From 5ed35a5c1ba233487715cdd40d417a776d709bcd Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Thu, 12 Apr 2018 07:50:02 +0200 Subject: [PATCH] kernel: ebtables: add support for ICMP/IGMP type matches Signed-off-by: Matthias Schiffer --- ...port-for-matching-ICMP-type-and-code.patch | 134 ++++++++++++++++++ ...s-add-support-for-matching-IGMP-type.patch | 88 ++++++++++++ 2 files changed, 222 insertions(+) create mode 100644 target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch create mode 100644 target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch diff --git a/target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch b/target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch new file mode 100644 index 0000000000..fe9c479338 --- /dev/null +++ b/target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch @@ -0,0 +1,134 @@ +From: Matthias Schiffer +Date: Sat, 3 Mar 2018 11:55:21 +0100 +Subject: [PATCH 1/2] ebtables: add support for matching ICMP type and code + +We already have ICMPv6 type/code matches. This adds support for IPv4 ICMP +matches in the same way. + +Signed-off-by: Matthias Schiffer +--- + include/uapi/linux/netfilter_bridge/ebt_ip.h | 13 +++++++-- + net/bridge/netfilter/ebt_ip.c | 43 +++++++++++++++++++++------- + 2 files changed, 43 insertions(+), 13 deletions(-) + +--- a/include/uapi/linux/netfilter_bridge/ebt_ip.h ++++ b/include/uapi/linux/netfilter_bridge/ebt_ip.h +@@ -24,8 +24,9 @@ + #define EBT_IP_PROTO 0x08 + #define EBT_IP_SPORT 0x10 + #define EBT_IP_DPORT 0x20 ++#define EBT_IP_ICMP 0x40 + #define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\ +- EBT_IP_SPORT | EBT_IP_DPORT ) ++ EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP) + #define EBT_IP_MATCH "ip" + + /* the same values are used for the invflags */ +@@ -38,8 +39,14 @@ struct ebt_ip_info { + __u8 protocol; + __u8 bitmask; + __u8 invflags; +- __u16 sport[2]; +- __u16 dport[2]; ++ union { ++ __u16 sport[2]; ++ __u8 icmp_type[2]; ++ }; ++ union { ++ __u16 dport[2]; ++ __u8 icmp_code[2]; ++ }; + }; + + #endif +--- a/net/bridge/netfilter/ebt_ip.c ++++ b/net/bridge/netfilter/ebt_ip.c +@@ -19,9 +19,15 @@ + #include + #include + +-struct tcpudphdr { +- __be16 src; +- __be16 dst; ++union pkthdr { ++ struct { ++ __be16 src; ++ __be16 dst; ++ } tcpudphdr; ++ struct { ++ u8 type; ++ u8 code; ++ } icmphdr; + }; + + static bool +@@ -30,8 +36,8 @@ ebt_ip_mt(const struct sk_buff *skb, str + const struct ebt_ip_info *info = par->matchinfo; + const struct iphdr *ih; + struct iphdr _iph; +- const struct tcpudphdr *pptr; +- struct tcpudphdr _ports; ++ const union pkthdr *pptr; ++ union pkthdr _pkthdr; + + ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); + if (ih == NULL) +@@ -50,29 +56,38 @@ ebt_ip_mt(const struct sk_buff *skb, str + if (info->bitmask & EBT_IP_PROTO) { + if (NF_INVF(info, EBT_IP_PROTO, info->protocol != ih->protocol)) + return false; +- if (!(info->bitmask & EBT_IP_DPORT) && +- !(info->bitmask & EBT_IP_SPORT)) ++ if (!(info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT | ++ EBT_IP_ICMP))) + return true; + if (ntohs(ih->frag_off) & IP_OFFSET) + return false; ++ ++ /* min icmp headersize is 4, so sizeof(_pkthdr) is ok. */ + pptr = skb_header_pointer(skb, ih->ihl*4, +- sizeof(_ports), &_ports); ++ sizeof(_pkthdr), &_pkthdr); + if (pptr == NULL) + return false; + if (info->bitmask & EBT_IP_DPORT) { +- u32 dst = ntohs(pptr->dst); ++ u32 dst = ntohs(pptr->tcpudphdr.dst); + if (NF_INVF(info, EBT_IP_DPORT, + dst < info->dport[0] || + dst > info->dport[1])) + return false; + } + if (info->bitmask & EBT_IP_SPORT) { +- u32 src = ntohs(pptr->src); ++ u32 src = ntohs(pptr->tcpudphdr.src); + if (NF_INVF(info, EBT_IP_SPORT, + src < info->sport[0] || + src > info->sport[1])) + return false; + } ++ if ((info->bitmask & EBT_IP_ICMP) && ++ NF_INVF(info, EBT_IP_ICMP, ++ pptr->icmphdr.type < info->icmp_type[0] || ++ pptr->icmphdr.type > info->icmp_type[1] || ++ pptr->icmphdr.code < info->icmp_code[0] || ++ pptr->icmphdr.code > info->icmp_code[1])) ++ return false; + } + return true; + } +@@ -101,6 +116,14 @@ static int ebt_ip_mt_check(const struct + return -EINVAL; + if (info->bitmask & EBT_IP_SPORT && info->sport[0] > info->sport[1]) + return -EINVAL; ++ if (info->bitmask & EBT_IP_ICMP) { ++ if ((info->invflags & EBT_IP_PROTO) || ++ info->protocol != IPPROTO_ICMP) ++ return -EINVAL; ++ if (info->icmp_type[0] > info->icmp_type[1] || ++ info->icmp_code[0] > info->icmp_code[1]) ++ return -EINVAL; ++ } + return 0; + } + diff --git a/target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch b/target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch new file mode 100644 index 0000000000..4c8144834d --- /dev/null +++ b/target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch @@ -0,0 +1,88 @@ +From: Matthias Schiffer +Date: Sat, 3 Mar 2018 12:02:21 +0100 +Subject: [PATCH 2/2] ebtables: add support for matching IGMP type + +We already have ICMPv6 type/code matches (which can be used to distinguish +different types of MLD packets). Add support for IPv4 IGMP matches in the +same way. + +Signed-off-by: Matthias Schiffer +--- + include/uapi/linux/netfilter_bridge/ebt_ip.h | 4 +++- + net/bridge/netfilter/ebt_ip.c | 19 +++++++++++++++++-- + 2 files changed, 20 insertions(+), 3 deletions(-) + +--- a/include/uapi/linux/netfilter_bridge/ebt_ip.h ++++ b/include/uapi/linux/netfilter_bridge/ebt_ip.h +@@ -25,8 +25,9 @@ + #define EBT_IP_SPORT 0x10 + #define EBT_IP_DPORT 0x20 + #define EBT_IP_ICMP 0x40 ++#define EBT_IP_IGMP 0x80 + #define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\ +- EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP) ++ EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP | EBT_IP_IGMP) + #define EBT_IP_MATCH "ip" + + /* the same values are used for the invflags */ +@@ -42,6 +43,7 @@ struct ebt_ip_info { + union { + __u16 sport[2]; + __u8 icmp_type[2]; ++ __u8 igmp_type[2]; + }; + union { + __u16 dport[2]; +--- a/net/bridge/netfilter/ebt_ip.c ++++ b/net/bridge/netfilter/ebt_ip.c +@@ -28,6 +28,9 @@ union pkthdr { + u8 type; + u8 code; + } icmphdr; ++ struct { ++ u8 type; ++ } igmphdr; + }; + + static bool +@@ -57,12 +60,12 @@ ebt_ip_mt(const struct sk_buff *skb, str + if (NF_INVF(info, EBT_IP_PROTO, info->protocol != ih->protocol)) + return false; + if (!(info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT | +- EBT_IP_ICMP))) ++ EBT_IP_ICMP | EBT_IP_IGMP))) + return true; + if (ntohs(ih->frag_off) & IP_OFFSET) + return false; + +- /* min icmp headersize is 4, so sizeof(_pkthdr) is ok. */ ++ /* min icmp/igmp headersize is 4, so sizeof(_pkthdr) is ok. */ + pptr = skb_header_pointer(skb, ih->ihl*4, + sizeof(_pkthdr), &_pkthdr); + if (pptr == NULL) +@@ -88,6 +91,11 @@ ebt_ip_mt(const struct sk_buff *skb, str + pptr->icmphdr.code < info->icmp_code[0] || + pptr->icmphdr.code > info->icmp_code[1])) + return false; ++ if ((info->bitmask & EBT_IP_IGMP) && ++ NF_INVF(info, EBT_IP_IGMP, ++ pptr->igmphdr.type < info->igmp_type[0] || ++ pptr->igmphdr.type > info->igmp_type[1])) ++ return false; + } + return true; + } +@@ -124,6 +132,13 @@ static int ebt_ip_mt_check(const struct + info->icmp_code[0] > info->icmp_code[1]) + return -EINVAL; + } ++ if (info->bitmask & EBT_IP_IGMP) { ++ if ((info->invflags & EBT_IP_PROTO) || ++ info->protocol != IPPROTO_IGMP) ++ return -EINVAL; ++ if (info->igmp_type[0] > info->igmp_type[1]) ++ return -EINVAL; ++ } + return 0; + } +