ebtables-devel Mailing List for Ethernet bridge tables (Page 2)
Brought to you by:
bdschuym
Menu
▾
▴
ebtables-devel — Development questions, bugs, patches
You can subscribe to this list here.
| 2002 |
Jan
|
Feb
|
Mar
|
Apr
(6) |
May
(9) |
Jun
(6) |
Jul
(5) |
Aug
(7) |
Sep
(13) |
Oct
(9) |
Nov
(11) |
Dec
(8) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2003 |
Jan
(13) |
Feb
(8) |
Mar
(32) |
Apr
(21) |
May
(15) |
Jun
(7) |
Jul
(35) |
Aug
(26) |
Sep
(29) |
Oct
(13) |
Nov
(4) |
Dec
(32) |
| 2004 |
Jan
(2) |
Feb
(20) |
Mar
(9) |
Apr
|
May
(7) |
Jun
(22) |
Jul
(7) |
Aug
(6) |
Sep
(15) |
Oct
(17) |
Nov
(12) |
Dec
(16) |
| 2005 |
Jan
(6) |
Feb
(15) |
Mar
(17) |
Apr
(27) |
May
(13) |
Jun
(43) |
Jul
(3) |
Aug
(12) |
Sep
(16) |
Oct
(12) |
Nov
(9) |
Dec
(10) |
| 2006 |
Jan
(3) |
Feb
(1) |
Mar
(1) |
Apr
(4) |
May
|
Jun
(2) |
Jul
(15) |
Aug
(2) |
Sep
(1) |
Oct
(5) |
Nov
(5) |
Dec
(10) |
| 2007 |
Jan
(2) |
Feb
(14) |
Mar
(19) |
Apr
|
May
(1) |
Jun
(3) |
Jul
|
Aug
(9) |
Sep
(6) |
Oct
(7) |
Nov
(4) |
Dec
|
| 2008 |
Jan
(11) |
Feb
(43) |
Mar
(3) |
Apr
(5) |
May
|
Jun
(1) |
Jul
|
Aug
|
Sep
(2) |
Oct
(2) |
Nov
|
Dec
|
| 2009 |
Jan
|
Feb
(1) |
Mar
|
Apr
|
May
|
Jun
|
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2010 |
Jan
|
Feb
|
Mar
(2) |
Apr
(1) |
May
|
Jun
(4) |
Jul
(3) |
Aug
|
Sep
(2) |
Oct
(4) |
Nov
|
Dec
|
| 2013 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
(3) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: David P O. <ol...@us...> - 2008-06-10 19:50:13
|
I can't seem to remove certain rules, unless I specifiy the rule number. For example, I create a rule: # ebtables -t nat -A PREROUTING --protocol ARP -i vif1.0 -s ! 00:16:3e:18:94:83 -j DROP which works ok...but when I attempt to delete it: # ebtables -t nat -D PREROUTING --protocol ARP -i vif1.0 -s ! 00:16:3e:18:94:83 -j DROP Sorry, rule does not exist. yet the rule prints out when I do a "ebtables -t nat -L" I am using ebtables v2.0.6-77, on SUSE running in Xen dom0. Dave O. |
|
From: Patrick M. <ka...@tr...> - 2008-04-21 14:41:18
|
Tseng, Kuo-Lang wrote: > Please try out the updated patch. It has fixed the coding style errors > and added protocol checks for UDPLITE, and shared the TCP/UDP/.. logging > part. Thanks. Unfortunately you've missed the networking merge window by a few days. I've queued your patch for 2.6.27 with the attached whitespace and sparse fixes. |
|
From: Tseng, Kuo-L. <kuo...@in...> - 2008-04-21 04:50:11
|
Tseng, Kuo-Lang wrote on Thursday, April 10, 2008 1:23 PM: > Patrick McHardy wrote on Tuesday, April 08, 2008 10:38 AM: >> >> >> I wanted to apply this, but the patch has multiple checkpatch >> errors. There are also some codingstyle errors checkpatch doesn't >> complain about, like: >> >> + for (i = 0; i < 4; i++) >> + tmp_addr.in6_u.u6_addr32[i] = >> ih6->saddr.in6_u.u6_addr32[i] & ^^^ needs tab >> >> It also seems the TCP/UDP/.. logging part could be shared between >> IPv4 and IPv6. The protocol checks seem to be missing UDPLITE. >> >> Please fix those up and resend, thanks. > > I'll fix and re-send the patch next week. Hi, Please try out the updated patch. It has fixed the coding style errors and added protocol checks for UDPLITE, and shared the TCP/UDP/.. logging part. |
|
From: Tseng, Kuo-L. <kuo...@in...> - 2008-04-10 20:23:27
|
