Skip to content

Commit 8fef24c

Browse files
Liping Zhangummakynes
Liping Zhang
authored and
ummakynes
committed
netfilter: ip6t_SYNPROXY: remove magic number for hop_limit
Replace '64' with the per-net ipv6_devconf_all's hop_limit when building the ipv6 header. Signed-off-by: Liping Zhang <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
1 parent 8d45ff2 commit 8fef24c

File tree

1 file changed

+30
-26
lines changed

1 file changed

+30
-26
lines changed

‎net/ipv6/netfilter/ip6t_SYNPROXY.c

Lines changed: 30 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -20,15 +20,16 @@
2020
#include <net/netfilter/nf_conntrack_synproxy.h>
2121

2222
static struct ipv6hdr *
23-
synproxy_build_ip(struct sk_buff *skb, const struct in6_addr *saddr,
24-
const struct in6_addr *daddr)
23+
synproxy_build_ip(struct net *net, struct sk_buff *skb,
24+
const struct in6_addr *saddr,
25+
const struct in6_addr *daddr)
2526
{
2627
struct ipv6hdr *iph;
2728

2829
skb_reset_network_header(skb);
2930
iph = (struct ipv6hdr *)skb_put(skb, sizeof(*iph));
3031
ip6_flow_hdr(iph, 0, 0);
31-
iph->hop_limit = 64; //XXX
32+
iph->hop_limit = net->ipv6.devconf_all->hop_limit;
3233
iph->nexthdr = IPPROTO_TCP;
3334
iph->saddr = *saddr;
3435
iph->daddr = *daddr;
@@ -37,13 +38,12 @@ synproxy_build_ip(struct sk_buff *skb, const struct in6_addr *saddr,
3738
}
3839

3940
static void
40-
synproxy_send_tcp(const struct synproxy_net *snet,
41+
synproxy_send_tcp(struct net *net,
4142
const struct sk_buff *skb, struct sk_buff *nskb,
4243
struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo,
4344
struct ipv6hdr *niph, struct tcphdr *nth,
4445
unsigned int tcp_hdr_size)
4546
{
46-
struct net *net = nf_ct_net(snet->tmpl);
4747
struct dst_entry *dst;
4848
struct flowi6 fl6;
4949

@@ -84,7 +84,7 @@ synproxy_send_tcp(const struct synproxy_net *snet,
8484
}
8585

8686
static void
87-
synproxy_send_client_synack(const struct synproxy_net *snet,
87+
synproxy_send_client_synack(struct net *net,
8888
const struct sk_buff *skb, const struct tcphdr *th,
8989
const struct synproxy_options *opts)
9090
{
@@ -103,7 +103,7 @@ synproxy_send_client_synack(const struct synproxy_net *snet,
103103
return;
104104
skb_reserve(nskb, MAX_TCP_HEADER);
105105

106-
niph = synproxy_build_ip(nskb, &iph->daddr, &iph->saddr);
106+
niph = synproxy_build_ip(net, nskb, &iph->daddr, &iph->saddr);
107107

108108
skb_reset_transport_header(nskb);
109109
nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
@@ -121,15 +121,16 @@ synproxy_send_client_synack(const struct synproxy_net *snet,
121121

122122
synproxy_build_options(nth, opts);
123123

124-
synproxy_send_tcp(snet, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
124+
synproxy_send_tcp(net, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
125125
niph, nth, tcp_hdr_size);
126126
}
127127

128128
static void
129-
synproxy_send_server_syn(const struct synproxy_net *snet,
129+
synproxy_send_server_syn(struct net *net,
130130
const struct sk_buff *skb, const struct tcphdr *th,
131131
const struct synproxy_options *opts, u32 recv_seq)
132132
{
133+
struct synproxy_net *snet = synproxy_pernet(net);
133134
struct sk_buff *nskb;
134135
struct ipv6hdr *iph, *niph;
135136
struct tcphdr *nth;
@@ -144,7 +145,7 @@ synproxy_send_server_syn(const struct synproxy_net *snet,
144145
return;
145146
skb_reserve(nskb, MAX_TCP_HEADER);
146147

147-
niph = synproxy_build_ip(nskb, &iph->saddr, &iph->daddr);
148+
niph = synproxy_build_ip(net, nskb, &iph->saddr, &iph->daddr);
148149

149150
skb_reset_transport_header(nskb);
150151
nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
@@ -165,12 +166,12 @@ synproxy_send_server_syn(const struct synproxy_net *snet,
165166

166167
synproxy_build_options(nth, opts);
167168

168-
synproxy_send_tcp(snet, skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
169+
synproxy_send_tcp(net, skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
169170
niph, nth, tcp_hdr_size);
170171
}
171172

172173
static void
173-
synproxy_send_server_ack(const struct synproxy_net *snet,
174+
synproxy_send_server_ack(struct net *net,
174175
const struct ip_ct_tcp *state,
175176
const struct sk_buff *skb, const struct tcphdr *th,
176177
const struct synproxy_options *opts)
@@ -189,7 +190,7 @@ synproxy_send_server_ack(const struct synproxy_net *snet,
189190
return;
190191
skb_reserve(nskb, MAX_TCP_HEADER);
191192

192-
niph = synproxy_build_ip(nskb, &iph->daddr, &iph->saddr);
193+
niph = synproxy_build_ip(net, nskb, &iph->daddr, &iph->saddr);
193194

