diff -urN v2.4.20-before-nf_reroute/linux/include/linux/netfilter_ipv4/ip_nat.h linux/include/linux/netfilter_ipv4/ip_nat.h --- v2.4.20-before-nf_reroute/linux/include/linux/netfilter_ipv4/ip_nat.h Fri Nov 29 03:00:12 2002 +++ linux/include/linux/netfilter_ipv4/ip_nat.h Fri Nov 29 04:18:07 2002 @@ -129,5 +129,13 @@ extern u_int16_t ip_nat_cheat_check(u_int32_t oldvalinv, u_int32_t newval, u_int16_t oldcheck); + +/* Call input routing for SNAT-ed traffic */ +extern unsigned int ip_nat_route_input(unsigned int hooknum, + struct sk_buff **pskb, + const struct net_device *in, + const struct net_device *out, + int (*okfn)(struct sk_buff *)); + #endif /*__KERNEL__*/ #endif diff -urN v2.4.20-before-nf_reroute/linux/include/net/route.h linux/include/net/route.h --- v2.4.20-before-nf_reroute/linux/include/net/route.h Sat Aug 3 12:13:50 2002 +++ linux/include/net/route.h Fri Nov 29 04:18:07 2002 @@ -49,6 +49,8 @@ { __u32 dst; __u32 src; + __u32 lsrc; + __u32 gw; int iif; int oif; #ifdef CONFIG_IP_ROUTE_FWMARK @@ -126,6 +128,7 @@ extern void rt_cache_flush(int how); extern int ip_route_output_key(struct rtable **, const struct rt_key *key); extern int ip_route_input(struct sk_buff*, u32 dst, u32 src, u8 tos, struct net_device *devin); +extern int ip_route_input_lookup(struct sk_buff*, u32 dst, u32 src, u8 tos, struct net_device *devin, u32 lsrc); extern unsigned short ip_rt_frag_needed(struct iphdr *iph, unsigned short new_mtu); extern void ip_rt_update_pmtu(struct dst_entry *dst, unsigned mtu); extern void ip_rt_send_redirect(struct sk_buff *skb); @@ -145,6 +148,15 @@ return ip_route_output_key(rp, &key); } + +static inline int +ip_route_output_lookup(struct rtable **rp, + u32 daddr, u32 saddr, u32 tos, int oif, u32 gw) +{ + struct rt_key key = { dst:daddr, src:saddr, gw:gw, oif:oif, tos:tos }; + + return ip_route_output_key(rp, &key); +} static inline void ip_rt_put(struct rtable * rt) { diff -urN v2.4.20-before-nf_reroute/linux/net/ipv4/fib_frontend.c linux/net/ipv4/fib_frontend.c --- v2.4.20-before-nf_reroute/linux/net/ipv4/fib_frontend.c Fri Nov 29 04:16:11 2002 +++ linux/net/ipv4/fib_frontend.c Fri Nov 29 04:18:07 2002 @@ -222,6 +222,7 @@ key.src = dst; key.tos = tos; key.oif = 0; + key.gw = 0; key.iif = oif; key.scope = RT_SCOPE_UNIVERSE; diff -urN v2.4.20-before-nf_reroute/linux/net/ipv4/fib_hash.c linux/net/ipv4/fib_hash.c --- v2.4.20-before-nf_reroute/linux/net/ipv4/fib_hash.c Fri Nov 29 04:16:11 2002 +++ linux/net/ipv4/fib_hash.c Fri Nov 29 04:18:07 2002 @@ -328,6 +328,9 @@ for (nhsel = 0, nh = fi->fib_nh; nhsel < fi->fib_nhs; nh++, nhsel++) { if (key->oif && key->oif != nh->nh_oif) continue; + if (key->gw && key->gw != nh->nh_gw && nh->nh_gw && + nh->nh_scope == RT_SCOPE_LINK) + continue; if (nh->nh_flags & RTNH_F_DEAD) continue; diff -urN v2.4.20-before-nf_reroute/linux/net/ipv4/fib_semantics.c linux/net/ipv4/fib_semantics.c --- v2.4.20-before-nf_reroute/linux/net/ipv4/fib_semantics.c Fri Nov 29 04:16:11 2002 +++ linux/net/ipv4/fib_semantics.c Fri Nov 29 04:18:07 2002 @@ -635,8 +635,12 @@ for_nexthops(fi) { if (nh->nh_flags&RTNH_F_DEAD) continue; - if (!key->oif || key->oif == nh->nh_oif) - break; + if (key->oif && key->oif != nh->nh_oif) + continue; + if (key->gw && key->gw != nh->nh_gw && + nh->nh_gw && nh->nh_scope == RT_SCOPE_LINK) + continue; + break; } #ifdef CONFIG_IP_ROUTE_MULTIPATH if (nhsel < fi->fib_nhs) { @@ -1028,6 +1032,9 @@ change_nexthops(fi) { if (key->oif != nh->nh_oif) continue; + if (key->gw && key->gw != nh->nh_gw && + nh->nh_gw && nh->nh_scope == RT_SCOPE_LINK) + continue; if (!(nh->nh_flags&RTNH_F_BADSTATE)) { if (nh->nh_power > w) { w = nh->nh_power; @@ -1086,11 +1093,14 @@ for_nexthops(fi) { if (!(nh->nh_flags&RTNH_F_DEAD)) { - if (!key->oif || key->oif == nh->nh_oif) { - spin_unlock_bh(&fib_multipath_lock); - res->nh_sel = nhsel; - return; - } + if (key->oif && key->oif != nh->nh_oif) + continue; + if (key->gw && key->gw != nh->nh_gw && + nh->nh_gw && nh->nh_scope == RT_SCOPE_LINK) + continue; + spin_unlock_bh(&fib_multipath_lock); + res->nh_sel = nhsel; + return; } } endfor_nexthops(fi); diff -urN v2.4.20-before-nf_reroute/linux/net/ipv4/ip_nat_dumb.c linux/net/ipv4/ip_nat_dumb.c --- v2.4.20-before-nf_reroute/linux/net/ipv4/ip_nat_dumb.c Tue Nov 13 03:25:26 2001 +++ linux/net/ipv4/ip_nat_dumb.c Fri Nov 29 04:18:07 2002 @@ -124,6 +124,7 @@ key.dst = ciph->saddr; key.iif = skb->dev->ifindex; key.oif = 0; + key.gw = 0; #ifdef CONFIG_IP_ROUTE_TOS key.tos = RT_TOS(ciph->tos); #endif diff -urN v2.4.20-before-nf_reroute/linux/net/ipv4/netfilter/ip_fw_compat_masq.c linux/net/ipv4/netfilter/ip_fw_compat_masq.c --- v2.4.20-before-nf_reroute/linux/net/ipv4/netfilter/ip_fw_compat_masq.c Fri Nov 29 03:00:19 2002 +++ linux/net/ipv4/netfilter/ip_fw_compat_masq.c Fri Nov 29 04:18:07 2002 @@ -40,6 +40,10 @@ enum ip_conntrack_info ctinfo; struct ip_conntrack *ct; unsigned int ret; + struct rtable *rt, *skb_rt; + struct net_device *skb_dev; + __u32 saddr; + int new; /* Sorry, only ICMP, TCP and UDP. */ if (iph->protocol != IPPROTO_ICMP @@ -63,22 +67,28 @@ } info = &ct->nat.info; + iph = (*pskb)->nh.iph; + saddr = iph->saddr; + new = 0; WRITE_LOCK(&ip_nat_lock); /* Setup the masquerade, if not already */ if (!info->initialized) { u_int32_t newsrc; - struct rtable *rt; struct ip_nat_multi_range range; + skb_rt = (struct rtable *) (*pskb)->dst; + skb_dev = skb_rt->u.dst.dev; /* Pass 0 instead of saddr, since it's going to be changed anyway. */ - if (ip_route_output(&rt, iph->daddr, 0, 0, 0) != 0) { + if (ip_route_output_lookup(&rt, iph->daddr, 0, RT_TOS(iph->tos), + skb_dev? skb_dev->ifindex : 0, + skb_dev? skb_rt->rt_gateway : 0) != 0) { + WRITE_UNLOCK(&ip_nat_lock); DEBUGP("ipnat_rule_masquerade: Can't reroute.