1 /* 2 * Handle firewalling 3 * Linux ethernet bridge 4 * 5 * Authors: 6 * Lennert Buytenhek <buytenh@gnu.org> 7 * Bart De Schuymer <bdschuym@pandora.be> 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License 11 * as published by the Free Software Foundation; either version 12 * 2 of the License, or (at your option) any later version. 13 * 14 * Lennert dedicates this file to Kerstin Wurdinger. 15 */ 16 17 #include <linux/module.h> 18 #include <linux/kernel.h> 19 #include <linux/slab.h> 20 #include <linux/ip.h> 21 #include <linux/netdevice.h> 22 #include <linux/skbuff.h> 23 #include <linux/if_arp.h> 24 #include <linux/if_ether.h> 25 #include <linux/if_vlan.h> 26 #include <linux/if_pppox.h> 27 #include <linux/ppp_defs.h> 28 #include <linux/netfilter_bridge.h> 29 #include <linux/netfilter_ipv4.h> 30 #include <linux/netfilter_ipv6.h> 31 #include <linux/netfilter_arp.h> 32 #include <linux/in_route.h> 33 #include <linux/inetdevice.h> 34 35 #include <net/ip.h> 36 #include <net/ipv6.h> 37 #include <net/addrconf.h> 38 #include <net/route.h> 39 #include <net/netfilter/br_netfilter.h> 40 41 #include <linux/uaccess.h> 42 #include "br_private.h" 43 #ifdef CONFIG_SYSCTL 44 #include <linux/sysctl.h> 45 #endif 46 47 /* We only check the length. A bridge shouldn't do any hop-by-hop stuff 48 * anyway 49 */ 50 static int br_nf_check_hbh_len(struct sk_buff *skb) 51 { 52 unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1); 53 u32 pkt_len; 54 const unsigned char *nh = skb_network_header(skb); 55 int off = raw - nh; 56 int len = (raw[1] + 1) << 3; 57 58 if ((raw + len) - skb->data > skb_headlen(skb)) 59 goto bad; 60 61 off += 2; 62 len -= 2; 63 64 while (len > 0) { 65 int optlen = nh[off + 1] + 2; 66 67 switch (nh[off]) { 68 case IPV6_TLV_PAD1: 69 optlen = 1; 70 break; 71 72 case IPV6_TLV_PADN: 73 break; 74 75 case IPV6_TLV_JUMBO: 76 if (nh[off + 1] != 4 || (off & 3) != 2) 77 goto bad; 78 pkt_len = ntohl(*(__be32 *)(nh + off + 2)); 79 if (pkt_len <= IPV6_MAXPLEN || 80 ipv6_hdr(skb)->payload_len) 81 goto bad; 82 if (pkt_len > skb->len - sizeof(struct ipv6hdr)) 83 goto bad; 84 if (pskb_trim_rcsum(skb, 85 pkt_len + sizeof(struct ipv6hdr))) 86 goto bad; 87 nh = skb_network_header(skb); 88 break; 89 default: 90 if (optlen > len) 91 goto bad; 92 break; 93 } 94 off += optlen; 95 len -= optlen; 96 } 97 if (len == 0) 98 return 0; 99 bad: 100 return -1; 101 } 102 103 int br_validate_ipv6(struct net *net, struct sk_buff *skb) 104 { 105 const struct ipv6hdr *hdr; 106 struct inet6_dev *idev = __in6_dev_get(skb->dev); 107 u32 pkt_len; 108 u8 ip6h_len = sizeof(struct ipv6hdr); 109 110 if (!pskb_may_pull(skb, ip6h_len)) 111 goto inhdr_error; 112 113 if (skb->len < ip6h_len) 114 goto drop; 115 116 hdr = ipv6_hdr(skb); 117 118 if (hdr->version != 6) 119 goto inhdr_error; 120 121 pkt_len = ntohs(hdr->payload_len); 122 123 if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) { 124 if (pkt_len + ip6h_len > skb->len) { 125 __IP6_INC_STATS(net, idev, 126 IPSTATS_MIB_INTRUNCATEDPKTS); 127 goto drop; 128 } 129 if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) { 130 __IP6_INC_STATS(net, idev, 131 IPSTATS_MIB_INDISCARDS); 132 goto drop; 133 } 134 hdr = ipv6_hdr(skb); 135 } 136 if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb)) 137 goto drop; 138 139 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); 140 /* No IP options in IPv6 header; however it should be 141 * checked if some next headers need special treatment 142 */ 143 return 0; 144 145 inhdr_error: 146 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS); 147 drop: 148 return -1; 149 } 150 151 static inline bool 152 br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb, 153 const struct nf_bridge_info *nf_bridge) 154 { 155 return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr, 156 sizeof(ipv6_hdr(skb)->daddr)) != 0; 157 } 158 159 /* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables 160 * PREROUTING and continue the bridge PRE_ROUTING hook. See comment 161 * for br_nf_pre_routing_finish(), same logic is used here but 162 * equivalent IPv6 function ip6_route_input() called indirectly. 163 */ 164 static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb) 165 { 166 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); 167 struct rtable *rt; 168 struct net_device *dev = skb->dev; 169 const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops(); 170 171 nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size; 172 173 if (nf_bridge->pkt_otherhost) { 174 skb->pkt_type = PACKET_OTHERHOST; 175 nf_bridge->pkt_otherhost = false; 176 } 177 nf_bridge->in_prerouting = 0; 178 if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) { 179 skb_dst_drop(skb); 180 v6ops->route_input(skb); 181 182 if (skb_dst(skb)->error) { 183 kfree_skb(skb); 184 return 0; 185 } 186 187 if (skb_dst(skb)->dev == dev) { 188 skb->dev = nf_bridge->physindev; 189 nf_bridge_update_protocol(skb); 190 nf_bridge_push_encap_header(skb); 191 br_nf_hook_thresh(NF_BR_PRE_ROUTING, 192 net, sk, skb, skb->dev, NULL, 193 br_nf_pre_routing_finish_bridge); 194 return 0; 195 } 196 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr); 197 skb->pkt_type = PACKET_HOST; 198 } else { 199 rt = bridge_parent_rtable(nf_bridge->physindev); 200 if (!rt) { 201 kfree_skb(skb); 202 return 0; 203 } 204 skb_dst_set_noref(skb, &rt->dst); 205 } 206 207 skb->dev = nf_bridge->physindev; 208 nf_bridge_update_protocol(skb); 209 nf_bridge_push_encap_header(skb); 210 br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb, 211 skb->dev, NULL, br_handle_frame_finish); 212 213 return 0; 214 } 215 216 /* Replicate the checks that IPv6 does on packet reception and pass the packet 217 * to ip6tables. 218 */ 219 unsigned int br_nf_pre_routing_ipv6(void *priv, 220 struct sk_buff *skb, 221 const struct nf_hook_state *state) 222 { 223 struct nf_bridge_info *nf_bridge; 224 225 if (br_validate_ipv6(state->net, skb)) 226 return NF_DROP; 227 228 nf_bridge = nf_bridge_alloc(skb); 229 if (!nf_bridge) 230 return NF_DROP; 231 if (!setup_pre_routing(skb)) 232 return NF_DROP; 233 234 nf_bridge = nf_bridge_info_get(skb); 235 nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr; 236 237 skb->protocol = htons(ETH_P_IPV6); 238 skb->transport_header = skb->network_header + sizeof(struct ipv6hdr); 239 240 NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb, 241 skb->dev, NULL, 242 br_nf_pre_routing_finish_ipv6); 243 244 return NF_STOLEN; 245 } 246