Skip to contentSkip to conversation

: Reinject v4 packet on input instead of calling netfilter

PATCH In review jamal 1 participant 1 message Nov 29, 2007

Subsystems (3)
Networking Network drivers Networking IPsec
lore
Share & tools
lore

jamal

author
#0 lore raw

PATCH 1/2 : Reinject v4 packet on input instead of calling netfilter

1 of 2.

cheers,
jamal

Quoted 1 line

From 682cee2131477497a2c8ee9bf4d0c2c8c030956f Mon Sep 17 00:00:00 2001

From: Jamal Hadi Salim <[email protected]>
Date: Thu, 29 Nov 2007 15:37:31 -0500
Subject: [PATCH 1/2] [IPSEC]: Reinject v4 packet on input instead of calling netfilter

Derived from an earlier down-trodden patch from Herbert. We re-inject a decrypted ipsec back and let it bubble up the network stack. This improves packet debugability (since sniffers like tcpdump can see the packet) and ingress tc filters can act on it.

Signed-off-by Jamal Hadi Salim <[email protected]>
---
 net/ipv4/xfrm4_input.c |   23 ++++++++++++++---------
 1 files changed, 14 insertions(+), 9 deletions(-)
net/ipv4/xfrm4_input.c +14 -9
index 0c377a6..1271668 100644
@@ -50,20 +50,25 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async)
 
 	iph->protocol = XFRM_MODE_SKB_CB(skb)->protocol;
 
-#ifdef CONFIG_NETFILTER
+	if (async)
+		return xfrm4_rcv_encap_finish(skb);
+
 	__skb_push(skb, skb->data - skb_network_header(skb));
 	iph->tot_len = htons(skb->len);
 	ip_send_check(iph);
 
-	NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
-		xfrm4_rcv_encap_finish);
-	return 0;
-#else
-	if (async)
-		return xfrm4_rcv_encap_finish(skb);
+	dst_release(skb->dst);
+	skb->dst = NULL;
+	{
+		/* make some packet-sock user (eg tcpdump) happy */
+		const unsigned char *old_mac;
+		old_mac = skb_mac_header(skb);
+		skb_set_mac_header(skb, -skb->mac_len);
+		memmove(skb_mac_header(skb), old_mac, skb->mac_len);
+	}
 
-	return -iph->protocol;
-#endif
+	netif_rx(skb);
+	return 0;
 }
 
 /* If it's a keepalive packet, then just eat it.
Signature · 1 line
1.4.4.1.gaed4