Commit d24f22f3 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller

ip6_tunnel: add optional fwmark inherit

Add IP6_TNL_F_USE_ORIG_FWMARK to ip6_tunnel, so that ip6_tnl_xmit2()
makes a route lookup taking into account skb->fwmark and doesnt cache
lookup result.

This permits more flexibility in policies and firewall setups.

To setup such a tunnel, "fwmark inherit" option should be added to "ip
-f inet6 tunnel" command.
Reported-by: default avatarAnders Franzen <Anders.Franzen@ericsson.com>
CC: Hans Schillström <hans.schillstrom@ericsson.com>
Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 46151ae8
...@@ -16,6 +16,8 @@ ...@@ -16,6 +16,8 @@
#define IP6_TNL_F_MIP6_DEV 0x8 #define IP6_TNL_F_MIP6_DEV 0x8
/* copy DSCP from the outer packet */ /* copy DSCP from the outer packet */
#define IP6_TNL_F_RCV_DSCP_COPY 0x10 #define IP6_TNL_F_RCV_DSCP_COPY 0x10
/* copy fwmark from inner packet */
#define IP6_TNL_F_USE_ORIG_FWMARK 0x20
struct ip6_tnl_parm { struct ip6_tnl_parm {
char name[IFNAMSIZ]; /* name of tunnel device */ char name[IFNAMSIZ]; /* name of tunnel device */
......
...@@ -889,7 +889,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb, ...@@ -889,7 +889,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
struct net_device_stats *stats = &t->dev->stats; struct net_device_stats *stats = &t->dev->stats;
struct ipv6hdr *ipv6h = ipv6_hdr(skb); struct ipv6hdr *ipv6h = ipv6_hdr(skb);
struct ipv6_tel_txoption opt; struct ipv6_tel_txoption opt;
struct dst_entry *dst, *ndst = NULL; struct dst_entry *dst = NULL, *ndst = NULL;
struct net_device *tdev; struct net_device *tdev;
int mtu; int mtu;
unsigned int max_headroom = sizeof(struct ipv6hdr); unsigned int max_headroom = sizeof(struct ipv6hdr);
...@@ -897,6 +897,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb, ...@@ -897,6 +897,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
int err = -1; int err = -1;
int pkt_len; int pkt_len;
if (!fl6->flowi6_mark)
dst = ip6_tnl_dst_check(t); dst = ip6_tnl_dst_check(t);
if (!dst) { if (!dst) {
ndst = ip6_route_output(net, NULL, fl6); ndst = ip6_route_output(net, NULL, fl6);
...@@ -955,8 +956,12 @@ static int ip6_tnl_xmit2(struct sk_buff *skb, ...@@ -955,8 +956,12 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
skb = new_skb; skb = new_skb;
} }
skb_dst_drop(skb); skb_dst_drop(skb);
if (fl6->flowi6_mark) {
skb_dst_set(skb, dst);
ndst = NULL;
} else {
skb_dst_set_noref(skb, dst); skb_dst_set_noref(skb, dst);
}
skb->transport_header = skb->network_header; skb->transport_header = skb->network_header;
proto = fl6->flowi6_proto; proto = fl6->flowi6_proto;
...@@ -1021,9 +1026,11 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -1021,9 +1026,11 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
dsfield = ipv4_get_dsfield(iph); dsfield = ipv4_get_dsfield(iph);
if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)) if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT) fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
& IPV6_TCLASS_MASK; & IPV6_TCLASS_MASK;
if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
fl6.flowi6_mark = skb->mark;
err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu); err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
if (err != 0) { if (err != 0) {
...@@ -1070,10 +1077,12 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -1070,10 +1077,12 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
fl6.flowi6_proto = IPPROTO_IPV6; fl6.flowi6_proto = IPPROTO_IPV6;
dsfield = ipv6_get_dsfield(ipv6h); dsfield = ipv6_get_dsfield(ipv6h);
if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)) if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK); fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
if ((t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)) if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK); fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);
if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
fl6.flowi6_mark = skb->mark;
err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu); err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
if (err != 0) { if (err != 0) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment