Merge branch 'misc' of master.kernel.org:/pub/scm/linux/kernel/git/galak/powerpc...

[pandora-kernel.git] / net / ipv6 / netfilter / nf_conntrack_proto_icmpv6.c

diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index c0f1da5..86c6703 100644 (file)
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -57,19 +57,19 @@ static int icmpv6_pkt_to_tuple(const struct sk_buff *skb,
        return 1;
 }
 
+/* Add 1; spaces filled with 0. */
+static u_int8_t invmap[] = {
+       [ICMPV6_ECHO_REQUEST - 128]     = ICMPV6_ECHO_REPLY + 1,
+       [ICMPV6_ECHO_REPLY - 128]       = ICMPV6_ECHO_REQUEST + 1,
+       [ICMPV6_NI_QUERY - 128]         = ICMPV6_NI_QUERY + 1,
+       [ICMPV6_NI_REPLY - 128]         = ICMPV6_NI_REPLY +1
+};
+
 static int icmpv6_invert_tuple(struct nf_conntrack_tuple *tuple,
                               const struct nf_conntrack_tuple *orig)
 {
-       /* Add 1; spaces filled with 0. */
-       static u_int8_t invmap[] = {
-               [ICMPV6_ECHO_REQUEST - 128]     = ICMPV6_ECHO_REPLY + 1,
-               [ICMPV6_ECHO_REPLY - 128]       = ICMPV6_ECHO_REQUEST + 1,
-               [ICMPV6_NI_QUERY - 128]         = ICMPV6_NI_QUERY + 1,
-               [ICMPV6_NI_REPLY - 128]         = ICMPV6_NI_REPLY +1
-       };
-
-       __u8 type = orig->dst.u.icmp.type - 128;
-       if (type >= sizeof(invmap) || !invmap[type])
+       int type = orig->dst.u.icmp.type - 128;
+       if (type < 0 || type >= sizeof(invmap) || !invmap[type])
                return 0;
 
        tuple->src.u.icmp.id   = orig->src.u.icmp.id;
@@ -129,12 +129,12 @@ static int icmpv6_new(struct nf_conn *conntrack,
                [ICMPV6_ECHO_REQUEST - 128] = 1,
                [ICMPV6_NI_QUERY - 128] = 1
        };
+       int type = conntrack->tuplehash[0].tuple.dst.u.icmp.type - 128;
 
-       if (conntrack->tuplehash[0].tuple.dst.u.icmp.type - 128 >= sizeof(valid_new)
-           || !valid_new[conntrack->tuplehash[0].tuple.dst.u.icmp.type - 128]) {
+       if (type < 0 || type >= sizeof(valid_new) || !valid_new[type]) {
                /* Can't create a new ICMPv6 `conn' with this. */
-               DEBUGP("icmp: can't create new conn with type %u\n",
-                      conntrack->tuplehash[0].tuple.dst.u.icmp.type);
+               DEBUGP("icmpv6: can't create new conn with type %u\n",
+                      type + 128);
                NF_CT_DUMP_TUPLE(&conntrack->tuplehash[0].tuple);
                return 0;
        }
@@ -185,7 +185,7 @@ icmpv6_error_message(struct sk_buff *skb,
                return -NF_ACCEPT;
        }
 
-       inproto = nf_ct_find_proto(PF_INET6, inprotonum);
+       inproto = __nf_ct_proto_find(PF_INET6, inprotonum);
 
        /* Are they talking about one of our connections? */
        if (!nf_ct_get_tuple(skb, inip6off, inprotoff, PF_INET6, inprotonum,
@@ -233,21 +233,13 @@ icmpv6_error(struct sk_buff *skb, unsigned int dataoff,
                return -NF_ACCEPT;
        }
 
