1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24#include <linux/module.h>
25#include <linux/kernel.h>
26#include <linux/ip.h>
27#include <linux/netdevice.h>
28#include <linux/skbuff.h>
29#include <linux/if_arp.h>
30#include <linux/if_ether.h>
31#include <linux/if_vlan.h>
32#include <linux/if_pppox.h>
33#include <linux/ppp_defs.h>
34#include <linux/netfilter_bridge.h>
35#include <linux/netfilter_ipv4.h>
36#include <linux/netfilter_ipv6.h>
37#include <linux/netfilter_arp.h>
38#include <linux/in_route.h>
39#include <linux/inetdevice.h>
40
41#include <net/ip.h>
42#include <net/ipv6.h>
43#include <net/route.h>
44
45#include <asm/uaccess.h>
46#include "br_private.h"
47#ifdef CONFIG_SYSCTL
48#include <linux/sysctl.h>
49#endif
50
51#define skb_origaddr(skb) (((struct bridge_skb_cb *) \
52 (skb->nf_bridge->data))->daddr.ipv4)
53#define store_orig_dstaddr(skb) (skb_origaddr(skb) = ip_hdr(skb)->daddr)
54#define dnat_took_place(skb) (skb_origaddr(skb) != ip_hdr(skb)->daddr)
55
56#ifdef CONFIG_SYSCTL
57static struct ctl_table_header *brnf_sysctl_header;
58static int brnf_call_iptables __read_mostly = 1;
59static int brnf_call_ip6tables __read_mostly = 1;
60static int brnf_call_arptables __read_mostly = 1;
61static int brnf_filter_vlan_tagged __read_mostly = 0;
62static int brnf_filter_pppoe_tagged __read_mostly = 0;
63#else
64#define brnf_filter_vlan_tagged 0
65#define brnf_filter_pppoe_tagged 0
66#endif
67
68static inline __be16 vlan_proto(const struct sk_buff *skb)
69{
70 return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
71}
72
73#define IS_VLAN_IP(skb) \
74 (skb->protocol == htons(ETH_P_8021Q) && \
75 vlan_proto(skb) == htons(ETH_P_IP) && \
76 brnf_filter_vlan_tagged)
77
78#define IS_VLAN_IPV6(skb) \
79 (skb->protocol == htons(ETH_P_8021Q) && \
80 vlan_proto(skb) == htons(ETH_P_IPV6) &&\
81 brnf_filter_vlan_tagged)
82
83#define IS_VLAN_ARP(skb) \
84 (skb->protocol == htons(ETH_P_8021Q) && \
85 vlan_proto(skb) == htons(ETH_P_ARP) && \
86 brnf_filter_vlan_tagged)
87
88static inline __be16 pppoe_proto(const struct sk_buff *skb)
89{
90 return *((__be16 *)(skb_mac_header(skb) + ETH_HLEN +
91 sizeof(struct pppoe_hdr)));
92}
93
94#define IS_PPPOE_IP(skb) \
95 (skb->protocol == htons(ETH_P_PPP_SES) && \
96 pppoe_proto(skb) == htons(PPP_IP) && \
97 brnf_filter_pppoe_tagged)
98
99#define IS_PPPOE_IPV6(skb) \
100 (skb->protocol == htons(ETH_P_PPP_SES) && \
101 pppoe_proto(skb) == htons(PPP_IPV6) && \
102 brnf_filter_pppoe_tagged)
103
104static void fake_update_pmtu(struct dst_entry *dst, u32 mtu)
105{
106}
107
108static struct dst_ops fake_dst_ops = {
109 .family = AF_INET,
110 .protocol = cpu_to_be16(ETH_P_IP),
111 .update_pmtu = fake_update_pmtu,
112 .entries = ATOMIC_INIT(0),
113};
114
115
116
117
118
119
120
121
122void br_netfilter_rtable_init(struct net_bridge *br)
123{
124 struct rtable *rt = &br->fake_rtable;
125
126 atomic_set(&rt->u.dst.__refcnt, 1);
127 rt->u.dst.dev = br->dev;
128 rt->u.dst.path = &rt->u.dst;
129 rt->u.dst.metrics[RTAX_MTU - 1] = 1500;
130 rt->u.dst.flags = DST_NOXFRM;
131 rt->u.dst.ops = &fake_dst_ops;
132}
133
134static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
135{
136 struct net_bridge_port *port = rcu_dereference(dev->br_port);
137
138 return port ? &port->br->fake_rtable : NULL;
139}
140
141static inline struct net_device *bridge_parent(const struct net_device *dev)
