Commit 4cf210cd authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller

[NETFILTER]: Apply ipsec to ipt_REJECT packets.

With help from Patrick McHardy.
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 75a07ab9
......@@ -22,6 +22,7 @@
#include <net/ip.h>
#include <net/tcp.h>
#include <net/route.h>
#include <net/dst.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ipt_REJECT.h>
#ifdef CONFIG_BRIDGE_NETFILTER
......@@ -38,7 +39,8 @@ MODULE_DESCRIPTION("iptables REJECT target module");
#define DEBUGP(format, args...)
#endif
static inline struct rtable *route_reverse(struct sk_buff *skb, int hook)
static inline struct rtable *route_reverse(struct sk_buff *skb,
struct tcphdr *tcph, int hook)
{
struct iphdr *iph = skb->nh.iph;
struct dst_entry *odst;
......@@ -75,9 +77,22 @@ static inline struct rtable *route_reverse(struct sk_buff *skb, int hook)
dst_release(&rt->u.dst);
rt = (struct rtable *)skb->dst;
skb->dst = odst;
fl.nl_u.ip4_u.daddr = iph->saddr;
fl.nl_u.ip4_u.saddr = iph->daddr;
fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
}
if (rt->u.dst.error) {
dst_release(&rt->u.dst);
return NULL;
}
fl.proto = IPPROTO_TCP;
fl.fl_ip_sport = tcph->dest;
fl.fl_ip_dport = tcph->source;
if (xfrm_lookup((struct dst_entry **)&rt, &fl, NULL, 0)) {
dst_release(&rt->u.dst);
rt = NULL;
}
......@@ -110,7 +125,7 @@ static void send_reset(struct sk_buff *oldskb, int hook)
return;
/* FIXME: Check checksum --RR */
if ((rt = route_reverse(oldskb, hook)) == NULL)
if ((rt = route_reverse(oldskb, oth, hook)) == NULL)
return;
hh_len = LL_RESERVED_SPACE(rt->u.dst.dev);
......@@ -282,10 +297,23 @@ static void send_unreach(struct sk_buff *skb_in, int code)
tos = (iph->tos & IPTOS_TOS_MASK) | IPTOS_PREC_INTERNETCONTROL;
{
struct flowi fl = { .nl_u = { .ip4_u =
{ .daddr = skb_in->nh.iph->saddr,
.saddr = saddr,
.tos = RT_TOS(tos) } } };
struct flowi fl = {
.nl_u = {
.ip4_u = {
.daddr = skb_in->nh.iph->saddr,
.saddr = saddr,
.tos = RT_TOS(tos)
}
},
.proto = IPPROTO_ICMP,
.uli_u = {
.icmpt = {
.type = ICMP_DEST_UNREACH,
.code = code
}
}
};
if (ip_route_output_key(&rt, &fl))
return;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment