netfilter: nf_conntrack: Add a struct net parameter to l4_pkt_to_tuple

As gre does not have the srckey in the packet gre_pkt_to_tuple
needs to perform a lookup in it's per network namespace tables.

Pass in the proper network namespace to all pkt_to_tuple
implementations to ensure gre (and any similar protocols) can get this
right.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index e8ad46834df87453e1335bccb7e80dda2ba9fbe5..d642f68a7c73708a99e0fd7a12388ac55313dee5 100644 (file)
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -191,7 +191,8 @@ int nf_conntrack_hash_check_insert(struct nf_conn *ct);
 bool nf_ct_delete(struct nf_conn *ct, u32 pid, int report);
 
 bool nf_ct_get_tuplepr(const struct sk_buff *skb, unsigned int nhoff,
-                      u_int16_t l3num, struct nf_conntrack_tuple *tuple);
+                      u_int16_t l3num, struct net *net,
+                      struct nf_conntrack_tuple *tuple);
 bool nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
                          const struct nf_conntrack_tuple *orig);
 

diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index c03f9c42b3cd32be938e282e47cf66e63536a8c3..788ef58a66b9b78807d164bce85060cc760ee336 100644 (file)
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -41,6 +41,7 @@ void nf_conntrack_cleanup_end(void);
 
 bool nf_ct_get_tuple(const struct sk_buff *skb, unsigned int nhoff,
                     unsigned int dataoff, u_int16_t l3num, u_int8_t protonum,
+                    struct net *net,
                     struct nf_conntrack_tuple *tuple,
                     const struct nf_conntrack_l3proto *l3proto,
                     const struct nf_conntrack_l4proto *l4proto);

diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index 1f7061313d54620d11c1fb2f4e08d99be961989c..956d8a6ac06935bc151a74ead1090268378eff70 100644 (file)
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -26,7 +26,7 @@ struct nf_conntrack_l4proto {
        /* Try to fill in the third arg: dataoff is offset past network protocol
            hdr.  Return true if possible. */
        bool (*pkt_to_tuple)(const struct sk_buff *skb, unsigned int dataoff,
-                            struct nf_conntrack_tuple *tuple);
+                            struct net *net, struct nf_conntrack_tuple *tuple);
 
        /* Invert the per-proto part of the tuple: ie. turn xmit into reply.
         * Some packets can't be inverted: return 0 in that case.

diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index cdde3ec496e94321c424d3dd37b31cb305e05451..c567e1b5d7990d977383453d58b4ae80f387d25c 100644 (file)
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -30,7 +30,7 @@ static inline struct nf_icmp_net *icmp_pernet(struct net *net)
 }
 
 static bool icmp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
-                             struct nf_conntrack_tuple *tuple)
+                             struct net *net, struct nf_conntrack_tuple *tuple)
 {
        const struct icmphdr *hp;
        struct icmphdr _hdr;
@@ -144,7 +144,7 @@ icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
        if (!nf_ct_get_tuplepr(skb,
                               skb_network_offset(skb) + ip_hdrlen(skb)
                                                       + sizeof(struct icmphdr),
-                              PF_INET, &origtuple)) {
+                              PF_INET, net, &origtuple)) {
                pr_debug("icmp_error_message: failed to get tuple\n");
                return -NF_ACCEPT;
        }

diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 0e6fae103d33454f70fb5790b71d2529af969636..d3b797446cea5fa2a87d50c45366e702c640f730 100644 (file)
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -36,6 +36,7 @@ static inline struct nf_icmp_net *icmpv6_pernet(struct net *net)
 
 static bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
                                unsigned int dataoff,
+                               struct net *net,
                                struct nf_conntrack_tuple *tuple)
 {
        const struct icmp6hdr *hp;
@@ -159,7 +160,7 @@ icmpv6_error_message(struct net *net, struct nf_conn *tmpl,
                               skb_network_offset(skb)
                                + sizeof(struct ipv6hdr)
                                + sizeof(struct icmp6hdr),
-                              PF_INET6, &origtuple)) {
+                              PF_INET6, net, &origtuple)) {
                pr_debug("icmpv6_error: Can't get tuple\n");
                return -NF_ACCEPT;
        }

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index c09d6c7198f60d809b36783ca1de43646025c876..09d1d19b2ab94f5085fef1f69fc372ba917197a7 100644 (file)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -168,6 +168,7 @@ nf_ct_get_tuple(const struct sk_buff *skb,
                unsigned int dataoff,
                u_int16_t l3num,
                u_int8_t protonum,
+               struct net *net,
                struct nf_conntrack_tuple *tuple,
                const struct nf_conntrack_l3proto *l3proto,
                const struct nf_conntrack_l4proto *l4proto)
@@ -181,12 +182,13 @@ nf_ct_get_tuple(const struct sk_buff *skb,
        tuple->dst.protonum = protonum;
        tuple->dst.dir = IP_CT_DIR_ORIGINAL;
 
-       return l4proto->pkt_to_tuple(skb, dataoff, tuple);
+       return l4proto->pkt_to_tuple(skb, dataoff, net, tuple);
 }
 EXPORT_SYMBOL_GPL(nf_ct_get_tuple);
 
 bool nf_ct_get_tuplepr(const struct sk_buff *skb, unsigned int nhoff,
-                      u_int16_t l3num, struct nf_conntrack_tuple *tuple)
+                      u_int16_t l3num,
+                      struct net *net, struct nf_conntrack_tuple *tuple)
 {
        struct nf_conntrack_l3proto *l3proto;
        struct nf_conntrack_l4proto *l4proto;
@@ -205,7 +207,7 @@ bool nf_ct_get_tuplepr(const struct sk_buff *skb, unsigned int nhoff,
 
        l4proto = __nf_ct_l4proto_find(l3num, protonum);
 
-       ret = nf_ct_get_tuple(skb, nhoff, protoff, l3num, protonum, tuple,
+       ret = nf_ct_get_tuple(skb, nhoff, protoff, l3num, protonum, net, tuple,
                              l3proto, l4proto);
 
        rcu_read_unlock();
@@ -1029,7 +1031,7 @@ resolve_normal_ct(struct net *net, struct nf_conn *tmpl,
        u32 hash;
 
        if (!nf_ct_get_tuple(skb, skb_network_offset(skb),
-                            dataoff, l3num, protonum, &tuple, l3proto,
+                            dataoff, l3num, protonum, net, &tuple, l3proto,
                             l4proto)) {
                pr_debug("resolve_normal_ct: Can't get tuple\n");
                return NULL;

diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index 6dd995c7c72b4400cdbd23da703467690f2e8cb4..fce1b1cca32d65c6241f0ee513db2fe5774a00b9 100644 (file)
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -398,7 +398,7 @@ static inline struct dccp_net *dccp_pernet(struct net *net)
 }
 
 static bool dccp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
-                             struct nf_conntrack_tuple *tuple)
+                             struct net *net, struct nf_conntrack_tuple *tuple)
 {
        struct dccp_hdr _hdr, *dh;
 

diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
index 2281be419a74b6d8abe0fd7da8d7e8b35d304600..86dc752e534963b08c7fc4217db533c480042d17 100644 (file)
--- a/net/netfilter/nf_conntrack_proto_generic.c
+++ b/net/netfilter/nf_conntrack_proto_generic.c
@@ -45,7 +45,7 @@ static inline struct nf_generic_net *generic_pernet(struct net *net)
 
 static bool generic_pkt_to_tuple(const struct sk_buff *skb,
                                 unsigned int dataoff,
-                                struct nf_conntrack_tuple *tuple)
+                                struct net *net, struct nf_conntrack_tuple *tuple)
 {
        tuple->src.u.all = 0;
        tuple->dst.u.all = 0;

diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index 7648674f29c3be28c1d3b3f91c5eab7400cedb51..a96451a7af20a8104c82711f31958b043de4bde7 100644 (file)
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -190,9 +190,8 @@ static bool gre_invert_tuple(struct nf_conntrack_tuple *tuple,
 
