/netfilter/ip_nat_core.c Tue Nov 13 01:25:53 2001 +++ linux/net/ipv4/netfilter/ip_nat_core.c Sat Nov 24 17:28:16 2001 @@ -206,7 +206,7 @@ struct rtable *rt; /* FIXME: IPTOS_TOS(iph->tos) --RR */ - if (ip_route_output(&rt, var_ip, 0, 0, 0) != 0) { + if (ip_route_output(&rt, var_ip, 0, 0, 0, 0) != 0) { DEBUGP("do_extra_mangle: Can't get route to %u.%u.%u.%u\n", NIPQUAD(var_ip)); return 0; @@ -852,6 +852,60 @@ hdr->checksum = 0; hdr->checksum = ip_compute_csum((unsigned char *)hdr, sizeof(*hdr) + datalen); + + return NF_ACCEPT; +} + +unsigned int +ip_nat_route_input(unsigned int hooknum, + struct sk_buff **pskb, + const struct net_device *in, + const struct net_device *out, + int (*okfn)(struct sk_buff *)) +{ + struct sk_buff *skb = *pskb; + struct iphdr *iph; + struct ip_conntrack *ct; + enum ip_conntrack_info ctinfo; + struct ip_nat_info *info; + enum ip_conntrack_dir dir; + __u32 saddr; + int i; + + if (!(ct = ip_conntrack_get(skb, &ctinfo))) + return NF_ACCEPT; + + info = &ct->nat.info; + if (!info->initialized) + return NF_ACCEPT; + + if (skb->dst) + return NF_ACCEPT; + + if (skb->len < sizeof(struct iphdr)) + return NF_ACCEPT; + + iph = skb->nh.iph; + saddr = iph->saddr; + hooknum = NF_IP_POST_ROUTING; + dir = CTINFO2DIR(ctinfo); + + READ_LOCK(&ip_nat_lock); + for (i = 0; i < info->num_manips; i++) { + if (info->manips[i].direction == dir + && info->manips[i].hooknum == hooknum + && info->manips[i].maniptype == IP_NAT_MANIP_SRC) { + saddr = info->manips[i].manip.ip; + } + } + READ_UNLOCK(&ip_nat_lock); + + if (saddr == iph->saddr) + return NF_ACCEPT; + + if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, + skb->dev, saddr)) + return NF_DROP; return NF_ACCEPT; } --- v2.4.14-before-nf_reroute/linux/net/ipv4/netfilter/ip_nat_standalone.c Tue Nov 13 01:29:33 2001 +++ linux/net/ipv4/netfilter/ip_nat_standalone.c Sat Nov 24 17:25:03 2001 @@ -225,6 +225,9 @@ /* Before packet filtering, change destination */ static struct nf_hook_ops ip_nat_in_ops = { { NULL, NULL }, ip_nat_fn, PF_INET, NF_IP_PRE_ROUTING, NF_IP_PRI_NAT_DST }; +/* Before routing, route before mangling */ +static struct nf_hook_ops ip_nat_inr_ops += { { NULL, NULL }, ip_nat_route_input, PF_INET, NF_IP_PRE_ROUTING, NF_IP_PRI_LAST-1 }; /* After packet filtering, change source */ static struct nf_hook_ops ip_nat_out_ops = { { NULL, NULL }, ip_nat_out, PF_INET, NF_IP_POST_ROUTING, NF_IP_PRI_NAT_SRC}; @@ -290,10 +293,15 @@ printk("ip_nat_init: can't register in hook.\n"); goto cleanup_nat; } + ret = nf_register_hook(&ip_nat_inr_ops); + if (ret < 0) { + printk("ip_nat_init: can't register inr hook.\n"); + goto cleanup_inops; + } ret = nf_register_hook(&ip_nat_out_ops); if (ret < 0) { printk("ip_nat_init: can't register out hook.