1 | /* |
2 | * IPv6 specific functions of netfilter core |
3 | * |
4 | * Rusty Russell (C) 2000 -- This code is GPL. |
5 | * Patrick McHardy (C) 2006-2012 |
6 | */ |
7 | #include <linux/kernel.h> |
8 | #include <linux/init.h> |
9 | #include <linux/ipv6.h> |
10 | #include <linux/netfilter.h> |
11 | #include <linux/netfilter_ipv6.h> |
12 | #include <linux/export.h> |
13 | #include <net/addrconf.h> |
14 | #include <net/dst.h> |
15 | #include <net/ipv6.h> |
16 | #include <net/ip6_route.h> |
17 | #include <net/xfrm.h> |
18 | #include <net/netfilter/nf_queue.h> |
19 | #include <net/netfilter/nf_conntrack_bridge.h> |
20 | #include <net/netfilter/ipv6/nf_defrag_ipv6.h> |
21 | #include "../bridge/br_private.h" |
22 | |
23 | int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff *skb) |
24 | { |
25 | const struct ipv6hdr *iph = ipv6_hdr(skb); |
26 | struct sock *sk = sk_to_full_sk(sk: sk_partial); |
27 | struct net_device *dev = skb_dst(skb)->dev; |
28 | struct flow_keys flkeys; |
29 | unsigned int hh_len; |
30 | struct dst_entry *dst; |
31 | int strict = (ipv6_addr_type(addr: &iph->daddr) & |
32 | (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL)); |
33 | struct flowi6 fl6 = { |
34 | .flowi6_l3mdev = l3mdev_master_ifindex(dev), |
35 | .flowi6_mark = skb->mark, |
36 | .flowi6_uid = sock_net_uid(net, sk), |
37 | .daddr = iph->daddr, |
38 | .saddr = iph->saddr, |
39 | }; |
40 | int err; |
41 | |
42 | if (sk && sk->sk_bound_dev_if) |
43 | fl6.flowi6_oif = sk->sk_bound_dev_if; |
44 | else if (strict) |
45 | fl6.flowi6_oif = dev->ifindex; |
46 | |
47 | fib6_rules_early_flow_dissect(net, skb, fl6: &fl6, flkeys: &flkeys); |
48 | dst = ip6_route_output(net, sk, fl6: &fl6); |
49 | err = dst->error; |
50 | if (err) { |
51 | IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES); |
52 | net_dbg_ratelimited("ip6_route_me_harder: No more route\n" ); |
53 | dst_release(dst); |
54 | return err; |
55 | } |
56 | |
57 | /* Drop old route. */ |
58 | skb_dst_drop(skb); |
59 | |
60 | skb_dst_set(skb, dst); |
61 | |
62 | #ifdef CONFIG_XFRM |
63 | if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) && |
64 | xfrm_decode_session(net, skb, fl: flowi6_to_flowi(fl6: &fl6), AF_INET6) == 0) { |
65 | skb_dst_set(skb, NULL); |
66 | dst = xfrm_lookup(net, dst_orig: dst, fl: flowi6_to_flowi(fl6: &fl6), sk, flags: 0); |
67 | if (IS_ERR(ptr: dst)) |
68 | return PTR_ERR(ptr: dst); |
69 | skb_dst_set(skb, dst); |
70 | } |
71 | #endif |
72 | |
73 | /* Change in oif may mean change in hh_len. */ |
74 | hh_len = skb_dst(skb)->dev->hard_header_len; |
75 | if (skb_headroom(skb) < hh_len && |
76 | pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)), |
77 | ntail: 0, GFP_ATOMIC)) |
78 | return -ENOMEM; |
79 | |
80 | return 0; |
81 | } |
82 | EXPORT_SYMBOL(ip6_route_me_harder); |
83 | |
84 | static int nf_ip6_reroute(struct sk_buff *skb, |
85 | const struct nf_queue_entry *entry) |
86 | { |
87 | struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry); |
88 | |
89 | if (entry->state.hook == NF_INET_LOCAL_OUT) { |
90 | const struct ipv6hdr *iph = ipv6_hdr(skb); |
91 | if (!ipv6_addr_equal(a1: &iph->daddr, a2: &rt_info->daddr) || |
92 | !ipv6_addr_equal(a1: &iph->saddr, a2: &rt_info->saddr) || |
93 | skb->mark != rt_info->mark) |
94 | return ip6_route_me_harder(entry->state.net, entry->state.sk, skb); |
95 | } |
96 | return 0; |
97 | } |
98 | |
99 | int __nf_ip6_route(struct net *net, struct dst_entry **dst, |
100 | struct flowi *fl, bool strict) |
101 | { |
102 | static const struct ipv6_pinfo fake_pinfo; |
103 | static const struct inet_sock fake_sk = { |
104 | /* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */ |
105 | .sk.sk_bound_dev_if = 1, |
106 | .pinet6 = (struct ipv6_pinfo *) &fake_pinfo, |
107 | }; |
108 | const void *sk = strict ? &fake_sk : NULL; |
109 | struct dst_entry *result; |
110 | int err; |
111 | |
112 | result = ip6_route_output(net, sk, fl6: &fl->u.ip6); |
113 | err = result->error; |
114 | if (err) |
115 | dst_release(dst: result); |
116 | else |
117 | *dst = result; |
118 | return err; |
119 | } |
120 | EXPORT_SYMBOL_GPL(__nf_ip6_route); |
121 | |
122 | int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, |
123 | struct nf_bridge_frag_data *data, |
124 | int (*output)(struct net *, struct sock *sk, |
125 | const struct nf_bridge_frag_data *data, |
126 | struct sk_buff *)) |
127 | { |
128 | int frag_max_size = BR_INPUT_SKB_CB(skb)->frag_max_size; |
129 | bool mono_delivery_time = skb->mono_delivery_time; |
130 | ktime_t tstamp = skb->tstamp; |
131 | struct ip6_frag_state state; |
132 | u8 *prevhdr, nexthdr = 0; |
133 | unsigned int mtu, hlen; |
134 | int hroom, err = 0; |
135 | __be32 frag_id; |
136 | |
137 | err = ip6_find_1stfragopt(skb, nexthdr: &prevhdr); |
138 | if (err < 0) |
139 | goto blackhole; |
140 | hlen = err; |
141 | nexthdr = *prevhdr; |
142 | |
143 | mtu = skb->dev->mtu; |
144 | if (frag_max_size > mtu || |
145 | frag_max_size < IPV6_MIN_MTU) |
146 | goto blackhole; |
147 | |
148 | mtu = frag_max_size; |
149 | if (mtu < hlen + sizeof(struct frag_hdr) + 8) |
150 | goto blackhole; |
151 | mtu -= hlen + sizeof(struct frag_hdr); |
152 | |
153 | frag_id = ipv6_select_ident(net, daddr: &ipv6_hdr(skb)->daddr, |
154 | saddr: &ipv6_hdr(skb)->saddr); |
155 | |
156 | if (skb->ip_summed == CHECKSUM_PARTIAL && |
157 | (err = skb_checksum_help(skb))) |
158 | goto blackhole; |
159 | |
160 | hroom = LL_RESERVED_SPACE(skb->dev); |
161 | if (skb_has_frag_list(skb)) { |
162 | unsigned int first_len = skb_pagelen(skb); |
163 | struct ip6_fraglist_iter iter; |
164 | struct sk_buff *frag2; |
165 | |
166 | if (first_len - hlen > mtu || |
167 | skb_headroom(skb) < (hroom + sizeof(struct frag_hdr))) |
168 | goto blackhole; |
169 | |
170 | if (skb_cloned(skb)) |
171 | goto slow_path; |
172 | |
173 | skb_walk_frags(skb, frag2) { |
174 | if (frag2->len > mtu || |
