lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

netfilter: ebt_ip6: allow matching on ipv6-icmp types/codes

Browse Source 
To avoid adding a new match revision icmp type/code are stored
in the sport/dport area.

Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Holger Eitzenberger <holger@eitzenberger.org>
Reviewed-by: Bart De Schuymer<bdschuym@pandora.be>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal
2010-12-20 15:57:47 +01:00
committed by Pablo Neira Ayuso
parent 255d0dc340
commit 6faee60a4e
2 changed files with 46 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
include/linux/netfilter_bridge/ebt_ip6.h
View File

@@ -18,8 +18,11 @@
#define EBT_IP6_PROTO 0x08 #define EBT_IP6_PROTO 0x08
#define EBT_IP6_SPORT 0x10 #define EBT_IP6_SPORT 0x10
#define EBT_IP6_DPORT 0x20 #define EBT_IP6_DPORT 0x20
#define EBT_IP6_ICMP6 0x40
#define EBT_IP6_MASK (EBT_IP6_SOURCE | EBT_IP6_DEST | EBT_IP6_TCLASS |\ #define EBT_IP6_MASK (EBT_IP6_SOURCE | EBT_IP6_DEST | EBT_IP6_TCLASS |\
EBT_IP6_PROTO | EBT_IP6_SPORT | EBT_IP6_DPORT) EBT_IP6_PROTO | EBT_IP6_SPORT | EBT_IP6_DPORT | \
EBT_IP6_ICMP6)
#define EBT_IP6_MATCH "ip6" #define EBT_IP6_MATCH "ip6"
/* the same values are used for the invflags */ /* the same values are used for the invflags */
@@ -32,8 +35,14 @@ struct ebt_ip6_info {
uint8_t protocol; uint8_t protocol;
uint8_t bitmask; uint8_t bitmask;
uint8_t invflags; uint8_t invflags;
union {
uint16_t sport[2]; uint16_t sport[2];
uint8_t icmpv6_type[2];
};
union {
uint16_t dport[2]; uint16_t dport[2];
uint8_t icmpv6_code[2];
};
}; };
#endif #endif

42
net/bridge/netfilter/ebt_ip6.c
View File

@@ -22,9 +22,15 @@
#include <linux/netfilter_bridge/ebtables.h> #include <linux/netfilter_bridge/ebtables.h>
#include <linux/netfilter_bridge/ebt_ip6.h> #include <linux/netfilter_bridge/ebt_ip6.h>
struct tcpudphdr { union pkthdr {
struct {
__be16 src; __be16 src;
__be16 dst; __be16 dst;
} tcpudphdr;
struct {
u8 type;
u8 code;
} icmphdr;
}; };
static bool static bool
@@ -33,8 +39,8 @@ ebt_ip6_mt(const struct sk_buff *skb, struct xt_action_param *par)
const struct ebt_ip6_info *info = par->matchinfo; const struct ebt_ip6_info *info = par->matchinfo;
const struct ipv6hdr *ih6; const struct ipv6hdr *ih6;
struct ipv6hdr _ip6h; struct ipv6hdr _ip6h;
const struct tcpudphdr *pptr; const union pkthdr *pptr;
struct tcpudphdr _ports; union pkthdr _pkthdr;
ih6 = skb_header_pointer(skb, 0, sizeof(_ip6h), &_ip6h); ih6 = skb_header_pointer(skb, 0, sizeof(_ip6h), &_ip6h);
if (ih6 == NULL) if (ih6 == NULL)
@@ -56,26 +62,34 @@ ebt_ip6_mt(const struct sk_buff *skb, struct xt_action_param *par)
return false; return false;
if (FWINV(info->protocol != nexthdr, EBT_IP6_PROTO)) if (FWINV(info->protocol != nexthdr, EBT_IP6_PROTO))
return false; return false;
if (!(info->bitmask & EBT_IP6_DPORT) && if (!(info->bitmask & ( EBT_IP6_DPORT |
!(info->bitmask & EBT_IP6_SPORT)) EBT_IP6_SPORT | EBT_IP6_ICMP6)))
return true; return true;
pptr = skb_header_pointer(skb, offset_ph, sizeof(_ports),
&_ports); /* min icmpv6 headersize is 4, so sizeof(_pkthdr) is ok. */
pptr = skb_header_pointer(skb, offset_ph, sizeof(_pkthdr),
&_pkthdr);
if (pptr == NULL) if (pptr == NULL)
return false; return false;
if (info->bitmask & EBT_IP6_DPORT) { if (info->bitmask & EBT_IP6_DPORT) {
u32 dst = ntohs(pptr->dst); u16 dst = ntohs(pptr->tcpudphdr.dst);
if (FWINV(dst < info->dport[0] || if (FWINV(dst < info->dport[0] ||
dst > info->dport[1], EBT_IP6_DPORT)) dst > info->dport[1], EBT_IP6_DPORT))
return false; return false;
} }
if (info->bitmask & EBT_IP6_SPORT) { if (info->bitmask & EBT_IP6_SPORT) {
u32 src = ntohs(pptr->src); u16 src = ntohs(pptr->tcpudphdr.src);
if (FWINV(src < info->sport[0] || if (FWINV(src < info->sport[0] ||
src > info->sport[1], EBT_IP6_SPORT)) src > info->sport[1], EBT_IP6_SPORT))
return false; return false;
} }
return true; if ((info->bitmask & EBT_IP6_ICMP6) &&
FWINV(pptr->icmphdr.type < info->icmpv6_type[0] ||
pptr->icmphdr.type > info->icmpv6_type[1] ||
pptr->icmphdr.code < info->icmpv6_code[0] ||
pptr->icmphdr.code > info->icmpv6_code[1],
EBT_IP6_ICMP6))
return false;
} }
return true; return true;
} }
@@ -103,6 +117,14 @@ static int ebt_ip6_mt_check(const struct xt_mtchk_param *par)
return -EINVAL; return -EINVAL;
if (info->bitmask & EBT_IP6_SPORT && info->sport[0] > info->sport[1]) if (info->bitmask & EBT_IP6_SPORT && info->sport[0] > info->sport[1])
return -EINVAL; return -EINVAL;
if (info->bitmask & EBT_IP6_ICMP6) {
if ((info->invflags & EBT_IP6_PROTO) ||
info->protocol != IPPROTO_ICMPV6)
return -EINVAL;
if (info->icmpv6_type[0] > info->icmpv6_type[1] ||
info->icmpv6_code[0] > info->icmpv6_code[1])
return -EINVAL;
}
return 0; return 0;
} }