1
2
3
4
5
6
7
8
9
10
11
12
13#include <linux/module.h>
14#include <linux/kernel.h>
15#include <linux/slab.h>
16#include <linux/ip.h>
17#include <linux/netdevice.h>
18#include <linux/skbuff.h>
19#include <linux/if_arp.h>
20#include <linux/if_ether.h>
21#include <linux/if_vlan.h>
22#include <linux/if_pppox.h>
23#include <linux/ppp_defs.h>
24#include <linux/netfilter_bridge.h>
25#include <uapi/linux/netfilter_bridge.h>
26#include <linux/netfilter_ipv4.h>
27#include <linux/netfilter_ipv6.h>
28#include <linux/netfilter_arp.h>
29#include <linux/in_route.h>
30#include <linux/rculist.h>
31#include <linux/inetdevice.h>
32
33#include <net/ip.h>
34#include <net/ipv6.h>
35#include <net/addrconf.h>
36#include <net/route.h>
37#include <net/netfilter/br_netfilter.h>
38#include <net/netns/generic.h>
39
40#include <linux/uaccess.h>
41#include "br_private.h"
42#ifdef CONFIG_SYSCTL
43#include <linux/sysctl.h>
44#endif
45
46static unsigned int brnf_net_id __read_mostly;
47
48struct brnf_net {
49 bool enabled;
50};
51
52#ifdef CONFIG_SYSCTL
53static struct ctl_table_header *brnf_sysctl_header;
54static int brnf_call_iptables __read_mostly = 1;
55static int brnf_call_ip6tables __read_mostly = 1;
56static int brnf_call_arptables __read_mostly = 1;
57static int brnf_filter_vlan_tagged __read_mostly;
58static int brnf_filter_pppoe_tagged __read_mostly;
59static int brnf_pass_vlan_indev __read_mostly;
60#else
61#define brnf_call_iptables 1
62#define brnf_call_ip6tables 1
63#define brnf_call_arptables 1
64#define brnf_filter_vlan_tagged 0
65#define brnf_filter_pppoe_tagged 0
66#define brnf_pass_vlan_indev 0
67#endif
68
69#define IS_IP(skb) \
70 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_IP))
71
72#define IS_IPV6(skb) \
73 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_IPV6))
74
75#define IS_ARP(skb) \
76 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_ARP))
77
78static inline __be16 vlan_proto(const struct sk_buff *skb)
79{
80 if (skb_vlan_tag_present(skb))
81 return skb->protocol;
82 else if (skb->protocol == htons(ETH_P_8021Q))
83 return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
84 else
85 return 0;
86}
87
88#define IS_VLAN_IP(skb) \
89 (vlan_proto(skb) == htons(ETH_P_IP) && \
90 brnf_filter_vlan_tagged)
91
92#define IS_VLAN_IPV6(skb) \
93 (vlan_proto(skb) == htons(ETH_P_IPV6) && \
94 brnf_filter_vlan_tagged)
95
96#define IS_VLAN_ARP(skb) \
97 (vlan_proto(skb) == htons(ETH_P_ARP) && \
98 brnf_filter_vlan_tagged)
99
100static inline __be16 pppoe_proto(const struct sk_buff *skb)
101{
102 return *((__be16 *)(skb_mac_header(skb) + ETH_HLEN +
103 sizeof(struct pppoe_hdr)));
104}
105
106#define IS_PPPOE_IP(skb) \
107 (skb->protocol == htons(ETH_P_PPP_SES) && \
108 pppoe_proto(skb) == htons(PPP_IP) && \
109 brnf_filter_pppoe_tagged)
110
111#define IS_PPPOE_IPV6(skb) \
112 (skb->protocol == htons(ETH_P_PPP_SES) && \
113 pppoe_proto(skb) == htons(PPP_IPV6) && \
114 brnf_filter_pppoe_tagged)
115
116
117#define NF_BRIDGE_MAX_MAC_HEADER_LENGTH (PPPOE_SES_HLEN + ETH_HLEN)
118
119struct brnf_frag_data {
120 char mac[NF_BRIDGE_MAX_MAC_HEADER_LENGTH];
121 u8 encap_size;
122 u8 size;
123 u16 vlan_tci;
124 __be16 vlan_proto;
125};
126
127static DEFINE_PER_CPU(struct brnf_frag_data, brnf_frag_data_storage);
128
129static void nf_bridge_info_free(struct sk_buff *skb)
130{
131 skb_ext_del(skb, SKB_EXT_BRIDGE_NF);
132}
133
134static inline struct net_device *bridge_parent(const struct net_device *dev)
135{
136 struct net_bridge_port *port;
137
138 port = br_port_get_rcu(dev);
139 return port ? port->br->dev : NULL;
140}
141
142static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