 /* gre hdr info to tuple */
 static bool gre_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
-                            struct nf_conntrack_tuple *tuple)
+                            struct net *net, struct nf_conntrack_tuple *tuple)
 {
-       struct net *net = dev_net(skb->dev ? skb->dev : skb_dst(skb)->dev);
        const struct gre_hdr_pptp *pgrehdr;
        struct gre_hdr_pptp _pgrehdr;
        __be16 srckey;

diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 67197731eb6835ff944c688afb942b90c9dc63a4..9578a7c371ef2ce04f0a7b10c694b2533e29bd3a 100644 (file)
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -156,7 +156,7 @@ static inline struct sctp_net *sctp_pernet(struct net *net)
 }
 
 static bool sctp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
-                             struct nf_conntrack_tuple *tuple)
+                             struct net *net, struct nf_conntrack_tuple *tuple)
 {
        const struct sctphdr *hp;
        struct sctphdr _hdr;

diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 70383de7205460a8ebdadd7fd1ba615fc7681296..278f3b9356efdcd37ca3d1aacb62f03e57db7e3c 100644 (file)
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -277,7 +277,7 @@ static inline struct nf_tcp_net *tcp_pernet(struct net *net)
 }
 
 static bool tcp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
-                            struct nf_conntrack_tuple *tuple)
+                            struct net *net, struct nf_conntrack_tuple *tuple)
 {
        const struct tcphdr *hp;
        struct tcphdr _hdr;

diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 6957281ffee54fe43f22a73772b1f88a2e758a50..478f92f834b61e7e2007779dc9dd8cace98ffcd2 100644 (file)
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -38,6 +38,7 @@ static inline struct nf_udp_net *udp_pernet(struct net *net)
 
 static bool udp_pkt_to_tuple(const struct sk_buff *skb,
                             unsigned int dataoff,
+                            struct net *net,
                             struct nf_conntrack_tuple *tuple)
 {
        const struct udphdr *hp;

diff --git a/net/netfilter/nf_conntrack_proto_udplite.c b/net/netfilter/nf_conntrack_proto_udplite.c
index c5903d1649f9a02ab1d59615a458be578e0a5f6d..1ac8ee13a873ea60dffb6d455c48fc11bf7e45c4 100644 (file)
--- a/net/netfilter/nf_conntrack_proto_udplite.c
+++ b/net/netfilter/nf_conntrack_proto_udplite.c
@@ -48,6 +48,7 @@ static inline struct udplite_net *udplite_pernet(struct net *net)
 
 static bool udplite_pkt_to_tuple(const struct sk_buff *skb,
                                 unsigned int dataoff,
+                                struct net *net,
                                 struct nf_conntrack_tuple *tuple)
 {
        const struct udphdr *hp;

diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 213db252e5bea291e5a21a35dbd2fa37a95e2a4a..99bbc829868d5042ab5dbcbc02dc70c8e57f6b85 100644 (file)
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -332,7 +332,7 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
                tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
                zone = nf_ct_zone(ct);
        } else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
-                                   par->family, &tuple)) {
+                                     par->family, net, &tuple)) {
                goto hotdrop;
        }
 

diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index e8e524ad8a01cb3e62b531cf13659784f2f123ef..aaf5cbd6d9aea5fbe5c628dce9b71049295c6a59 100644 (file)
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -345,7 +345,7 @@ ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone,
 {
        struct nf_conntrack_tuple tuple;
 
-       if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, &tuple))
+       if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, net, &tuple))
                return NULL;
        return __nf_ct_expect_find(net, zone, &tuple);
 }

diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index 413ac39147d819a9582a5d5e2f77fd53975815fe..bb41699c6c49eb4a40241d662a79ebd39cd6ff8f 100644 (file)
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -68,7 +68,7 @@ static int tcf_connmark(struct sk_buff *skb, const struct tc_action *a,
        }
 
        if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
-                              proto, &tuple))
+                              proto, ca->net, &tuple))
                goto out;
 
        zone.id = ca->zone;