Commit f5a41847 authored by Julian Anastasov's avatar Julian Anastasov Committed by Simon Horman

ipvs: move ip_route_me_harder for ICMP

 	Currently, ip_route_me_harder after ip_vs_out_icmp
is called even if packet is not related to IPVS connection.
Move it into handle_response_icmp. Also, force rerouting
if sending to local client because IPv4 stack uses addresses
from the route.
Signed-off-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarSimon Horman <horms@verge.net.au>
parent 1ca5bb54
...@@ -702,6 +702,17 @@ static int handle_response_icmp(int af, struct sk_buff *skb, ...@@ -702,6 +702,17 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
#endif #endif
ip_vs_nat_icmp(skb, pp, cp, 1); ip_vs_nat_icmp(skb, pp, cp, 1);
#ifdef CONFIG_IP_VS_IPV6
if (af == AF_INET6) {
if (sysctl_ip_vs_snat_reroute && ip6_route_me_harder(skb) != 0)
goto out;
} else
#endif
if ((sysctl_ip_vs_snat_reroute ||
skb_rtable(skb)->rt_flags & RTCF_LOCAL) &&
ip_route_me_harder(skb, RTN_LOCAL) != 0)
goto out;
/* do the statistics and put it back */ /* do the statistics and put it back */
ip_vs_out_stats(cp, skb); ip_vs_out_stats(cp, skb);
...@@ -940,16 +951,16 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, ...@@ -940,16 +951,16 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
* if it came from this machine itself. So re-compute * if it came from this machine itself. So re-compute
* the routing information. * the routing information.
*/ */
if (sysctl_ip_vs_snat_reroute) {
#ifdef CONFIG_IP_VS_IPV6 #ifdef CONFIG_IP_VS_IPV6
if (af == AF_INET6) { if (af == AF_INET6) {
if (ip6_route_me_harder(skb) != 0) if (sysctl_ip_vs_snat_reroute && ip6_route_me_harder(skb) != 0)
goto drop; goto drop;
} else } else
#endif #endif
if (ip_route_me_harder(skb, RTN_LOCAL) != 0) if ((sysctl_ip_vs_snat_reroute ||
skb_rtable(skb)->rt_flags & RTCF_LOCAL) &&
ip_route_me_harder(skb, RTN_LOCAL) != 0)
goto drop; goto drop;
}
IP_VS_DBG_PKT(10, pp, skb, 0, "After SNAT"); IP_VS_DBG_PKT(10, pp, skb, 0, "After SNAT");
...@@ -1001,13 +1012,8 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb, ...@@ -1001,13 +1012,8 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb,
int verdict = ip_vs_out_icmp_v6(skb, &related, int verdict = ip_vs_out_icmp_v6(skb, &related,
hooknum); hooknum);
if (related) { if (related)
if (sysctl_ip_vs_snat_reroute &&
NF_ACCEPT == verdict &&
ip6_route_me_harder(skb))
verdict = NF_DROP;
return verdict; return verdict;
}
ip_vs_fill_iphdr(af, skb_network_header(skb), &iph); ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
} }
} else } else
...@@ -1016,13 +1022,8 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb, ...@@ -1016,13 +1022,8 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb,
int related; int related;
int verdict = ip_vs_out_icmp(skb, &related, hooknum); int verdict = ip_vs_out_icmp(skb, &related, hooknum);
if (related) { if (related)
if (sysctl_ip_vs_snat_reroute &&
NF_ACCEPT == verdict &&
ip_route_me_harder(skb, RTN_LOCAL))
verdict = NF_DROP;
return verdict; return verdict;
}
ip_vs_fill_iphdr(af, skb_network_header(skb), &iph); ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment