1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17#include <linux/module.h>
18#include <linux/kernel.h>
19#include <linux/slab.h>
20#include <linux/ip.h>
21#include <linux/netdevice.h>
22#include <linux/skbuff.h>
23#include <linux/if_arp.h>
24#include <linux/if_ether.h>
25#include <linux/if_vlan.h>
26#include <linux/if_pppox.h>
27#include <linux/ppp_defs.h>
28#include <linux/netfilter_bridge.h>
29#include <linux/netfilter_ipv4.h>
30#include <linux/netfilter_ipv6.h>
31#include <linux/netfilter_arp.h>
32#include <linux/in_route.h>
33#include <linux/rculist.h>
34#include <linux/inetdevice.h>
35
36#include <net/ip.h>
37#include <net/ipv6.h>
38#include <net/addrconf.h>
39#include <net/route.h>
40#include <net/netfilter/br_netfilter.h>
41#include <net/netns/generic.h>
42
43#include <linux/uaccess.h>
44#include "br_private.h"
45#ifdef CONFIG_SYSCTL
46#include <linux/sysctl.h>
47#endif
48
49static unsigned int brnf_net_id __read_mostly;
50
51struct brnf_net {
52 bool enabled;
53};
54
55#ifdef CONFIG_SYSCTL
56static struct ctl_table_header *brnf_sysctl_header;
57static int brnf_call_iptables __read_mostly = 1;
58static int brnf_call_ip6tables __read_mostly = 1;
59static int brnf_call_arptables __read_mostly = 1;
60static int brnf_filter_vlan_tagged __read_mostly;
61static int brnf_filter_pppoe_tagged __read_mostly;
62static int brnf_pass_vlan_indev __read_mostly;
63#else
64#define brnf_call_iptables 1
65#define brnf_call_ip6tables 1
66#define brnf_call_arptables 1
67#define brnf_filter_vlan_tagged 0
68#define brnf_filter_pppoe_tagged 0
69#define brnf_pass_vlan_indev 0
70#endif
71
72#define IS_IP(skb) \
73 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_IP))
74
75#define IS_IPV6(skb) \
76 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_IPV6))
77
78#define IS_ARP(skb) \
79 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_ARP))
80
81static inline __be16 vlan_proto(const struct sk_buff *skb)
82{
83 if (skb_vlan_tag_present(skb))
84 return skb->protocol;
85 else if (skb->protocol == htons(ETH_P_8021Q))
86 return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
87 else
88 return 0;
89}
90
91#define IS_VLAN_IP(skb) \
92 (vlan_proto(skb) == htons(ETH_P_IP) && \
93 brnf_filter_vlan_tagged)
94
95#define IS_VLAN_IPV6(skb) \
96 (vlan_proto(skb) == htons(ETH_P_IPV6) && \
97 brnf_filter_vlan_tagged)
98
99#define IS_VLAN_ARP(skb) \
100 (vlan_proto(skb) == htons(ETH_P_ARP) && \
101 brnf_filter_vlan_tagged)
102
103static inline __be16 pppoe_proto(const struct sk_buff *skb)
104{
105 return *((__be16 *)(skb_mac_header(skb) + ETH_HLEN +
106 sizeof(struct pppoe_hdr)));
107}
108
109#define IS_PPPOE_IP(skb) \
110 (skb->protocol == htons(ETH_P_PPP_SES) && \
111 pppoe_proto(skb) == htons(PPP_IP) && \
112 brnf_filter_pppoe_tagged)
113
114#define IS_PPPOE_IPV6(skb) \
115 (skb->protocol == htons(ETH_P_PPP_SES) && \
116 pppoe_proto(skb) == htons(PPP_IPV6) && \
117 brnf_filter_pppoe_tagged)
118
119
120#define NF_BRIDGE_MAX_MAC_HEADER_LENGTH (PPPOE_SES_HLEN + ETH_HLEN)
121
122struct brnf_frag_data {
123 char mac[NF_BRIDGE_MAX_MAC_HEADER_LENGTH];
124 u8 encap_size;
125 u8 size;
126 u16 vlan_tci;
127 __be16 vlan_proto;
128};
129
130static DEFINE_PER_CPU(struct brnf_frag_data, brnf_frag_data_storage);
131
132static void nf_bridge_info_free(struct sk_buff *skb)
133{
134 if (skb->nf_bridge) {
135 nf_bridge_put(skb->nf_bridge);
136 skb->nf_bridge = NULL;
137 }
138}
139
140static inline struct net_device *bridge_parent(const struct net_device *dev)
141{
142 struct net_bridge_port *port;
143
144 port = br_port_get_rcu(dev);
145 return port ? port->br->dev : NULL;
146}
147
148static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
149{
150 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
151
152 if (refcount_read(&nf_bridge->use) > 1) {
153 struct nf_bridge_info *tmp = nf_bridge_alloc(skb);
154
155 if (tmp) {
156 memcpy(tmp, nf_bridge, sizeof(struct nf_bridge_info));
157 refcount_set(&tmp->use, 1);
158 }
159 nf_bridge_put(nf_bridge);
160 nf_bridge = tmp;
161 }
162 return nf_bridge;
163}
164
165unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb)
166{
167 switch (skb->protocol) {
168 case __cpu_to_be16(ETH_P_8021Q):
169 return VLAN_HLEN;
170 case __cpu_to_be16(ETH_P_PPP_SES):
171 return PPPOE_SES_HLEN;
172 default:
173 return 0;
174 }
175}
176
177static inline void nf_bridge_pull_encap_header(struct sk_buff *skb)
178{
179 unsigned int len = nf_bridge_encap_header_len(skb);
180
181 skb_pull(skb, len);
182 skb->network_header += len;
183}
184
185static inline void nf_bridge_pull_encap_header_rcsum(struct sk_buff *skb)
186{
187 unsigned int len = nf_bridge_encap_header_len(skb);
188
189 skb_pull_rcsum(skb, len);
190 skb->network_header += len;
191}
192
193
194
195
196
197
198static int br_validate_ipv4(struct net *net, struct sk_buff *skb)
199{
200 const struct iphdr *iph;
201 u32 len;
202
203 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
204 goto inhdr_error;
205
206 iph = ip_hdr(skb);
207
208
209 if (iph->ihl < 5 || iph->version != 4)
210 goto inhdr_error;
211
212 if (!pskb_may_pull(skb, iph->ihl*4))
213 goto inhdr_error;
214
215 iph = ip_hdr(skb);
216 if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
217 goto csum_error;
218
219 len = ntohs(iph->tot_len);
220 if (skb->len < len) {
221 __IP_INC_STATS(net, IPSTATS_MIB_INTRUNCATEDPKTS);
222 goto drop;
223 } else if (len < (iph->ihl*4))
224 goto inhdr_error;
225
226 if (pskb_trim_rcsum(skb, len)) {
227 __IP_INC_STATS(net, IPSTATS_MIB_INDISCARDS);
228 goto drop;
229 }
230
231 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
232
233
234
235
236
237 return 0;
238
239csum_error:
240 __IP_INC_STATS(net, IPSTATS_MIB_CSUMERRORS);
241inhdr_error:
242 __IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
243drop:
244 return -1;
245}
246
247void nf_bridge_update_protocol(struct sk_buff *skb)
248{
249 switch (skb->nf_bridge->orig_proto) {
250 case BRNF_PROTO_8021Q:
251 skb->protocol = htons(ETH_P_8021Q);
252 break;
253 case BRNF_PROTO_PPPOE:
254 skb->protocol = htons(ETH_P_PPP_SES);
255 break;
256 case BRNF_PROTO_UNCHANGED:
257 break;
258 }
259}
260
261
262
263
264
265
266int br_nf_pre_routing_finish_bridge(struct net *net, struct sock *sk, struct sk_buff *skb)
267{
268 struct neighbour *neigh;
269 struct dst_entry *dst;
270
271 skb->dev = bridge_parent(skb->dev);
272 if (!skb->dev)
273 goto free_skb;
274 dst = skb_dst(skb);
275 neigh = dst_neigh_lookup_skb(dst, skb);
276 if (neigh) {
277 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
278 int ret;
279
280 if (neigh->hh.hh_len) {
281 neigh_hh_bridge(&neigh->hh, skb);
