kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

netfilter: bridge: nf queue verdict to use NFQA_VLAN and NFQA_L2HDR

Browse source 
This makes nf queues use NFQA_VLAN and NFQA_L2HDR in verdict to modify the
original skb

Signed-off-by: Stephane Bryant <stephane.ml.bryant@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Stephane Bryant 2016-03-26 08:42:12 +01:00 committed by Pablo Neira Ayuso
parent 15824ab29f
commit 8d45ff22f1
1 changed files with 47 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

47
net/netfilter/nfnetlink_queue.c
View file

@ -964,12 +964,18 @@ static struct notifier_block nfqnl_rtnl_notifier = {
.notifier_call = nfqnl_rcv_nl_event, .notifier_call = nfqnl_rcv_nl_event,
}; };
static const struct nla_policy nfqa_vlan_policy[NFQA_VLAN_MAX + 1] = {
[NFQA_VLAN_TCI] = { .type = NLA_U16},
[NFQA_VLAN_PROTO] = { .type = NLA_U16},
};
static const struct nla_policy nfqa_verdict_policy[NFQA_MAX+1] = { static const struct nla_policy nfqa_verdict_policy[NFQA_MAX+1] = {
[NFQA_VERDICT_HDR] = { .len = sizeof(struct nfqnl_msg_verdict_hdr) }, [NFQA_VERDICT_HDR] = { .len = sizeof(struct nfqnl_msg_verdict_hdr) },
[NFQA_MARK] = { .type = NLA_U32 }, [NFQA_MARK] = { .type = NLA_U32 },
[NFQA_PAYLOAD] = { .type = NLA_UNSPEC }, [NFQA_PAYLOAD] = { .type = NLA_UNSPEC },
[NFQA_CT] = { .type = NLA_UNSPEC }, [NFQA_CT] = { .type = NLA_UNSPEC },
[NFQA_EXP] = { .type = NLA_UNSPEC }, [NFQA_EXP] = { .type = NLA_UNSPEC },
[NFQA_VLAN] = { .type = NLA_NESTED },
}; };
static const struct nla_policy nfqa_verdict_batch_policy[NFQA_MAX+1] = { static const struct nla_policy nfqa_verdict_batch_policy[NFQA_MAX+1] = {
@ -1083,6 +1089,40 @@ static struct nf_conn *nfqnl_ct_parse(struct nfnl_ct_hook *nfnl_ct,
return ct; return ct;
} }
static int nfqa_parse_bridge(struct nf_queue_entry *entry,
const struct nlattr * const nfqa[])
{
if (nfqa[NFQA_VLAN]) {
struct nlattr *tb[NFQA_VLAN_MAX + 1];
int err;
err = nla_parse_nested(tb, NFQA_VLAN_MAX, nfqa[NFQA_VLAN],
nfqa_vlan_policy);
if (err < 0)
return err;
if (!tb[NFQA_VLAN_TCI] || !tb[NFQA_VLAN_PROTO])
return -EINVAL;
entry->skb->vlan_tci = ntohs(nla_get_be16(tb[NFQA_VLAN_TCI]));
entry->skb->vlan_proto = nla_get_be16(tb[NFQA_VLAN_PROTO]);
}
if (nfqa[NFQA_L2HDR]) {
int mac_header_len = entry->skb->network_header -
entry->skb->mac_header;
if (mac_header_len != nla_len(nfqa[NFQA_L2HDR]))
return -EINVAL;
else if (mac_header_len > 0)
memcpy(skb_mac_header(entry->skb),
nla_data(nfqa[NFQA_L2HDR]),
mac_header_len);
}
return 0;
}
static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl, static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
struct sk_buff *skb, struct sk_buff *skb,
const struct nlmsghdr *nlh, const struct nlmsghdr *nlh,
@ -1098,6 +1138,7 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
struct nfnl_ct_hook *nfnl_ct; struct nfnl_ct_hook *nfnl_ct;
struct nf_conn *ct = NULL; struct nf_conn *ct = NULL;
struct nfnl_queue_net *q = nfnl_queue_pernet(net); struct nfnl_queue_net *q = nfnl_queue_pernet(net);
int err;
queue = instance_lookup(q, queue_num); queue = instance_lookup(q, queue_num);
if (!queue) if (!queue)
@ -1124,6 +1165,12 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
ct = nfqnl_ct_parse(nfnl_ct, nlh, nfqa, entry, &ctinfo); ct = nfqnl_ct_parse(nfnl_ct, nlh, nfqa, entry, &ctinfo);
} }
if (entry->state.pf == PF_BRIDGE) {
err = nfqa_parse_bridge(entry, nfqa);
if (err < 0)
return err;
}
if (nfqa[NFQA_PAYLOAD]) { if (nfqa[NFQA_PAYLOAD]) {
u16 payload_len = nla_len(nfqa[NFQA_PAYLOAD]); u16 payload_len = nla_len(nfqa[NFQA_PAYLOAD]);
int diff = payload_len - entry->skb->len; int diff = payload_len - entry->skb->len;