\n"); - goto cleanup_inops; + goto cleanup_inrops; } ret = nf_register_hook(&ip_nat_local_out_ops); if (ret < 0) { @@ -310,6 +318,8 @@ nf_unregister_hook(&ip_nat_local_out_ops); cleanup_outops: nf_unregister_hook(&ip_nat_out_ops); + cleanup_inrops: + nf_unregister_hook(&ip_nat_inr_ops); cleanup_inops: nf_unregister_hook(&ip_nat_in_ops); cleanup_nat: --- v2.4.14-before-nf_reroute/linux/net/ipv4/netfilter/ipt_MASQUERADE.c Tue Nov 13 01:29:33 2001 +++ linux/net/ipv4/netfilter/ipt_MASQUERADE.c Sat Nov 24 17:25:03 2001 @@ -88,6 +88,7 @@ key.src = 0; /* Unknown: that's what we're trying to establish */ key.tos = RT_TOS((*pskb)->nh.iph->tos)|RTO_CONN; key.oif = out->ifindex; + key.gw = ((struct rtable *) (*pskb)->dst)->rt_gateway; #ifdef CONFIG_IP_ROUTE_FWMARK key.fwmark = (*pskb)->nfmark; #endif --- v2.4.14-before-nf_reroute/linux/net/ipv4/netfilter/ipt_MIRROR.c Tue Nov 13 01:29:33 2001 +++ linux/net/ipv4/netfilter/ipt_MIRROR.c Sat Nov 24 17:25:03 2001 @@ -44,7 +44,7 @@ /* Backwards */ if (ip_route_output(&rt, iph->saddr, iph->daddr, RT_TOS(iph->tos) | RTO_CONN, - 0)) { + 0, 0)) { return 0; } --- v2.4.14-before-nf_reroute/linux/net/ipv4/netfilter/ipt_REJECT.c Tue Nov 13 01:29:33 2001 +++ linux/net/ipv4/netfilter/ipt_REJECT.c Sat Nov 24 17:25:03 2001 @@ -130,7 +130,7 @@ if (ip_route_output(&rt, nskb->nh.iph->daddr, local ? nskb->nh.iph->saddr : 0, RT_TOS(nskb->nh.iph->tos) | RTO_CONN, - 0) != 0) + 0, 0) != 0) goto free_nskb; dst_release(nskb->dst); @@ -203,7 +203,7 @@ tos = (iph->tos & IPTOS_TOS_MASK) | IPTOS_PREC_INTERNETCONTROL; - if (ip_route_output(&rt, iph->saddr, saddr, RT_TOS(tos), 0)) + if (ip_route_output(&rt, iph->saddr, saddr, RT_TOS(tos), 0, 0)) return; /* RFC says return as much as we can without exceeding 576 bytes. */ --- v2.4.14-before-nf_reroute/linux/net/ipv4/raw.c Tue Nov 13 01:27:00 2001 +++ linux/net/ipv4/raw.c Sat Nov 24 17:25:03 2001 @@ -408,7 +408,7 @@ rfh.saddr = sk->protinfo.af_inet.mc_addr; } - err = ip_route_output(&rt, daddr, rfh.saddr, tos, ipc.oif); + err = ip_route_output(&rt, daddr, rfh.saddr, tos, ipc.oif, 0); if (err) goto done; --- v2.4.14-before-nf_reroute/linux/net/ipv4/route.c Tue Nov 13 01:36:44 2001 +++ linux/net/ipv4/route.c Sat Nov 24 17:25:03 2001 @@ -835,6 +835,7 @@ /* Gateway is different ... */ rt->rt_gateway = new_gw; + if (rt->key.gw) rt->key.gw = new_gw; /* Redirect received -> path was valid */ dst_confirm(&rth->u.dst); @@ -1258,6 +1259,7 @@ rth->key.fwmark = skb->nfmark; #endif rth->key.src = saddr; + rth->key.lsrc = 0; rth->rt_src = saddr; #ifdef CONFIG_IP_ROUTE_NAT rth->rt_dst_map = daddr; @@ -1271,6 +1273,7 @@ rth->u.dst.dev = &loopback_dev; dev_hold(rth->u.dst.dev); rth->key.oif = 0; + rth->key.gw = 0; rth->rt_gateway = daddr; rth->rt_spec_dst= spec_dst; rth->rt_type = RTN_MULTICAST; @@ -1310,7 +1313,7 @@ */ int ip_route_input_slow(struct sk_buff *skb, u32 daddr, u32 saddr, - u8 tos, struct net_device *dev) + u8 tos, struct net_device *dev, u32 lsrc) { struct rt_key key; struct fib_result res; @@ -1330,16 +1333,18 @@ goto out; key.dst = daddr; - key.src = saddr; + key.src = lsrc? : saddr; + key.lsrc = lsrc; key.tos = tos; #ifdef CONFIG_IP_ROUTE_FWMARK key.fwmark = skb->nfmark; #endif - key.iif = dev->ifindex; + key.iif = lsrc? loopback_dev.ifindex : dev->ifindex; key.oif = 0; + key.gw = 0; key.scope = RT_SCOPE_UNIVERSE; - hash = rt_hash_code(daddr, saddr ^ (key.iif << 5), tos); + hash = rt_hash_code(daddr, saddr ^ (dev->ifindex << 5), tos); /* Check for the most weird martians, which can be not detected by