Patrick McHardy
e281e3ac2b
The NAT changes in 2.6.11 changed the position where helpers are called and perform packet mangling. Before 2.6.11, a NAT helper was called before the packet was NATed and had its sequence number adjusted. Since 2.6.11, the helpers get packets with already adjusted sequence numbers. This breaks sequence number adjustment, adjust_tcp_sequence() needs the original sequence number to determine whether a packet was a retransmission and to store it for further corrections. It can't be reconstructed without more information than available, so this patch restores the old order by calling helpers from a new conntrack hook two priorities below ip_conntrack_confirm() and adjusting the sequence number from a new NAT hook one priority below ip_conntrack_confirm(). Tracked down by Phil Oester <kernel@linuxace.com> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
94 lines
2.6 KiB
C
94 lines
2.6 KiB
C
#ifndef __LINUX_IP_NETFILTER_H
|
|
#define __LINUX_IP_NETFILTER_H
|
|
|
|
/* IPv4-specific defines for netfilter.
|
|
* (C)1998 Rusty Russell -- This code is GPL.
|
|
*/
|
|
|
|
#include <linux/config.h>
|
|
#include <linux/netfilter.h>
|
|
|
|
/* IP Cache bits. */
|
|
/* Src IP address. */
|
|
#define NFC_IP_SRC 0x0001
|
|
/* Dest IP address. */
|
|
#define NFC_IP_DST 0x0002
|
|
/* Input device. */
|
|
#define NFC_IP_IF_IN 0x0004
|
|
/* Output device. */
|
|
#define NFC_IP_IF_OUT 0x0008
|
|
/* TOS. */
|
|
#define NFC_IP_TOS 0x0010
|
|
/* Protocol. */
|
|
#define NFC_IP_PROTO 0x0020
|
|
/* IP options. */
|
|
#define NFC_IP_OPTIONS 0x0040
|
|
/* Frag & flags. */
|
|
#define NFC_IP_FRAG 0x0080
|
|
|
|
/* Per-protocol information: only matters if proto match. */
|
|
/* TCP flags. */
|
|
#define NFC_IP_TCPFLAGS 0x0100
|
|
/* Source port. */
|
|
#define NFC_IP_SRC_PT 0x0200
|
|
/* Dest port. */
|
|
#define NFC_IP_DST_PT 0x0400
|
|
/* Something else about the proto */
|
|
#define NFC_IP_PROTO_UNKNOWN 0x2000
|
|
|
|
/* IP Hooks */
|
|
/* After promisc drops, checksum checks. */
|
|
#define NF_IP_PRE_ROUTING 0
|
|
/* If the packet is destined for this box. */
|
|
#define NF_IP_LOCAL_IN 1
|
|
/* If the packet is destined for another interface. */
|
|
#define NF_IP_FORWARD 2
|
|
/* Packets coming from a local process. */
|
|
#define NF_IP_LOCAL_OUT 3
|
|
/* Packets about to hit the wire. */
|
|
#define NF_IP_POST_ROUTING 4
|
|
#define NF_IP_NUMHOOKS 5
|
|
|
|
enum nf_ip_hook_priorities {
|
|
NF_IP_PRI_FIRST = INT_MIN,
|
|
NF_IP_PRI_CONNTRACK_DEFRAG = -400,
|
|
NF_IP_PRI_RAW = -300,
|
|
NF_IP_PRI_SELINUX_FIRST = -225,
|
|
NF_IP_PRI_CONNTRACK = -200,
|
|
NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
|
|
NF_IP_PRI_MANGLE = -150,
|
|
NF_IP_PRI_NAT_DST = -100,
|
|
NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT = -50,
|
|
NF_IP_PRI_FILTER = 0,
|
|
NF_IP_PRI_NAT_SRC = 100,
|
|
NF_IP_PRI_SELINUX_LAST = 225,
|
|
NF_IP_PRI_CONNTRACK_HELPER = INT_MAX - 2,
|
|
NF_IP_PRI_NAT_SEQ_ADJUST = INT_MAX - 1,
|
|
NF_IP_PRI_CONNTRACK_CONFIRM = INT_MAX,
|
|
NF_IP_PRI_LAST = INT_MAX,
|
|
};
|
|
|
|
/* Arguments for setsockopt SOL_IP: */
|
|
/* 2.0 firewalling went from 64 through 71 (and +256, +512, etc). */
|
|
/* 2.2 firewalling (+ masq) went from 64 through 76 */
|
|
/* 2.4 firewalling went 64 through 67. */
|
|
#define SO_ORIGINAL_DST 80
|
|
|
|
#ifdef __KERNEL__
|
|
#ifdef CONFIG_NETFILTER_DEBUG
|
|
void nf_debug_ip_local_deliver(struct sk_buff *skb);
|
|
void nf_debug_ip_loopback_xmit(struct sk_buff *newskb);
|
|
void nf_debug_ip_finish_output2(struct sk_buff *skb);
|
|
#endif /*CONFIG_NETFILTER_DEBUG*/
|
|
|
|
extern int ip_route_me_harder(struct sk_buff **pskb);
|
|
|
|
/* Call this before modifying an existing IP packet: ensures it is
|
|
modifiable and linear to the point you care about (writable_len).
|
|
Returns true or false. */
|
|
extern int skb_ip_make_writable(struct sk_buff **pskb,
|
|
unsigned int writable_len);
|
|
#endif /*__KERNEL__*/
|
|
|
|
#endif /*__LINUX_IP_NETFILTER_H*/
|