Skip to contentSkip to conversation

netfilter: xt_pkttype: IPv6 has no broadcast

PATCH In review Phil Oester 2 participants 2 messages Jul 11, 2013 – Jul 15, 2013

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

Phil Oester

author
#0 lore raw

PATCH 1/1 netfilter: xt_pkttype: IPv6 has no broadcast

As stated in RFC 4291:

There are no broadcast addresses in IPv6, their function being superseded by multicast addresses.

As such, the pkttype match should not allow IPv6 rules to be added which attempt to match broadcast packets. The addrtype match already rejects such attempts.

Phil

Signed-off-by Phil Oester <[email protected]>
net/netfilter/xt_pkttype.c +22 -6
index 5b645cb..4c0b0e1 100644
@@ -42,13 +42,29 @@ pkttype_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	return (type == info->pkttype) ^ info->invert;
 }
 
+static int pkttype_mt_checkentry(const struct xt_mtchk_param *par)
+{
+	const struct xt_pkttype_info *info = par->matchinfo;
+
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	if (par->family == NFPROTO_IPV6) {
+		if (info->pkttype == PACKET_BROADCAST) {
+			pr_err("IPv6 does not support BROADCAST packets\n");
+			return -EINVAL;
+		}
+	}
+#endif
+	return 0;
+}
+
 static struct xt_match pkttype_mt_reg __read_mostly = {
-	.name      = "pkttype",
-	.revision  = 0,
-	.family    = NFPROTO_UNSPEC,
-	.match     = pkttype_mt,
-	.matchsize = sizeof(struct xt_pkttype_info),
-	.me        = THIS_MODULE,
+	.name		= "pkttype",
+	.revision	= 0,
+	.family		= NFPROTO_UNSPEC,
+	.checkentry	= pkttype_mt_checkentry,
+	.match		= pkttype_mt,
+	.matchsize	= sizeof(struct xt_pkttype_info),
+	.me		= THIS_MODULE,
 };
 
 static int __init pkttype_mt_init(void)
maintainer
#1 lore raw

Hi Phil,

Quoted 23 lines · Phil Oester

As stated in RFC 4291:

There are no broadcast addresses in IPv6, their function being superseded by multicast addresses.

As such, the pkttype match should not allow IPv6 rules to be added which attempt to match broadcast packets. The addrtype match already rejects such attempts.

Phil

Signed-off-by Phil Oester <[email protected]>
net/netfilter/xt_pkttype.c +1 -0
index 5b645cb..4c0b0e1 100644
@@ -42,13 +42,29 @@ pkttype_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	return (type == info->pkttype) ^ info->invert;
 }
 
+static int pkttype_mt_checkentry(const struct xt_mtchk_param *par)

net/netfilter/xt_pkttype.c pkttype_mt(const struct sk_buff *skb, struct xt_action_param *par) · line 55

Quoted 10 lines
net/netfilter/xt_pkttype.c +10 -0
+{
+	const struct xt_pkttype_info *info = par->matchinfo;
+
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+	if (par->family == NFPROTO_IPV6) {
+		if (info->pkttype == PACKET_BROADCAST) {
+			pr_err("IPv6 does not support BROADCAST packets\n");
+			return -EINVAL;
+		}
+	}

pkttype is set from the ethernet layer, so it's still possible to forge a packet using the ethernet broadcast address on IPv6 (even if it's ilegal), we should allow our users to drop that from ip6tables.

Quoted 21 lines
net/netfilter/xt_pkttype.c +11 -6
+#endif
+	return 0;
+}
+
 static struct xt_match pkttype_mt_reg __read_mostly = {
-	.name      = "pkttype",
-	.revision  = 0,
-	.family    = NFPROTO_UNSPEC,
-	.match     = pkttype_mt,
-	.matchsize = sizeof(struct xt_pkttype_info),
-	.me        = THIS_MODULE,
+	.name		= "pkttype",
+	.revision	= 0,
+	.family		= NFPROTO_UNSPEC,
+	.checkentry	= pkttype_mt_checkentry,
+	.match		= pkttype_mt,
+	.matchsize	= sizeof(struct xt_pkttype_info),
+	.me		= THIS_MODULE,
 };
 
 static int __init pkttype_mt_init(void)