netfilter: ebtables: add support for matching IGMP type

We already have ICMPv6 type/code matches (which can be used to distinguish
different types of MLD packets). Add support for IPv4 IGMP matches in the
same way.

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/uapi/linux/netfilter_bridge/ebt_ip.h b/include/uapi/linux/netfilter_bridge/ebt_ip.h
index 4ed7fbb0a482019b013f5fab9d2097619ebb77fe..46d6261370b0ca06ae618e6d45bb32b98a8adf48 100644 (file)
--- a/include/uapi/linux/netfilter_bridge/ebt_ip.h
+++ b/include/uapi/linux/netfilter_bridge/ebt_ip.h
@@ -25,8 +25,9 @@
 #define EBT_IP_SPORT 0x10
 #define EBT_IP_DPORT 0x20
 #define EBT_IP_ICMP 0x40
+#define EBT_IP_IGMP 0x80
 #define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
-                    EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP)
+                    EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP | EBT_IP_IGMP)
 #define EBT_IP_MATCH "ip"
 
 /* the same values are used for the invflags */
@@ -42,6 +43,7 @@ struct ebt_ip_info {
        union {
                __u16 sport[2];
                __u8 icmp_type[2];
+               __u8 igmp_type[2];
        };
        union {
                __u16 dport[2];

diff --git a/net/bridge/netfilter/ebt_ip.c b/net/bridge/netfilter/ebt_ip.c
index 8cb8f8395768be498fe551335aaea165e7498933..ffaa8ce2e724f76ce27b572dd54be66bb9f4c0dc 100644 (file)
--- a/net/bridge/netfilter/ebt_ip.c
+++ b/net/bridge/netfilter/ebt_ip.c
@@ -28,6 +28,9 @@ union pkthdr {
                u8 type;
                u8 code;
        } icmphdr;
+       struct {
+               u8 type;
+       } igmphdr;
 };
 
 static bool
@@ -57,12 +60,12 @@ ebt_ip_mt(const struct sk_buff *skb, struct xt_action_param *par)
                if (NF_INVF(info, EBT_IP_PROTO, info->protocol != ih->protocol))
                        return false;
                if (!(info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT |
-                                      EBT_IP_ICMP)))
+                                      EBT_IP_ICMP | EBT_IP_IGMP)))
                        return true;
                if (ntohs(ih->frag_off) & IP_OFFSET)
                        return false;
 
-               /* min icmp headersize is 4, so sizeof(_pkthdr) is ok. */
+               /* min icmp/igmp headersize is 4, so sizeof(_pkthdr) is ok. */
                pptr = skb_header_pointer(skb, ih->ihl*4,
                                          sizeof(_pkthdr), &_pkthdr);
                if (pptr == NULL)
@@ -88,6 +91,11 @@ ebt_ip_mt(const struct sk_buff *skb, struct xt_action_param *par)
                            pptr->icmphdr.code < info->icmp_code[0] ||
                            pptr->icmphdr.code > info->icmp_code[1]))
                        return false;
+               if ((info->bitmask & EBT_IP_IGMP) &&
+                   NF_INVF(info, EBT_IP_IGMP,
+                           pptr->igmphdr.type < info->igmp_type[0] ||
+                           pptr->igmphdr.type > info->igmp_type[1]))
+                       return false;
        }
        return true;
 }
@@ -124,6 +132,13 @@ static int ebt_ip_mt_check(const struct xt_mtchk_param *par)
                    info->icmp_code[0] > info->icmp_code[1])
                        return -EINVAL;
        }
+       if (info->bitmask & EBT_IP_IGMP) {
+               if ((info->invflags & EBT_IP_PROTO) ||
+                   info->protocol != IPPROTO_IGMP)
+                       return -EINVAL;
+               if (info->igmp_type[0] > info->igmp_type[1])
+                       return -EINVAL;
+       }
        return 0;
 }