mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-24 09:50:04 +00:00
netfilter: nf_tables_bridge: use nft_set_pktinfo_ipv{4, 6}_validate
Consolidate pktinfo setup and validation by using the new generic functions so we converge to the netdev family codebase. We only need a linear IPv4 and IPv6 header from the reject expression, so move nft_bridge_iphdr_validate() and nft_bridge_ip6hdr_validate() to net/bridge/netfilter/nft_reject_bridge.c. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
ddc8b6027a
commit
10151d7b03
3 changed files with 45 additions and 78 deletions
|
@ -1,7 +0,0 @@
|
|||
#ifndef _NET_NF_TABLES_BRIDGE_H
|
||||
#define _NET_NF_TABLES_BRIDGE_H
|
||||
|
||||
int nft_bridge_iphdr_validate(struct sk_buff *skb);
|
||||
int nft_bridge_ip6hdr_validate(struct sk_buff *skb);
|
||||
|
||||
#endif /* _NET_NF_TABLES_BRIDGE_H */
|
|
@ -13,79 +13,11 @@
|
|||
#include <linux/module.h>
|
||||
#include <linux/netfilter_bridge.h>
|
||||
#include <net/netfilter/nf_tables.h>
|
||||
#include <net/netfilter/nf_tables_bridge.h>
|
||||
#include <linux/ip.h>
|
||||
#include <linux/ipv6.h>
|
||||
#include <net/netfilter/nf_tables_ipv4.h>
|
||||
#include <net/netfilter/nf_tables_ipv6.h>
|
||||
|
||||
int nft_bridge_iphdr_validate(struct sk_buff *skb)
|
||||
{
|
||||
struct iphdr *iph;
|
||||
u32 len;
|
||||
|
||||
if (!pskb_may_pull(skb, sizeof(struct iphdr)))
|
||||
return 0;
|
||||
|
||||
iph = ip_hdr(skb);
|
||||
if (iph->ihl < 5 || iph->version != 4)
|
||||
return 0;
|
||||
|
||||
len = ntohs(iph->tot_len);
|
||||
if (skb->len < len)
|
||||
return 0;
|
||||
else if (len < (iph->ihl*4))
|
||||
return 0;
|
||||
|
||||
if (!pskb_may_pull(skb, iph->ihl*4))
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(nft_bridge_iphdr_validate);
|
||||
|
||||
int nft_bridge_ip6hdr_validate(struct sk_buff *skb)
|
||||
{
|
||||
struct ipv6hdr *hdr;
|
||||
u32 pkt_len;
|
||||
|
||||
if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
|
||||
return 0;
|
||||
|
||||
hdr = ipv6_hdr(skb);
|
||||
if (hdr->version != 6)
|
||||
return 0;
|
||||
|
||||
pkt_len = ntohs(hdr->payload_len);
|
||||
if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(nft_bridge_ip6hdr_validate);
|
||||
|
||||
static inline void nft_bridge_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
|
||||
struct sk_buff *skb,
|
||||
const struct nf_hook_state *state)
|
||||
{
|
||||
if (nft_bridge_iphdr_validate(skb))
|
||||
nft_set_pktinfo_ipv4(pkt, skb, state);
|
||||
else
|
||||
nft_set_pktinfo_unspec(pkt, skb, state);
|
||||
}
|
||||
|
||||
static inline void nft_bridge_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
|
||||
struct sk_buff *skb,
|
||||
const struct nf_hook_state *state)
|
||||
{
|
||||
#if IS_ENABLED(CONFIG_IPV6)
|
||||
if (nft_bridge_ip6hdr_validate(skb) &&
|
||||
nft_set_pktinfo_ipv6(pkt, skb, state) == 0)
|
||||
return;
|
||||
#endif
|
||||
nft_set_pktinfo_unspec(pkt, skb, state);
|
||||
}
|
||||
|
||||
static unsigned int
|
||||
nft_do_chain_bridge(void *priv,
|
||||
struct sk_buff *skb,
|
||||
|
@ -95,10 +27,10 @@ nft_do_chain_bridge(void *priv,
|
|||
|
||||
switch (eth_hdr(skb)->h_proto) {
|
||||
case htons(ETH_P_IP):
|
||||
nft_bridge_set_pktinfo_ipv4(&pkt, skb, state);
|
||||
nft_set_pktinfo_ipv4_validate(&pkt, skb, state);
|
||||
break;
|
||||
case htons(ETH_P_IPV6):
|
||||
nft_bridge_set_pktinfo_ipv6(&pkt, skb, state);
|
||||
nft_set_pktinfo_ipv6_validate(&pkt, skb, state);
|
||||
break;
|
||||
default:
|
||||
nft_set_pktinfo_unspec(&pkt, skb, state);
|
||||
|
|
|
@ -14,7 +14,6 @@
|
|||
#include <linux/netfilter/nf_tables.h>
|
||||
#include <net/netfilter/nf_tables.h>
|
||||
#include <net/netfilter/nft_reject.h>
|
||||
#include <net/netfilter/nf_tables_bridge.h>
|
||||
#include <net/netfilter/ipv4/nf_reject.h>
|
||||
#include <net/netfilter/ipv6/nf_reject.h>
|
||||
#include <linux/ip.h>
|
||||
|
@ -37,6 +36,30 @@ static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
|
|||
skb_pull(nskb, ETH_HLEN);
|
||||
}
|
||||
|
||||
static int nft_bridge_iphdr_validate(struct sk_buff *skb)
|
||||
{
|
||||
struct iphdr *iph;
|
||||
u32 len;
|
||||
|
||||
if (!pskb_may_pull(skb, sizeof(struct iphdr)))
|
||||
return 0;
|
||||
|
||||
iph = ip_hdr(skb);
|
||||
if (iph->ihl < 5 || iph->version != 4)
|
||||
return 0;
|
||||
|
||||
len = ntohs(iph->tot_len);
|
||||
if (skb->len < len)
|
||||
return 0;
|
||||
else if (len < (iph->ihl*4))
|
||||
return 0;
|
||||
|
||||
if (!pskb_may_pull(skb, iph->ihl*4))
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* We cannot use oldskb->dev, it can be either bridge device (NF_BRIDGE INPUT)
|
||||
* or the bridge port (NF_BRIDGE PREROUTING).
|
||||
*/
|
||||
|
@ -143,6 +166,25 @@ static void nft_reject_br_send_v4_unreach(struct net *net,
|
|||
br_forward(br_port_get_rcu(dev), nskb, false, true);
|
||||
}
|
||||
|
||||
static int nft_bridge_ip6hdr_validate(struct sk_buff *skb)
|
||||
{
|
||||
struct ipv6hdr *hdr;
|
||||
u32 pkt_len;
|
||||
|
||||
if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
|
||||
return 0;
|
||||
|
||||
hdr = ipv6_hdr(skb);
|
||||
if (hdr->version != 6)
|
||||
return 0;
|
||||
|
||||
pkt_len = ntohs(hdr->payload_len);
|
||||
if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static void nft_reject_br_send_v6_tcp_reset(struct net *net,
|
||||
struct sk_buff *oldskb,
|
||||
const struct net_device *dev,
|
||||
|
|
Loading…
Reference in a new issue