142{
143 struct net_bridge_port *port = rcu_dereference(dev->br_port);
144
145 return port ? port->br->dev : NULL;
146}
147
148static inline struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
149{
150 skb->nf_bridge = kzalloc(sizeof(struct nf_bridge_info), GFP_ATOMIC);
151 if (likely(skb->nf_bridge))
152 atomic_set(&(skb->nf_bridge->use), 1);
153
154 return skb->nf_bridge;
155}
156
157static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
158{
159 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
160
161 if (atomic_read(&nf_bridge->use) > 1) {
162 struct nf_bridge_info *tmp = nf_bridge_alloc(skb);
163
164 if (tmp) {
165 memcpy(tmp, nf_bridge, sizeof(struct nf_bridge_info));
166 atomic_set(&tmp->use, 1);
167 nf_bridge_put(nf_bridge);
168 }
169 nf_bridge = tmp;
170 }
171 return nf_bridge;
172}
173
174static inline void nf_bridge_push_encap_header(struct sk_buff *skb)
175{
176 unsigned int len = nf_bridge_encap_header_len(skb);
177
178 skb_push(skb, len);
179 skb->network_header -= len;
180}
181
182static inline void nf_bridge_pull_encap_header(struct sk_buff *skb)
183{
184 unsigned int len = nf_bridge_encap_header_len(skb);
185
186 skb_pull(skb, len);
187 skb->network_header += len;
188}
189
190static inline void nf_bridge_pull_encap_header_rcsum(struct sk_buff *skb)
191{
192 unsigned int len = nf_bridge_encap_header_len(skb);
193
194 skb_pull_rcsum(skb, len);
195 skb->network_header += len;
196}
197
198static inline void nf_bridge_save_header(struct sk_buff *skb)
199{
200 int header_size = ETH_HLEN + nf_bridge_encap_header_len(skb);
201
202 skb_copy_from_linear_data_offset(skb, -header_size,
203 skb->nf_bridge->data, header_size);
204}
205
206
207
208
209
210int nf_bridge_copy_header(struct sk_buff *skb)
211{
212 int err;
213 int header_size = ETH_HLEN + nf_bridge_encap_header_len(skb);
214
215 err = skb_cow_head(skb, header_size);
216 if (err)
217 return err;
218
219 skb_copy_to_linear_data_offset(skb, -header_size,
220 skb->nf_bridge->data, header_size);
221 __skb_push(skb, nf_bridge_encap_header_len(skb));
222 return 0;
223}
224
225
226
227
228static int br_nf_pre_routing_finish_ipv6(struct sk_buff *skb)
229{
230 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
231 struct rtable *rt;
232
233 if (nf_bridge->mask & BRNF_PKT_TYPE) {
234 skb->pkt_type = PACKET_OTHERHOST;
235 nf_bridge->mask ^= BRNF_PKT_TYPE;
236 }
237 nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
238
239 rt = bridge_parent_rtable(nf_bridge->physindev);
240 if (!rt) {
241 kfree_skb(skb);
242 return 0;
243 }
244 dst_hold(&rt->u.dst);
245 skb_dst_set(skb, &rt->u.dst);
246
247 skb->dev = nf_bridge->physindev;
248 nf_bridge_push_encap_header(skb);
249 NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
250 br_handle_frame_finish, 1);
251
252 return 0;
253}
254
255static void __br_dnat_complain(void)
256{
257 static unsigned long last_complaint;
258
259 if (jiffies - last_complaint >= 5 * HZ) {
260 printk(KERN_WARNING "Performing cross-bridge DNAT requires IP "
261 "forwarding to be enabled\n");
262 last_complaint = jiffies;
263 }
264}
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315static int br_nf_pre_routing_finish_bridge(struct sk_buff *skb)
316{
317 if (skb->pkt_type == PACKET_OTHERHOST) {
318 skb->pkt_type = PACKET_HOST;
319 skb->nf_bridge->mask |= BRNF_PKT_TYPE;
320 }
321 skb->nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
322
323 skb->dev = bridge_parent(skb->dev);
324 if (skb->dev) {
325 struct dst_entry *dst = skb_dst(skb);
326
327 nf_bridge_pull_encap_header(skb);
328
329 if (dst->hh)
330 return neigh_hh_output(dst->hh, skb);
331 else if (dst->neighbour)
332 return dst->neighbour->output(skb);
333 }
334 kfree_skb(skb);
335 return 0;
336}
337
338static int br_nf_pre_routing_finish(struct sk_buff *skb)
339{
340 struct net_device *dev = skb->dev;
341 struct iphdr *iph = ip_hdr(skb);
342 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
343 struct rtable *rt;
344 int err;
345
346 if (nf_bridge->mask & BRNF_PKT_TYPE) {
347 skb->pkt_type = PACKET_OTHERHOST;
348 nf_bridge->mask ^= BRNF_PKT_TYPE;
349 }
350 nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
351 if (dnat_took_place(skb)) {
352 if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
353 struct flowi fl = {
354 .nl_u = {
355 .ip4_u = {
356 .daddr = iph->daddr,
357 .saddr = 0,
358 .tos = RT_TOS(iph->tos) },
359 },
360 .proto = 0,
361 };
362 struct in_device *in_dev = __in_dev_get_rcu(dev);
363
364
365
366
367
368
369
370
371 if (err != -EHOSTUNREACH || !in_dev || IN_DEV_FORWARD(in_dev))
372 goto free_skb;
373
374 if (!ip_route_output_key(dev_net(dev), &rt, &fl)) {
375
376
377 if (((struct dst_entry *)rt)->dev == dev) {
378 skb_dst_set(skb, (struct dst_entry *)rt);
379 goto bridged_dnat;
380 }
381
382
383
384
385 __br_dnat_complain();
386 dst_release((struct dst_entry *)rt);
387 }
388free_skb:
389 kfree_skb(skb);
390 return 0;
391 } else {
392 if (skb_dst(skb)->dev == dev) {
393bridged_dnat:
394
395
396 nf_bridge->mask |= BRNF_BRIDGED_DNAT;
397 skb->dev = nf_bridge->physindev;
398 nf_bridge_push_encap_header(skb);
399 NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING,
400 skb, skb->dev, NULL,
401 br_nf_pre_routing_finish_bridge,
402 1);
403 return 0;
404 }
405 memcpy(eth_hdr(skb)->h_dest, dev->dev_addr, ETH_ALEN);
406 skb->pkt_type = PACKET_HOST;
407 }
408 } else {
409 rt = bridge_parent_rtable(nf_bridge->physindev);
410 if (!rt) {
411 kfree_skb(skb);
412 return 0;
413 }
414 dst_hold(&rt->u.dst);
415 skb_dst_set(skb, &rt->u.dst);
416 }
417
418 skb->dev = nf_bridge->physindev;
419 nf_bridge_push_encap_header(skb);
420 NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
421 br_handle_frame_finish, 1);
422
423 return 0;
424}
425
426
427static struct net_device *setup_pre_routing(struct sk_buff *skb)
428{
429 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
430
431 if (skb->pkt_type == PACKET_OTHERHOST) {
432 skb->pkt_type = PACKET_HOST;
433 nf_bridge->mask |= BRNF_PKT_TYPE;
434 }
435
436 nf_bridge->mask |= BRNF_NF_BRIDGE_PREROUTING;
437 nf_bridge->physindev = skb->dev;
438 skb->dev = bridge_parent(skb->dev);
439
440 return skb->dev;
441}
442
443
444static int check_hbh_len(struct sk_buff *skb)
445{
446 unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
447 u32 pkt_len;
448 const unsigned char *nh = skb_network_header(skb);
449 int off = raw - nh;
450 int len = (raw[1] + 1) << 3;
451
452 if ((raw + len) - skb->data > skb_headlen(skb))
453 goto bad;
454
455 off += 2;
456 len -= 2;
457
458 while (len > 0) {
459 int optlen = nh[off + 1] + 2;
460
461 switch (nh[off]) {
462 case IPV6_TLV_PAD0:
463 optlen = 1;
464 break;
465
466 case IPV6_TLV_PADN:
467 break;
468
469 case IPV6_TLV_JUMBO:
470 if (nh[off + 1] != 4 || (off & 3) != 2)
471 goto bad;
472 pkt_len = ntohl(*(__be32 *) (nh + off + 2));
473 if (pkt_len <= IPV6_MAXPLEN ||
474 ipv6_hdr(skb)->payload_len)
475 goto bad;
476 if (pkt_len > skb->len - sizeof(struct ipv6hdr))
477 goto bad;
478 if (pskb_trim_rcsum(skb,
479 pkt_len + sizeof(struct ipv6hdr)))
480 goto bad;
481 nh = skb_network_header(skb);
482 break;
483 default:
484 if (optlen > len)
485 goto bad;
486 break;
487 }
488 off += optlen;
489 len -= optlen;
490 }
491 if (len == 0)
492 return 0;
493bad:
494 return -1;
495
496}
497
498
499
500static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
501 struct sk_buff *skb,
502 const struct net_device *in,
503 const struct net_device *out,
504 int (*okfn)(struct sk_buff *))
505{
506 struct ipv6hdr *hdr;
507 u32 pkt_len;
508
509 if (skb->len < sizeof(struct ipv6hdr))
510 goto inhdr_error;
511
512 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
513 goto inhdr_error;
514
515 hdr = ipv6_hdr(skb);
516
517 if (hdr->version != 6)
518 goto inhdr_error;
519
520 pkt_len = ntohs(hdr->payload_len);
521
522 if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
523 if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
524 goto inhdr_error;
525 if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
526 goto inhdr_error;
527 }
528 if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb))
529 goto inhdr_error;
530
531 nf_bridge_put(skb->nf_bridge);
532 if (!nf_bridge_alloc(skb))
533 return NF_DROP;
534 if (!setup_pre_routing(skb))
535 return NF_DROP;
536
537 NF_HOOK(PF_INET6, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
538 br_nf_pre_routing_finish_ipv6);
539
540 return NF_STOLEN;
541
542inhdr_error:
543 return NF_DROP;
544}
545
546
547
548
549
550
551
552static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
553 const struct net_device *in,
554 const struct net_device *out,
555 int (*okfn)(struct sk_buff *))
556{
557 struct iphdr *iph;
558 __u32 len = nf_bridge_encap_header_len(skb);
559
560 if (unlikely(!pskb_may_pull(skb, len)))
561 goto out;
562
563 if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
564 IS_PPPOE_IPV6(skb)) {
565#ifdef CONFIG_SYSCTL
566 if (!brnf_call_ip6tables)
567 return NF_ACCEPT;
568#endif
569 nf_bridge_pull_encap_header_rcsum(skb);
570 return br_nf_pre_routing_ipv6(hook, skb, in, out, okfn);
571 }
572#ifdef CONFIG_SYSCTL
573 if (!brnf_call_iptables)
574 return NF_ACCEPT;
575#endif
576
577 if (skb->protocol != htons(ETH_P_IP) && !IS_VLAN_IP(skb) &&
578 !IS_PPPOE_IP(skb))
579 return NF_ACCEPT;
580
581 nf_bridge_pull_encap_header_rcsum(skb);
582
583 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
584 goto inhdr_error;
585
586 iph = ip_hdr(skb);
587 if (iph->ihl < 5 || iph->version != 4)
588 goto inhdr_error;
589
590 if (!pskb_may_pull(skb, 4 * iph->ihl))
591 goto inhdr_error;
592
593 iph = ip_hdr(skb);
594 if (ip_fast_csum((__u8 *) iph, iph->ihl) != 0)
595 goto inhdr_error;
596
597 len = ntohs(iph->tot_len);
598 if (skb->len < len || len < 4 * iph->ihl)
599 goto inhdr_error;
600
601 pskb_trim_rcsum(skb, len);
602
603 nf_bridge_put(skb->nf_bridge);
604 if (!nf_bridge_alloc(skb))
605 return NF_DROP;
606 if (!setup_pre_routing(skb))
607 return NF_DROP;
608 store_orig_dstaddr(skb);
609
610 NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
611 br_nf_pre_routing_finish);
612
613 return NF_STOLEN;
614
615inhdr_error:
616
617out:
