[NETFILTER]: ebt_arp: add gratuitous arp filtering

The attached patch adds gratuitous arp filtering, more precisely: it
allows checking that the IPv4 source address matches the IPv4
destination address inside the ARP header. It also adds a check for the
hardware address type when matching MAC addresses (nothing critical,
just for better consistency).

Signed-off-by: Bart De Schuymer <bdschuym@pandora.be>
Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 22 insertions, 26 deletions

diff --git a/net/bridge/netfilter/ebt_arp.c b/net/bridge/netfilter/ebt_arp.c
index 9c599800a900..1a46952a56d9 100644
--- a/net/bridge/netfilter/ebt_arp.c
+++ b/net/bridge/netfilter/ebt_arp.c
@@ -35,40 +35,36 @@ static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in
                 return EBT_NOMATCH;
 
         if (info->bitmask & (EBT_ARP_SRC_IP | EBT_ARP_DST_IP)) {
-                __be32 _addr, *ap;
+                __be32 saddr, daddr, *sap, *dap;
 
-                /* IPv4 addresses are always 4 bytes */
-                if (ah->ar_pln != sizeof(__be32))
+                if (ah->ar_pln != sizeof(__be32) || ah->ar_pro != htons(ETH_P_IP))
+                        return EBT_NOMATCH;
+                sap = skb_header_pointer(skb, sizeof(struct arphdr) +
+                                        ah->ar_hln, sizeof(saddr),
+                                        &saddr);
+                if (sap == NULL)
+                        return EBT_NOMATCH;
+                dap = skb_header_pointer(skb, sizeof(struct arphdr) +
+                                        2*ah->ar_hln+sizeof(saddr),
+                                        sizeof(daddr), &daddr);
+                if (dap == NULL)
+                        return EBT_NOMATCH;
+                if (info->bitmask & EBT_ARP_SRC_IP &&
+                    FWINV(info->saddr != (*sap & info->smsk), EBT_ARP_SRC_IP))
+                        return EBT_NOMATCH;
+                if (info->bitmask & EBT_ARP_DST_IP &&
+                    FWINV(info->daddr != (*dap & info->dmsk), EBT_ARP_DST_IP))
+                        return EBT_NOMATCH;
+                if (info->bitmask & EBT_ARP_GRAT &&
+                    FWINV(*dap != *sap, EBT_ARP_GRAT))
                         return EBT_NOMATCH;
-                if (info->bitmask & EBT_ARP_SRC_IP) {
-                        ap = skb_header_pointer(skb, sizeof(struct arphdr) +
-                                                ah->ar_hln, sizeof(_addr),
-                                                &_addr);
-                        if (ap == NULL)
-                                return EBT_NOMATCH;
-                        if (FWINV(info->saddr != (*ap & info->smsk),
-                           EBT_ARP_SRC_IP))
-                                return EBT_NOMATCH;
-                }
-
-                if (info->bitmask & EBT_ARP_DST_IP) {
-                        ap = skb_header_pointer(skb, sizeof(struct arphdr) +
-                                                2*ah->ar_hln+sizeof(__be32),
-                                                sizeof(_addr), &_addr);
-                        if (ap == NULL)
-                                return EBT_NOMATCH;
-                        if (FWINV(info->daddr != (*ap & info->dmsk),
-                           EBT_ARP_DST_IP))
-                                return EBT_NOMATCH;
-                }
         }
 
         if (info->bitmask & (EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC)) {
                 unsigned char _mac[ETH_ALEN], *mp;
                 uint8_t verdict, i;
 
-                /* MAC addresses are 6 bytes */
-                if (ah->ar_hln != ETH_ALEN)
+                if (ah->ar_hln != ETH_ALEN || ah->ar_hrd != htons(ARPHRD_ETHER))
                         return EBT_NOMATCH;
                 if (info->bitmask & EBT_ARP_SRC_MAC) {
                         mp = skb_header_pointer(skb, sizeof(struct arphdr),