Patrick McHardy wrote on Tuesday, April 08, 2008 10:38 AM: > > > I wanted to apply this, but the patch has multiple checkpatch > errors. There are also some codingstyle errors checkpatch doesn't > complain about, like: > > + for (i = 0; i < 4; i++) > + tmp_addr.in6_u.u6_addr32[i] = > ih6->saddr.in6_u.u6_addr32[i] & ^^^ needs tab > > It also seems the TCP/UDP/.. logging part could be shared between > IPv4 and IPv6. The protocol checks seem to be missing UDPLITE. > > Please fix those up and resend, thanks. I'll fix and re-send the patch next week. |
|
From: Patrick M. <ka...@tr...> - 2008-04-08 17:38:14
|
Tseng, Kuo-Lang wrote: > Tseng, Kuo-Lang wrote on Monday, February 18, 2008 6:05 PM: > >> This is the corresponding br-netfilter patch. >> >> It implements matching functions for IPv6 address & traffic class >> (merged from the patch sent by Jan Engelhardt >> [je...@co...] >> http://marc.info/?l=netfilter-devel&m=120182168424052&w=2), protocol, >> and layer-4 port id. Corresponding watcher logging function is also >> added for IPv6. >> >> Signed-off-by: Kuo-lang Tseng <kuo...@in...> > > Reposting the patch as an attachment (earlier one had line split. Sorry > about that) I wanted to apply this, but the patch has multiple checkpatch errors. There are also some codingstyle errors checkpatch doesn't complain about, like: + for (i = 0; i < 4; i++) + tmp_addr.in6_u.u6_addr32[i] = ih6->saddr.in6_u.u6_addr32[i] & ^^^ needs tab It also seems the TCP/UDP/.. logging part could be shared between IPv4 and IPv6. The protocol checks seem to be missing UDPLITE. Please fix those up and resend, thanks. |
|
From: Patrick M. <ka...@tr...> - 2008-04-08 17:31:48
|
Peter Warasin wrote: > Hi > > Patrick McHardy wrote: >> Peter Warasin wrote: >> > This patch adds the ebtables nflog watcher to the >> > kernel >> This seems mostly fine to me. A few minor comments: > >> If you'll resend the patch based on net-2.6.26 I'll queue it >> if Bart has no objections. > > I re-based on net-2.6.26 and changed what you mentioned. > Patch is attached Applied, thanks. |
|
From: Bart De S. <bds...@pa...> - 2008-03-17 22:22:46
|
Op ma, 17-03-2008 te 17:25 +0100, schreef Peter Warasin: > Hi > > Bart De Schuymer wrote: > > Op di, 26-02-2008 te 00:03 +0100, schreef Peter Warasin: > >> I re-based on net-2.6.26 and changed what you mentioned. > >> Patch is attached > > It looks fine, I'm just wondering what the flags and the pad in struct > > ebt_nflog_info are for... > > I have not seen the submit on net-2.6.26 and in ebtables cvs. Is the > patch queued or is there something to do for me? I've just committed the userspace part in cvs. Thanks for reminding me. cheers, Bart |
|
From: Patrick M. <ka...@tr...> - 2008-03-17 16:45:43
|
Peter Warasin wrote: > Hi > > Bart De Schuymer wrote: >> Op di, 26-02-2008 te 00:03 +0100, schreef Peter Warasin: >>> I re-based on net-2.6.26 and changed what you mentioned. >>> Patch is attached >> It looks fine, I'm just wondering what the flags and the pad in struct >> ebt_nflog_info are for... > > I have not seen the submit on net-2.6.26 and in ebtables cvs. Is the > patch queued or is there something to do for me? I'm currently holding off netfilter 2.6.26 patches because there are some conflicts with the net-2.6.26 tree. I'll apply it once Dave has rebased to Linus' current tree. |
|
From: Peter W. <pe...@en...> - 2008-03-17 16:25:42
|