175 | skb_headroom(skb: frag2) < (hlen + hroom + sizeof(struct frag_hdr))) |
176 | goto blackhole; |
177 | |
178 | /* Partially cloned skb? */ |
179 | if (skb_shared(skb: frag2)) |
180 | goto slow_path; |
181 | } |
182 | |
183 | err = ip6_fraglist_init(skb, hlen, prevhdr, nexthdr, frag_id, |
184 | iter: &iter); |
185 | if (err < 0) |
186 | goto blackhole; |
187 | |
188 | for (;;) { |
189 | /* Prepare header of the next frame, |
190 | * before previous one went down. |
191 | */ |
192 | if (iter.frag) |
193 | ip6_fraglist_prepare(skb, iter: &iter); |
194 | |
195 | skb_set_delivery_time(skb, kt: tstamp, mono: mono_delivery_time); |
196 | err = output(net, sk, data, skb); |
197 | if (err || !iter.frag) |
198 | break; |
199 | |
200 | skb = ip6_fraglist_next(iter: &iter); |
201 | } |
202 | |
203 | kfree(objp: iter.tmp_hdr); |
204 | if (!err) |
205 | return 0; |
206 | |
207 | kfree_skb_list(segs: iter.frag); |
208 | return err; |
209 | } |
210 | slow_path: |
211 | /* This is a linearized skbuff, the original geometry is lost for us. |
212 | * This may also be a clone skbuff, we could preserve the geometry for |
213 | * the copies but probably not worth the effort. |
214 | */ |
215 | ip6_frag_init(skb, hlen, mtu, needed_tailroom: skb->dev->needed_tailroom, |
216 | LL_RESERVED_SPACE(skb->dev), prevhdr, nexthdr, frag_id, |
217 | state: &state); |
218 | |
219 | while (state.left > 0) { |
220 | struct sk_buff *skb2; |
221 | |
222 | skb2 = ip6_frag_next(skb, state: &state); |
223 | if (IS_ERR(ptr: skb2)) { |
224 | err = PTR_ERR(ptr: skb2); |
225 | goto blackhole; |
226 | } |
227 | |
228 | skb_set_delivery_time(skb: skb2, kt: tstamp, mono: mono_delivery_time); |
229 | err = output(net, sk, data, skb2); |
230 | if (err) |
231 | goto blackhole; |
232 | } |
233 | consume_skb(skb); |
234 | return err; |
235 | |
236 | blackhole: |
237 | kfree_skb(skb); |
238 | return 0; |
239 | } |
240 | EXPORT_SYMBOL_GPL(br_ip6_fragment); |
241 | |
242 | static const struct nf_ipv6_ops ipv6ops = { |
243 | #if IS_MODULE(CONFIG_IPV6) |
244 | .chk_addr = ipv6_chk_addr, |
245 | .route_me_harder = ip6_route_me_harder, |
246 | .dev_get_saddr = ipv6_dev_get_saddr, |
247 | .route = __nf_ip6_route, |
248 | #if IS_ENABLED(CONFIG_SYN_COOKIES) |
249 | .cookie_init_sequence = __cookie_v6_init_sequence, |
250 | .cookie_v6_check = __cookie_v6_check, |
251 | #endif |
252 | #endif |
253 | .route_input = ip6_route_input, |
254 | .fragment = ip6_fragment, |
255 | .reroute = nf_ip6_reroute, |
256 | #if IS_MODULE(CONFIG_IPV6) |
257 | .br_fragment = br_ip6_fragment, |
258 | #endif |
259 | }; |
260 | |
261 | int __init ipv6_netfilter_init(void) |
262 | { |
263 | RCU_INIT_POINTER(nf_ipv6_ops, &ipv6ops); |
264 | return 0; |
265 | } |
266 | |
267 | /* This can be called from inet6_init() on errors, so it cannot |
268 | * be marked __exit. -DaveM |
269 | */ |
270 | void ipv6_netfilter_fini(void) |
271 | { |
272 | RCU_INIT_POINTER(nf_ipv6_ops, NULL); |
273 | } |
274 | |