From: Jesper Dangaard Brouer <jbrouer@redhat•com>
To: Patrick McHardy <kaber@trash•net>
Cc: pablo@netfilter•org, netfilter-devel@vger•kernel.org,
netdev@vger•kernel.org, mph@one•com, as@one•com
Subject: Re: [PATCH 5/5] netfilter: add IPv6 SYNPROXY target
Date: Wed, 7 Aug 2013 22:34:40 +0200 [thread overview]
Message-ID: <20130807223440.0a40a7c1@redhat.com> (raw)
In-Reply-To: <1375897371-18430-6-git-send-email-kaber@trash.net>
On Wed, 7 Aug 2013 19:42:51 +0200 Patrick McHardy <kaber@trash•net> wrote:
> Add an IPv6 version of the SYNPROXY target. The main differences to
> the IPv4 version is routing and IP header construction.
>
> Signed-off-by: Patrick McHardy <kaber@trash•net>
[...]
> diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c
> b/net/ipv6/netfilter/ip6t_SYNPROXY.c new file mode 100644
> index 0000000..ee773da
> --- /dev/null
> +++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
[...]
> +static void
> +synproxy_send_server_syn(const struct synproxy_net *snet,
> + const struct sk_buff *skb, const struct tcphdr *th,
> + const struct synproxy_options *opts)
> +{
> + struct sk_buff *nskb;
> + struct ipv6hdr *iph, *niph;
> + struct tcphdr *nth;
> + unsigned int tcp_hdr_size;
> +
> + iph = ipv6_hdr(skb);
> +
> + tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
> + nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + LL_MAX_HEADER,
> + GFP_ATOMIC);
> + if (nskb == NULL)
> + return;
> + skb_reserve(nskb, LL_MAX_HEADER);
> +
> + niph = synproxy_build_ip(nskb, &iph->saddr, &iph->daddr);
> +
> + skb_reset_transport_header(nskb);
> + nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
> + nth->source = th->source;
> + nth->dest = th->dest;
> + nth->seq = htonl(ntohl(th->seq) - 1);
> + nth->ack_seq = htonl(ntohl(th->ack_seq) - 1);;
Strange double ";;".
And as IPv4, shouldn't this be zero? I might be wrong...
> + tcp_flag_word(nth) = TCP_FLAG_SYN;
> + if (opts->options & XT_SYNPROXY_OPT_ECN)
> + tcp_flag_word(nth) |= TCP_FLAG_ECE | TCP_FLAG_CWR;
> + nth->doff = tcp_hdr_size / 4;
> + nth->window = th->window;
> + nth->check = 0;
> + nth->urg_ptr = 0;
> +
> + synproxy_build_options(nth, opts);
> +
> + synproxy_send_tcp(skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
> + niph, nth, tcp_hdr_size);
> +}
> +
> +static void
> +synproxy_send_server_ack(const struct synproxy_net *snet,
> + const struct ip_ct_tcp *state,
> + const struct sk_buff *skb, const struct tcphdr *th,
> + const struct synproxy_options *opts)
> +{
> + struct sk_buff *nskb;
> + struct ipv6hdr *iph, *niph;
> + struct tcphdr *nth;
> + unsigned int tcp_hdr_size;
> +
> + iph = ipv6_hdr(skb);
> +
> + tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
> + nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + LL_MAX_HEADER,
> + GFP_ATOMIC);
> + if (nskb == NULL)
> + return;
> + skb_reserve(nskb, LL_MAX_HEADER);
> +
> + niph = synproxy_build_ip(nskb, &iph->daddr, &iph->saddr);
> +
> + skb_reset_transport_header(nskb);
> + nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
> + nth->source = th->dest;
