From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Thu, 12 Apr 2018 07:50:02 +0200
Subject: kernel: ebtables: add support for ICMP/IGMP type matches

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>

diff --git a/target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch b/target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch
new file mode 100644
index 0000000000000000000000000000000000000000..fe9c479338a7b597be649c761c70a63085b51c5f
--- /dev/null
+++ b/target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch
@@ -0,0 +1,134 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Sat, 3 Mar 2018 11:55:21 +0100
+Subject: [PATCH 1/2] ebtables: add support for matching ICMP type and code
+
+We already have ICMPv6 type/code matches. This adds support for IPv4 ICMP
+matches in the same way.
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+---
+ include/uapi/linux/netfilter_bridge/ebt_ip.h | 13 +++++++--
+ net/bridge/netfilter/ebt_ip.c                | 43 +++++++++++++++++++++-------
+ 2 files changed, 43 insertions(+), 13 deletions(-)
+
+--- a/include/uapi/linux/netfilter_bridge/ebt_ip.h
++++ b/include/uapi/linux/netfilter_bridge/ebt_ip.h
+@@ -24,8 +24,9 @@
+ #define EBT_IP_PROTO 0x08
+ #define EBT_IP_SPORT 0x10
+ #define EBT_IP_DPORT 0x20
++#define EBT_IP_ICMP 0x40
+ #define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
+- EBT_IP_SPORT | EBT_IP_DPORT )
++		     EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP)
+ #define EBT_IP_MATCH "ip"
+ 
+ /* the same values are used for the invflags */
+@@ -38,8 +39,14 @@ struct ebt_ip_info {
+ 	__u8  protocol;
+ 	__u8  bitmask;
+ 	__u8  invflags;
+-	__u16 sport[2];
+-	__u16 dport[2];
++	union {
++		__u16 sport[2];
++		__u8 icmp_type[2];
++	};
++	union {
++		__u16 dport[2];
++		__u8 icmp_code[2];
++	};
+ };
+ 
+ #endif
+--- a/net/bridge/netfilter/ebt_ip.c
++++ b/net/bridge/netfilter/ebt_ip.c
+@@ -19,9 +19,15 @@
+ #include <linux/netfilter_bridge/ebtables.h>
+ #include <linux/netfilter_bridge/ebt_ip.h>
+ 
+-struct tcpudphdr {
+-	__be16 src;
+-	__be16 dst;
++union pkthdr {
++	struct {
++		__be16 src;
++		__be16 dst;
++	} tcpudphdr;
++	struct {
++		u8 type;
++		u8 code;
++	} icmphdr;
+ };
+ 
+ static bool
+@@ -30,8 +36,8 @@ ebt_ip_mt(const struct sk_buff *skb, str
+ 	const struct ebt_ip_info *info = par->matchinfo;
+ 	const struct iphdr *ih;
+ 	struct iphdr _iph;
+-	const struct tcpudphdr *pptr;
+-	struct tcpudphdr _ports;
++	const union pkthdr *pptr;
++	union pkthdr _pkthdr;
+ 
+ 	ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
+ 	if (ih == NULL)
+@@ -50,29 +56,38 @@ ebt_ip_mt(const struct sk_buff *skb, str
+ 	if (info->bitmask & EBT_IP_PROTO) {
+ 		if (NF_INVF(info, EBT_IP_PROTO, info->protocol != ih->protocol))
+ 			return false;
+-		if (!(info->bitmask & EBT_IP_DPORT) &&
+-		    !(info->bitmask & EBT_IP_SPORT))
++		if (!(info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT |
++				       EBT_IP_ICMP)))
+ 			return true;
+ 		if (ntohs(ih->frag_off) & IP_OFFSET)
+ 			return false;
++
++		/* min icmp headersize is 4, so sizeof(_pkthdr) is ok. */
+ 		pptr = skb_header_pointer(skb, ih->ihl*4,
+-					  sizeof(_ports), &_ports);
++					  sizeof(_pkthdr), &_pkthdr);
+ 		if (pptr == NULL)
+ 			return false;
+ 		if (info->bitmask & EBT_IP_DPORT) {
+-			u32 dst = ntohs(pptr->dst);
++			u32 dst = ntohs(pptr->tcpudphdr.dst);
+ 			if (NF_INVF(info, EBT_IP_DPORT,
+ 				    dst < info->dport[0] ||
+ 				    dst > info->dport[1]))
+ 				return false;
+ 		}
+ 		if (info->bitmask & EBT_IP_SPORT) {
+-			u32 src = ntohs(pptr->src);
++			u32 src = ntohs(pptr->tcpudphdr.src);
+ 			if (NF_INVF(info, EBT_IP_SPORT,
+ 				    src < info->sport[0] ||
+ 				    src > info->sport[1]))
+ 				return false;
+ 		}
++		if ((info->bitmask & EBT_IP_ICMP) &&
++		    NF_INVF(info, EBT_IP_ICMP,
++			    pptr->icmphdr.type < info->icmp_type[0] ||
++			    pptr->icmphdr.type > info->icmp_type[1] ||
++			    pptr->icmphdr.code < info->icmp_code[0] ||
++			    pptr->icmphdr.code > info->icmp_code[1]))
++			return false;
+ 	}
+ 	return true;
+ }
+@@ -101,6 +116,14 @@ static int ebt_ip_mt_check(const struct
+ 		return -EINVAL;
+ 	if (info->bitmask & EBT_IP_SPORT && info->sport[0] > info->sport[1])
+ 		return -EINVAL;
++	if (info->bitmask & EBT_IP_ICMP) {
++		if ((info->invflags & EBT_IP_PROTO) ||
++		    info->protocol != IPPROTO_ICMP)
++			return -EINVAL;
++		if (info->icmp_type[0] > info->icmp_type[1] ||
++		    info->icmp_code[0] > info->icmp_code[1])
++			return -EINVAL;
++	}
+ 	return 0;
+ }
+ 
diff --git a/target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch b/target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch
new file mode 100644
index 0000000000000000000000000000000000000000..4c8144834d87c58ff90363cdc2f2933194e54fdc
--- /dev/null
+++ b/target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch
@@ -0,0 +1,88 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Sat, 3 Mar 2018 12:02:21 +0100
+Subject: [PATCH 2/2] ebtables: add support for matching IGMP type
+
+We already have ICMPv6 type/code matches (which can be used to distinguish
+different types of MLD packets). Add support for IPv4 IGMP matches in the
+same way.