618 return NF_DROP;
619}
620
621
622
623
624
625
626
627
628
629static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff *skb,
630 const struct net_device *in,
631 const struct net_device *out,
632 int (*okfn)(struct sk_buff *))
633{
634 struct rtable *rt = skb_rtable(skb);
635
636 if (rt && rt == bridge_parent_rtable(in))
637 skb_dst_drop(skb);
638
639 return NF_ACCEPT;
640}
641
642
643static int br_nf_forward_finish(struct sk_buff *skb)
644{
645 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
646 struct net_device *in;
647
648 if (skb->protocol != htons(ETH_P_ARP) && !IS_VLAN_ARP(skb)) {
649 in = nf_bridge->physindev;
650 if (nf_bridge->mask & BRNF_PKT_TYPE) {
651 skb->pkt_type = PACKET_OTHERHOST;
652 nf_bridge->mask ^= BRNF_PKT_TYPE;
653 }
654 } else {
655 in = *((struct net_device **)(skb->cb));
656 }
657 nf_bridge_push_encap_header(skb);
658 NF_HOOK_THRESH(PF_BRIDGE, NF_BR_FORWARD, skb, in,
659 skb->dev, br_forward_finish, 1);
660 return 0;
661}
662
663
664
665
666
667
668static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
669 const struct net_device *in,
670 const struct net_device *out,
671 int (*okfn)(struct sk_buff *))
672{
673 struct nf_bridge_info *nf_bridge;
674 struct net_device *parent;
675 u_int8_t pf;
676
677 if (!skb->nf_bridge)
678 return NF_ACCEPT;
679
680
681
682 if (!nf_bridge_unshare(skb))
683 return NF_DROP;
684
685 parent = bridge_parent(out);
686 if (!parent)
687 return NF_DROP;
688
689 if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
690 IS_PPPOE_IP(skb))
691 pf = PF_INET;
692 else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
693 IS_PPPOE_IPV6(skb))
694 pf = PF_INET6;
695 else
696 return NF_ACCEPT;
697
698 nf_bridge_pull_encap_header(skb);
699
700 nf_bridge = skb->nf_bridge;
701 if (skb->pkt_type == PACKET_OTHERHOST) {
702 skb->pkt_type = PACKET_HOST;
703 nf_bridge->mask |= BRNF_PKT_TYPE;
704 }
705
706
707 nf_bridge->mask |= BRNF_BRIDGED;
708 nf_bridge->physoutdev = skb->dev;
709
710 NF_HOOK(pf, NF_INET_FORWARD, skb, bridge_parent(in), parent,
711 br_nf_forward_finish);
712
713 return NF_STOLEN;
714}
715
716static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
717 const struct net_device *in,
718 const struct net_device *out,
719 int (*okfn)(struct sk_buff *))
720{
721 struct net_device **d = (struct net_device **)(skb->cb);
722
723#ifdef CONFIG_SYSCTL
724 if (!brnf_call_arptables)
725 return NF_ACCEPT;
726#endif
727
728 if (skb->protocol != htons(ETH_P_ARP)) {
729 if (!IS_VLAN_ARP(skb))
730 return NF_ACCEPT;
731 nf_bridge_pull_encap_header(skb);
732 }
733
734 if (arp_hdr(skb)->ar_pln != 4) {
735 if (IS_VLAN_ARP(skb))
736 nf_bridge_push_encap_header(skb);
737 return NF_ACCEPT;
738 }
739 *d = (struct net_device *)in;
740 NF_HOOK(NFPROTO_ARP, NF_ARP_FORWARD, skb, (struct net_device *)in,
741 (struct net_device *)out, br_nf_forward_finish);
742
743 return NF_STOLEN;
744}
745
746
747
748
749
750
751
752
753
754
755
756
757
758static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff *skb,
759 const struct net_device *in,
760 const struct net_device *out,
761 int (*okfn)(struct sk_buff *))
762{
763 struct net_device *realindev;
764 struct nf_bridge_info *nf_bridge;
765
766 if (!skb->nf_bridge)
767 return NF_ACCEPT;
768
769
770
771 if (!nf_bridge_unshare(skb))
772 return NF_DROP;
773
774 nf_bridge = skb->nf_bridge;
775 if (!(nf_bridge->mask & BRNF_BRIDGED_DNAT))