-       if (hooknum != NF_IP6_PRE_ROUTING)
-               goto skipped;
-
-       /* Ignore it if the checksum's bogus. */
-       if (csum_ipv6_magic(&skb->nh.ipv6h->saddr, &skb->nh.ipv6h->daddr,
-                           skb->len - dataoff, IPPROTO_ICMPV6,
-                           skb_checksum(skb, dataoff,
-                                        skb->len - dataoff, 0))) {
+       if (hooknum == NF_IP6_PRE_ROUTING &&
+           nf_ip6_checksum(skb, hooknum, dataoff, IPPROTO_ICMPV6)) {
                nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
                              "nf_ct_icmpv6: ICMPv6 checksum failed\n");
                return -NF_ACCEPT;
        }
 
-skipped:
-
        /* is not error message ? */
        if (icmp6h->icmp6_type >= 128)
                return NF_ACCEPT;
@@ -255,6 +247,60 @@ skipped:
        return icmpv6_error_message(skb, dataoff, ctinfo, hooknum);
 }
 
+#if defined(CONFIG_NF_CT_NETLINK) || \
+    defined(CONFIG_NF_CT_NETLINK_MODULE)
+
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_conntrack.h>
+static int icmpv6_tuple_to_nfattr(struct sk_buff *skb,
+                                 const struct nf_conntrack_tuple *t)
+{
+       NFA_PUT(skb, CTA_PROTO_ICMPV6_ID, sizeof(u_int16_t),
+               &t->src.u.icmp.id);
+       NFA_PUT(skb, CTA_PROTO_ICMPV6_TYPE, sizeof(u_int8_t),
+               &t->dst.u.icmp.type);
+       NFA_PUT(skb, CTA_PROTO_ICMPV6_CODE, sizeof(u_int8_t),
+               &t->dst.u.icmp.code);
+
+       return 0;
+
+nfattr_failure:
+       return -1;
+}
+
+static const size_t cta_min_proto[CTA_PROTO_MAX] = {
+       [CTA_PROTO_ICMPV6_TYPE-1] = sizeof(u_int8_t),
+       [CTA_PROTO_ICMPV6_CODE-1] = sizeof(u_int8_t),
+       [CTA_PROTO_ICMPV6_ID-1]   = sizeof(u_int16_t)
+};
+
+static int icmpv6_nfattr_to_tuple(struct nfattr *tb[],
+                               struct nf_conntrack_tuple *tuple)
+{
+       if (!tb[CTA_PROTO_ICMPV6_TYPE-1]
+           || !tb[CTA_PROTO_ICMPV6_CODE-1]
+           || !tb[CTA_PROTO_ICMPV6_ID-1])
+               return -EINVAL;
+
+       if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
+               return -EINVAL;
+
+       tuple->dst.u.icmp.type =
+                       *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMPV6_TYPE-1]);
+       tuple->dst.u.icmp.code =
+                       *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMPV6_CODE-1]);
+       tuple->src.u.icmp.id =
+                       *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_ICMPV6_ID-1]);
+
+       if (tuple->dst.u.icmp.type < 128
+           || tuple->dst.u.icmp.type - 128 >= sizeof(invmap)
+           || !invmap[tuple->dst.u.icmp.type - 128])
+               return -EINVAL;
+
+       return 0;
+}
+#endif
+
 struct nf_conntrack_protocol nf_conntrack_protocol_icmpv6 =
 {
        .l3proto                = PF_INET6,
@@ -267,6 +313,11 @@ struct nf_conntrack_protocol nf_conntrack_protocol_icmpv6 =
        .packet                 = icmpv6_packet,
        .new                    = icmpv6_new,
        .error                  = icmpv6_error,
+#if defined(CONFIG_NF_CT_NETLINK) || \
+    defined(CONFIG_NF_CT_NETLINK_MODULE)
+       .tuple_to_nfattr        = icmpv6_tuple_to_nfattr,
+       .nfattr_to_tuple        = icmpv6_nfattr_to_tuple,
+#endif
 };
 
 EXPORT_SYMBOL(nf_conntrack_protocol_icmpv6);