1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17#include <linux/module.h>
18#include <linux/kernel.h>
19#include <linux/slab.h>
20#include <linux/ip.h>
21#include <linux/netdevice.h>
22#include <linux/skbuff.h>
23#include <linux/if_arp.h>
24#include <linux/if_ether.h>
25#include <linux/if_vlan.h>
26#include <linux/if_pppox.h>
27#include <linux/ppp_defs.h>
28#include <linux/netfilter_bridge.h>
29#include <linux/netfilter_ipv4.h>
30#include <linux/netfilter_ipv6.h>
31#include <linux/netfilter_arp.h>
32#include <linux/in_route.h>
33#include <linux/inetdevice.h>
34
35#include <net/ip.h>
36#include <net/ipv6.h>
37#include <net/route.h>
38#include <net/netfilter/br_netfilter.h>
39
40#include <asm/uaccess.h>
41#include "br_private.h"
42#ifdef CONFIG_SYSCTL
43#include <linux/sysctl.h>
44#endif
45
46#ifdef CONFIG_SYSCTL
47static struct ctl_table_header *brnf_sysctl_header;
48static int brnf_call_iptables __read_mostly = 1;
49static int brnf_call_ip6tables __read_mostly = 1;
50static int brnf_call_arptables __read_mostly = 1;
51static int brnf_filter_vlan_tagged __read_mostly = 0;
52static int brnf_filter_pppoe_tagged __read_mostly = 0;
53static int brnf_pass_vlan_indev __read_mostly = 0;
54#else
55#define brnf_call_iptables 1
56#define brnf_call_ip6tables 1
57#define brnf_call_arptables 1
58#define brnf_filter_vlan_tagged 0
59#define brnf_filter_pppoe_tagged 0
60#define brnf_pass_vlan_indev 0
61#endif
62
63#define IS_IP(skb) \
64 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_IP))
65
66#define IS_IPV6(skb) \
67 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_IPV6))
68
69#define IS_ARP(skb) \
70 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_ARP))
71
72static inline __be16 vlan_proto(const struct sk_buff *skb)
73{
74 if (skb_vlan_tag_present(skb))
75 return skb->protocol;
76 else if (skb->protocol == htons(ETH_P_8021Q))
77 return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
78 else
79 return 0;
80}
81
82#define IS_VLAN_IP(skb) \
83 (vlan_proto(skb) == htons(ETH_P_IP) && \
84 brnf_filter_vlan_tagged)
85
86#define IS_VLAN_IPV6(skb) \
87 (vlan_proto(skb) == htons(ETH_P_IPV6) && \
88 brnf_filter_vlan_tagged)
89
90#define IS_VLAN_ARP(skb) \
91 (vlan_proto(skb) == htons(ETH_P_ARP) && \
92 brnf_filter_vlan_tagged)
93
94static inline __be16 pppoe_proto(const struct sk_buff *skb)
95{
96 return *((__be16 *)(skb_mac_header(skb) + ETH_HLEN +
97 sizeof(struct pppoe_hdr)));
98}
99
100#define IS_PPPOE_IP(skb) \
101 (skb->protocol == htons(ETH_P_PPP_SES) && \
102 pppoe_proto(skb) == htons(PPP_IP) && \
103 brnf_filter_pppoe_tagged)
104
105#define IS_PPPOE_IPV6(skb) \
106 (skb->protocol == htons(ETH_P_PPP_SES) && \
107 pppoe_proto(skb) == htons(PPP_IPV6) && \
108 brnf_filter_pppoe_tagged)
109
110
111#define NF_BRIDGE_MAX_MAC_HEADER_LENGTH (PPPOE_SES_HLEN + ETH_HLEN)
112
113#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
114struct brnf_frag_data {
115 char mac[NF_BRIDGE_MAX_MAC_HEADER_LENGTH];
116 u8 encap_size;
117 u8 size;
118};
119
120static DEFINE_PER_CPU(struct brnf_frag_data, brnf_frag_data_storage);
121#endif
122
123static struct nf_bridge_info *nf_bridge_info_get(const struct sk_buff *skb)
124{
125 return skb->nf_bridge;
126}
127
128static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
129{
130 struct net_bridge_port *port;