776 return NF_ACCEPT;
777
778
779
780 nf_bridge->physoutdev = skb->dev;
781 realindev = nf_bridge->physindev;
782
783 if (nf_bridge->mask & BRNF_PKT_TYPE) {
784 skb->pkt_type = PACKET_OTHERHOST;
785 nf_bridge->mask ^= BRNF_PKT_TYPE;
786 }
787 nf_bridge_push_encap_header(skb);
788
789 NF_HOOK(PF_BRIDGE, NF_BR_FORWARD, skb, realindev, skb->dev,
790 br_forward_finish);
791 return NF_STOLEN;
792}
793
794#if defined(CONFIG_NF_CONNTRACK_IPV4) || defined(CONFIG_NF_CONNTRACK_IPV4_MODULE)
795static int br_nf_dev_queue_xmit(struct sk_buff *skb)
796{
797 if (skb->nfct != NULL &&
798 (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb)) &&
799 skb->len > skb->dev->mtu &&
800 !skb_is_gso(skb))
801 return ip_fragment(skb, br_dev_queue_push_xmit);
802 else
803 return br_dev_queue_push_xmit(skb);
804}
805#else
806static int br_nf_dev_queue_xmit(struct sk_buff *skb)
807{
808 return br_dev_queue_push_xmit(skb);
809}
810#endif
811
812
813static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
814 const struct net_device *in,
815 const struct net_device *out,
816 int (*okfn)(struct sk_buff *))
817{
818 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
819 struct net_device *realoutdev = bridge_parent(skb->dev);
820 u_int8_t pf;
821
822#ifdef CONFIG_NETFILTER_DEBUG
823
824
825 if (skb_mac_header(skb) < skb->head ||
826 skb_mac_header(skb) + ETH_HLEN > skb->data) {
827 printk(KERN_CRIT "br_netfilter: Argh!! br_nf_post_routing: "
828 "bad mac.raw pointer.\n");
829 goto print_error;
830 }
831#endif
832
833 if (!nf_bridge)
834 return NF_ACCEPT;
835
836 if (!(nf_bridge->mask & (BRNF_BRIDGED | BRNF_BRIDGED_DNAT)))
837 return NF_ACCEPT;
838
839 if (!realoutdev)
840 return NF_DROP;
841
842 if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
843 IS_PPPOE_IP(skb))
844 pf = PF_INET;
845 else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
846 IS_PPPOE_IPV6(skb))
847 pf = PF_INET6;
848 else
849 return NF_ACCEPT;
850
851#ifdef CONFIG_NETFILTER_DEBUG
852 if (skb_dst(skb) == NULL) {
853 printk(KERN_INFO "br_netfilter post_routing: skb->dst == NULL\n");
854 goto print_error;
855 }
856#endif
857
858
859
860 if (skb->pkt_type == PACKET_OTHERHOST) {
861 skb->pkt_type = PACKET_HOST;
862 nf_bridge->mask |= BRNF_PKT_TYPE;
863 }
864
865 nf_bridge_pull_encap_header(skb);
866 nf_bridge_save_header(skb);
867
868 NF_HOOK(pf, NF_INET_POST_ROUTING, skb, NULL, realoutdev,
869 br_nf_dev_queue_xmit);
870
871 return NF_STOLEN;
872
873#ifdef CONFIG_NETFILTER_DEBUG
874print_error:
875 if (skb->dev != NULL) {
876 printk("[%s]", skb->dev->name);
877 if (realoutdev)
878 printk("[%s]", realoutdev->name);
879 }
880 printk(" head:%p, raw:%p, data:%p\n", skb->head, skb_mac_header(skb),
881 skb->data);
882 dump_stack();
883 return NF_ACCEPT;
884#endif
885}
886
887
888
889
890static unsigned int ip_sabotage_in(unsigned int hook, struct sk_buff *skb,
891 const struct net_device *in,
892 const struct net_device *out,
893 int (*okfn)(struct sk_buff *))
894{
895 if (skb->nf_bridge &&
896 !(skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)) {
897 return NF_STOP;
898 }
899
900 return NF_ACCEPT;
901}
902
903
904
905
906
907static struct nf_hook_ops br_nf_ops[] __read_mostly = {
908 {
909 .hook = br_nf_pre_routing,
910 .owner = THIS_MODULE,
911 .pf = PF_BRIDGE,
912 .hooknum = NF_BR_PRE_ROUTING,
913 .priority = NF_BR_PRI_BRNF,
914 },
