[10/11] icmp: introduce helper for nat'd source address in network device context

Origin: https://git.zx2c4.com/wireguard-linux/commit?id=dece343674f61484816a13784d716f1d7098fa05
Bug-Debian: https://bugs.debian.org/953569

This introduces a helper function to be called only by network drivers
that wraps calls to icmp[v6]_send in a conntrack transformation, in case
NAT has been used. We don't want to pollute the non-driver path, though,
so we introduce this as a helper to be called by places that actually
make use of this, as suggested by Florian.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: commits 0b41713b606694257b90d61ba7e2712d8457648b and
 a8e41f6033a0c5633d55d6e35993c9e2005d872f "icmp: allow icmpv6_ndo_send to work with CONFIG_IPV6=n"
 upstream]

Gbp-Pq: Topic features/all/wireguard
Gbp-Pq: Name 0010-icmp-introduce-helper-for-nat-d-source-address-in-ne.patch

diff --git a/include/linux/icmpv6.h b/include/linux/icmpv6.h
index ef1cbb5f454f7aa105db534ecc1ddbb56df333ce..33d37960231441d63a1d7a3d611da916734fc2cd 100644 (file)
--- a/include/linux/icmpv6.h
+++ b/include/linux/icmpv6.h
@@ -22,12 +22,22 @@ extern int inet6_unregister_icmp_sender(ip6_icmp_send_t *fn);
 int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type,
                               unsigned int data_len);
 
+#if IS_ENABLED(CONFIG_NF_NAT)
+void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info);
+#else
+#define icmpv6_ndo_send icmpv6_send
+#endif
+
 #else
 
 static inline void icmpv6_send(struct sk_buff *skb,
                               u8 type, u8 code, __u32 info)
 {
+}
 
+static inline void icmpv6_ndo_send(struct sk_buff *skb,
+                                  u8 type, u8 code, __u32 info)
+{
 }
 #endif
 

diff --git a/include/net/icmp.h b/include/net/icmp.h
index 5d4bfdba9adf03759affb01617245a290e339a8f..9ac2d2672a938626b28ccbd7e8d5095bcf2910f5 100644 (file)
--- a/include/net/icmp.h
+++ b/include/net/icmp.h
@@ -43,6 +43,12 @@ static inline void icmp_send(struct sk_buff *skb_in, int type, int code, __be32
        __icmp_send(skb_in, type, code, info, &IPCB(skb_in)->opt);
 }
 
+#if IS_ENABLED(CONFIG_NF_NAT)
+void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info);
+#else
+#define icmp_ndo_send icmp_send
+#endif
+
 int icmp_rcv(struct sk_buff *skb);
 int icmp_err(struct sk_buff *skb, u32 info);
 int icmp_init(void);

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 18068ed42f258349a07248a85acdf93b8c2f1749..f369e7ce685b8374eae04d0ca0c5508463c5e72f 100644 (file)
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -748,6 +748,39 @@ out:;
 }
 EXPORT_SYMBOL(__icmp_send);
 
+#if IS_ENABLED(CONFIG_NF_NAT)
+#include <net/netfilter/nf_conntrack.h>
+void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info)
+{
+       struct sk_buff *cloned_skb = NULL;
+       enum ip_conntrack_info ctinfo;
+       struct nf_conn *ct;
+       __be32 orig_ip;
+
+       ct = nf_ct_get(skb_in, &ctinfo);
+       if (!ct || !(ct->status & IPS_SRC_NAT)) {
+               icmp_send(skb_in, type, code, info);
+               return;
+       }
+
+       if (skb_shared(skb_in))
+               skb_in = cloned_skb = skb_clone(skb_in, GFP_ATOMIC);
+
+       if (unlikely(!skb_in || skb_network_header(skb_in) < skb_in->head ||
+           (skb_network_header(skb_in) + sizeof(struct iphdr)) >
+           skb_tail_pointer(skb_in) || skb_ensure_writable(skb_in,
+           skb_network_offset(skb_in) + sizeof(struct iphdr))))
+               goto out;
+
+       orig_ip = ip_hdr(skb_in)->saddr;
+       ip_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.ip;
+       icmp_send(skb_in, type, code, info);
+       ip_hdr(skb_in)->saddr = orig_ip;
+out:
+       consume_skb(cloned_skb);
+}
+EXPORT_SYMBOL(icmp_ndo_send);
+#endif
 
 static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
 {

diff --git a/net/ipv6/ip6_icmp.c b/net/ipv6/ip6_icmp.c
index 02045494c24cccaa8b50af839aae975695319922..e0086758b6ee3c3e91568e59028838c770fac795 100644 (file)
--- a/net/ipv6/ip6_icmp.c
+++ b/net/ipv6/ip6_icmp.c
@@ -45,4 +45,38 @@ out:
        rcu_read_unlock();
 }
 EXPORT_SYMBOL(icmpv6_send);
+
+#if IS_ENABLED(CONFIG_NF_NAT)
+#include <net/netfilter/nf_conntrack.h>
+void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info)
+{
+       struct sk_buff *cloned_skb = NULL;
+       enum ip_conntrack_info ctinfo;
+       struct in6_addr orig_ip;
+       struct nf_conn *ct;
+
+       ct = nf_ct_get(skb_in, &ctinfo);
+       if (!ct || !(ct->status & IPS_SRC_NAT)) {
+               icmpv6_send(skb_in, type, code, info);
+               return;
+       }
+
+       if (skb_shared(skb_in))
+               skb_in = cloned_skb = skb_clone(skb_in, GFP_ATOMIC);
+
+       if (unlikely(!skb_in || skb_network_header(skb_in) < skb_in->head ||
+           (skb_network_header(skb_in) + sizeof(struct ipv6hdr)) >
+           skb_tail_pointer(skb_in) || skb_ensure_writable(skb_in,
+           skb_network_offset(skb_in) + sizeof(struct ipv6hdr))))
+               goto out;
+
+       orig_ip = ipv6_hdr(skb_in)->saddr;
+       ipv6_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.in6;
+       icmpv6_send(skb_in, type, code, info);
+       ipv6_hdr(skb_in)->saddr = orig_ip;
+out:
+       consume_skb(cloned_skb);
+}
+EXPORT_SYMBOL(icmpv6_ndo_send);
+#endif
 #endif