fib_lookup. @@ -1360,6 +1365,20 @@ if (BADCLASS(daddr) || ZERONET(daddr) || LOOPBACK(daddr)) goto martian_destination; + if (lsrc) { + struct net_device *dev_out; + + if (MULTICAST(lsrc) || BADCLASS(lsrc) || + ZERONET(lsrc) || LOOPBACK(lsrc)) + goto e_inval; + + /* It is equivalent to inet_addr_type(lsrc) == RTN_LOCAL */ + dev_out = ip_dev_find(lsrc); + if (dev_out == NULL) + goto e_inval; + dev_put(dev_out); + } + /* * Now we are ready to route packet. */ @@ -1369,6 +1388,10 @@ goto no_route; } free_res = 1; + if (lsrc && res.type != RTN_UNICAST) + goto e_inval; + key.iif = dev->ifindex; + key.src = saddr; rt_cache_stat[smp_processor_id()].in_slow_tot++; @@ -1440,6 +1463,7 @@ flags |= RTCF_DIRECTSRC; if (out_dev == in_dev && err && !(flags & (RTCF_NAT | RTCF_MASQ)) && + !lsrc && (IN_DEV_SHARED_MEDIA(out_dev) || inet_addr_onlink(out_dev, saddr, FIB_RES_GW(res)))) flags |= RTCF_DOREDIRECT; @@ -1466,6 +1490,7 @@ #endif rth->key.src = saddr; rth->rt_src = saddr; + rth->key.lsrc = lsrc; rth->rt_gateway = daddr; #ifdef CONFIG_IP_ROUTE_NAT rth->rt_src_map = key.src; @@ -1478,6 +1503,7 @@ rth->u.dst.dev = out_dev->dev; dev_hold(rth->u.dst.dev); rth->key.oif = 0; + rth->key.gw = 0; rth->rt_spec_dst= spec_dst; rth->u.dst.input = ip_forward; @@ -1488,7 +1514,8 @@ rth->rt_flags = flags; #ifdef CONFIG_NET_FASTROUTE - if (netdev_fastroute && !(flags&(RTCF_NAT|RTCF_MASQ|RTCF_DOREDIRECT))) { + if (netdev_fastroute && !(flags&(RTCF_NAT|RTCF_MASQ|RTCF_DOREDIRECT)) && + !lsrc) { struct net_device *odev = rth->u.dst.dev; if (odev != dev && dev->accept_fastpath && @@ -1511,6 +1538,8 @@ brd_input: if (skb->protocol != __constant_htons(ETH_P_IP)) goto e_inval; + if (lsrc) + goto e_inval; if (ZERONET(saddr)) spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK); @@ -1543,6 +1572,7 @@ #endif rth->key.src = saddr; rth->rt_src = saddr; + rth->key.lsrc = 0; #ifdef CONFIG_IP_ROUTE_NAT rth->rt_dst_map = key.dst; rth->rt_src_map = key.src; @@ -1555,6 +1585,7 @@ rth->u.dst.dev = &loopback_dev; dev_hold(rth->u.dst.dev); rth->key.oif = 0; + rth->key.gw = 0; rth->rt_gateway = daddr; rth->rt_spec_dst= spec_dst; rth->u.dst.input= ip_local_deliver; @@ -1621,7 +1652,7 @@ } int ip_route_input(struct sk_buff *skb, u32 daddr, u32 saddr, - u8 tos, struct net_device *dev) + u8 tos, struct net_device *dev, u32 lsrc) { struct rtable * rth; unsigned hash; @@ -1635,6 +1666,7 @@ if (rth->key.dst == daddr && rth->key.src == saddr && rth->key.iif == iif && + rth->key.lsrc == lsrc && rth->key.oif == 0 && #ifdef CONFIG_IP_ROUTE_FWMARK rth->key.fwmark == skb->nfmark && @@ -1681,7 +1713,7 @@ read_unlock(&inetdev_lock); return -EINVAL; } - return ip_route_input_slow(skb, daddr, saddr, tos, dev); + return ip_route_input_slow(skb, daddr, saddr, tos, dev, lsrc); } /* @@ -1706,6 +1738,7 @@ key.tos = tos & IPTOS_RT_MASK; key.iif = loopback_dev.ifindex; key.oif = oldkey->oif; + key.gw = oldkey->gw; #ifdef CONFIG_IP_ROUTE_FWMARK key.fwmark = oldkey->fwmark; #endif @@ -1795,6 +1828,7 @@ dev_out = &loopback_dev; dev_hold(dev_out); key.oif = loopback_dev.ifindex; + key.gw = 0; res.type = RTN_LOCAL; flags |= RTCF_LOCAL; goto