915 {
916 .hook = br_nf_local_in,
917 .owner = THIS_MODULE,
918 .pf = PF_BRIDGE,
919 .hooknum = NF_BR_LOCAL_IN,
920 .priority = NF_BR_PRI_BRNF,
921 },
922 {
923 .hook = br_nf_forward_ip,
924 .owner = THIS_MODULE,
925 .pf = PF_BRIDGE,
926 .hooknum = NF_BR_FORWARD,
927 .priority = NF_BR_PRI_BRNF - 1,
928 },
929 {
930 .hook = br_nf_forward_arp,
931 .owner = THIS_MODULE,
932 .pf = PF_BRIDGE,
933 .hooknum = NF_BR_FORWARD,
934 .priority = NF_BR_PRI_BRNF,
935 },
936 {
937 .hook = br_nf_local_out,
938 .owner = THIS_MODULE,
939 .pf = PF_BRIDGE,
940 .hooknum = NF_BR_LOCAL_OUT,
941 .priority = NF_BR_PRI_FIRST,
942 },
943 {
944 .hook = br_nf_post_routing,
945 .owner = THIS_MODULE,
946 .pf = PF_BRIDGE,
947 .hooknum = NF_BR_POST_ROUTING,
948 .priority = NF_BR_PRI_LAST,
949 },
950 {
951 .hook = ip_sabotage_in,
952 .owner = THIS_MODULE,
953 .pf = PF_INET,
954 .hooknum = NF_INET_PRE_ROUTING,
955 .priority = NF_IP_PRI_FIRST,
956 },
957 {
958 .hook = ip_sabotage_in,
959 .owner = THIS_MODULE,
960 .pf = PF_INET6,
961 .hooknum = NF_INET_PRE_ROUTING,
962 .priority = NF_IP6_PRI_FIRST,
963 },
964};
965
966#ifdef CONFIG_SYSCTL
967static
968int brnf_sysctl_call_tables(ctl_table * ctl, int write,
969 void __user * buffer, size_t * lenp, loff_t * ppos)
970{
971 int ret;
972
973 ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
974
975 if (write && *(int *)(ctl->data))
976 *(int *)(ctl->data) = 1;
977 return ret;
978}
979
980static ctl_table brnf_table[] = {
981 {
982 .procname = "bridge-nf-call-arptables",
983 .data = &brnf_call_arptables,
984 .maxlen = sizeof(int),
985 .mode = 0644,
986 .proc_handler = brnf_sysctl_call_tables,
987 },
988 {
989 .procname = "bridge-nf-call-iptables",
990 .data = &brnf_call_iptables,
991 .maxlen = sizeof(int),
992 .mode = 0644,
993 .proc_handler = brnf_sysctl_call_tables,
994 },
995 {
996 .procname = "bridge-nf-call-ip6tables",
997 .data = &brnf_call_ip6tables,
998 .maxlen = sizeof(int),
999 .mode = 0644,
1000 .proc_handler = brnf_sysctl_call_tables,
1001 },
1002 {
1003 .procname = "bridge-nf-filter-vlan-tagged",
1004 .data = &brnf_filter_vlan_tagged,
1005 .maxlen = sizeof(int),
1006 .mode = 0644,
1007 .proc_handler = brnf_sysctl_call_tables,
1008 },
1009 {
1010 .procname = "bridge-nf-filter-pppoe-tagged",
1011 .data = &brnf_filter_pppoe_tagged,
1012 .maxlen = sizeof(int),
1013 .mode = 0644,
1014 .proc_handler = brnf_sysctl_call_tables,
1015 },
1016 { .ctl_name = 0 }
1017};
1018
1019static struct ctl_path brnf_path[] = {
1020 { .procname = "net", .ctl_name = CTL_NET, },
1021 { .procname = "bridge", .ctl_name = NET_BRIDGE, },
1022 { }
1023};
1024#endif
1025
1026int __init br_netfilter_init(void)
1027{
1028 int ret;
1029
1030 ret = nf_register_hooks(br_nf_ops, ARRAY_SIZE(br_nf_ops));
1031 if (ret < 0)
1032 return ret;
1033#ifdef CONFIG_SYSCTL
1034 brnf_sysctl_header = register_sysctl_paths(brnf_path, brnf_table);
1035 if (brnf_sysctl_header == NULL) {
1036 printk(KERN_WARNING
1037 "br_netfilter: can't register to sysctl.\n");
1038 nf_unregister_hooks(br_nf_ops, ARRAY_SIZE(br_nf_ops));
1039 return -ENOMEM;
1040 }
1041#endif
1042 printk(KERN_NOTICE "Bridge firewalling registered\n");
1043 return 0;
1044}
1045
1046void br_netfilter_fini(void)
1047{
1048 nf_unregister_hooks(br_nf_ops, ARRAY_SIZE(br_nf_ops));
1049#ifdef CONFIG_SYSCTL
1050 unregister_sysctl_table(brnf_sysctl_header);
1051#endif
1052}
1053