131
132 port = br_port_get_rcu(dev);
133 return port ? &port->br->fake_rtable : NULL;
134}
135
136static inline struct net_device *bridge_parent(const struct net_device *dev)
137{
138 struct net_bridge_port *port;
139
140 port = br_port_get_rcu(dev);
141 return port ? port->br->dev : NULL;
142}
143
144static inline struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
145{
146 skb->nf_bridge = kzalloc(sizeof(struct nf_bridge_info), GFP_ATOMIC);
147 if (likely(skb->nf_bridge))
148 atomic_set(&(skb->nf_bridge->use), 1);
149
150 return skb->nf_bridge;
151}
152
153static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
154{
155 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
156
157 if (atomic_read(&nf_bridge->use) > 1) {
158 struct nf_bridge_info *tmp = nf_bridge_alloc(skb);
159
160 if (tmp) {
161 memcpy(tmp, nf_bridge, sizeof(struct nf_bridge_info));
162 atomic_set(&tmp->use, 1);
163 }
164 nf_bridge_put(nf_bridge);
165 nf_bridge = tmp;
166 }
167 return nf_bridge;
168}
169
170static unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb)
171{
172 switch (skb->protocol) {
173 case __cpu_to_be16(ETH_P_8021Q):
174 return VLAN_HLEN;
175 case __cpu_to_be16(ETH_P_PPP_SES):
176 return PPPOE_SES_HLEN;
177 default:
178 return 0;
179 }
180}
181
182static inline void nf_bridge_push_encap_header(struct sk_buff *skb)
183{
184 unsigned int len = nf_bridge_encap_header_len(skb);
185
186 skb_push(skb, len);
187 skb->network_header -= len;
188}
189
190static inline void nf_bridge_pull_encap_header(struct sk_buff *skb)
191{
192 unsigned int len = nf_bridge_encap_header_len(skb);
193
194 skb_pull(skb, len);
195 skb->network_header += len;
196}
197
198static inline void nf_bridge_pull_encap_header_rcsum(struct sk_buff *skb)
199{
200 unsigned int len = nf_bridge_encap_header_len(skb);
201
202 skb_pull_rcsum(skb, len);
203 skb->network_header += len;
204}
205
206
207
208
209
210
211static int br_parse_ip_options(struct sk_buff *skb)
212{
213 const struct iphdr *iph;
214 struct net_device *dev = skb->dev;
215 u32 len;
216
217 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
218 goto inhdr_error;
219
220 iph = ip_hdr(skb);
221
222
223 if (iph->ihl < 5 || iph->version != 4)
224 goto inhdr_error;
225
226 if (!pskb_may_pull(skb, iph->ihl*4))
227 goto inhdr_error;
228
229 iph = ip_hdr(skb);
230 if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
231 goto inhdr_error;
232
233 len = ntohs(iph->tot_len);
234 if (skb->len < len) {
235 IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INTRUNCATEDPKTS);
236 goto drop;
237 } else if (len < (iph->ihl*4))
238 goto inhdr_error;
239
240 if (pskb_trim_rcsum(skb, len)) {
241 IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INDISCARDS);
242 goto drop;
243 }
244
245 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
246
247
248
249
250
251 return 0;
252
253inhdr_error:
254 IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INHDRERRORS);
255drop:
256 return -1;
257}
258
259static void nf_bridge_update_protocol(struct sk_buff *skb)
260{
261 switch (skb->nf_bridge->orig_proto) {
262 case BRNF_PROTO_8021Q:
263 skb->protocol = htons(ETH_P_8021Q);
264 break;
265 case BRNF_PROTO_PPPOE:
266 skb->protocol = htons(ETH_P_PPP_SES);
267 break;
268 case BRNF_PROTO_UNCHANGED:
269 break;
270 }
271}
272
273
274
275