282 skb->dev = nf_bridge->physindev;
283 ret = br_handle_frame_finish(net, sk, skb);
284 } else {
285
286
287
288
289 skb_copy_from_linear_data_offset(skb,
290 -(ETH_HLEN-ETH_ALEN),
291 nf_bridge->neigh_header,
292 ETH_HLEN-ETH_ALEN);
293
294 nf_bridge->bridged_dnat = 1;
295
296 ret = neigh->output(neigh, skb);
297 }
298 neigh_release(neigh);
299 return ret;
300 }
301free_skb:
302 kfree_skb(skb);
303 return 0;
304}
305
306static inline bool
307br_nf_ipv4_daddr_was_changed(const struct sk_buff *skb,
308 const struct nf_bridge_info *nf_bridge)
309{
310 return ip_hdr(skb)->daddr != nf_bridge->ipv4_daddr;
311}
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
353{
354 struct net_device *dev = skb->dev;
355 struct iphdr *iph = ip_hdr(skb);
356 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
357 struct rtable *rt;
358 int err;
359
360 nf_bridge->frag_max_size = IPCB(skb)->frag_max_size;
361
362 if (nf_bridge->pkt_otherhost) {
363 skb->pkt_type = PACKET_OTHERHOST;
364 nf_bridge->pkt_otherhost = false;
365 }
366 nf_bridge->in_prerouting = 0;
367 if (br_nf_ipv4_daddr_was_changed(skb, nf_bridge)) {
368 if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
369 struct in_device *in_dev = __in_dev_get_rcu(dev);
370
371
372
373
374
375
376
377
378 if (err != -EHOSTUNREACH || !in_dev || IN_DEV_FORWARD(in_dev))
379 goto free_skb;
380
381 rt = ip_route_output(net, iph->daddr, 0,
382 RT_TOS(iph->tos), 0);
383 if (!IS_ERR(rt)) {
384
385
386 if (rt->dst.dev == dev) {
387 skb_dst_set(skb, &rt->dst);
388 goto bridged_dnat;
389 }
390 ip_rt_put(rt);
391 }
392free_skb:
393 kfree_skb(skb);
394 return 0;
395 } else {
396 if (skb_dst(skb)->dev == dev) {
397bridged_dnat:
398 skb->dev = nf_bridge->physindev;
399 nf_bridge_update_protocol(skb);
400 nf_bridge_push_encap_header(skb);
401 br_nf_hook_thresh(NF_BR_PRE_ROUTING,
402 net, sk, skb, skb->dev,
403 NULL,
404 br_nf_pre_routing_finish_bridge);
405 return 0;
406 }
407 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
408 skb->pkt_type = PACKET_HOST;
409 }
410 } else {
411 rt = bridge_parent_rtable(nf_bridge->physindev);
412 if (!rt) {
413 kfree_skb(skb);
414 return 0;
415 }
416 skb_dst_set_noref(skb, &rt->dst);
417 }
418
419 skb->dev = nf_bridge->physindev;
420 nf_bridge_update_protocol(skb);
421 nf_bridge_push_encap_header(skb);
422 br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb, skb->dev, NULL,
423 br_handle_frame_finish);
424 return 0;
425}
426
427static struct net_device *brnf_get_logical_dev(struct sk_buff *skb, const struct net_device *dev)
428{
429 struct net_device *vlan, *br;
430
431 br = bridge_parent(dev);
432 if (brnf_pass_vlan_indev == 0 || !skb_vlan_tag_present(skb))
433 return br;
434
435 vlan = __vlan_find_dev_deep_rcu(br, skb->vlan_proto,
436 skb_vlan_tag_get(skb) & VLAN_VID_MASK);
437
438 return vlan ? vlan : br;
439}
440
441
442struct net_device *setup_pre_routing(struct sk_buff *skb)
443{
444 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
445
446 if (skb->pkt_type == PACKET_OTHERHOST) {
447 skb->pkt_type = PACKET_HOST;
448 nf_bridge->pkt_otherhost = true;
449 }
450
451 nf_bridge->in_prerouting = 1;
452 nf_bridge->physindev = skb->dev;
453 skb->dev = brnf_get_logical_dev(skb, skb->dev);
454
455 if (skb->protocol == htons(ETH_P_8021Q))
456 nf_bridge->orig_proto = BRNF_PROTO_8021Q;
457 else if (skb->protocol == htons(ETH_P_PPP_SES))
458 nf_bridge->orig_proto = BRNF_PROTO_PPPOE;
459
460
461 skb_orphan(skb);
462 return skb->dev;
463}
464
465
466
467
468
469
470
471static unsigned int br_nf_pre_routing(void *priv,
472 struct sk_buff *skb,
473 const struct nf_hook_state *state)
474{
475 struct nf_bridge_info *nf_bridge;
476 struct net_bridge_port *p;
477 struct net_bridge *br;
478 __u32 len = nf_bridge_encap_header_len(skb);
479
480 if (unlikely(!pskb_may_pull(skb, len)))
481 return NF_DROP;
482
483 p = br_port_get_rcu(state->in);
484 if (p == NULL)
485 return NF_DROP;
486 br = p->br;
487
488 if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb)) {
489 if (!brnf_call_ip6tables && !br->nf_call_ip6tables)
490 return NF_ACCEPT;
491
492 nf_bridge_pull_encap_header_rcsum(skb);
493 return br_nf_pre_routing_ipv6(priv, skb, state);
494 }
495
496 if (!brnf_call_iptables && !br->nf_call_iptables)
497 return NF_ACCEPT;
498
499 if (!IS_IP(skb) && !IS_VLAN_IP(skb) && !IS_PPPOE_IP(skb))
500 return NF_ACCEPT;
501
502 nf_bridge_pull_encap_header_rcsum(skb);
503
504 if (br_validate_ipv4(state->net, skb))
505 return NF_DROP;
506
507 nf_bridge_put(skb->nf_bridge);
508 if (!nf_bridge_alloc(skb))
509 return NF_DROP;
510 if (!setup_pre_routing(skb))
511 return NF_DROP;
512
513 nf_bridge = nf_bridge_info_get(skb);
514 nf_bridge->ipv4_daddr = ip_hdr(skb)->daddr;
515
516 skb->protocol = htons(ETH_P_IP);
517
518 NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
519 skb->dev, NULL,
520 br_nf_pre_routing_finish);
521
522 return NF_STOLEN;
523}
524
525
526
527static int br_nf_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
528{
529 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
530 struct net_device *in;
531
532 if (!IS_ARP(skb) && !IS_VLAN_ARP(skb)) {
533
534 if (skb->protocol == htons(ETH_P_IP))
535 nf_bridge->frag_max_size = IPCB(skb)->frag_max_size;
536
537 if (skb->protocol == htons(ETH_P_IPV6))
538 nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
539
540 in = nf_bridge->physindev;
541 if (nf_bridge->pkt_otherhost) {
542 skb->pkt_type = PACKET_OTHERHOST;
543 nf_bridge->pkt_otherhost = false;
544 }
545 nf_bridge_update_protocol(skb);
546 } else {
547 in = *((struct net_device **)(skb->cb));
548 }
549 nf_bridge_push_encap_header(skb);
550
551 br_nf_hook_thresh(NF_BR_FORWARD, net, sk, skb, in, skb->dev,
552 br_forward_finish);
553 return 0;
554}
555
556
557
558
559
560
561
562static unsigned int br_nf_forward_ip(void *priv,
563 struct sk_buff *skb,
564 const struct nf_hook_state *state)
565{
566 struct nf_bridge_info *nf_bridge;
567 struct net_device *parent;
568 u_int8_t pf;
569
570 if (!skb->nf_bridge)
571 return NF_ACCEPT;
572
573
574
575 if (!nf_bridge_unshare(skb))
576 return NF_DROP;
577
578 nf_bridge = nf_bridge_info_get(skb);
579 if (!nf_bridge)
580 return NF_DROP;
581
582 parent = bridge_parent(state->out);
583 if (!parent)
584 return NF_DROP;
585
586 if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
587 pf = NFPROTO_IPV4;
588 else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
589 pf = NFPROTO_IPV6;
590 else
591 return NF_ACCEPT;
592
593 nf_bridge_pull_encap_header(skb);
594
595 if (skb->pkt_type == PACKET_OTHERHOST) {
596 skb->pkt_type = PACKET_HOST;
597 nf_bridge->pkt_otherhost = true;
598 }
599
600 if (pf == NFPROTO_IPV4) {
601 if (br_validate_ipv4(state->net, skb))
602 return NF_DROP;
603 IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
604 }
605
606 if (pf == NFPROTO_IPV6) {
607 if (br_validate_ipv6(state->net, skb))
608 return NF_DROP;
609 IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
610 }
611
612 nf_bridge->physoutdev = skb->dev;
613 if (pf == NFPROTO_IPV4)
614 skb->protocol = htons(ETH_P_IP);
615 else
616 skb->protocol = htons(ETH_P_IPV6);
617
618 NF_HOOK(pf, NF_INET_FORWARD, state->net, NULL, skb,
619 brnf_get_logical_dev(skb, state->in),
620 parent, br_nf_forward_finish);
621
622 return NF_STOLEN;
623}
624
625static unsigned int br_nf_forward_arp(void *priv,
626 struct sk_buff *skb,
627 const struct nf_hook_state *state)
628{
629 struct net_bridge_port *p;
630 struct net_bridge *br;
631 struct net_device **d = (struct net_device **)(skb->cb);
632
633 p = br_port_get_rcu(state->out);
634 if (p == NULL)
635 return NF_ACCEPT;
636 br = p->br;
637
638 if (!brnf_call_arptables && !br->nf_call_arptables)
639 return NF_ACCEPT;
640
641 if (!IS_ARP(skb)) {
642 if (!IS_VLAN_ARP(skb))
643 return NF_ACCEPT;
644 nf_bridge_pull_encap_header(skb);
645 }
646
647 if (arp_hdr(skb)->ar_pln != 4) {
648 if (IS_VLAN_ARP(skb))
649 nf_bridge_push_encap_header(skb);
650 return NF_ACCEPT;
651 }
652 *d = state->in;
653 NF_HOOK(NFPROTO_ARP, NF_ARP_FORWARD, state->net, state->sk, skb,
654 state->in, state->out, br_nf_forward_finish);
655
656 return NF_STOLEN;
657}
658
659static int br_nf_push_frag_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
660{
661 struct brnf_frag_data *data;
662 int err;
663
664 data = this_cpu_ptr(&brnf_frag_data_storage);
665 err = skb_cow_head(skb, data->size);
666
667 if (err) {
668 kfree_skb(skb);
669 return 0;
670 }
671
672 if (data->vlan_tci) {
673 skb->vlan_tci = data->vlan_tci;
674 skb->vlan_proto = data->vlan_proto;
675 }
676
677 skb_copy_to_linear_data_offset(skb, -data->size, data->mac, data->size);
678 __skb_push(skb, data->encap_size);
679
680 nf_bridge_info_free(skb);
681 return br_dev_queue_push_xmit(net, sk, skb);
682}
683
684static int
685br_nf_ip_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
686 int (*output)(struct net *, struct sock *, struct sk_buff *))
687{
688 unsigned int mtu = ip_skb_dst_mtu(sk, skb);
689 struct iphdr *iph = ip_hdr(skb);
690
691 if (unlikely(((iph->frag_off & htons(IP_DF)) && !skb->ignore_df) ||
692 (IPCB(skb)->frag_max_size &&
693 IPCB(skb)->frag_max_size > mtu))) {
694 IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
695 kfree_skb(skb);
696 return -EMSGSIZE;
697 }
698
699 return ip_do_fragment(net, sk, skb, output);
700}
701
702static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb)
703{
704 if (skb->nf_bridge->orig_proto == BRNF_PROTO_PPPOE)
705 return PPPOE_SES_HLEN;
706 return 0;
707}
708
709static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
710{
711 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
712 unsigned int mtu, mtu_reserved;
713
714 mtu_reserved = nf_bridge_mtu_reduction(skb);
715 mtu = skb->dev->mtu;
716
717 if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
718 mtu = nf_bridge->frag_max_size;
719
720 if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) {
721 nf_bridge_info_free(skb);
722 return br_dev_queue_push_xmit(net, sk, skb);
723 }
724
725
726
727
728 if (IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) &&
729 skb->protocol == htons(ETH_P_IP)) {
730 struct brnf_frag_data *data;
731
732 if (br_validate_ipv4(net, skb))
733 goto drop;
734
735 IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
736
737 nf_bridge_update_protocol(skb);
738
739 data = this_cpu_ptr(&brnf_frag_data_storage);
740
741 data->vlan_tci = skb->vlan_tci;
742 data->vlan_proto = skb->vlan_proto;
743 data->encap_size = nf_bridge_encap_header_len(skb);
744 data->size = ETH_HLEN + data->encap_size;
745
746 skb_copy_from_linear_data_offset(skb, -data->size, data->mac,
747 data->size);
748
749 return br_nf_ip_fragment(net, sk, skb, br_nf_push_frag_xmit);
750 }
751 if (IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) &&
752 skb->protocol == htons(ETH_P_IPV6)) {
753 const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
754 struct brnf_frag_data *data;
755
756 if (br_validate_ipv6(net, skb))
757 goto drop;
758
759 IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
760
761 nf_bridge_update_protocol(skb);
762
763 data = this_cpu_ptr(&brnf_frag_data_storage);
764 data->encap_size = nf_bridge_encap_header_len(skb);
765 data->size = ETH_HLEN + data->encap_size;
766
767 skb_copy_from_linear_data_offset(skb, -data->size, data->mac,
768 data->size);
769
770 if (v6ops)
771 return v6ops->fragment(net, sk, skb, br_nf_push_frag_xmit);
772
773 kfree_skb(skb);
774 return -EMSGSIZE;
775 }
776 nf_bridge_info_free(skb);
777 return br_dev_queue_push_xmit(net, sk, skb);
778 drop:
779 kfree_skb(skb);
780 return 0;
781}
782
783
784static unsigned int br_nf_post_routing(void *priv,
785 struct sk_buff *skb,
786 const struct nf_hook_state *state)
787{
788 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
789 struct net_device *realoutdev = bridge_parent(skb->dev);
790 u_int8_t pf;
791
792
793
794
795
796
797 if (!nf_bridge || !nf_bridge->physoutdev)
798 return NF_ACCEPT;
799
800 if (!realoutdev)
801 return NF_DROP;
802
803 if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
804 pf = NFPROTO_IPV4;
805 else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
806 pf = NFPROTO_IPV6;
807 else
808 return NF_ACCEPT;
809
810
811
812 if (skb->pkt_type == PACKET_OTHERHOST) {
813 skb->pkt_type = PACKET_HOST;
814 nf_bridge->pkt_otherhost = true;
815 }
816
817 nf_bridge_pull_encap_header(skb);
818 if (pf == NFPROTO_IPV4)
819 skb->protocol = htons(ETH_P_IP);
820 else
821 skb->protocol = htons(ETH_P_IPV6);
822
823 NF_HOOK(pf, NF_INET_POST_ROUTING, state->net, state->sk, skb,
824 NULL, realoutdev,
825 br_nf_dev_queue_xmit);
826
827 return NF_STOLEN;
828}
829
830
831
832
833static unsigned int ip_sabotage_in(void *priv,
834 struct sk_buff *skb,
835 const struct nf_hook_state *state)
836{
837 if (skb->nf_bridge && !skb->nf_bridge->in_prerouting) {
838 state->okfn(state->net, state->sk, skb);
839 return NF_STOLEN;
840 }
841
842 return NF_ACCEPT;
843}
844
845
846
847
848
849
850
851
852
853
854static void br_nf_pre_routing_finish_bridge_slow(struct sk_buff *skb)
855{
856 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
857
858 skb_pull(skb, ETH_HLEN);
859 nf_bridge->bridged_dnat = 0;
860
861 BUILD_BUG_ON(sizeof(nf_bridge->neigh_header) != (ETH_HLEN - ETH_ALEN));
862
863 skb_copy_to_linear_data_offset(skb, -(ETH_HLEN - ETH_ALEN),
864 nf_bridge->neigh_header,
865 ETH_HLEN - ETH_ALEN);
866 skb->dev = nf_bridge->physindev;
867
868 nf_bridge->physoutdev = NULL;
869 br_handle_frame_finish(dev_net(skb->dev), NULL, skb);
870}
871
872static int br_nf_dev_xmit(struct sk_buff *skb)
873{
874 if (skb->nf_bridge && skb->nf_bridge->bridged_dnat) {
875 br_nf_pre_routing_finish_bridge_slow(skb);
876 return 1;
877 }
878 return 0;
879}
880
881static const struct nf_br_ops br_ops = {
882 .br_dev_xmit_hook = br_nf_dev_xmit,
883};
884
885void br_netfilter_enable(void)
886{
887}
888EXPORT_SYMBOL_GPL(br_netfilter_enable);
889
890
891
892static const struct nf_hook_ops br_nf_ops[] = {
893 {
894 .hook = br_nf_pre_routing,
895 .pf = NFPROTO_BRIDGE,
896 .hooknum = NF_BR_PRE_ROUTING,
897 .priority = NF_BR_PRI_BRNF,
898 },
899 {
900 .hook = br_nf_forward_ip,
901 .pf = NFPROTO_BRIDGE,
902 .hooknum = NF_BR_FORWARD,
903 .priority = NF_BR_PRI_BRNF - 1,
904 },
905 {
906 .hook = br_nf_forward_arp,
907 .pf = NFPROTO_BRIDGE,
908 .hooknum = NF_BR_FORWARD,
909 .priority = NF_BR_PRI_BRNF,
910 },
911 {
912 .hook = br_nf_post_routing,
913 .pf = NFPROTO_BRIDGE,
914 .hooknum = NF_BR_POST_ROUTING,
915 .priority = NF_BR_PRI_LAST,
916 },
917 {
918 .hook = ip_sabotage_in,
919 .pf = NFPROTO_IPV4,
920 .hooknum = NF_INET_PRE_ROUTING,
921 .priority = NF_IP_PRI_FIRST,
922 },
923 {
924 .hook = ip_sabotage_in,
925 .pf = NFPROTO_IPV6,
926 .hooknum = NF_INET_PRE_ROUTING,
927 .priority = NF_IP6_PRI_FIRST,
928 },
929};
930
931static int brnf_device_event(struct notifier_block *unused, unsigned long event,
932 void *ptr)
933{
934 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
935 struct brnf_net *brnet;
936 struct net *net;
937 int ret;
938
939 if (event != NETDEV_REGISTER || !(dev->priv_flags & IFF_EBRIDGE))
940 return NOTIFY_DONE;
941
942 ASSERT_RTNL();
943
944 net = dev_net(dev);
945 brnet = net_generic(net, brnf_net_id);
946 if (brnet->enabled)
947 return NOTIFY_OK;
948
949 ret = nf_register_net_hooks(net, br_nf_ops, ARRAY_SIZE(br_nf_ops));
950 if (ret)
951 return NOTIFY_BAD;
952
953 brnet->enabled = true;
954 return NOTIFY_OK;
955}
956
957static void __net_exit brnf_exit_net(struct net *net)
958{
959 struct brnf_net *brnet = net_generic(net, brnf_net_id);
960
961 if (!brnet->enabled)
962 return;
963
964 nf_unregister_net_hooks(net, br_nf_ops, ARRAY_SIZE(br_nf_ops));
965 brnet->enabled = false;
966}
967
968static struct pernet_operations brnf_net_ops __read_mostly = {
969 .exit = brnf_exit_net,
970 .id = &brnf_net_id,
971 .size = sizeof(struct brnf_net),
972};
973
974static struct notifier_block brnf_notifier __read_mostly = {
975 .notifier_call = brnf_device_event,
976};
977
978
979
980
981
982
983int br_nf_hook_thresh(unsigned int hook, struct net *net,
984 struct sock *sk, struct sk_buff *skb,
985 struct net_device *indev,
986 struct net_device *outdev,
987 int (*okfn)(struct net *, struct sock *,
988 struct sk_buff *))
989{
990 const struct nf_hook_entries *e;
991 struct nf_hook_state state;
992 struct nf_hook_ops **ops;
993 unsigned int i;
994 int ret;
995
996 e = rcu_dereference(net->nf.hooks_bridge[hook]);
997 if (!e)
998 return okfn(net, sk, skb);
999
1000 ops = nf_hook_entries_get_hook_ops(e);
1001 for (i = 0; i < e->num_hook_entries &&
1002 ops[i]->priority <= NF_BR_PRI_BRNF; i++)
1003 ;
1004
1005 nf_hook_state_init(&state, hook, NFPROTO_BRIDGE, indev, outdev,
1006 sk, net, okfn);
1007
1008 ret = nf_hook_slow(skb, &state, e, i);
1009 if (ret == 1)
1010 ret = okfn(net, sk, skb);
1011
1012 return ret;
1013}
1014
1015#ifdef CONFIG_SYSCTL
1016static
1017int brnf_sysctl_call_tables(struct ctl_table *ctl, int write,
1018 void __user *buffer, size_t *lenp, loff_t *ppos)
1019{
1020 int ret;
1021
1022 ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
1023
1024 if (write && *(int *)(ctl->data))
1025 *(int *)(ctl->data) = 1;
1026 return ret;
1027}
1028
1029static struct ctl_table brnf_table[] = {
1030 {
1031 .procname = "bridge-nf-call-arptables",
1032 .data = &brnf_call_arptables,
1033 .maxlen = sizeof(int),
1034 .mode = 0644,
1035 .proc_handler = brnf_sysctl_call_tables,
1036 },
1037 {
1038 .procname = "bridge-nf-call-iptables",
1039 .data = &brnf_call_iptables,
1040 .maxlen = sizeof(int),
1041 .mode = 0644,
1042 .proc_handler = brnf_sysctl_call_tables,
1043 },
1044 {
1045 .procname = "bridge-nf-call-ip6tables",
1046 .data = &brnf_call_ip6tables,
1047 .maxlen = sizeof(int),
1048 .mode = 0644,
1049 .proc_handler = brnf_sysctl_call_tables,
1050 },
1051 {
1052 .procname = "bridge-nf-filter-vlan-tagged",
1053 .data = &brnf_filter_vlan_tagged,
1054 .maxlen = sizeof(int),
1055 .mode = 0644,
1056 .proc_handler = brnf_sysctl_call_tables,
1057 },
1058 {
1059 .procname = "bridge-nf-filter-pppoe-tagged",
1060 .data = &brnf_filter_pppoe_tagged,
1061 .maxlen = sizeof(int),
1062 .mode = 0644,
1063 .proc_handler = brnf_sysctl_call_tables,
1064 },
1065 {
1066 .procname = "bridge-nf-pass-vlan-input-dev",
1067 .data = &brnf_pass_vlan_indev,
1068 .maxlen = sizeof(int),
1069 .mode = 0644,
1070 .proc_handler = brnf_sysctl_call_tables,
1071 },
1072 { }
1073};
1074#endif
1075
1076static int __init br_netfilter_init(void)
1077{
1078 int ret;
1079
1080 ret = register_pernet_subsys(&brnf_net_ops);
1081 if (ret < 0)
1082 return ret;
1083
1084 ret = register_netdevice_notifier(&brnf_notifier);
1085 if (ret < 0) {
1086 unregister_pernet_subsys(&brnf_net_ops);
1087 return ret;
1088 }
1089
1090#ifdef CONFIG_SYSCTL
1091 brnf_sysctl_header = register_net_sysctl(&init_net, "net/bridge", brnf_table);
1092 if (brnf_sysctl_header == NULL) {
1093 printk(KERN_WARNING
1094 "br_netfilter: can't register to sysctl.\n");
1095 unregister_netdevice_notifier(&brnf_notifier);
1096 unregister_pernet_subsys(&brnf_net_ops);
1097 return -ENOMEM;
1098 }
1099#endif
1100 RCU_INIT_POINTER(nf_br_ops, &br_ops);
1101 printk(KERN_NOTICE "Bridge firewalling registered\n");
1102 return 0;
1103}
1104
1105static void __exit br_netfilter_fini(void)
1106{
1107 RCU_INIT_POINTER(nf_br_ops, NULL);
1108 unregister_netdevice_notifier(&brnf_notifier);
1109 unregister_pernet_subsys(&brnf_net_ops);
1110#ifdef CONFIG_SYSCTL
1111 unregister_net_sysctl_table(brnf_sysctl_header);
1112#endif
1113}
1114
1115module_init(br_netfilter_init);
1116module_exit(br_netfilter_fini);
1117
1118MODULE_LICENSE("GPL");
1119MODULE_AUTHOR("Lennert Buytenhek <buytenh@gnu.org>");
1120MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
1121MODULE_DESCRIPTION("Linux ethernet netfilter firewall bridge");
1122