Hi Bart De Schuymer wrote: > Op di, 26-02-2008 te 00:03 +0100, schreef Peter Warasin: >> I re-based on net-2.6.26 and changed what you mentioned. >> Patch is attached > It looks fine, I'm just wondering what the flags and the pad in struct > ebt_nflog_info are for... I have not seen the submit on net-2.6.26 and in ebtables cvs. Is the patch queued or is there something to do for me? peter |
|
From: Tseng, Kuo-L. <kuo...@in...> - 2008-02-26 19:30:46
|
Tseng, Kuo-Lang wrote on Tuesday, February 26, 2008 11:09 AM: > Tseng, Kuo-Lang wrote on Monday, February 18, 2008 5:49 PM: > >> According to >> http://article.gmane.org/gmane.linux.network.bridge.ebtables.devel/719, >> I need to add required functions into userspace ebtables program and >> bridge-nf kernel module for parsing and matching on IPv6 header >> fields address, traffic class, IP protocol, and layer-4 port ids. >> >> Signed-off-by: Kuo-lang Tseng <kuo...@in...> > > I haven't heard any feedback yet. Since these patches have been > accepted upstream, I suggest we can push the patch files into our > tree (this will be needed by va_nw_mgr for adding IPv6 support). > > The kernel patch (sent in [PATCH 2/2] mail]) needs to be applied into > linux-2.6.18-xen source. Is it the hg/xen/patches/linux-2.6.18 > directory that we should add the patch file into? Who can do this > push? > > For userspace change, since I don't see ebtbales user space source in > our tree so I assume we only need to push in the excutable ebtables > which should be in /sbin in sos file system. Please ignore my previous email (was sent to wrong mailing list). |
|
From: Tseng, Kuo-L. <kuo...@in...> - 2008-02-26 19:09:15
|
Tseng, Kuo-Lang wrote on Monday, February 18, 2008 5:49 PM: > According to > http://article.gmane.org/gmane.linux.network.bridge.ebtables.devel/719, > I need to add required functions into userspace ebtables program and > bridge-nf kernel module for parsing and matching on IPv6 header > fields address, traffic class, IP protocol, and layer-4 port ids. > > Signed-off-by: Kuo-lang Tseng <kuo...@in...> I haven't heard any feedback yet. Since these patches have been accepted upstream, I suggest we can push the patch files into our tree (this will be needed by va_nw_mgr for adding IPv6 support). The kernel patch (sent in [PATCH 2/2] mail]) needs to be applied into linux-2.6.18-xen source. Is it the hg/xen/patches/linux-2.6.18 directory that we should add the patch file into? Who can do this push? For userspace change, since I don't see ebtbales user space source in our tree so I assume we only need to push in the excutable ebtables which should be in /sbin in sos file system. |
|
From: Patrick M. <ka...@tr...> - 2008-02-26 02:50:42
|
Bart De Schuymer wrote: > Op di, 26-02-2008 te 00:03 +0100, schreef Peter Warasin: >> Hi >> >> Patrick McHardy wrote: >>> Peter Warasin wrote: >>> > This patch adds the ebtables nflog watcher to the >>> > kernel >>> This seems mostly fine to me. A few minor comments: >>> If you'll resend the patch based on net-2.6.26 I'll queue it >>> if Bart has no objections. >> I re-based on net-2.6.26 and changed what you mentioned. >> Patch is attached > > It looks fine, I'm just wondering what the flags and the pad in struct > ebt_nflog_info are for... Both have their origin in NFLOG. The flags were intended for something I still want to add, a reliable log mode where packets are dropped when netlink transmission or memory allocation fails. I can't really remember why I added the padding, but in any case it doesn't hurt since the structure size is usually padded to a multiple of 4/8 anyways. |