\n"); return NF_DROP; } - newsrc = inet_select_addr(rt->u.dst.dev, rt->rt_gateway, - RT_SCOPE_UNIVERSE); + newsrc = rt->rt_src; ip_rt_put(rt); range = ((struct ip_nat_multi_range) { 1, @@ -93,12 +103,31 @@ } place_in_hashes(ct, info); - info->initialized = 1; + new = info->initialized = 1; } else DEBUGP("Masquerading already done on this conn.\n"); WRITE_UNLOCK(&ip_nat_lock); - return do_bindings(ct, ctinfo, info, NF_IP_POST_ROUTING, pskb); + ret = do_bindings(ct, ctinfo, info, NF_IP_POST_ROUTING, pskb); + if (ret != NF_ACCEPT || saddr == (*pskb)->nh.iph->saddr || new) + return ret; + + iph = (*pskb)->nh.iph; + if (ip_route_output(&rt, iph->daddr, iph->saddr, RT_TOS(iph->tos), 0) != 0) + return NF_DROP; + + skb_rt = (struct rtable *) (*pskb)->dst; + skb_dev = skb_rt->u.dst.dev; + if (skb_dev != rt->u.dst.dev || rt->rt_gateway != skb_rt->rt_gateway) { + if (skb_dev != rt->u.dst.dev) { + /* TODO: check the new mtu and reply FRAG_NEEDED */ + } + dst_release((*pskb)->dst); + (*pskb)->dst = &rt->u.dst; + } else { + ip_rt_put(rt); + } + return NF_ACCEPT; } void diff -urN v2.4.20-before-nf_reroute/linux/net/ipv4/netfilter/ip_nat_core.c linux/net/ipv4/netfilter/ip_nat_core.c --- v2.4.20-before-nf_reroute/linux/net/ipv4/netfilter/ip_nat_core.c Fri Nov 29 03:00:19 2002 +++ linux/net/ipv4/netfilter/ip_nat_core.c Fri Nov 29 04:18:07 2002 @@ -953,6 +953,60 @@ return NF_ACCEPT; } +unsigned int +ip_nat_route_input(unsigned int hooknum, + struct sk_buff **pskb, + const struct net_device *in, + const struct net_device *out, + int (*okfn)(struct sk_buff *)) +{ + struct sk_buff *skb = *pskb; + struct iphdr *iph; + struct ip_conntrack *ct; + enum ip_conntrack_info ctinfo; + struct ip_nat_info *info; + enum ip_conntrack_dir dir; + __u32 saddr; + int i; + + if (!(ct = ip_conntrack_get(skb, &ctinfo))) + return NF_ACCEPT; + + info = &ct->nat.info; + if (!info->initialized) + return NF_ACCEPT; + + if (skb->dst) + return NF_ACCEPT; + + if (skb->len < sizeof(struct iphdr)) + return NF_ACCEPT; + + iph = skb->nh.iph; + saddr = iph->saddr; + hooknum = NF_IP_POST_ROUTING; + dir = CTINFO2DIR(ctinfo); + + READ_LOCK(&ip_nat_lock); + for (i = 0; i < info->num_manips; i++) { + if (info->manips[i].direction == dir + && info->manips[i].hooknum == hooknum + && info->manips[i].maniptype == IP_NAT_MANIP_SRC) { + saddr = info->manips[i].manip.ip; + } + } + READ_UNLOCK(&ip_nat_lock); + + if (saddr == iph->saddr) + return NF_ACCEPT; + + if (ip_route_input_lookup(skb, iph->daddr, iph->saddr, iph->tos, + skb->dev, saddr)) + return NF_DROP; + + return