make_route; @@ -1845,6 +1879,7 @@ dev_out = &loopback_dev; dev_hold(dev_out); key.oif = dev_out->ifindex; + key.gw = 0; if (res.fi) fib_info_put(res.fi); res.fi = NULL; @@ -1915,7 +1950,9 @@ rth->key.tos = tos; rth->key.src = oldkey->src; rth->key.iif = 0; + rth->key.lsrc = 0; rth->key.oif = oldkey->oif; + rth->key.gw = oldkey->gw; #ifdef CONFIG_IP_ROUTE_FWMARK rth->key.fwmark = oldkey->fwmark; #endif @@ -1994,6 +2031,7 @@ rth->key.src == key->src && rth->key.iif == 0 && rth->key.oif == key->oif && + rth->key.gw == key->gw && #ifdef CONFIG_IP_ROUTE_FWMARK rth->key.fwmark == key->fwmark && #endif @@ -2146,7 +2184,7 @@ skb->protocol = __constant_htons(ETH_P_IP); skb->dev = dev; local_bh_disable(); - err = ip_route_input(skb, dst, src, rtm->rtm_tos, dev); + err = ip_route_input(skb, dst, src, rtm->rtm_tos, dev, 0); local_bh_enable(); rt = (struct rtable*)skb->dst; if (!err && rt->u.dst.error) @@ -2155,7 +2193,7 @@ int oif = 0; if (rta[RTA_OIF - 1]) memcpy(&oif, RTA_DATA(rta[RTA_OIF - 1]), sizeof(int)); - err = ip_route_output(&rt, dst, src, rtm->rtm_tos, oif); + err = ip_route_output(&rt, dst, src, rtm->rtm_tos, oif, 0); } if (err) { kfree_skb(skb); --- v2.4.14-before-nf_reroute/linux/net/ipv4/syncookies.c Tue Nov 13 01:30:32 2001 +++ linux/net/ipv4/syncookies.c Sat Nov 24 17:25:03 2001 @@ -176,7 +176,7 @@ opt->srr ? opt->faddr : req->af.v4_req.rmt_addr, req->af.v4_req.loc_addr, RT_CONN_FLAGS(sk), - 0)) { + 0, 0)) { tcp_openreq_free(req); goto out; } --- v2.4.14-before-nf_reroute/linux/net/ipv4/tcp_ipv4.c Tue Nov 13 01:30:33 2001 +++ linux/net/ipv4/tcp_ipv4.c Sat Nov 24 17:25:03 2001 @@ -1154,7 +1154,7 @@ opt->faddr : req->af.v4_req.rmt_addr), req->af.v4_req.loc_addr, - RT_CONN_FLAGS(sk), sk->bound_dev_if)) { + RT_CONN_FLAGS(sk), sk->bound_dev_if, 0)) { IP_INC_STATS_BH(IpOutNoRoutes); return NULL; } @@ -1782,7 +1782,7 @@ daddr = sk->protinfo.af_inet.opt->faddr; err = ip_route_output(&rt, daddr, sk->saddr, - RT_CONN_FLAGS(sk), sk->bound_dev_if); + RT_CONN_FLAGS(sk), sk->bound_dev_if, 0); if (!err) { __sk_dst_set(sk, &rt->u.dst); sk->route_caps = rt->u.dst.dev->features; --- v2.4.14-before-nf_reroute/linux/net/ipv4/udp.c Tue Nov 13 01:30:08 2001 +++ linux/net/ipv4/udp.c Sat Nov 24 17:25:03 2001 @@ -517,7 +517,7 @@ rt = (struct rtable*)sk_dst_check(sk, 0); if (rt == NULL) { - err = ip_route_output(&rt, daddr, ufh.saddr, tos, ipc.oif); + err = ip_route_output(&rt, daddr, ufh.saddr, tos, ipc.oif, 0); if (err) goto out; --- v2.4.14-before-nf_reroute/linux/net/ipv6/sit.c Tue Nov 13 01:29:33 2001 +++ linux/net/ipv6/sit.c Sat Nov 24 17:25:03 2001 @@ -501,7 +501,7 @@ dst = addr6->s6_addr32[3]; } - if (ip_route_output(&rt, dst, tiph->saddr, RT_TOS(tos), tunnel->parms.link)) { + if (ip_route_output(&rt, dst, tiph->saddr, RT_TOS(tos), tunnel->parms.link, 0)) { tunnel->stat.tx_carrier_errors++; goto tx_error_icmp; } @@ -773,7 +773,7 @@ if (iph->daddr) { struct rtable *rt; - if (!ip_route_output(&rt, iph->daddr, iph->saddr, RT_TOS(iph->tos), tunnel->parms.link)) { + if (!ip_route_output(&rt, iph->daddr, iph->saddr, RT_TOS(iph->tos), tunnel->parms.link, 0)) { tdev = rt->u.dst.dev; ip_rt_put(rt); }