From: Sven Eckelmann <sven.eckelmann@gmx.de>
To: gregkh@suse.de
Cc: b.a.t.m.a.n@lists.open-mesh.net
Subject: [B.A.T.M.A.N.] [PATCH 5/6] Staging: batman-adv: Adding netfilter-bridge hooks
Date: Sat, 22 May 2010 17:54:43 +0200 [thread overview]
Message-ID: <1274543684-4919-5-git-send-email-sven.eckelmann@gmx.de> (raw)
In-Reply-To: <201005221753.54176.sven.eckelmann@gmx.de>
From: Linus Lüssing <linus.luessing@web.de>
batman-adv is receiving and sending the packets of its own ether type
on a very early/low level. Therefore we need to add explicit hooks to
give netfilter/ebtables a chance to filter them.
Reported-by: Antonio Quartulli <ordex@ritirata.org>
Signed-off-by: Linus Lüssing <linus.luessing@web.de>
Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
drivers/staging/batman-adv/hard-interface.c | 14 +++++++++++++-
drivers/staging/batman-adv/send.c | 9 +++++++--
2 files changed, 20 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/batman-adv/hard-interface.c b/drivers/staging/batman-adv/hard-interface.c
index 7a582e8..66f5550 100644
--- a/drivers/staging/batman-adv/hard-interface.c
+++ b/drivers/staging/batman-adv/hard-interface.c
@@ -30,6 +30,7 @@
#include "hash.h"
#include <linux/if_arp.h>
+#include <linux/netfilter_bridge.h>
#define MIN(x, y) ((x) < (y) ? (x) : (y))
@@ -432,6 +433,11 @@ out:
return NOTIFY_DONE;
}
+int batman_skb_recv_finish(struct sk_buff *skb)
+{
+ return NF_ACCEPT;
+}
+
/* receive a packet with the batman ethertype coming on a hard
* interface */
int batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
@@ -451,6 +457,13 @@ int batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
if (atomic_read(&module_state) != MODULE_ACTIVE)
goto err_free;
+ /* if netfilter/ebtables wants to block incoming batman
+ * packets then give them a chance to do so here */
+ ret = NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_IN, skb, dev, NULL,
+ batman_skb_recv_finish);
+ if (ret != 1)
+ goto err_out;
+
/* packet should hold at least type and version */
if (unlikely(skb_headlen(skb) < 2))
goto err_free;
@@ -530,7 +543,6 @@ err_out:
return NET_RX_DROP;
}
-
struct notifier_block hard_if_notifier = {
.notifier_call = hard_if_event,
};
diff --git a/drivers/staging/batman-adv/send.c b/drivers/staging/batman-adv/send.c
index ac69ed8..7365f6d 100644
--- a/drivers/staging/batman-adv/send.c
+++ b/drivers/staging/batman-adv/send.c
@@ -29,6 +29,8 @@
#include "vis.h"
#include "aggregation.h"
+#include <linux/netfilter_bridge.h>
+
/* apply hop penalty for a normal link */
static uint8_t hop_penalty(const uint8_t tq)
{
@@ -90,9 +92,12 @@ int send_skb_packet(struct sk_buff *skb,
/* dev_queue_xmit() returns a negative result on error. However on
* congestion and traffic shaping, it drops and returns NET_XMIT_DROP
- * (which is > 0). This will not be treated as an error. */
+ * (which is > 0). This will not be treated as an error.
+ * Also, if netfilter/ebtables wants to block outgoing batman
+ * packets then giving them a chance to do so here */
- return dev_queue_xmit(skb);
+ return NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
+ dev_queue_xmit);
send_skb_err:
kfree_skb(skb);
return NET_XMIT_DROP;
--
1.7.1
next prev parent reply other threads:[~2010-05-22 15:54 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-05-22 15:53 [B.A.T.M.A.N.] [PATCH 00/26] Staging: batman-adv for 2.6.36 Sven Eckelmann
2010-05-22 15:54 ` [B.A.T.M.A.N.] [PATCH 1/6] Staging: batman-adv: remove redundant struct declaration Sven Eckelmann
2010-05-22 15:54 ` [B.A.T.M.A.N.] [PATCH 2/6] Staging: batman-adv: Move device for icmp injection to debugfs Sven Eckelmann
2010-05-22 15:54 ` [B.A.T.M.A.N.] [PATCH 3/6] Staging: batman-adv: Move tables from sysfs " Sven Eckelmann
2010-05-22 15:54 ` [B.A.T.M.A.N.] [PATCH 4/6] Staging: batman-adv: convert all sysfs files to single value files Sven Eckelmann
2010-05-22 15:54 ` Sven Eckelmann [this message]
2010-05-22 15:54 ` [B.A.T.M.A.N.] [PATCH 6/6] Staging: batman-adv: Add information about batman-adv sysfs entries Sven Eckelmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1274543684-4919-5-git-send-email-sven.eckelmann@gmx.de \
--to=sven.eckelmann@gmx.de \
--cc=b.a.t.m.a.n@lists.open-mesh.net \
--cc=b.a.t.m.a.n@lists.open-mesh.org \
--cc=gregkh@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).