1 /*
2 * Handle firewalling
3 * Linux ethernet bridge
4 *
5 * Authors:
6 * Lennert Buytenhek <buytenh@gnu.org>
7 * Bart De Schuymer <bdschuym@pandora.be>
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * as published by the Free Software Foundation; either version
12 * 2 of the License, or (at your option) any later version.
13 *
14 * Lennert dedicates this file to Kerstin Wurdinger.
15 */
16
17 #include <linux/module.h>
18 #include <linux/kernel.h>
19 #include <linux/slab.h>
20 #include <linux/ip.h>
21 #include <linux/netdevice.h>
22 #include <linux/skbuff.h>
23 #include <linux/if_arp.h>
24 #include <linux/if_ether.h>
25 #include <linux/if_vlan.h>
26 #include <linux/if_pppox.h>
27 #include <linux/ppp_defs.h>
28 #include <linux/netfilter_bridge.h>
29 #include <linux/netfilter_ipv4.h>
30 #include <linux/netfilter_ipv6.h>
31 #include <linux/netfilter_arp.h>
32 #include <linux/in_route.h>
33 #include <linux/inetdevice.h>
34
35 #include <net/ip.h>
36 #include <net/ipv6.h>
37 #include <net/addrconf.h>
38 #include <net/route.h>
39 #include <net/netfilter/br_netfilter.h>
40
41 #include <linux/uaccess.h>
42 #include "br_private.h"
43 #ifdef CONFIG_SYSCTL
44 #include <linux/sysctl.h>
45 #endif
46
47 /* We only check the length. A bridge shouldn't do any hop-by-hop stuff
48 * anyway
49 */
br_nf_check_hbh_len(struct sk_buff * skb)50 static int br_nf_check_hbh_len(struct sk_buff *skb)
51 {
52 unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
53 u32 pkt_len;
54 const unsigned char *nh = skb_network_header(skb);
55 int off = raw - nh;
56 int len = (raw[1] + 1) << 3;
57
58 if ((raw + len) - skb->data > skb_headlen(skb))
59 goto bad;
60
61 off += 2;
62 len -= 2;
63
64 while (len > 0) {
65 int optlen = nh[off + 1] + 2;
66
67 switch (nh[off]) {
68 case IPV6_TLV_PAD1:
69 optlen = 1;
70 break;
71
72 case IPV6_TLV_PADN:
73 break;
74
75 case IPV6_TLV_JUMBO:
76 if (nh[off + 1] != 4 || (off & 3) != 2)
77 goto bad;
78 pkt_len = ntohl(*(__be32 *)(nh + off + 2));
79 if (pkt_len <= IPV6_MAXPLEN ||
80 ipv6_hdr(skb)->payload_len)
81 goto bad;
82 if (pkt_len > skb->len - sizeof(struct ipv6hdr))
83 goto bad;
84 if (pskb_trim_rcsum(skb,
85 pkt_len + sizeof(struct ipv6hdr)))
86 goto bad;
87 nh = skb_network_header(skb);
88 break;
89 default:
90 if (optlen > len)
91 goto bad;
92 break;
93 }
94 off += optlen;
95 len -= optlen;
96 }
97 if (len == 0)
98 return 0;
99 bad:
100 return -1;
101 }
102
br_validate_ipv6(struct net * net,struct sk_buff * skb)103 int br_validate_ipv6(struct net *net, struct sk_buff *skb)
104 {
105 const struct ipv6hdr *hdr;
106 struct inet6_dev *idev = __in6_dev_get(skb->dev);
107 u32 pkt_len;
108 u8 ip6h_len = sizeof(struct ipv6hdr);
109
110 if (!pskb_may_pull(skb, ip6h_len))
111 goto inhdr_error;
112
113 if (skb->len < ip6h_len)
114 goto drop;
115
116 hdr = ipv6_hdr(skb);
117
118 if (hdr->version != 6)
119 goto inhdr_error;
120
121 pkt_len = ntohs(hdr->payload_len);
122
123 if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
124 if (pkt_len + ip6h_len > skb->len) {
125 __IP6_INC_STATS(net, idev,
126 IPSTATS_MIB_INTRUNCATEDPKTS);
127 goto drop;
128 }
129 if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
130 __IP6_INC_STATS(net, idev,
131 IPSTATS_MIB_INDISCARDS);
132 goto drop;
133 }
134 }
135 if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb))
