1// SPDX-License-Identifier: GPL-2.0-or-later 2/* 3 * Handle firewalling 4 * Linux ethernet bridge 5 * 6 * Authors: 7 * Lennert Buytenhek <buytenh@gnu.org> 8 * Bart De Schuymer <bdschuym@pandora.be> 9 * 10 * Lennert dedicates this file to Kerstin Wurdinger. 11 */ 12 13#include <linux/module.h> 14#include <linux/kernel.h> 15#include <linux/slab.h> 16#include <linux/ip.h> 17#include <linux/netdevice.h> 18#include <linux/skbuff.h> 19#include <linux/if_arp.h> 20#include <linux/if_ether.h> 21#include <linux/if_vlan.h> 22#include <linux/if_pppox.h> 23#include <linux/ppp_defs.h> 24#include <linux/netfilter_bridge.h> 25#include <linux/netfilter_ipv4.h> 26#include <linux/netfilter_ipv6.h> 27#include <linux/netfilter_arp.h> 28#include <linux/in_route.h> 29#include <linux/inetdevice.h> 30 31#include <net/ip.h> 32#include <net/ipv6.h> 33#include <net/addrconf.h> 34#include <net/route.h> 35#include <net/netfilter/br_netfilter.h> 36 37#include <linux/uaccess.h> 38#include "br_private.h" 39#ifdef CONFIG_SYSCTL 40#include <linux/sysctl.h> 41#endif 42 43int br_validate_ipv6(struct net *net, struct sk_buff *skb) 44{ 45 const struct ipv6hdr *hdr; 46 struct inet6_dev *idev = __in6_dev_get(skb->dev); 47 u32 pkt_len; 48 u8 ip6h_len = sizeof(struct ipv6hdr); 49 50 if (!pskb_may_pull(skb, ip6h_len)) 51 goto inhdr_error; 52 53 if (skb->len < ip6h_len) 54 goto drop; 55 56 hdr = ipv6_hdr(skb); 57 58 if (hdr->version != 6) 59 goto inhdr_error; 60 61 pkt_len = ntohs(hdr->payload_len); 62 if (hdr->nexthdr == NEXTHDR_HOP && nf_ip6_check_hbh_len(skb, &pkt_len)) 63 goto drop; 64 65 if (pkt_len + ip6h_len > skb->len) { 66 __IP6_INC_STATS(net, idev, 67 IPSTATS_MIB_INTRUNCATEDPKTS); 68 goto drop; 69 } 70 if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) { 71 __IP6_INC_STATS(net, idev, 72 IPSTATS_MIB_INDISCARDS); 73 goto drop; 74 } 75 76 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); 77 /* No IP options in IPv6 header; however it should be 78 * checked if some next headers need special treatment 79 */ 80 return 0; 81 82inhdr_error: 83 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS); 84drop: 85 return -1; 86} 87 88static inline bool 89br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb, 90 const struct nf_bridge_info *nf_bridge) 91{ 92 return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr, 93 sizeof(ipv6_hdr(skb)->daddr)) != 0; 94} 95 96/* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables 97 * PREROUTING and continue the bridge PRE_ROUTING hook. See comment 98 * for br_nf_pre_routing_finish(), same logic is used here but 99 * equivalent IPv6 function ip6_route_input() called indirectly. 100 */ 101static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb) 102{ 103 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); 104 struct rtable *rt; 105 struct net_device *dev = skb->dev, *br_indev; 106 const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops(); 107 108 br_indev = nf_bridge_get_physindev(skb, net); 109 if (!br_indev) { 110 kfree_skb(skb); 111 return 0; 112 } 113 114 nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size; 115 116 if (nf_bridge->pkt_otherhost) { 117 skb->pkt_type = PACKET_OTHERHOST; 118 nf_bridge->pkt_otherhost = false; 119 } 120 nf_bridge->in_prerouting = 0; 121 if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) { 122 skb_dst_drop(skb); 123 v6ops->route_input(skb); 124 125 if (skb_dst(skb)->error) { 126 kfree_skb(skb); 127 return 0; 128 } 129 130 if (skb_dst(skb)->dev == dev) { 131 skb->dev = br_indev; 132 nf_bridge_update_protocol(skb); 133 nf_bridge_push_encap_header(skb); 134 br_nf_hook_thresh(NF_BR_PRE_ROUTING, 135 net, sk, skb, skb->dev, NULL, 136 br_nf_pre_routing_finish_bridge); 137 return 0; 138 } 139 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr); 140 skb->pkt_type = PACKET_HOST; 141 } else { 142 rt = bridge_parent_rtable(br_indev); 143 if (!rt) { 144 kfree_skb(skb); 145 return 0; 146 } 147 skb_dst_drop(skb); 148 skb_dst_set_noref(skb, &rt->dst); 149 } 150 151 skb->dev = br_indev; 152 nf_bridge_update_protocol(skb); 153 nf_bridge_push_encap_header(skb); 154 br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb, 155 skb->dev, NULL, br_handle_frame_finish); 156 157 return 0; 158} 159 160/* Replicate the checks that IPv6 does on packet reception and pass the packet 161 * to ip6tables. 162 */ 163unsigned int br_nf_pre_routing_ipv6(void *priv, 164 struct sk_buff *skb, 165 const struct nf_hook_state *state) 166{ 167 struct nf_bridge_info *nf_bridge; 168 169 if (br_validate_ipv6(state->net, skb)) 170 return NF_DROP_REASON(skb, SKB_DROP_REASON_IP_INHDR, 0); 171 172 nf_bridge = nf_bridge_alloc(skb); 173 if (!nf_bridge) 174 return NF_DROP_REASON(skb, SKB_DROP_REASON_NOMEM, 0); 175 if (!setup_pre_routing(skb, state->net)) 176 return NF_DROP_REASON(skb, SKB_DROP_REASON_DEV_READY, 0); 177 178 nf_bridge = nf_bridge_info_get(skb); 179 nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr; 180 181 skb->protocol = htons(ETH_P_IPV6); 182 skb->transport_header = skb->network_header + sizeof(struct ipv6hdr); 183 184 NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb, 185 skb->dev, NULL, 186 br_nf_pre_routing_finish_ipv6); 187 188 return NF_STOLEN; 189} 190