NF_ACCEPT; +} + int __init ip_nat_init(void) { size_t i; diff -urN v2.4.20-before-nf_reroute/linux/net/ipv4/netfilter/ip_nat_standalone.c linux/net/ipv4/netfilter/ip_nat_standalone.c --- v2.4.20-before-nf_reroute/linux/net/ipv4/netfilter/ip_nat_standalone.c Fri Nov 29 03:00:19 2002 +++ linux/net/ipv4/netfilter/ip_nat_standalone.c Fri Nov 29 04:18:07 2002 @@ -226,6 +226,9 @@ /* Before packet filtering, change destination */ static struct nf_hook_ops ip_nat_in_ops = { { NULL, NULL }, ip_nat_fn, PF_INET, NF_IP_PRE_ROUTING, NF_IP_PRI_NAT_DST }; +/* Before routing, route before mangling */ +static struct nf_hook_ops ip_nat_inr_ops += { { NULL, NULL }, ip_nat_route_input, PF_INET, NF_IP_PRE_ROUTING, NF_IP_PRI_LAST-1 }; /* After packet filtering, change source */ static struct nf_hook_ops ip_nat_out_ops = { { NULL, NULL }, ip_nat_out, PF_INET, NF_IP_POST_ROUTING, NF_IP_PRI_NAT_SRC}; @@ -296,10 +299,15 @@ printk("ip_nat_init: can't register in hook.\n"); goto cleanup_nat; } + ret = nf_register_hook(&ip_nat_inr_ops); + if (ret < 0) { + printk("ip_nat_init: can't register inr hook.\n"); + goto cleanup_inops; + } ret = nf_register_hook(&ip_nat_out_ops); if (ret < 0) { printk("ip_nat_init: can't register out hook.\n"); - goto cleanup_inops; + goto cleanup_inrops; } ret = nf_register_hook(&ip_nat_local_out_ops); if (ret < 0) { @@ -327,6 +335,8 @@ nf_unregister_hook(&ip_nat_local_out_ops); cleanup_outops: nf_unregister_hook(&ip_nat_out_ops); + cleanup_inrops: + nf_unregister_hook(&ip_nat_inr_ops); cleanup_inops: nf_unregister_hook(&ip_nat_in_ops); cleanup_nat: diff -urN v2.4.20-before-nf_reroute/linux/net/ipv4/netfilter/ipt_MASQUERADE.c linux/net/ipv4/netfilter/ipt_MASQUERADE.c --- v2.4.20-before-nf_reroute/linux/net/ipv4/netfilter/ipt_MASQUERADE.c Tue Nov 13 03:29:33 2001 +++ linux/net/ipv4/netfilter/ipt_MASQUERADE.c Fri Nov 29 04:18:07 2002 @@ -88,6 +88,7 @@ key.src = 0; /* Unknown: that's what we're trying to establish */ key.tos = RT_TOS((*pskb)->nh.iph->tos)|RTO_CONN; key.oif = out->ifindex; + key.gw = ((struct rtable *) (*pskb)->dst)->rt_gateway; #ifdef CONFIG_IP_ROUTE_FWMARK key.fwmark = (*pskb)->nfmark; #endif diff -urN v2.4.20-before-nf_reroute/linux/net/ipv4/route.c linux/net/ipv4/route.c --- v2.4.20-before-nf_reroute/linux/net/ipv4/route.c Fri Nov 29 04:16:11 2002 +++ linux/net/ipv4/route.c Fri Nov 29 04:18:23 2002 @@ -850,6 +850,7 @@ /* Gateway is different ... */ rt->rt_gateway = new_gw; + if (rt->key.gw) rt->key.gw = new_gw; /* Redirect received -> path was valid */ dst_confirm(&rth->u.dst); @@ -1273,6 +1274,7 @@ rth->key.fwmark = skb->nfmark; #endif rth->key.src = saddr; + rth->key.lsrc = 0; rth->rt_src = saddr; #ifdef CONFIG_IP_ROUTE_NAT rth->rt_dst_map = daddr; @@ -1286,6 +1288,7 @@ rth->u.dst.dev = &loopback_dev; dev_hold(rth->u.dst.dev); rth->key.oif = 0; + rth->key.gw = 0; rth->rt_gateway = daddr; rth->rt_spec_dst= spec_dst; rth->rt_type = RTN_MULTICAST; @@ -1325,7 +1328,7 @@ */ int ip_route_input_slow(struct sk_buff *skb, u32 daddr, u32 saddr, - u8 tos, struct net_device *dev) + u8 tos, struct net_device *dev, u32 lsrc) { struct rt_key key; struct fib_result res; @@ -1345,16 +1348,17 @@ goto out; key.dst = daddr; - key.src = saddr; + key.src = lsrc? : saddr; key.tos = tos; #ifdef CONFIG_IP_ROUTE_FWMARK key.fwmark = skb->nfmark; #endif - key.iif = dev->ifindex; + key.iif = lsrc? loopback_dev.ifindex : dev->ifindex; key.oif = 0; + key.gw = 0; key.scope = RT_SCOPE_UNIVERSE; - hash = rt_hash_code(daddr, saddr ^ (key.iif << 5), tos); + hash = rt_hash_code(daddr, saddr ^ (dev->ifindex << 5), tos); /* Check for the most weird martians, which can be not detected by fib_lookup. @@ -1375,6 +1379,12 @@ if (BADCLASS(daddr) || ZERONET(daddr) || LOOPBACK(daddr)) goto martian_destination; + if (lsrc) { + if (MULTICAST(lsrc) || BADCLASS(lsrc) || + ZERONET(lsrc) || LOOPBACK(lsrc)) + goto e_inval; + } + /* * Now we are ready to route packet. */ @@ -1384,6 +1394,10 @@ goto no_route; } free_res = 1; + if (lsrc && res.type != RTN_UNICAST && res.type != RTN_NAT) + goto e_inval; + key.iif = dev->ifindex; + key.src = saddr; rt_cache_stat[smp_processor_id()].in_slow_tot++; @@ -1394,7 +1408,7 @@ if (1) { u32 src_map = saddr; - if (res.r) + if (res.r && !lsrc) src_map = fib_rules_policy(saddr, &res, &flags); if (res.type == RTN_NAT) { @@ -1455,6 +1469,7 @@ flags |= RTCF_DIRECTSRC; if (out_dev == in_dev && err && !(flags & (RTCF_NAT | RTCF_MASQ)) && + !lsrc && (IN_DEV_SHARED_MEDIA(out_dev) || inet_addr_onlink(out_dev, saddr, FIB_RES_GW(res)))) flags |= RTCF_DOREDIRECT; @@ -1481,6 +1496,7 @@ #endif rth->key.src = saddr; rth->rt_src = saddr; + rth->key.lsrc = lsrc; rth->rt_gateway = daddr; #ifdef CONFIG_IP_ROUTE_NAT rth->rt_src_map = key.src; @@ -1493,6 +1509,7 @@ rth->u.dst.dev = out_dev->dev; dev_hold(rth->u.dst.dev); rth->key.oif = 0; + rth->key.gw = 0; rth->rt_spec_dst= spec_dst; rth->u.dst.input = ip_forward; @@ -1503,7 +1520,8 @@ rth->rt_flags = flags; #ifdef CONFIG_NET_FASTROUTE - if (netdev_fastroute && !(flags&(RTCF_NAT|RTCF_MASQ|RTCF_DOREDIRECT))) { + if (netdev_fastroute && !(flags&(RTCF_NAT|RTCF_MASQ|RTCF_DOREDIRECT)) && + !lsrc) { struct net_device *odev = rth->u.dst.dev; if (odev != dev && dev->accept_fastpath && @@ -1526,6 +1544,8 @@ brd_input: if (skb->protocol != htons(ETH_P_IP)) goto e_inval; + if (lsrc) + goto e_inval; if (ZERONET(saddr)) spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK); @@ -1558,6 +1578,7 @@ #endif rth->key.src = saddr; rth->rt_src = saddr; + rth->key.lsrc = 0; #ifdef CONFIG_IP_ROUTE_NAT rth->rt_dst_map = key.dst; rth->rt_src_map = key.src; @@ -1570,6 +1591,7 @@ rth->u.dst.dev = &loopback_dev; dev_hold(rth->u.dst.dev); rth->key.oif = 0; + rth->key.gw = 0; rth->rt_gateway = daddr; rth->rt_spec_dst= spec_dst; rth->u.dst.input= ip_local_deliver; @@ -1635,8 +1657,9 @@ goto e_inval; } -int ip_route_input(struct sk_buff *skb, u32 daddr, u32 saddr, - u8 tos, struct net_device *dev) +static inline int +ip_route_input_cached(struct sk_buff *skb, u32 daddr, u32 saddr, + u8 tos, struct net_device *dev, u32 lsrc) { struct rtable * rth; unsigned hash; @@ -1650,6 +1673,7 @@ if (rth->key.dst == daddr && rth->key.src == saddr && rth->key.iif == iif && + rth->key.lsrc == lsrc && rth->key.oif == 0 && #ifdef CONFIG_IP_ROUTE_FWMARK rth->key.fwmark == skb->nfmark && @@ -1696,9 +1720,21 @@ read_unlock(&inetdev_lock); return -EINVAL; } - return ip_route_input_slow(skb, daddr, saddr, tos, dev); + return ip_route_input_slow(skb, daddr, saddr, tos, dev, lsrc); } +int ip_route_input(struct sk_buff *skb, u32 daddr, u32 saddr, + u8 tos, struct net_device *dev) +{ + return ip_route_input_cached(skb, daddr, saddr, tos, dev, 0); +} + +int ip_route_input_lookup(struct sk_buff *skb, u32 daddr, u32 saddr, + u8 tos, struct net_device *dev, u32 lsrc) +{ + return ip_route_input_cached(skb, daddr, saddr, tos, dev, lsrc); +} + /* * Major route resolver routine. */ @@ -1721,6 +1757,7 @@ key.tos = tos & IPTOS_RT_MASK; key.iif = loopback_dev.ifindex; key.oif = oldkey->oif; + key.gw = oldkey->gw; #ifdef CONFIG_IP_ROUTE_FWMARK key.fwmark = oldkey->fwmark; #endif @@ -1810,6 +1847,7 @@ dev_out = &loopback_dev; dev_hold(dev_out); key.oif = loopback_dev.ifindex; + key.gw = 0; res.type = RTN_LOCAL; flags |= RTCF_LOCAL; goto make_route; @@ -1860,6 +1898,7 @@ dev_out = &loopback_dev; dev_hold(dev_out); key.oif = dev_out->ifindex; + key.gw = 0; if (res.fi) fib_info_put(res.fi); res.fi = NULL; @@ -1930,7 +1969,9 @@ rth->key.tos = tos; rth->key.src = oldkey->src; rth->key.iif = 0; + rth->key.lsrc = 0; rth->key.oif = oldkey->oif; + rth->key.gw = oldkey->gw; #ifdef CONFIG_IP_ROUTE_FWMARK rth->key.fwmark = oldkey->fwmark; #endif @@ -2009,6 +2050,7 @@ rth->key.src == key->src && rth->key.iif == 0 && rth->key.oif == key->oif && + rth->key.gw == key->gw && #ifdef CONFIG_IP_ROUTE_FWMARK rth->key.fwmark == key->fwmark && #endif diff -urN v2.4.20-before-nf_reroute/linux/net/netsyms.c linux/net/netsyms.c --- v2.4.20-before-nf_reroute/linux/net/netsyms.c Fri Nov 29 03:00:23 2002 +++ linux/net/netsyms.c Fri Nov 29 04:18:07 2002 @@ -248,6 +248,7 @@ EXPORT_SYMBOL(inet_unregister_protosw); EXPORT_SYMBOL(ip_route_output_key); EXPORT_SYMBOL(ip_route_input); +EXPORT_SYMBOL(ip_route_input_lookup); EXPORT_SYMBOL(icmp_send); EXPORT_SYMBOL(ip_options_compile); EXPORT_SYMBOL(ip_options_undo);