Re: IPv6 multicast (MLD,IGMP) code bypasses netfilter hooks

3 messages, 3 authors, 2003-11-24 · open the first message on its own page

Re: IPv6 multicast (MLD,IGMP) code bypasses netfilter hooks

From: David Stevens <hidden>
Date: 2003-11-23 11:13:39




Here's a patch to add netfilter hooks for MLD v1 & v2. Can you take
quick look at it, Harald?

                        +-DLS

--- linux-2.6.0-test9-bk25/net/ipv6/mcast.c     2003-11-21 19:33:41.000000000 -0800
+++ linux-2.6.0-test9-bk25F1/net/ipv6/mcast.c   2003-11-23 01:32:39.000000000 -0800

@@ -46,6 +46,9 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>

+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv6.h>
+
 #include <net/sock.h>
 #include <net/snmp.h>

@@ -1265,6 +1268,7 @@
      struct mld2_report *pmr = (struct mld2_report *)skb->h.raw;
      int payload_len, mldlen;
      struct inet6_dev *idev = in6_dev_get(skb->dev);
+     int err;

      payload_len = skb->tail - (unsigned char *)skb->nh.ipv6h -
            sizeof(struct ipv6hdr);

@@ -1273,8 +1277,10 @@

      pmr->csum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
            IPPROTO_ICMPV6, csum_partial(skb->h.raw, mldlen, 0));
-     dev_queue_xmit(skb);
-     ICMP6_INC_STATS(idev,Icmp6OutMsgs);
+     err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, skb->dev,
+           dev_queue_xmit);
+     if (!err)
+           ICMP6_INC_STATS(idev,Icmp6OutMsgs);
      if (likely(idev != NULL))
            in6_dev_put(idev);
 }

@@ -1603,12 +1609,15 @@

      idev = in6_dev_get(skb->dev);

-     dev_queue_xmit(skb);
-     if (type == ICMPV6_MGM_REDUCTION)
-           ICMP6_INC_STATS(idev, Icmp6OutGroupMembReductions);
-     else
-           ICMP6_INC_STATS(idev, Icmp6OutGroupMembResponses);
-     ICMP6_INC_STATS(idev, Icmp6OutMsgs);
+     err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, skb->dev,
+           dev_queue_xmit);
+     if (!err) {
+           if (type == ICMPV6_MGM_REDUCTION)
+                 ICMP6_INC_STATS(idev, Icmp6OutGroupMembReductions);
+           else
+                 ICMP6_INC_STATS(idev, Icmp6OutGroupMembResponses);
+           ICMP6_INC_STATS(idev, Icmp6OutMsgs);
+     }

      if (likely(idev != NULL))
            in6_dev_put(idev);

(See attached file: MLDNF.patch)

Re: IPv6 multicast (MLD,IGMP) code bypasses netfilter hooks

From: David S. Miller <hidden>
Date: 2003-11-24 06:44:14

On Sun, 23 Nov 2003 04:13:39 -0700
David Stevens [off-list ref] wrote:

Here's a patch to add netfilter hooks for MLD v1 & v2. Can you take
quick look at it, Harald?

Whoa, David beat me to it, on a weekend no less :)))

It looks good to me.  Applied, thanks.

Re: IPv6 multicast (MLD,IGMP) code bypasses netfilter hooks

From: Harald Welte <hidden>
Date: 2003-11-24 10:24:51

On Sun, Nov 23, 2003 at 10:44:14PM -0800, David S. Miller wrote:

David Stevens [off-list ref] wrote:

quoted

Here's a patch to add netfilter hooks for MLD v1 & v2. Can you take
quick look at it, Harald?

Whoa, David beat me to it, on a weekend no less :)))

Thanks, David & David :)

It looks good to me.  Applied, thanks.

obviously fine with mee, too.

-- 
- Harald Welte [off-list ref]             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help