Commit 2a7851bf authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: add nf_ipv6_ops hook to fix xt_addrtype with IPv6 

Quoting https://bugzilla.netfilter.org/show_bug.cgi?id=812

:

[ ip6tables -m addrtype ]
When I tried to use in the nat/PREROUTING it messes up the
routing cache even if the rule didn't matched at all.
[..]
If I remove the --limit-iface-in from the non-working scenario, so just
use the -m addrtype --dst-type LOCAL it works!

This happens when LOCAL type matching is requested with --limit-iface-in,
and the default ipv6 route is via the interface the packet we test
arrived on.

Because xt_addrtype uses ip6_route_output, the ipv6 routing implementation
creates an unwanted cached entry, and the packet won't make it to the
real/expected destination.

Silently ignoring --limit-iface-in makes the routing work but it breaks
rule matching (--dst-type LOCAL with limit-iface-in is supposed to only
match if the dst address is configured on the incoming interface;
without --limit-iface-in it will match if the address is reachable
via lo).

The test should call ipv6_chk_addr() instead.  However, this would add
a link-time dependency on ipv6.

There are two possible solutions:

1) Revert the commit that moved ipt_addrtype to xt_addrtype,
   and put ipv6 specific code into ip6t_addrtype.
2) add new "nf_ipv6_ops" struct to register pointers to ipv6 functions.

While the former might seem preferable, Pablo pointed out that there
are more xt modules with link-time dependeny issues regarding ipv6,
so lets go for 2).

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 497574c7

include/linux/netfilter_ipv6.h

+16 −0
Original line number Diff line number Diff line
@@ -17,6 +17,22 @@ extern __sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook, 


extern int ipv6_netfilter_init(void);

extern void ipv6_netfilter_fini(void);



/*

 * Hook functions for ipv6 to allow xt_* modules to be built-in even

 * if IPv6 is a module.

 */

struct nf_ipv6_ops {

	int (*chk_addr)(struct net *net, const struct in6_addr *addr,

			const struct net_device *dev, int strict);

};



extern const struct nf_ipv6_ops __rcu *nf_ipv6_ops;

static inline const struct nf_ipv6_ops *nf_get_ipv6_ops(void)

{

	return rcu_dereference(nf_ipv6_ops);

}



#else /* CONFIG_NETFILTER */

static inline int ipv6_netfilter_init(void) { return 0; }

static inline void ipv6_netfilter_fini(void) { return; }

include/net/addrconf.h

+1 −1
Original line number Diff line number Diff line
@@ -65,7 +65,7 @@ extern int addrconf_set_dstaddr(struct net *net, 


extern int			ipv6_chk_addr(struct net *net,

					      const struct in6_addr *addr,

					      struct net_device *dev,

					      const struct net_device *dev,

					      int strict);



#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)

net/ipv6/addrconf.c

+1 −1
Original line number Diff line number Diff line
@@ -1487,7 +1487,7 @@ static int ipv6_count_addresses(struct inet6_dev *idev) 
}



int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,

		  struct net_device *dev, int strict)

		  const struct net_device *dev, int strict)

{

	struct inet6_ifaddr *ifp;

	unsigned int hash = inet6_addr_hash(addr);

net/ipv6/netfilter.c

+7 −0
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ 
#include <linux/netfilter.h>

#include <linux/netfilter_ipv6.h>

#include <linux/export.h>

#include <net/addrconf.h>

#include <net/dst.h>

#include <net/ipv6.h>

#include <net/ip6_route.h>
@@ -186,6 +187,10 @@ static __sum16 nf_ip6_checksum_partial(struct sk_buff *skb, unsigned int hook, 
	return csum;

};



static const struct nf_ipv6_ops ipv6ops = {

	.chk_addr	= ipv6_chk_addr,

};



static const struct nf_afinfo nf_ip6_afinfo = {

	.family			= AF_INET6,

	.checksum		= nf_ip6_checksum,
@@ -198,6 +203,7 @@ static const struct nf_afinfo nf_ip6_afinfo = { 


int __init ipv6_netfilter_init(void)

{

	RCU_INIT_POINTER(nf_ipv6_ops, &ipv6ops);

	return nf_register_afinfo(&nf_ip6_afinfo);

}
@@ -206,5 +212,6 @@ int __init ipv6_netfilter_init(void) 
 */

void ipv6_netfilter_fini(void)

{

	RCU_INIT_POINTER(nf_ipv6_ops, NULL);

	nf_unregister_afinfo(&nf_ip6_afinfo);

}

net/netfilter/core.c

+2 −0
Original line number Diff line number Diff line
@@ -30,6 +30,8 @@ static DEFINE_MUTEX(afinfo_mutex); 


const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;

EXPORT_SYMBOL(nf_afinfo);

const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly;

EXPORT_SYMBOL_GPL(nf_ipv6_ops);



int nf_register_afinfo(const struct nf_afinfo *afinfo)

{

CRA Git | Maintained and supported by SUSTech CRA and CCSE