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+---
+ include/uapi/linux/netfilter_bridge/ebt_ip.h |  4 +++-
+ net/bridge/netfilter/ebt_ip.c                | 19 +++++++++++++++++--
+ 2 files changed, 20 insertions(+), 3 deletions(-)
+
+--- a/include/uapi/linux/netfilter_bridge/ebt_ip.h
++++ b/include/uapi/linux/netfilter_bridge/ebt_ip.h
+@@ -25,8 +25,9 @@
+ #define EBT_IP_SPORT 0x10
+ #define EBT_IP_DPORT 0x20
+ #define EBT_IP_ICMP 0x40
++#define EBT_IP_IGMP 0x80
+ #define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
+-		     EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP)
++		     EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP | EBT_IP_IGMP)
+ #define EBT_IP_MATCH "ip"
+ 
+ /* the same values are used for the invflags */
+@@ -42,6 +43,7 @@ struct ebt_ip_info {
+ 	union {
+ 		__u16 sport[2];
+ 		__u8 icmp_type[2];
++		__u8 igmp_type[2];
+ 	};
+ 	union {
+ 		__u16 dport[2];
+--- a/net/bridge/netfilter/ebt_ip.c
++++ b/net/bridge/netfilter/ebt_ip.c
+@@ -28,6 +28,9 @@ union pkthdr {
+ 		u8 type;
+ 		u8 code;
+ 	} icmphdr;
++	struct {
++		u8 type;
++	} igmphdr;
+ };
+ 
+ static bool
+@@ -57,12 +60,12 @@ ebt_ip_mt(const struct sk_buff *skb, str
+ 		if (NF_INVF(info, EBT_IP_PROTO, info->protocol != ih->protocol))
+ 			return false;
+ 		if (!(info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT |
+-				       EBT_IP_ICMP)))
++				       EBT_IP_ICMP | EBT_IP_IGMP)))
+ 			return true;
+ 		if (ntohs(ih->frag_off) & IP_OFFSET)
+ 			return false;
+ 
+-		/* min icmp headersize is 4, so sizeof(_pkthdr) is ok. */
++		/* min icmp/igmp headersize is 4, so sizeof(_pkthdr) is ok. */
+ 		pptr = skb_header_pointer(skb, ih->ihl*4,
+ 					  sizeof(_pkthdr), &_pkthdr);
+ 		if (pptr == NULL)
+@@ -88,6 +91,11 @@ ebt_ip_mt(const struct sk_buff *skb, str
+ 			    pptr->icmphdr.code < info->icmp_code[0] ||
+ 			    pptr->icmphdr.code > info->icmp_code[1]))
+ 			return false;
++		if ((info->bitmask & EBT_IP_IGMP) &&
++		    NF_INVF(info, EBT_IP_IGMP,
++			    pptr->igmphdr.type < info->igmp_type[0] ||
++			    pptr->igmphdr.type > info->igmp_type[1]))
++			return false;
+ 	}
+ 	return true;
+ }
+@@ -124,6 +132,13 @@ static int ebt_ip_mt_check(const struct
+ 		    info->icmp_code[0] > info->icmp_code[1])
+ 			return -EINVAL;
+ 	}
++	if (info->bitmask & EBT_IP_IGMP) {
++		if ((info->invflags & EBT_IP_PROTO) ||
++		    info->protocol != IPPROTO_IGMP)
++			return -EINVAL;
++		if (info->igmp_type[0] > info->igmp_type[1])
++			return -EINVAL;
++	}
+ 	return 0;
+ }
+ 
