<div> hello, all:<br>I have been reseach on tproxy(for kernel-2.6.24) these days. <br>And I found that Tproxy sets skb->mark and skb->sk first (both the TPROXY target and socket match do the same), <br>then hand packets to non-local sockets rely on policy routing. <br><br>Today I saw that Tproxy has modified ip_route_me_harder, it inserted lines of code to ip_route_me_harder like following:<br>so, what does ip_route_me_harder used for, why Tproxy modified those codes. thanks very much! <br><br>/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */<br>int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)<br>{<br> const struct iphdr *iph = ip_hdr(skb);<br> struct rtable *rt;<br> struct flowi fl = {};<br> struct dst_entry *odst;<br> unsigned int hh_len;<br> unsigned int type;<br><br> type = inet_addr_type(iph->saddr);<br> <u><font color="#800000"><b>if (skb->sk && inet_sk(skb->sk)->transparent) //TPROXY ADDED <br> type = RTN_LOCAL;</b></font></u><br> if (addr_type == RTN_UNSPEC)<br> addr_type = type;<br><br> /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause<br> * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.<br> */<br> if (addr_type == RTN_LOCAL) {<br> fl.nl_u.ip4_u.daddr = iph->daddr;<br> if (type == RTN_LOCAL)<br> fl.nl_u.ip4_u.saddr = iph->saddr;<br> fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);<br> fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;<br> fl.mark = skb->mark;<br> <u> <font color="#800000"><b> fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;</b></font></u> //TPROXY ADDED<br> if (ip_route_output_key(&rt, &fl) != 0)<br> return -1;<br><br> /* Drop old route. */<br> dst_release(skb->dst);<br> skb->dst = &rt->u.dst;<br> } else {<br> /* non-local src, find valid iif to satisfy<br> * rp-filter when calling ip_route_input. */<br> fl.nl_u.ip4_u.daddr = iph->saddr;<br> if (ip_route_output_key(&rt, &fl) != 0)<br> return -1;<br><br> odst = skb->dst;<br> if (ip_route_input(skb, iph->daddr, iph->saddr,<br> RT_TOS(iph->tos), rt->u.dst.dev) != 0) {<br> dst_release(&rt->u.dst);<br> return -1;<br> }<br> dst_release(&rt->udst);<br> dst_release(odst);<br> }<br><br> if (skb->dst->error)<br> return -1;<br><br>#ifdef CONFIG_XFRM<br> if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&<br> xfrm_decode_session(skb, &fl, AF_INET) == 0)<br> if (xfrm_lookup(&skb->dst, &fl, skb->sk, 0))<br> return -1;<br>#endif<br><br> /* Change in oif may mean change in hh_len. */<br> hh_len = skb->dst->dev->hard_header_len;<br> if (skb_headroom(skb) < hh_len &&<br> pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))<br> return -1;<br><br> return 0;<br>}<br><br>regards.<br></div><div> </div><br><!-- footer --><br>
<hr>
<font style="font-size:12px;line-height:15px;">[广告] </font><font style="font-size:12px;line-height:15px;">购卡罗拉、花冠EX、威驰，即送价值</font><a style="font-size:12px;line-height:15px; color:blue; text-decoration:underline;" href="http://popme.163.com/link/004992_1211_6738.html">3500元专属导航仪</a>