1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* |
3 | * Handle firewalling |
4 | * Linux ethernet bridge |
5 | * |
6 | * Authors: |
7 | * Lennert Buytenhek <buytenh@gnu.org> |
8 | * Bart De Schuymer <bdschuym@pandora.be> |
9 | * |
10 | * Lennert dedicates this file to Kerstin Wurdinger. |
11 | */ |
12 | |
13 | #include <linux/module.h> |
14 | #include <linux/kernel.h> |
15 | #include <linux/slab.h> |
16 | #include <linux/ip.h> |
17 | #include <linux/netdevice.h> |
18 | #include <linux/skbuff.h> |
19 | #include <linux/if_arp.h> |
20 | #include <linux/if_ether.h> |
21 | #include <linux/if_vlan.h> |
22 | #include <linux/if_pppox.h> |
23 | #include <linux/ppp_defs.h> |
24 | #include <linux/netfilter_bridge.h> |
25 | #include <linux/netfilter_ipv4.h> |
26 | #include <linux/netfilter_ipv6.h> |
27 | #include <linux/netfilter_arp.h> |
28 | #include <linux/in_route.h> |
29 | #include <linux/inetdevice.h> |
30 | |
31 | #include <net/ip.h> |
32 | #include <net/ipv6.h> |
33 | #include <net/addrconf.h> |
34 | #include <net/route.h> |
35 | #include <net/netfilter/br_netfilter.h> |
36 | |
37 | #include <linux/uaccess.h> |
38 | #include "br_private.h" |
39 | #ifdef CONFIG_SYSCTL |
40 | #include <linux/sysctl.h> |
41 | #endif |
42 | |
43 | int br_validate_ipv6(struct net *net, struct sk_buff *skb) |
44 | { |
45 | const struct ipv6hdr *hdr; |
46 | struct inet6_dev *idev = __in6_dev_get(dev: skb->dev); |
47 | u32 pkt_len; |
48 | u8 ip6h_len = sizeof(struct ipv6hdr); |
49 | |
50 | if (!pskb_may_pull(skb, len: ip6h_len)) |
51 | goto inhdr_error; |
52 | |
53 | if (skb->len < ip6h_len) |
54 | goto drop; |
55 | |
56 | hdr = ipv6_hdr(skb); |
57 | |
58 | if (hdr->version != 6) |
59 | goto inhdr_error; |
60 | |
61 | pkt_len = ntohs(hdr->payload_len); |
62 | if (hdr->nexthdr == NEXTHDR_HOP && nf_ip6_check_hbh_len(skb, plen: &pkt_len)) |
63 | goto drop; |
64 | |
65 | if (pkt_len + ip6h_len > skb->len) { |
66 | __IP6_INC_STATS(net, idev, |
67 | IPSTATS_MIB_INTRUNCATEDPKTS); |
68 | goto drop; |
69 | } |
70 | if (pskb_trim_rcsum(skb, len: pkt_len + ip6h_len)) { |
71 | __IP6_INC_STATS(net, idev, |
72 | IPSTATS_MIB_INDISCARDS); |
73 | goto drop; |
74 | } |
75 | |
76 | memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); |
77 | /* No IP options in IPv6 header; however it should be |
78 | * checked if some next headers need special treatment |
79 | */ |
80 | return 0; |
81 | |
82 | inhdr_error: |
83 | __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS); |
84 | drop: |
85 | return -1; |
86 | } |
87 | |
88 | static inline bool |
89 | br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb, |
90 | const struct nf_bridge_info *nf_bridge) |
91 | { |
92 | return memcmp(p: &nf_bridge->ipv6_daddr, q: &ipv6_hdr(skb)->daddr, |
93 | size: sizeof(ipv6_hdr(skb)->daddr)) != 0; |
94 | } |
95 | |
96 | /* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables |
97 | * PREROUTING and continue the bridge PRE_ROUTING hook. See comment |
98 | * for br_nf_pre_routing_finish(), same logic is used here but |
99 | * equivalent IPv6 function ip6_route_input() called indirectly. |
100 | */ |
101 | static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb) |
102 | { |
103 | struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); |
104 | struct rtable *rt; |
105 | struct net_device *dev = skb->dev; |
106 | const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops(); |
107 | |
108 | nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size; |
109 | |
110 | if (nf_bridge->pkt_otherhost) { |
111 | skb->pkt_type = PACKET_OTHERHOST; |
112 | nf_bridge->pkt_otherhost = false; |
113 | } |
114 | nf_bridge->in_prerouting = 0; |
115 | if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) { |
116 | skb_dst_drop(skb); |
117 | v6ops->route_input(skb); |
118 | |
119 | if (skb_dst(skb)->error) { |
120 | kfree_skb(skb); |
121 | return 0; |
122 | } |
123 | |
124 | if (skb_dst(skb)->dev == dev) { |
125 | skb->dev = nf_bridge->physindev; |
126 | nf_bridge_update_protocol(skb); |
127 | nf_bridge_push_encap_header(skb); |
128 | br_nf_hook_thresh(NF_BR_PRE_ROUTING, |
129 | net, sk, skb, indev: skb->dev, NULL, |
130 | okfn: br_nf_pre_routing_finish_bridge); |
131 | return 0; |
132 | } |
133 | ether_addr_copy(dst: eth_hdr(skb)->h_dest, src: dev->dev_addr); |
134 | skb->pkt_type = PACKET_HOST; |
135 | } else { |
136 | rt = bridge_parent_rtable(dev: nf_bridge->physindev); |
137 | if (!rt) { |
138 | kfree_skb(skb); |
139 | return 0; |
140 | } |
141 | skb_dst_drop(skb); |
142 | skb_dst_set_noref(skb, dst: &rt->dst); |
143 | } |
144 | |
145 | skb->dev = nf_bridge->physindev; |
146 | nf_bridge_update_protocol(skb); |
147 | nf_bridge_push_encap_header(skb); |
148 | br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb, |
149 | indev: skb->dev, NULL, okfn: br_handle_frame_finish); |
150 | |
151 | return 0; |
152 | } |
153 | |
154 | /* Replicate the checks that IPv6 does on packet reception and pass the packet |
155 | * to ip6tables. |
156 | */ |
157 | unsigned int br_nf_pre_routing_ipv6(void *priv, |
158 | struct sk_buff *skb, |
159 | const struct nf_hook_state *state) |
160 | { |
161 | struct nf_bridge_info *nf_bridge; |
162 | |
163 | if (br_validate_ipv6(net: state->net, skb)) |
164 | return NF_DROP_REASON(skb, reason: SKB_DROP_REASON_IP_INHDR, err: 0); |
165 | |
166 | nf_bridge = nf_bridge_alloc(skb); |
167 | if (!nf_bridge) |
168 | return NF_DROP_REASON(skb, reason: SKB_DROP_REASON_NOMEM, err: 0); |
169 | if (!setup_pre_routing(skb, net: state->net)) |
170 | return NF_DROP_REASON(skb, reason: SKB_DROP_REASON_DEV_READY, err: 0); |
171 | |
172 | nf_bridge = nf_bridge_info_get(skb); |
173 | nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr; |
174 | |
175 | skb->protocol = htons(ETH_P_IPV6); |
176 | skb->transport_header = skb->network_header + sizeof(struct ipv6hdr); |
177 | |
178 | NF_HOOK(pf: NFPROTO_IPV6, hook: NF_INET_PRE_ROUTING, net: state->net, sk: state->sk, skb, |
179 | in: skb->dev, NULL, |
180 | okfn: br_nf_pre_routing_finish_ipv6); |
181 | |
182 | return NF_STOLEN; |
183 | } |
184 | |