icmp: introduce helper for nat'd source address in network device context

This introduces a helper function to be called only by network drivers
that wraps calls to icmp[v6]_send in a conntrack transformation, in case
NAT has been used. We don't want to pollute the non-driver path, though,
so we introduce this as a helper to be called by places that actually
make use of this, as suggested by Florian.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/icmpv6.h b/include/linux/icmpv6.h
index ef1cbb5f454f7aa105db534ecc1ddbb56df333ce..93338fd54af884fbada4211197f801a4284594d9 100644 (file)
--- a/include/linux/icmpv6.h
+++ b/include/linux/icmpv6.h
@@ -31,6 +31,12 @@ static inline void icmpv6_send(struct sk_buff *skb,
 }
 #endif
 
+#if IS_ENABLED(CONFIG_NF_NAT)
+void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info);
+#else
+#define icmpv6_ndo_send icmpv6_send
+#endif
+
 extern int                             icmpv6_init(void);
 extern int                             icmpv6_err_convert(u8 type, u8 code,
                                                           int *err);

diff --git a/include/net/icmp.h b/include/net/icmp.h
index 5d4bfdba9adf03759affb01617245a290e339a8f..9ac2d2672a938626b28ccbd7e8d5095bcf2910f5 100644 (file)
--- a/include/net/icmp.h
+++ b/include/net/icmp.h
@@ -43,6 +43,12 @@ static inline void icmp_send(struct sk_buff *skb_in, int type, int code, __be32
        __icmp_send(skb_in, type, code, info, &IPCB(skb_in)->opt);
 }
 
+#if IS_ENABLED(CONFIG_NF_NAT)
+void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info);
+#else
+#define icmp_ndo_send icmp_send
+#endif
+
 int icmp_rcv(struct sk_buff *skb);
 int icmp_err(struct sk_buff *skb, u32 info);
 int icmp_init(void);

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 18068ed42f258349a07248a85acdf93b8c2f1749..f369e7ce685b8374eae04d0ca0c5508463c5e72f 100644 (file)
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -748,6 +748,39 @@ out:;
 }
 EXPORT_SYMBOL(__icmp_send);
 
+#if IS_ENABLED(CONFIG_NF_NAT)
+#include <net/netfilter/nf_conntrack.h>
+void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info)
+{
+       struct sk_buff *cloned_skb = NULL;
+       enum ip_conntrack_info ctinfo;
+       struct nf_conn *ct;
+       __be32 orig_ip;
+
+       ct = nf_ct_get(skb_in, &ctinfo);
+       if (!ct || !(ct->status & IPS_SRC_NAT)) {
+               icmp_send(skb_in, type, code, info);
+               return;
+       }
+
+       if (skb_shared(skb_in))
+               skb_in = cloned_skb = skb_clone(skb_in, GFP_ATOMIC);
+
+       if (unlikely(!skb_in || skb_network_header(skb_in) < skb_in->head ||
+           (skb_network_header(skb_in) + sizeof(struct iphdr)) >
+           skb_tail_pointer(skb_in) || skb_ensure_writable(skb_in,
+           skb_network_offset(skb_in) + sizeof(struct iphdr))))
+               goto out;
+
+       orig_ip = ip_hdr(skb_in)->saddr;
+       ip_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.ip;
+       icmp_send(skb_in, type, code, info);
+       ip_hdr(skb_in)->saddr = orig_ip;
+out:
+       consume_skb(cloned_skb);
+}
+EXPORT_SYMBOL(icmp_ndo_send);
+#endif
 
 static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
 {

diff --git a/net/ipv6/ip6_icmp.c b/net/ipv6/ip6_icmp.c
index 02045494c24cccaa8b50af839aae975695319922..e0086758b6ee3c3e91568e59028838c770fac795 100644 (file)
--- a/net/ipv6/ip6_icmp.c
+++ b/net/ipv6/ip6_icmp.c
@@ -45,4 +45,38 @@ out:
        rcu_read_unlock();
 }
 EXPORT_SYMBOL(icmpv6_send);
+
+#if IS_ENABLED(CONFIG_NF_NAT)
+#include <net/netfilter/nf_conntrack.h>
+void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info)
+{
+       struct sk_buff *cloned_skb = NULL;
+       enum ip_conntrack_info ctinfo;
+       struct in6_addr orig_ip;
+       struct nf_conn *ct;
+
+       ct = nf_ct_get(skb_in, &ctinfo);
+       if (!ct || !(ct->status & IPS_SRC_NAT)) {
+               icmpv6_send(skb_in, type, code, info);
+               return;
+       }
+
+       if (skb_shared(skb_in))
+               skb_in = cloned_skb = skb_clone(skb_in, GFP_ATOMIC);
+
+       if (unlikely(!skb_in || skb_network_header(skb_in) < skb_in->head ||
+           (skb_network_header(skb_in) + sizeof(struct ipv6hdr)) >
+           skb_tail_pointer(skb_in) || skb_ensure_writable(skb_in,
+           skb_network_offset(skb_in) + sizeof(struct ipv6hdr))))
+               goto out;
+
+       orig_ip = ipv6_hdr(skb_in)->saddr;
+       ipv6_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.in6;
+       icmpv6_send(skb_in, type, code, info);
+       ipv6_hdr(skb_in)->saddr = orig_ip;
+out:
+       consume_skb(cloned_skb);
+}
+EXPORT_SYMBOL(icmpv6_ndo_send);
+#endif
 #endif