> + nth->dest = th->source;
> + nth->seq = htonl(ntohl(th->ack_seq));
> + nth->ack_seq = htonl(ntohl(th->seq) + 1);;
Strange double ";;"
> + tcp_flag_word(nth) = TCP_FLAG_ACK;
> + nth->doff = tcp_hdr_size / 4;
> + nth->window =
> htons(state->seen[IP_CT_DIR_ORIGINAL].td_maxwin);
> + nth->check = 0;
> + nth->urg_ptr = 0;
> +
> + synproxy_build_options(nth, opts);
> +
> + synproxy_send_tcp(skb, nskb, skb->nfct, IP_CT_ESTABLISHED,
> + niph, nth, tcp_hdr_size);
> +}
> +
> +static int synproxy_tg6_check(const struct xt_tgchk_param *par)
> +{
> + /// XXX PROTO match TCP
Ups, this looks like an comment to your self ;-)
> + return nf_ct_l3proto_try_module_get(par->family);
> +}
--
Best regards,
Jesper Dangaard Brouer
MSc.CS, Sr. Network Kernel Developer at Red Hat
Author of http://www.iptv-analyzer.org
LinkedIn: http://www.linkedin.com/in/brouer
next prev parent reply other threads:[~2013-08-07 20:34 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-08-07 17:42 [PATCH RFC 0/5] netfilter: implement netfilter SYN proxy Patrick McHardy
2013-08-07 17:42 ` [PATCH 1/5] netfilter: nf_conntrack: make sequence number adjustments usuable without NAT Patrick McHardy
2013-08-07 20:02 ` Jesper Dangaard Brouer
2013-08-07 17:42 ` [PATCH 2/5] net: syncookies: export cookie_v4_init_sequence/cookie_v4_check Patrick McHardy
2013-08-07 20:03 ` Jesper Dangaard Brouer
2013-08-07 17:42 ` [PATCH 3/5] netfilter: add SYNPROXY core/target Patrick McHardy
2013-08-07 20:26 ` Jesper Dangaard Brouer
2013-08-07 20:56 ` Patrick McHardy
2013-08-08 6:22 ` Patrick McHardy
2013-08-08 15:07 ` Jesper Dangaard Brouer
2013-08-08 8:04 ` Jesper Dangaard Brouer
2013-08-08 8:24 ` Patrick McHardy
2013-08-07 22:11 ` Eric Dumazet
2013-08-07 23:37 ` Patrick McHardy
2013-08-08 6:34 ` Patrick McHardy
2013-08-07 17:42 ` [PATCH 4/5] net: syncookies: export cookie_v6_init_sequence/cookie_v6_check Patrick McHardy
2013-08-07 20:27 ` Jesper Dangaard Brouer
2013-08-07 17:42 ` [PATCH 5/5] netfilter: add IPv6 SYNPROXY target Patrick McHardy
2013-08-07 20:34 ` Jesper Dangaard Brouer [this message]
2013-08-07 20:57 ` Patrick McHardy
2013-08-07 18:06 ` [PATCH RFC 0/5] netfilter: implement netfilter SYN proxy Eric Dumazet
2013-08-07 20:59 ` Patrick McHardy
2013-08-07 21:05 ` Hannes Frederic Sowa
2013-08-07 21:24 ` Patrick McHardy
2013-08-07 21:39 ` Eric Dumazet
2013-08-07 23:40 ` David Miller
2013-08-08 0:04 ` Hannes Frederic Sowa
2013-08-08 0:13 ` Patrick McHardy
2013-08-09 13:55 ` Neal Cardwell
-- strict thread matches above, loose matches on Subject: below --
2013-08-27 6:50 [PATCH 0/5] netfilter: SYNPROXY target v3 Patrick McHardy
2013-08-27 6:50 ` [PATCH 5/5] netfilter: add IPv6 SYNPROXY target Patrick McHardy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130807223440.0a40a7c1@redhat.com \
--to=jbrouer@redhat$(echo .)com \
--cc=as@one$(echo .)com \
--cc=kaber@trash$(echo .)net \
--cc=mph@one$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=netfilter-devel@vger$(echo .)kernel.org \
--cc=pablo@netfilter$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox