Mirrors/criu
1
0
Fork 0
mirror of https://github.com/checkpoint-restore/criu.git synced 2026-07-25 11:04:35 +00:00
Code Issues Projects Releases Wiki Activity

netfilter: use ipv4 iptables rules to block IPv4-mapped IPv6 addresses

Browse source 
If ipv6 socket has an IPv4-mapped address, it is used to handle ipv4
connection, so we have to use ipv4 iptables rules to block this
connection.

Reported-by: Mr Jenkins
Signed-off-by: Andrei Vagin <avagin@virtuozzo.com>
This commit is contained in:
Andrei Vagin 2017-11-28 01:12:23 +03:00
parent 89cdc6bcb4
commit de467742c6
1 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
criu/netfilter.c
View file

@ -47,6 +47,12 @@ void preload_netfilter_modules(void)
close_safe(&fd);
}
/* IPv4-Mapped IPv6 Addresses */
static int ipv6_addr_mapped(u32 *addr)
{
return (addr[2] == htonl(0x0000ffff));
}
static int nf_connection_switch_raw(int family, u32 *src_addr, u16 src_port,
u32 *dst_addr, u16 dst_port,
bool input, bool lock)
@ -56,6 +62,12 @@ static int nf_connection_switch_raw(int family, u32 *src_addr, u16 src_port,
char *argv[4] = { "sh", "-c", buf, NULL };
int ret;
if (family == AF_INET6 && ipv6_addr_mapped(dst_addr)) {
family = AF_INET;
src_addr = &src_addr[3];
dst_addr = &dst_addr[3];
}
switch (family) {
case AF_INET:
cmd = iptable_cmd_ipv4;