276static int br_nf_pre_routing_finish_ipv6(struct sock *sk, struct sk_buff *skb)
277{
278 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
279 struct rtable *rt;
280
281 if (nf_bridge->pkt_otherhost) {
282 skb->pkt_type = PACKET_OTHERHOST;
283 nf_bridge->pkt_otherhost = false;
284 }
285 nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
286
287 rt = bridge_parent_rtable(nf_bridge->physindev);
288 if (!rt) {
289 kfree_skb(skb);
290 return 0;
291 }
292 skb_dst_set_noref(skb, &rt->dst);
293
294 skb->dev = nf_bridge->physindev;
295 nf_bridge_update_protocol(skb);
296 nf_bridge_push_encap_header(skb);
297 NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, sk, skb,
298 skb->dev, NULL,
299 br_handle_frame_finish, 1);
300
301 return 0;
302}
303
304
305
306
307
308
309static int br_nf_pre_routing_finish_bridge(struct sock *sk, struct sk_buff *skb)
310{
311 struct neighbour *neigh;
312 struct dst_entry *dst;
313
314 skb->dev = bridge_parent(skb->dev);
315 if (!skb->dev)
316 goto free_skb;
317 dst = skb_dst(skb);
318 neigh = dst_neigh_lookup_skb(dst, skb);
319 if (neigh) {
320 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
321 int ret;
322
323 if (neigh->hh.hh_len) {
324 neigh_hh_bridge(&neigh->hh, skb);
325 skb->dev = nf_bridge->physindev;
326 ret = br_handle_frame_finish(sk, skb);
327 } else {
328
329
330
331
332 skb_copy_from_linear_data_offset(skb,
333 -(ETH_HLEN-ETH_ALEN),
334 nf_bridge->neigh_header,
335 ETH_HLEN-ETH_ALEN);
336
337 nf_bridge->mask |= BRNF_BRIDGED_DNAT;
338
339 ret = neigh->output(neigh, skb);
340 }
341 neigh_release(neigh);
342 return ret;
343 }
344free_skb:
345 kfree_skb(skb);
346 return 0;
347}
348
349static bool daddr_was_changed(const struct sk_buff *skb,
350 const struct nf_bridge_info *nf_bridge)
351{
352 return ip_hdr(skb)->daddr != nf_bridge->ipv4_daddr;
353}
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394static int br_nf_pre_routing_finish(struct sock *sk, struct sk_buff *skb)
395{
396 struct net_device *dev = skb->dev;
397 struct iphdr *iph = ip_hdr(skb);
398 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
399 struct rtable *rt;
400 int err;
401 int frag_max_size;
402
403 frag_max_size = IPCB(skb)->frag_max_size;
404 BR_INPUT_SKB_CB(skb)->frag_max_size = frag_max_size;
405
406 if (nf_bridge->pkt_otherhost) {
407 skb->pkt_type = PACKET_OTHERHOST;
408 nf_bridge->pkt_otherhost = false;
409 }
410 nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
411 if (daddr_was_changed(skb, nf_bridge)) {
412 if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
413 struct in_device *in_dev = __in_dev_get_rcu(dev);
414
415
416
417
418
419
420
421
422 if (err != -EHOSTUNREACH || !in_dev || IN_DEV_FORWARD(in_dev))
423 goto free_skb;
424
425 rt = ip_route_output(dev_net(dev), iph->daddr, 0,
426 RT_TOS(iph->tos), 0);
427 if (!IS_ERR(rt)) {
428
429
430 if (rt->dst.dev == dev) {
431 skb_dst_set(skb, &rt->dst);
432 goto bridged_dnat;
433 }
434 ip_rt_put(rt);
435 }
436free_skb:
437 kfree_skb(skb);
438 return 0;
439 } else {
440 if (skb_dst(skb)->dev == dev) {
441bridged_dnat:
442 skb->dev = nf_bridge->physindev;
443 nf_bridge_update_protocol(skb);
444 nf_bridge_push_encap_header(skb);
445 NF_HOOK_THRESH(NFPROTO_BRIDGE,
446 NF_BR_PRE_ROUTING,
447 sk, skb, skb->dev, NULL,
448 br_nf_pre_routing_finish_bridge,
449 1);
450 return 0;
451 }
452 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
453 skb->pkt_type = PACKET_HOST;
454 }
455 } else {
456 rt = bridge_parent_rtable(nf_bridge->physindev);
457 if (!rt) {
458 kfree_skb(skb);
459 return 0;
460 }
461 skb_dst_set_noref(skb, &rt->dst);
462 }
463
464 skb->dev = nf_bridge->physindev;
465 nf_bridge_update_protocol(skb);
466 nf_bridge_push_encap_header(skb);
467 NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, sk, skb,
468 skb->dev, NULL,
469 br_handle_frame_finish, 1);
470
471 return 0;
472}
473
474static struct net_device *brnf_get_logical_dev(struct sk_buff *skb, const struct net_device *dev)
475{
476 struct net_device *vlan, *br;
477
478 br = bridge_parent(dev);
479 if (brnf_pass_vlan_indev == 0 || !skb_vlan_tag_present(skb))
480 return br;
481
482 vlan = __vlan_find_dev_deep_rcu(br, skb->vlan_proto,
483 skb_vlan_tag_get(skb) & VLAN_VID_MASK);
484
485 return vlan ? vlan : br;
486}
487
488
489static struct net_device *setup_pre_routing(struct sk_buff *skb)
490{
491 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
492
493 if (skb->pkt_type == PACKET_OTHERHOST) {
494 skb->pkt_type = PACKET_HOST;
495 nf_bridge->pkt_otherhost = true;
496 }
497
498 nf_bridge->mask |= BRNF_NF_BRIDGE_PREROUTING;
499 nf_bridge->physindev = skb->dev;
500 skb->dev = brnf_get_logical_dev(skb, skb->dev);
501
502 if (skb->protocol == htons(ETH_P_8021Q))
503 nf_bridge->orig_proto = BRNF_PROTO_8021Q;
504 else if (skb->protocol == htons(ETH_P_PPP_SES))
505 nf_bridge->orig_proto = BRNF_PROTO_PPPOE;
506
507
508 skb_orphan(skb);
509 return skb->dev;
510}
511
512
513static int check_hbh_len(struct sk_buff *skb)
514{
515 unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
516 u32 pkt_len;
517 const unsigned char *nh = skb_network_header(skb);
518 int off = raw - nh;
519 int len = (raw[1] + 1) << 3;
520
521 if ((raw + len) - skb->data > skb_headlen(skb))
522 goto bad;
523
524 off += 2;
525 len -= 2;
526
527 while (len > 0) {
528 int optlen = nh[off + 1] + 2;
529
530 switch (nh[off]) {
531 case IPV6_TLV_PAD1:
532 optlen = 1;
533 break;
534
535 case IPV6_TLV_PADN:
536 break;
537
538 case IPV6_TLV_JUMBO:
539 if (nh[off + 1] != 4 || (off & 3) != 2)
540 goto bad;
541 pkt_len = ntohl(*(__be32 *) (nh + off + 2));
542 if (pkt_len <= IPV6_MAXPLEN ||
543 ipv6_hdr(skb)->payload_len)
544 goto bad;
545 if (pkt_len > skb->len - sizeof(struct ipv6hdr))
546 goto bad;
547 if (pskb_trim_rcsum(skb,
548 pkt_len + sizeof(struct ipv6hdr)))
549 goto bad;
550 nh = skb_network_header(skb);
551 break;
552 default:
553 if (optlen > len)
554 goto bad;
555 break;
556 }
557 off += optlen;
558 len -= optlen;
559 }
560 if (len == 0)
561 return 0;
562bad:
563 return -1;
564
565}
566
567
568
569static unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,
570 struct sk_buff *skb,
571 const struct nf_hook_state *state)
572{
573 const struct ipv6hdr *hdr;
574 u32 pkt_len;
575
576 if (skb->len < sizeof(struct ipv6hdr))
577 return NF_DROP;
578
579 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
580 return NF_DROP;
581
582 hdr = ipv6_hdr(skb);
583
584 if (hdr->version != 6)
585 return NF_DROP;
586
587 pkt_len = ntohs(hdr->payload_len);
588
589 if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
590 if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