136 goto drop;
137
138 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
139 /* No IP options in IPv6 header; however it should be
140 * checked if some next headers need special treatment
141 */
142 return 0;
143
144 inhdr_error:
145 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
146 drop:
147 return -1;
148 }
149
150 static inline bool
br_nf_ipv6_daddr_was_changed(const struct sk_buff * skb,const struct nf_bridge_info * nf_bridge)151 br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
152 const struct nf_bridge_info *nf_bridge)
153 {
154 return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
155 sizeof(ipv6_hdr(skb)->daddr)) != 0;
156 }
157
158 /* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
159 * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
160 * for br_nf_pre_routing_finish(), same logic is used here but
161 * equivalent IPv6 function ip6_route_input() called indirectly.
162 */
br_nf_pre_routing_finish_ipv6(struct net * net,struct sock * sk,struct sk_buff * skb)163 static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb)
164 {
165 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
166 struct rtable *rt;
167 struct net_device *dev = skb->dev;
168 const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
169
170 nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
171
172 if (nf_bridge->pkt_otherhost) {
173 skb->pkt_type = PACKET_OTHERHOST;
174 nf_bridge->pkt_otherhost = false;
175 }
176 nf_bridge->in_prerouting = 0;
177 if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
178 skb_dst_drop(skb);
179 v6ops->route_input(skb);
180
181 if (skb_dst(skb)->error) {
182 kfree_skb(skb);
183 return 0;
184 }
185
186 if (skb_dst(skb)->dev == dev) {
187 skb->dev = nf_bridge->physindev;
188 nf_bridge_update_protocol(skb);
189 nf_bridge_push_encap_header(skb);
190 br_nf_hook_thresh(NF_BR_PRE_ROUTING,
191 net, sk, skb, skb->dev, NULL,
192 br_nf_pre_routing_finish_bridge);
193 return 0;
194 }
195 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
196 skb->pkt_type = PACKET_HOST;
197 } else {
198 rt = bridge_parent_rtable(nf_bridge->physindev);
199 if (!rt) {
200 kfree_skb(skb);
201 return 0;
202 }
203 skb_dst_set_noref(skb, &rt->dst);
204 }
205
206 skb->dev = nf_bridge->physindev;
207 nf_bridge_update_protocol(skb);
208 nf_bridge_push_encap_header(skb);
209 br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb,
210 skb->dev, NULL, br_handle_frame_finish);
211
212 return 0;
213 }
214
215 /* Replicate the checks that IPv6 does on packet reception and pass the packet
216 * to ip6tables.
217 */
br_nf_pre_routing_ipv6(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)218 unsigned int br_nf_pre_routing_ipv6(void *priv,
219 struct sk_buff *skb,
220 const struct nf_hook_state *state)
221 {
222 struct nf_bridge_info *nf_bridge;
223
224 if (br_validate_ipv6(state->net, skb))
225 return NF_DROP;
226
227 nf_bridge_put(skb->nf_bridge);
228 if (!nf_bridge_alloc(skb))
229 return NF_DROP;
230 if (!setup_pre_routing(skb))
231 return NF_DROP;
232
233 nf_bridge = nf_bridge_info_get(skb);
234 nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
235
236 skb->protocol = htons(ETH_P_IPV6);
237 NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
238 skb->dev, NULL,
239 br_nf_pre_routing_finish_ipv6);
240
241 return NF_STOLEN;
242 }
243
