![Florian Westphal](/assets/img/avatar_default.png)
Back in the day, skb_ensure_writable did not exist. By now, both functions have the same precondition: I. skb_make_writable will test in this order: 1. wlen > skb->len -> error 2. if not cloned and wlen <= headlen -> OK 3. If cloned and wlen bytes of clone writeable -> OK After those checks, skb is either not cloned but needs to pull from nonlinear area, or writing to head would also alter data of another clone. In both cases skb_make_writable will then call __pskb_pull_tail, which will kmalloc a new memory area to use for skb->head. IOW, after successful skb_make_writable call, the requested length is in linear area and can be modified, even if skb was cloned. II. skb_ensure_writable will do this instead: 1. call pskb_may_pull. This handles case 1 above. After this, wlen is in linear area, but skb might be cloned. 2. return if skb is not cloned 3. return if wlen byte of clone are writeable. 4. fully copy the skb. So post-conditions are the same: *len bytes are writeable in linear area without altering any payload data of a clone, all header pointers might have been changed. Only differences are that skb_ensure_writable is in the core, whereas skb_make_writable lives in netfilter core and the inverted return value. skb_make_writable returns 0 on error, whereas skb_ensure_writable returns negative value. For the normal cases performance is similar: A. skb is not cloned and in linear area: pskb_may_pull is inline helper, so neither function copies. B. skb is cloned, write is in linear area and clone is writeable: both funcions return with step 3. This series removes skb_make_writable from the kernel. While at it, pass the needed value instead, its less confusing that way: There is no special-handling of "0-length" argument in either skb_make_writable or skb_ensure_writable. bridge already makes sure ethernet header is in linear area, only purpose of the make_writable() is is to copy skb->head in case of cloned skbs. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
96 lines
2.3 KiB
C
96 lines
2.3 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* ebt_dnat
|
|
*
|
|
* Authors:
|
|
* Bart De Schuymer <bdschuym@pandora.be>
|
|
*
|
|
* June, 2002
|
|
*
|
|
*/
|
|
#include <linux/module.h>
|
|
#include <net/sock.h>
|
|
#include "../br_private.h"
|
|
#include <linux/netfilter.h>
|
|
#include <linux/netfilter/x_tables.h>
|
|
#include <linux/netfilter_bridge/ebtables.h>
|
|
#include <linux/netfilter_bridge/ebt_nat.h>
|
|
|
|
static unsigned int
|
|
ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
|
|
{
|
|
const struct ebt_nat_info *info = par->targinfo;
|
|
struct net_device *dev;
|
|
|
|
if (skb_ensure_writable(skb, ETH_ALEN))
|
|
return EBT_DROP;
|
|
|
|
ether_addr_copy(eth_hdr(skb)->h_dest, info->mac);
|
|
|
|
if (is_multicast_ether_addr(info->mac)) {
|
|
if (is_broadcast_ether_addr(info->mac))
|
|
skb->pkt_type = PACKET_BROADCAST;
|
|
else
|
|
skb->pkt_type = PACKET_MULTICAST;
|
|
} else {
|
|
if (xt_hooknum(par) != NF_BR_BROUTING)
|
|
dev = br_port_get_rcu(xt_in(par))->br->dev;
|
|
else
|
|
dev = xt_in(par);
|
|
|
|
if (ether_addr_equal(info->mac, dev->dev_addr))
|
|
skb->pkt_type = PACKET_HOST;
|
|
else
|
|
skb->pkt_type = PACKET_OTHERHOST;
|
|
}
|
|
|
|
return info->target;
|
|
}
|
|
|
|
static int ebt_dnat_tg_check(const struct xt_tgchk_param *par)
|
|
{
|
|
const struct ebt_nat_info *info = par->targinfo;
|
|
unsigned int hook_mask;
|
|
|
|
if (BASE_CHAIN && info->target == EBT_RETURN)
|
|
return -EINVAL;
|
|
|
|
hook_mask = par->hook_mask & ~(1 << NF_BR_NUMHOOKS);
|
|
if ((strcmp(par->table, "nat") != 0 ||
|
|
(hook_mask & ~((1 << NF_BR_PRE_ROUTING) |
|
|
(1 << NF_BR_LOCAL_OUT)))) &&
|
|
(strcmp(par->table, "broute") != 0 ||
|
|
hook_mask & ~(1 << NF_BR_BROUTING)))
|
|
return -EINVAL;
|
|
if (ebt_invalid_target(info->target))
|
|
return -EINVAL;
|
|
return 0;
|
|
}
|
|
|
|
static struct xt_target ebt_dnat_tg_reg __read_mostly = {
|
|
.name = "dnat",
|
|
.revision = 0,
|
|
.family = NFPROTO_BRIDGE,
|
|
.hooks = (1 << NF_BR_NUMHOOKS) | (1 << NF_BR_PRE_ROUTING) |
|
|
(1 << NF_BR_LOCAL_OUT) | (1 << NF_BR_BROUTING),
|
|
.target = ebt_dnat_tg,
|
|
.checkentry = ebt_dnat_tg_check,
|
|
.targetsize = sizeof(struct ebt_nat_info),
|
|
.me = THIS_MODULE,
|
|
};
|
|
|
|
static int __init ebt_dnat_init(void)
|
|
{
|
|
return xt_register_target(&ebt_dnat_tg_reg);
|
|
}
|
|
|
|
static void __exit ebt_dnat_fini(void)
|
|
{
|
|
xt_unregister_target(&ebt_dnat_tg_reg);
|
|
}
|
|
|
|
module_init(ebt_dnat_init);
|
|
module_exit(ebt_dnat_fini);
|
|
MODULE_DESCRIPTION("Ebtables: Destination MAC address translation");
|
|
MODULE_LICENSE("GPL");
|