194195
skb_reset_transport_header(nskb);
195196
nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
@@ -205,11 +206,11 @@ synproxy_send_server_ack(const struct synproxy_net *snet,
205206

206207
synproxy_build_options(nth, opts);
207208

208-
synproxy_send_tcp(snet, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
209+
synproxy_send_tcp(net, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
209210
}
210211

211212
static void
212-
synproxy_send_client_ack(const struct synproxy_net *snet,
213+
synproxy_send_client_ack(struct net *net,
213214
const struct sk_buff *skb, const struct tcphdr *th,
214215
const struct synproxy_options *opts)
215216
{
@@ -227,7 +228,7 @@ synproxy_send_client_ack(const struct synproxy_net *snet,
227228
return;
228229
skb_reserve(nskb, MAX_TCP_HEADER);
229230

230-
niph = synproxy_build_ip(nskb, &iph->saddr, &iph->daddr);
231+
niph = synproxy_build_ip(net, nskb, &iph->saddr, &iph->daddr);
231232

232233
skb_reset_transport_header(nskb);
233234
nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
@@ -243,15 +244,16 @@ synproxy_send_client_ack(const struct synproxy_net *snet,
243244

244245
synproxy_build_options(nth, opts);
245246

246-
synproxy_send_tcp(snet, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
247+
synproxy_send_tcp(net, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
247248
niph, nth, tcp_hdr_size);
248249
}
249250

250251
static bool
251-
synproxy_recv_client_ack(const struct synproxy_net *snet,
252+
synproxy_recv_client_ack(struct net *net,
252253
const struct sk_buff *skb, const struct tcphdr *th,
253254
struct synproxy_options *opts, u32 recv_seq)
254255
{
256+
struct synproxy_net *snet = synproxy_pernet(net);
255257
int mss;
256258

257259
mss = __cookie_v6_check(ipv6_hdr(skb), th, ntohl(th->ack_seq) - 1);
@@ -267,15 +269,16 @@ synproxy_recv_client_ack(const struct synproxy_net *snet,
267269
if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
268270
synproxy_check_timestamp_cookie(opts);
269271

270-
synproxy_send_server_syn(snet, skb, th, opts, recv_seq);
272+
synproxy_send_server_syn(net, skb, th, opts, recv_seq);
271273
return true;
272274
}
273275

274276
static unsigned int
275277
synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
276278
{
277279
const struct xt_synproxy_info *info = par->targinfo;
278-
struct synproxy_net *snet = synproxy_pernet(par->net);
280+
struct net *net = par->net;
281+
struct synproxy_net *snet = synproxy_pernet(net);
279282
struct synproxy_options opts = {};
280283
struct tcphdr *th, _th;
281284

@@ -304,12 +307,12 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
304307
XT_SYNPROXY_OPT_SACK_PERM |
305308
XT_SYNPROXY_OPT_ECN);
306309

307-
synproxy_send_client_synack(snet, skb, th, &opts);
310+
synproxy_send_client_synack(net, skb, th, &opts);
308311
return NF_DROP;
309312

310313
} else if (th->ack && !(th->fin || th->rst || th->syn)) {
311314
/* ACK from client */
312-
synproxy_recv_client_ack(snet, skb, th, &opts, ntohl(th->seq));
315+
synproxy_recv_client_ack(net, skb, th, &opts, ntohl(th->seq));
313316
return NF_DROP;
314317
}
315318

@@ -320,7 +323,8 @@ static unsigned int ipv6_synproxy_hook(void *priv,
320323
struct sk_buff *skb,
321324
const struct nf_hook_state *nhs)
322325
{
323-
struct synproxy_net *snet = synproxy_pernet(nhs->net);
326+
struct net *net = nhs->net;
327+
struct synproxy_net *snet = synproxy_pernet(net);
324328
enum ip_conntrack_info ctinfo;
325329
struct nf_conn *ct;
326330
struct nf_conn_synproxy *synproxy;
@@ -384,7 +388,7 @@ static unsigned int ipv6_synproxy_hook(void *priv,
384388
* therefore we need to add 1 to make the SYN sequence
385389
* number match the one of first SYN.
386390
*/
387-
if (synproxy_recv_client_ack(snet, skb, th, &opts,
391+
if (synproxy_recv_client_ack(net, skb, th, &opts,
388392
ntohl(th->seq) + 1))
389393
this_cpu_inc(snet->stats->cookie_retrans);
390394

@@ -410,12 +414,12 @@ static unsigned int ipv6_synproxy_hook(void *priv,
410414
XT_SYNPROXY_OPT_SACK_PERM);
411415

412416
swap(opts.tsval, opts.tsecr);
413-
synproxy_send_server_ack(snet, state, skb, th, &opts);
417+
synproxy_send_server_ack(net, state, skb, th, &opts);
414418

415419
nf_ct_seqadj_init(ct, ctinfo, synproxy->isn - ntohl(th->seq));
416420

417421
swap(opts.tsval, opts.tsecr);
418-
synproxy_send_client_ack(snet, skb, th, &opts);
422+
synproxy_send_client_ack(net, skb, th, &opts);
419423

420424
consume_skb(skb);
421425
return NF_STOLEN;

0 commit comments

Comments
 (0)