|
From: Bart De S. <bds...@pa...> - 2008-02-25 23:24:02
|
Op di, 26-02-2008 te 00:03 +0100, schreef Peter Warasin: > Hi > > Patrick McHardy wrote: > > Peter Warasin wrote: > > > This patch adds the ebtables nflog watcher to the > > > kernel > > This seems mostly fine to me. A few minor comments: > > > If you'll resend the patch based on net-2.6.26 I'll queue it > > if Bart has no objections. > > I re-based on net-2.6.26 and changed what you mentioned. > Patch is attached It looks fine, I'm just wondering what the flags and the pad in struct ebt_nflog_info are for... cheers, Bart |
|
From: Peter W. <pe...@en...> - 2008-02-25 23:03:53
|
Hi Patrick McHardy wrote: > Peter Warasin wrote: > > This patch adds the ebtables nflog watcher to the > > kernel > This seems mostly fine to me. A few minor comments: > If you'll resend the patch based on net-2.6.26 I'll queue it > if Bart has no objections. I re-based on net-2.6.26 and changed what you mentioned. Patch is attached regards, peter |
|
From: Peter W. <pe...@en...> - 2008-02-25 13:55:49
|
Hi Bart Bart De Schuymer wrote: > I had a look at those posts (through your links), the patches seem fine. > However, the lines are truncated around 80 characters. Can you resend or > point me to newer patches? I resend as attachment. This is the patch for the ebtables userland tool. The kernel module follows later as i rebased it to net-2.2.26 and test it currently. peter |
|
From: Bart De S. <bds...@pa...> - 2008-02-21 22:23:37
|
Op di, 12-02-2008 te 21:30 +0100, schreef Peter Warasin: > Hi Bart > > Bart De Schuymer wrote: > > I just searched the mailing list archives and you've never before posted > > to the ebtables lists. You must have forgotten to include > > > Oh, i see. > That's wired. I got mails back from the ebtables list. Probably > they have been blocked by sourceforge's mailman and I got them > because of the crosspost and filtering rules. > > Anyway, the posts in question are these: > http://marc.info/?l=netfilter-devel&m=120223788107898&w=2 > http://marc.info/?l=netfilter-devel&m=120223788207901&w=2 > http://marc.info/?l=netfilter-devel&m=120223788307904&w=2 Hi Peter, I had a look at those posts (through your links), the patches seem fine. However, the lines are truncated around 80 characters. Can you resend or point me to newer patches? cheers, Bart |
|
From: Bart De S. <bds...@pa...> - 2008-02-21 21:29:58
|
Op di, 19-02-2008 te 10:24 -0800, schreef Tseng, Kuo-Lang: > Tseng, Kuo-Lang wrote on Monday, February 18, 2008 5:50 PM: > > > This is the userspace ebtables patch that implements IPv6 header field > > checking and parsing. > > > > Signed-off-by: Kuo-lang Tseng <kuo...@in...> > > > > Reposting the patch as an attachment (earlier one had line split. Sorry > about that) Thanks a lot, userspace and kernel code look ok to me. I'll commit the userspace part. cheers, Bart |
|
From: Patrick M. <ka...@tr...> - 2008-02-21 14:13:33
|
Peter Warasin wrote:
> This patch adds the ebtables nflog watcher to the
> kernel in order to allow ebtables log through the
> nfnetlink_log backend.
This seems mostly fine to me. A few minor comments:
> +#define EBT_NFLOG_PREFIX_SIZE 30
People found the 30 character limit to small for iptables,
which is why I increased it to 64 in NFLOG. For consistency
it would be better to use the same value here in my opinion.
> +static struct ebt_watcher nflog = {
This could be __read_mostly.
