Skip to contentSkip to conversation

netfilter : nfmark routing in OUTPUT, mangle, NFQUEUE

PATCH In review Laurent Licour 2 participants 3 messages Jul 10, 2008 – Jul 17, 2008

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 netfilter : nfmark routing in OUTPUT, mangle, NFQUEUE

This patch let nfmark to be evaluated for routing decision for OUTPUT packet, in mangle table, when process paquet in NFQUEUE
Until now, only change (in NFQUEUE process) on fields src_addr, dest_addr and tos could make netfilter to reevalute the routing.
Similar code could also be applied to ipv6 code...

net/ipv4/netfilter.c 2008-07-07 02:04:34.000000000 +0200 renamed from net/ipv4/netfilter.c 2006-09-20 05:42:06.000000000 +0200 +3 -0
@@ -131,6 +131,9 @@
      u_int32_t daddr;
      u_int32_t saddr;
      u_int8_t tos;
+#ifdef CONFIG_IP_ROUTE_FWMARK
+       __u32 nfmark;
+#endif

};

static void nf_ip_saveroute(const struct sk_buff *skb, struct nf_info *info) @@ -143,6 +146,9 @@

              rt_info->tos = iph->tos;
              rt_info->daddr = iph->daddr;
              rt_info->saddr = iph->saddr;
+#ifdef CONFIG_IP_ROUTE_FWMARK
+               rt_info->nfmark = skb->nfmark;
+#endif
      }
}

@@ -154,6 +160,9 @@

              struct iphdr *iph = (*pskb)->nh.iph;

              if (!(iph->tos == rt_info->tos
+#ifdef CONFIG_IP_ROUTE_FWMARK
+                     && (*pskb)->nfmark == rt_info->nfmark
+#endif
                    && iph->daddr == rt_info->daddr
                    && iph->saddr == rt_info->saddr))
                      return ip_route_me_harder(pskb);
#1 lore raw
Quoted 8 lines · Laurent Licour

This patch let nfmark to be evaluated for routing decision for OUTPUT packet, in mangle table, when process paquet in NFQUEUE
Until now, only change (in NFQUEUE process) on fields src_addr, dest_addr and tos could make netfilter to reevalute the routing.
Similar code could also be applied to ipv6 code...

Quoted 4 lines

--- linux-2.6.18.i386.ori/net/ipv4/netfilter.c 2006-09-20 05:42:06.000000000 +0200
+++ linux-2.6.18.i386/net/ipv4/netfilter.c 2008-07-07
02:04:34.000000000 +0200

Please resend against the current kernel tree if you want me to apply this. Also it appears the patch is whitespace damaged, please make sure you'll send it in a way that doesn't corrupt it (f.i. as attachment).

#2 lore raw
Quoted 5 lines

Please resend against the current kernel tree if you want me to apply this. Also it appears the patch is whitespace damaged, please make sure you'll send it in a way that doesn't corrupt it (f.i. as attachment).

Here is the patch against the 2.6.26-stable

net/ipv4/netfilter.c renamed from net/ipv4/netfilter.c.ori +3 -0
@@ -121,6 +121,7 @@
 	__be32 daddr;
 	__be32 saddr;
 	u_int8_t tos;
+	__u32 mark;
 };
 
 static void nf_ip_saveroute(const struct sk_buff *skb,
@@ -134,6 +135,7 @@
 		rt_info->tos = iph->tos;
 		rt_info->daddr = iph->daddr;
 		rt_info->saddr = iph->saddr;
+		rt_info->mark = skb->mark;
 	}
 }
 
@@ -146,6 +148,7 @@
 		const struct iphdr *iph = ip_hdr(skb);
 
 		if (!(iph->tos == rt_info->tos
+		      && skb->mark == rt_info->mark
 		      && iph->daddr == rt_info->daddr
 		      && iph->saddr == rt_info->saddr))
 			return ip_route_me_harder(skb, RTN_UNSPEC);