591 return NF_DROP;
592 if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
593 return NF_DROP;
594 }
595 if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb))
596 return NF_DROP;
597
598 nf_bridge_put(skb->nf_bridge);
599 if (!nf_bridge_alloc(skb))
600 return NF_DROP;
601 if (!setup_pre_routing(skb))
602 return NF_DROP;
603
604 skb->protocol = htons(ETH_P_IPV6);
605 NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->sk, skb,
606 skb->dev, NULL,
607 br_nf_pre_routing_finish_ipv6);
608
609 return NF_STOLEN;
610}
611
612
613
614
615
616
617
618static unsigned int br_nf_pre_routing(const struct nf_hook_ops *ops,
619 struct sk_buff *skb,
620 const struct nf_hook_state *state)
621{
622 struct nf_bridge_info *nf_bridge;
623 struct net_bridge_port *p;
624 struct net_bridge *br;
625 __u32 len = nf_bridge_encap_header_len(skb);
626
627 if (unlikely(!pskb_may_pull(skb, len)))
628 return NF_DROP;
629
630 p = br_port_get_rcu(state->in);
631 if (p == NULL)
632 return NF_DROP;
633 br = p->br;
634
635 if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb)) {
636 if (!brnf_call_ip6tables && !br->nf_call_ip6tables)
637 return NF_ACCEPT;
638
639 nf_bridge_pull_encap_header_rcsum(skb);
640 return br_nf_pre_routing_ipv6(ops, skb, state);
641 }
642
643 if (!brnf_call_iptables && !br->nf_call_iptables)
644 return NF_ACCEPT;
645
646 if (!IS_IP(skb) && !IS_VLAN_IP(skb) && !IS_PPPOE_IP(skb))
647 return NF_ACCEPT;
648
649 nf_bridge_pull_encap_header_rcsum(skb);
650
651 if (br_parse_ip_options(skb))
652 return NF_DROP;
653
654 nf_bridge_put(skb->nf_bridge);
655 if (!nf_bridge_alloc(skb))
656 return NF_DROP;
657 if (!setup_pre_routing(skb))
658 return NF_DROP;
659
660 nf_bridge = nf_bridge_info_get(skb);
661 nf_bridge->ipv4_daddr = ip_hdr(skb)->daddr;
662
663 skb->protocol = htons(ETH_P_IP);
664
665 NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, state->sk, skb,
666 skb->dev, NULL,
667 br_nf_pre_routing_finish);
668
669 return NF_STOLEN;
670}
671
672
673
674
675
676
677
678
679
680static unsigned int br_nf_local_in(const struct nf_hook_ops *ops,
681 struct sk_buff *skb,
682 const struct nf_hook_state *state)
683{
684 br_drop_fake_rtable(skb);
685 return NF_ACCEPT;
686}
687
688
689static int br_nf_forward_finish(struct sock *sk, struct sk_buff *skb)
690{
691 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
692 struct net_device *in;
693
694 if (!IS_ARP(skb) && !IS_VLAN_ARP(skb)) {
695 int frag_max_size;
696
697 if (skb->protocol == htons(ETH_P_IP)) {
698 frag_max_size = IPCB(skb)->frag_max_size;
699 BR_INPUT_SKB_CB(skb)->frag_max_size = frag_max_size;
700 }
701
702 in = nf_bridge->physindev;
703 if (nf_bridge->pkt_otherhost) {
704 skb->pkt_type = PACKET_OTHERHOST;
705 nf_bridge->pkt_otherhost = false;
706 }
707 nf_bridge_update_protocol(skb);
708 } else {
709 in = *((struct net_device **)(skb->cb));
710 }
711 nf_bridge_push_encap_header(skb);
712
713 NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_FORWARD, sk, skb,
714 in, skb->dev, br_forward_finish, 1);
715 return 0;
716}
717
718
719
720
721
722
723
724static unsigned int br_nf_forward_ip(const struct nf_hook_ops *ops,
725 struct sk_buff *skb,
726 const struct nf_hook_state *state)
727{
728 struct nf_bridge_info *nf_bridge;
729 struct net_device *parent;
730 u_int8_t pf;
731
732 if (!skb->nf_bridge)
733 return NF_ACCEPT;
734
735
736
737 if (!nf_bridge_unshare(skb))
738 return NF_DROP;
739
740 nf_bridge = nf_bridge_info_get(skb);
741 if (!nf_bridge)
742 return NF_DROP;
743
744 parent = bridge_parent(state->out);
745 if (!parent)
746 return NF_DROP;
747
748 if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
749 pf = NFPROTO_IPV4;
750 else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
751 pf = NFPROTO_IPV6;
752 else
753 return NF_ACCEPT;
754
755 nf_bridge_pull_encap_header(skb);
756
757 if (skb->pkt_type == PACKET_OTHERHOST) {
758 skb->pkt_type = PACKET_HOST;
759 nf_bridge->pkt_otherhost = true;
760 }
761
762 if (pf == NFPROTO_IPV4) {
763 int frag_max = BR_INPUT_SKB_CB(skb)->frag_max_size;
764
765 if (br_parse_ip_options(skb))
766 return NF_DROP;
767
768 IPCB(skb)->frag_max_size = frag_max;
769 }
770
771 nf_bridge->physoutdev = skb->dev;
772 if (pf == NFPROTO_IPV4)
773 skb->protocol = htons(ETH_P_IP);
774 else
775 skb->protocol = htons(ETH_P_IPV6);
776
777 NF_HOOK(pf, NF_INET_FORWARD, NULL, skb,
778 brnf_get_logical_dev(skb, state->in),
779 parent, br_nf_forward_finish);
780
781 return NF_STOLEN;
782}
783
784static unsigned int br_nf_forward_arp(const struct nf_hook_ops *ops,
785 struct sk_buff *skb,
786 const struct nf_hook_state *state)
787{
788 struct net_bridge_port *p;
789 struct net_bridge *br;
790 struct net_device **d = (struct net_device **)(skb->cb);
791
792 p = br_port_get_rcu(state->out);
793 if (p == NULL)
794 return NF_ACCEPT;
795 br = p->br;
796
797 if (!brnf_call_arptables && !br->nf_call_arptables)
798 return NF_ACCEPT;
799
800 if (!IS_ARP(skb)) {
801 if (!IS_VLAN_ARP(skb))
802 return NF_ACCEPT;
803 nf_bridge_pull_encap_header(skb);
804 }
805
806 if (arp_hdr(skb)->ar_pln != 4) {
807 if (IS_VLAN_ARP(skb))
808 nf_bridge_push_encap_header(skb);
809 return NF_ACCEPT;
810 }
811 *d = state->in;
812 NF_HOOK(NFPROTO_ARP, NF_ARP_FORWARD, state->sk, skb,
813 state->in, state->out, br_nf_forward_finish);
814
815 return NF_STOLEN;
816}
817
818#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
819static int br_nf_push_frag_xmit(struct sock *sk, struct sk_buff *skb)
820{
821 struct brnf_frag_data *data;
822 int err;
823
824 data = this_cpu_ptr(&brnf_frag_data_storage);
825 err = skb_cow_head(skb, data->size);
826
827 if (err) {
828 kfree_skb(skb);
829 return 0;
830 }
831
832 skb_copy_to_linear_data_offset(skb, -data->size, data->mac, data->size);
833 __skb_push(skb, data->encap_size);
834
835 return br_dev_queue_push_xmit(sk, skb);
836}
837
838static int br_nf_dev_queue_xmit(struct sock *sk, struct sk_buff *skb)
839{
840 int ret;
841 int frag_max_size;
842 unsigned int mtu_reserved;
843
844 if (skb_is_gso(skb) || skb->protocol != htons(ETH_P_IP))
845 return br_dev_queue_push_xmit(sk, skb);
846
847 mtu_reserved = nf_bridge_mtu_reduction(skb);
848
849
850
851 if (skb->len + mtu_reserved > skb->dev->mtu) {
852 struct brnf_frag_data *data;
853
854 frag_max_size = BR_INPUT_SKB_CB(skb)->frag_max_size;
855 if (br_parse_ip_options(skb))
856
857 return NF_DROP;
858 IPCB(skb)->frag_max_size = frag_max_size;
859
860 nf_bridge_update_protocol(skb);
861
862 data = this_cpu_ptr(&brnf_frag_data_storage);
863 data->encap_size = nf_bridge_encap_header_len(skb);
864 data->size = ETH_HLEN + data->encap_size;
865
866 skb_copy_from_linear_data_offset(skb, -data->size, data->mac,
867 data->size);
868
869 ret = ip_fragment(sk, skb, br_nf_push_frag_xmit);
870 } else {
871 ret = br_dev_queue_push_xmit(sk, skb);
872 }
873
874 return ret;
875}
876#else
877static int br_nf_dev_queue_xmit(struct sock *sk, struct sk_buff *skb)
878{
879 return br_dev_queue_push_xmit(sk, skb);
880}
881#endif
882
883
884static unsigned int br_nf_post_routing(const struct nf_hook_ops *ops,
885 struct sk_buff *skb,
886 const struct nf_hook_state *state)
887{
888 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
889 struct net_device *realoutdev = bridge_parent(skb->dev);
890 u_int8_t pf;
891
892
893
894
895
896
897 if (!nf_bridge || !nf_bridge->physoutdev)
898 return NF_ACCEPT;
899
900 if (!realoutdev)
901 return NF_DROP;
902
903 if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
904 pf = NFPROTO_IPV4;
905 else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
906 pf = NFPROTO_IPV6;
907 else
908 return NF_ACCEPT;
909
910
911
912 if (skb->pkt_type == PACKET_OTHERHOST) {
913 skb->pkt_type = PACKET_HOST;
914 nf_bridge->pkt_otherhost = true;
915 }
916
917 nf_bridge_pull_encap_header(skb);
918 if (pf == NFPROTO_IPV4)
919 skb->protocol = htons(ETH_P_IP);
920 else
921 skb->protocol = htons(ETH_P_IPV6);
922
923 NF_HOOK(pf, NF_INET_POST_ROUTING, state->sk, skb,
924 NULL, realoutdev,
925 br_nf_dev_queue_xmit);
926
927 return NF_STOLEN;
928}
929
930
931
932
933static unsigned int ip_sabotage_in(const struct nf_hook_ops *ops,
934 struct sk_buff *skb,
935 const struct nf_hook_state *state)
936{
937 if (skb->nf_bridge &&
938 !(skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)) {
939 return NF_STOP;
940 }
941
942 return NF_ACCEPT;
943}
944
945
946
947
948
949
950
951
952
953
954static void br_nf_pre_routing_finish_bridge_slow(struct sk_buff *skb)
955{
956 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
957
958 skb_pull(skb, ETH_HLEN);
959 nf_bridge->mask &= ~BRNF_BRIDGED_DNAT;
960
961 BUILD_BUG_ON(sizeof(nf_bridge->neigh_header) != (ETH_HLEN - ETH_ALEN));
962
963 skb_copy_to_linear_data_offset(skb, -(ETH_HLEN - ETH_ALEN),
964 nf_bridge->neigh_header,
965 ETH_HLEN - ETH_ALEN);
966 skb->dev = nf_bridge->physindev;
967 br_handle_frame_finish(NULL, skb);
968}
969
970static int br_nf_dev_xmit(struct sk_buff *skb)
971{
972 if (skb->nf_bridge && (skb->nf_bridge->mask & BRNF_BRIDGED_DNAT)) {
973 br_nf_pre_routing_finish_bridge_slow(skb);
974 return 1;
975 }
976 return 0;
977}
978
979static const struct nf_br_ops br_ops = {
980 .br_dev_xmit_hook = br_nf_dev_xmit,
981};
982
983void br_netfilter_enable(void)
984{
985}
986EXPORT_SYMBOL_GPL(br_netfilter_enable);
987
988
989
990static struct nf_hook_ops br_nf_ops[] __read_mostly = {
991 {
992 .hook = br_nf_pre_routing,
993 .owner = THIS_MODULE,
994 .pf = NFPROTO_BRIDGE,
995 .hooknum = NF_BR_PRE_ROUTING,
996 .priority = NF_BR_PRI_BRNF,
997 },
998 {
999 .hook = br_nf_local_in,
1000 .owner = THIS_MODULE,
1001 .pf = NFPROTO_BRIDGE,
1002 .hooknum = NF_BR_LOCAL_IN,
1003 .priority = NF_BR_PRI_BRNF,
1004 },
1005 {
1006 .hook = br_nf_forward_ip,
1007 .owner = THIS_MODULE,
1008 .pf = NFPROTO_BRIDGE,
1009 .hooknum = NF_BR_FORWARD,
1010 .priority = NF_BR_PRI_BRNF - 1,
1011 },
1012 {
1013 .hook = br_nf_forward_arp,
1014 .owner = THIS_MODULE,
1015 .pf = NFPROTO_BRIDGE,
1016 .hooknum = NF_BR_FORWARD,
1017 .priority = NF_BR_PRI_BRNF,
1018 },
1019 {
1020 .hook = br_nf_post_routing,
1021 .owner = THIS_MODULE,
1022 .pf = NFPROTO_BRIDGE,
1023 .hooknum = NF_BR_POST_ROUTING,
1024 .priority = NF_BR_PRI_LAST,
1025 },
1026 {
1027 .hook = ip_sabotage_in,
1028 .owner = THIS_MODULE,
1029 .pf = NFPROTO_IPV4,
1030 .hooknum = NF_INET_PRE_ROUTING,
1031 .priority = NF_IP_PRI_FIRST,
1032 },
1033 {
1034 .hook = ip_sabotage_in,
1035 .owner = THIS_MODULE,
1036 .pf = NFPROTO_IPV6,
1037 .hooknum = NF_INET_PRE_ROUTING,
1038 .priority = NF_IP6_PRI_FIRST,
1039 },
1040};
1041
1042#ifdef CONFIG_SYSCTL
1043static
1044int brnf_sysctl_call_tables(struct ctl_table *ctl, int write,
1045 void __user *buffer, size_t *lenp, loff_t *ppos)
1046{
1047 int ret;
1048
1049 ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
1050
1051 if (write && *(int *)(ctl->data))
1052 *(int *)(ctl->data) = 1;
1053 return ret;
1054}
1055
1056static struct ctl_table brnf_table[] = {
1057 {
1058 .procname = "bridge-nf-call-arptables",
1059 .data = &brnf_call_arptables,
1060 .maxlen = sizeof(int),
1061 .mode = 0644,
1062 .proc_handler = brnf_sysctl_call_tables,
1063 },
1064 {
1065 .procname = "bridge-nf-call-iptables",
1066 .data = &brnf_call_iptables,
1067 .maxlen = sizeof(int),
1068 .mode = 0644,
1069 .proc_handler = brnf_sysctl_call_tables,
1070 },
1071 {
1072 .procname = "bridge-nf-call-ip6tables",
1073 .data = &brnf_call_ip6tables,
1074 .maxlen = sizeof(int),
1075 .mode = 0644,
1076 .proc_handler = brnf_sysctl_call_tables,
1077 },
1078 {
1079 .procname = "bridge-nf-filter-vlan-tagged",
1080 .data = &brnf_filter_vlan_tagged,
1081 .maxlen = sizeof(int),
1082 .mode = 0644,
1083 .proc_handler = brnf_sysctl_call_tables,
1084 },
1085 {
1086 .procname = "bridge-nf-filter-pppoe-tagged",
1087 .data = &brnf_filter_pppoe_tagged,
1088 .maxlen = sizeof(int),
1089 .mode = 0644,
1090 .proc_handler = brnf_sysctl_call_tables,
1091 },
1092 {
1093 .procname = "bridge-nf-pass-vlan-input-dev",
1094 .data = &brnf_pass_vlan_indev,
1095 .maxlen = sizeof(int),
1096 .mode = 0644,
1097 .proc_handler = brnf_sysctl_call_tables,
1098 },
1099 { }
1100};
1101#endif
1102
1103static int __init br_netfilter_init(void)
1104{
1105 int ret;
1106
1107 ret = nf_register_hooks(br_nf_ops, ARRAY_SIZE(br_nf_ops));
1108 if (ret < 0)
1109 return ret;
1110
1111#ifdef CONFIG_SYSCTL
1112 brnf_sysctl_header = register_net_sysctl(&init_net, "net/bridge", brnf_table);
1113 if (brnf_sysctl_header == NULL) {
1114 printk(KERN_WARNING
1115 "br_netfilter: can't register to sysctl.\n");
1116 nf_unregister_hooks(br_nf_ops, ARRAY_SIZE(br_nf_ops));
1117 return -ENOMEM;
1118 }
1119#endif
1120 RCU_INIT_POINTER(nf_br_ops, &br_ops);
1121 printk(KERN_NOTICE "Bridge firewalling registered\n");
1122 return 0;
1123}
1124
1125static void __exit br_netfilter_fini(void)
1126{
1127 RCU_INIT_POINTER(nf_br_ops, NULL);
1128 nf_unregister_hooks(br_nf_ops, ARRAY_SIZE(br_nf_ops));
1129#ifdef CONFIG_SYSCTL
1130 unregister_net_sysctl_table(brnf_sysctl_header);
1131#endif
1132}
1133
1134module_init(br_netfilter_init);
1135module_exit(br_netfilter_fini);
1136
1137MODULE_LICENSE("GPL");
1138MODULE_AUTHOR("Lennert Buytenhek <buytenh@gnu.org>");
1139MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
1140MODULE_DESCRIPTION("Linux ethernet netfilter firewall bridge");
1141