If you'll resend the patch based on net-2.6.26 I'll queue it
if Bart has no objections.
|
|
From: Tseng, Kuo-L. <kuo...@in...> - 2008-02-19 18:27:47
|
Tseng, Kuo-Lang wrote on Monday, February 18, 2008 6:05 PM: > This is the corresponding br-netfilter patch. > > It implements matching functions for IPv6 address & traffic class > (merged from the patch sent by Jan Engelhardt > [je...@co...] > http://marc.info/?l=netfilter-devel&m=120182168424052&w=2), protocol, > and layer-4 port id. Corresponding watcher logging function is also > added for IPv6. > > Signed-off-by: Kuo-lang Tseng <kuo...@in...> Reposting the patch as an attachment (earlier one had line split. Sorry about that) |
|
From: Tseng, Kuo-L. <kuo...@in...> - 2008-02-19 18:25:26
|
Tseng, Kuo-Lang wrote on Monday, February 18, 2008 5:50 PM: > This is the userspace ebtables patch that implements IPv6 header field > checking and parsing. > > Signed-off-by: Kuo-lang Tseng <kuo...@in...> > Reposting the patch as an attachment (earlier one had line split. Sorry about that) |
|
From: Bart De S. <bds...@pa...> - 2008-02-19 17:47:02
|
Op di, 19-02-2008 te 16:03 +0100, schreef Patrick McHardy: > Tseng, Kuo-Lang wrote: > > According to > > http://article.gmane.org/gmane.linux.network.bridge.ebtables.devel/719, > > I need to add required functions into userspace ebtables program and > > bridge-nf kernel module for parsing and matching on IPv6 header fields > > address, traffic class, IP protocol, and layer-4 port ids. > > > > Signed-off-by: Kuo-lang Tseng <kuo...@in...> > > > I'll queue this for 2.6.26 if Bart is fine with these patches. I received this with lines split around 80 characters. Kuo, please repost with an attachment or fix your mailer... cheers, Bart |
|
From: Patrick M. <ka...@tr...> - 2008-02-19 15:13:08
|
Bart De Schuymer wrote: > Op ma, 11-02-2008 te 23:07 +0100, schreef Peter Warasin: >> Hi Guys >> >> The following patch-set adds ebtables nflog support to ulogd. >> >> In order to have this work it's also necessary to apply the >> ebtables and kernel patches I posted some time ago >> (i posted as well as this post on both, ebtables and >> netfilter devel lists). > > Hi Peter, > > I just searched the mailing list archives and you've never before posted > to the ebtables lists. You must have forgotten to include > ebtables-devel. Anyway, I just subscribed to netfilter-devel to prevent > this stuff from happening again. > Maybe we should move ebtables traffic to the netfilter lists, I'm not > really against it. Patrick? I agree, that would make sense since there is quite a lot of overlap between both topics. |
|
From: Patrick M. <ka...@tr...> - 2008-02-19 15:04:01
|
Tseng, Kuo-Lang wrote: > According to > http://article.gmane.org/gmane.linux.network.bridge.ebtables.devel/719, > I need to add required functions into userspace ebtables program and > bridge-nf kernel module for parsing and matching on IPv6 header fields > address, traffic class, IP protocol, and layer-4 port ids. > > Signed-off-by: Kuo-lang Tseng <kuo...@in...> I'll queue this for 2.6.26 if Bart is fine with these patches. |
|
From: Tseng, Kuo-L. <kuo...@in...> - 2008-02-19 02:06:10
|
This is the corresponding br-netfilter patch. It implements matching functions for IPv6 address & traffic class (merged from the patch sent by Jan Engelhardt [je...@co...] http://marc.info/?l=netfilter-devel&m=120182168424052&w=2), protocol, and layer-4 port id. Corresponding watcher logging function is also added for IPv6. Signed-off-by: Kuo-lang Tseng <kuo...@in...> diff -ruNp a/include/linux/netfilter_bridge/ebt_ip6.h b/include/linux/netfilter_bridge/ebt_ip6.h --- a/include/linux/netfilter_bridge/ebt_ip6.h 1969-12-31 16:00:00.000000000 -0800 +++ b/include/linux/netfilter_bridge/ebt_ip6.h 2008-02-18 16:34:57.000000000 -0800 @@ -0,0 +1,40 @@ +/* + * ebt_ip6 + * + * Authors: + * Kuo-Lang Tseng <kuo...@in...> + * Manohar Castelino <man...@in...> + * + * Jan 11, 2008 + * + */ + +#ifndef __LINUX_BRIDGE_EBT_IP6_H +#define __LINUX_BRIDGE_EBT_IP6_H + +#define EBT_IP6_SOURCE 0x01 +#define EBT_IP6_DEST 0x02 +#define EBT_IP6_TCLASS 0x04 +#define EBT_IP6_PROTO 0x08 +#define EBT_IP6_SPORT 0x10 +#define EBT_IP6_DPORT 0x20 +#define EBT_IP6_MASK (EBT_IP6_SOURCE | EBT_IP6_DEST | EBT_IP6_TCLASS |\ + EBT_IP6_PROTO | EBT_IP6_SPORT | EBT_IP6_DPORT ) +#define EBT_IP6_MATCH "ip6" + +/* the same values are used for the invflags */ +struct ebt_ip6_info +{ + struct in6_addr saddr; + struct in6_addr daddr; + struct in6_addr smsk; + struct in6_addr dmsk; + uint8_t tclass; + uint8_t protocol; + uint8_t bitmask; + uint8_t invflags; + uint16_t sport[2]; + uint16_t dport[2]; +}; + +#endif diff -ruNp a/include/linux/netfilter_bridge/ebt_log.h b/include/linux/netfilter_bridge/ebt_log.h --- a/include/linux/netfilter_bridge/ebt_log.h 2008-02-18 16:32:34.000000000 -0800 +++ b/include/linux/netfilter_bridge/ebt_log.h 2008-02-18 16:34:57.000000000 -0800 @@ -4,7 +4,8 @@ #define EBT_LOG_IP 0x01 /* if the frame is made by ip, log the ip information */ #define EBT_LOG_ARP 0x02 #define EBT_LOG_NFLOG 0x04 -#define EBT_LOG_MASK (EBT_LOG_IP | EBT_LOG_ARP) +#define EBT_LOG_IP6 0x08 +#define EBT_LOG_MASK (EBT_LOG_IP | EBT_LOG_ARP | EBT_LOG_IP6) #define EBT_LOG_PREFIX_SIZE 30 #define EBT_LOG_WATCHER "log" diff -ruNp a/net/bridge/netfilter/ebt_ip6.c b/net/bridge/netfilter/ebt_ip6.c --- a/net/bridge/netfilter/ebt_ip6.c 1969-12-31 16:00:00.000000000 -0800 +++ b/net/bridge/netfilter/ebt_ip6.c 2008-02-18 16:26:59.000000000 -0800 @@ -0,0 +1,141 @@ +/* + * ebt_ip6 + * + * Authors: + * Manohar Castelino <man...@in...> + * Kuo-Lang Tseng <kuo...@in...> + * Jan Engelhardt <je...@co...> + * + * Summary: + * This is just a modification of the IPv4 code written by + * Bart De Schuymer <bds...@pa...> + * with the changes required to support IPv6 + * + * Jan, 2008 + */ + +#include <linux/netfilter_bridge/ebtables.h> +#include <linux/netfilter_bridge/ebt_ip6.h> +#include <linux/ipv6.h> +#include <net/ipv6.h> +#include <linux/in.h> +#include <linux/module.h> +#include <net/dsfield.h> + +struct tcpudphdr { + uint16_t src; + uint16_t dst; +}; + +static int ebt_filter_ip6(const struct sk_buff *skb, const struct net_device *in, + const struct net_device *out, const void *data, + unsigned int datalen) +{ + struct ebt_ip6_info *info = (struct ebt_ip6_info *)data; + struct ipv6hdr _ip6h, *ih6; + struct in6_addr tmp_addr; + int i; + + ih6 = skb_header_pointer(skb, 0, sizeof(_ip6h), &_ip6h); + if (ih6 == NULL) + return EBT_NOMATCH; + if (info->bitmask & EBT_IP6_TCLASS && + FWINV(info->tclass != ipv6_get_dsfield(ih6), EBT_IP6_TCLASS)) + return EBT_NOMATCH; + for (i = 0; i < 4; i++) + tmp_addr.in6_u.u6_addr32[i] = ih6->saddr.in6_u.u6_addr32[i] & + info->smsk.in6_u.u6_addr32[i]; + if (info->bitmask & EBT_IP6_SOURCE && + FWINV((ipv6_addr_cmp(&tmp_addr, &info->saddr) != 0), EBT_IP6_SOURCE)) + return EBT_NOMATCH; + for (i = 0; i < 4; i++) + tmp_addr.in6_u.u6_addr32[i] = ih6->daddr.in6_u.u6_addr32[i] & + info->dmsk.in6_u.u6_addr32[i]; + if (info->bitmask & EBT_IP6_DEST && + FWINV((ipv6_addr_cmp(&tmp_addr, &info->daddr) != 0), EBT_IP6_DEST)) + return EBT_NOMATCH; + if (info->bitmask & EBT_IP6_PROTO) { + struct tcpudphdr _phdr, *pptr; + uint8_t *nexthdrp = &ih6->nexthdr; + int offset_ph; + + offset_ph = ipv6_skip_exthdr(skb, sizeof(_ip6h), nexthdrp); + if (offset_ph == -1) + return EBT_NOMATCH; + if (FWINV(info->protocol != *nexthdrp, EBT_IP6_PROTO)) + return EBT_NOMATCH; + + if (!(info->bitmask & EBT_IP6_DPORT) && + !(info->bitmask & EBT_IP6_SPORT)) + return EBT_MATCH; + pptr = skb_header_pointer(skb, offset_ph, sizeof(_phdr), &_phdr); + if (pptr == NULL) + return EBT_NOMATCH; + if (info->bitmask & EBT_IP6_DPORT) { + u32 dst = ntohs(pptr->dst); + if (FWINV(dst < info->dport[0] || + dst > info->dport[1], + EBT_IP6_DPORT)) + return EBT_NOMATCH; + } + if (info->bitmask & EBT_IP6_SPORT) { + u32 src = ntohs(pptr->src); + if (FWINV(src < info->sport[0] || + src > info->sport[1], + EBT_IP6_SPORT)) + return EBT_NOMATCH; + } + return EBT_MATCH; + } + return EBT_MATCH; +} + +static int ebt_ip6_check(const char *tablename, unsigned int hookmask, + const struct ebt_entry *e, void *data, unsigned int datalen) +{ + struct ebt_ip6_info *info = (struct ebt_ip6_info *)data; + + if (datalen != EBT_ALIGN(sizeof(struct ebt_ip6_info))) + return -EINVAL; + if (e->ethproto != htons(ETH_P_IPV6) || + e->invflags & EBT_IPROTO) + return -EINVAL; + if (info->bitmask & ~EBT_IP6_MASK || info->invflags & ~EBT_IP6_MASK) + return -EINVAL; + if (info->bitmask & (EBT_IP6_DPORT | EBT_IP6_SPORT)) { + if (info->invflags & EBT_IP6_PROTO) + return -EINVAL; + if (info->protocol != IPPROTO_TCP && + info->protocol != IPPROTO_UDP && + info->protocol != IPPROTO_SCTP && + info->protocol != IPPROTO_DCCP) + return -EINVAL; + } + if (info->bitmask & EBT_IP6_DPORT && info->dport[0] > info->dport[1]) + return -EINVAL; + if (info->bitmask & EBT_IP6_SPORT && info->sport[0] > info->sport[1]) + return -EINVAL; + return 0; +} + +static struct ebt_match filter_ip6 = +{ + .name = EBT_IP6_MATCH, + .match = ebt_filter_ip6, + .check = ebt_ip6_check, + .me = THIS_MODULE, +}; + +static int __init ebt_ip6_init(void) +{ + return ebt_register_match(&filter_ip6); +} + +static void __exit ebt_ip6_fini(void) +{ + ebt_unregister_match(&filter_ip6); +} + +module_init(ebt_ip6_init); +module_exit(ebt_ip6_fini); +MODULE_LICENSE("GPL"); diff -ruNp a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c --- a/net/bridge/netfilter/ebt_log.c 2008-02-18 16:26:37.000000000 -0800 +++ b/net/bridge/netfilter/ebt_log.c 2008-02-18 16:26:58.000000000 -0800 @@ -18,6 +18,8 @@ #include <linux/in.h> #include <linux/if_arp.h> #include <linux/spinlock.h> +#include <linux/ipv6.h> +#include <linux/in6.h> static DEFINE_SPINLOCK(ebt_log_lock); @@ -112,6 +114,43 @@ ebt_log_packet(unsigned int pf, unsigned goto out; } + if ((bitmask & EBT_LOG_IP6) && eth_hdr(skb)->h_proto == + htons(ETH_P_IPV6)){ + struct ipv6hdr _iph, *ih; + uint8_t *nexthdrp; + int offset_ph; + + ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); + if (ih == NULL) { + printk(" INCOMPLETE IPv6 header"); + goto out; + } + printk(" IPv6 SRC=%x:%x:%x:%x:%x:%x:%x:%x " + "IPv6 DST=%x:%x:%x:%x:%x:%x:%x:%x, IPv6 " + "priority=0x%01X, Next Header=%d", NIP6(ih->saddr), + NIP6(ih->daddr), ih->priority, ih->nexthdr); + nexthdrp = &ih->nexthdr; + offset_ph = ipv6_skip_exthdr(skb, sizeof(_iph), nexthdrp); + if (offset_ph == -1) + goto out; + if (*nexthdrp == IPPROTO_TCP || + *nexthdrp == IPPROTO_UDP || + *nexthdrp == IPPROTO_SCTP || + *nexthdrp == IPPROTO_DCCP) { + struct tcpudphdr _ports, *pptr; + + pptr = skb_header_pointer(skb, offset_ph, + sizeof(_ports), &_ports); + if (pptr == NULL) { + printk(" INCOMPLETE TCP/UDP header"); + goto out; + } + printk(" SPT=%u DPT=%u", ntohs(pptr->src), + ntohs(pptr->dst)); + } + goto out; + } + if ((bitmask & EBT_LOG_ARP) && ((eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) || (eth_hdr(skb)->h_proto == htons(ETH_P_RARP)))) { diff -ruNp a/net/bridge/netfilter/Kconfig b/net/bridge/netfilter/Kconfig --- a/net/bridge/netfilter/Kconfig 2008-02-18 16:26:37.000000000 -0800 +++ b/net/bridge/netfilter/Kconfig 2008-02-18 16:26:58.000000000 -0800 @@ -83,6 +83,15 @@ config BRIDGE_EBT_IP To compile it as a module, choose M here. If unsure, say N. +config BRIDGE_EBT_IP6 + tristate "ebt: IP6 filter support" + depends on BRIDGE_NF_EBTABLES + help + This option adds the IP6 match, which allows basic IPV6 header field + filtering. + + To compile it as a module, choose M here. If unsure, say N. + config BRIDGE_EBT_LIMIT tristate "ebt: limit match support" depends on BRIDGE_NF_EBTABLES diff -ruNp a/net/bridge/netfilter/Makefile b/net/bridge/netfilter/Makefile --- a/net/bridge/netfilter/Makefile 2008-02-18 16:26:37.000000000 -0800 +++ b/net/bridge/netfilter/Makefile 2008-02-18 16:26:59.000000000 -0800 @@ -14,6 +14,7 @@ obj-$(CONFIG_BRIDGE_EBT_802_3) += ebt_80 obj-$(CONFIG_BRIDGE_EBT_AMONG) += ebt_among.o obj-$(CONFIG_BRIDGE_EBT_ARP) += ebt_arp.o obj-$(CONFIG_BRIDGE_EBT_IP) += ebt_ip.o +obj-$(CONFIG_BRIDGE_EBT_IP6) += ebt_ip6.o obj-$(CONFIG_BRIDGE_EBT_LIMIT) += ebt_limit.o obj-$(CONFIG_BRIDGE_EBT_MARK) += ebt_mark_m.o obj-$(CONFIG_BRIDGE_EBT_PKTTYPE) += ebt_pkttype.o |
|
From: Tseng, Kuo-L. <kuo...@in...> - 2008-02-19 01:54:33
|
According to http://article.gmane.org/gmane.linux.network.bridge.ebtables.devel/719, I need to add required functions into userspace ebtables program and bridge-nf kernel module for parsing and matching on IPv6 header fields address, traffic class, IP protocol, and layer-4 port ids. Signed-off-by: Kuo-lang Tseng <kuo...@in...> Kuo |
4 messages has been excluded from this view by a project administrator.