143{
144 return skb_ext_add(skb, SKB_EXT_BRIDGE_NF);
145}
146
147unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb)
148{
149 switch (skb->protocol) {
150 case __cpu_to_be16(ETH_P_8021Q):
151 return VLAN_HLEN;
152 case __cpu_to_be16(ETH_P_PPP_SES):
153 return PPPOE_SES_HLEN;
154 default:
155 return 0;
156 }
157}
158
159static inline void nf_bridge_pull_encap_header(struct sk_buff *skb)
160{
161 unsigned int len = nf_bridge_encap_header_len(skb);
162
163 skb_pull(skb, len);
164 skb->network_header += len;
165}
166
167static inline void nf_bridge_pull_encap_header_rcsum(struct sk_buff *skb)
168{
169 unsigned int len = nf_bridge_encap_header_len(skb);
170
171 skb_pull_rcsum(skb, len);
172 skb->network_header += len;
173}
174
175
176
177
178
179
180static int br_validate_ipv4(struct net *net, struct sk_buff *skb)
181{
182 const struct iphdr *iph;
183 u32 len;
184
185 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
186 goto inhdr_error;
187
188 iph = ip_hdr(skb);
189
190
191 if (iph->ihl < 5 || iph->version != 4)
192 goto inhdr_error;
193
194 if (!pskb_may_pull(skb, iph->ihl*4))
195 goto inhdr_error;
196
197 iph = ip_hdr(skb);
198 if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
199 goto csum_error;
200
201 len = ntohs(iph->tot_len);
202 if (skb->len < len) {
203 __IP_INC_STATS(net, IPSTATS_MIB_INTRUNCATEDPKTS);
204 goto drop;
205 } else if (len < (iph->ihl*4))
206 goto inhdr_error;
207
208 if (pskb_trim_rcsum(skb, len)) {
209 __IP_INC_STATS(net, IPSTATS_MIB_INDISCARDS);
210 goto drop;
211 }
212
213 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
214
215
216
217
218
219 return 0;
220
221csum_error:
222 __IP_INC_STATS(net, IPSTATS_MIB_CSUMERRORS);
223inhdr_error:
224 __IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
225drop:
226 return -1;
227}
228
229void nf_bridge_update_protocol(struct sk_buff *skb)
230{
231 const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
232
233 switch (nf_bridge->orig_proto) {
234 case BRNF_PROTO_8021Q:
235 skb->protocol = htons(ETH_P_8021Q);
236 break;
237 case BRNF_PROTO_PPPOE:
238 skb->protocol = htons(ETH_P_PPP_SES);
239 break;
240 case BRNF_PROTO_UNCHANGED:
241 break;
242 }
243}
244
245
246
247
248
249
250int br_nf_pre_routing_finish_bridge(struct net *net, struct sock *sk, struct sk_buff *skb)
251{
252 struct neighbour *neigh;
253 struct dst_entry *dst;
254
255 skb->dev = bridge_parent(skb->dev);
256 if (!skb->dev)
257 goto free_skb;
258 dst = skb_dst(skb);
259 neigh = dst_neigh_lookup_skb(dst, skb);
260 if (neigh) {
261 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
262 int ret;
263
264 if ((neigh->nud_state & NUD_CONNECTED) && neigh->hh.hh_len) {
265 neigh_hh_bridge(&neigh->hh, skb);
266 skb->dev = nf_bridge->physindev;
267 ret = br_handle_frame_finish(net, sk, skb);
268 } else {
269
270
271
272
273 skb_copy_from_linear_data_offset(skb,
274 -(ETH_HLEN-ETH_ALEN),
275 nf_bridge->neigh_header,
276 ETH_HLEN-ETH_ALEN);
277
278 nf_bridge->bridged_dnat = 1;
279
280 ret = neigh->output(neigh, skb);
281 }
282 neigh_release(neigh);
283 return ret;
284 }
285free_skb:
286 kfree_skb(skb);
287 return 0;
288}
289
290static inline bool
291br_nf_ipv4_daddr_was_changed(const struct sk_buff *skb,
292 const struct nf_bridge_info *nf_bridge)
293{
294 return ip_hdr(skb)->daddr != nf_bridge->ipv4_daddr;
295}
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
337{
338 struct net_device *dev = skb->dev;
339 struct iphdr *iph = ip_hdr(skb);
340 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
341 struct rtable *rt;
342 int err;
343
344 nf_bridge->frag_max_size = IPCB(skb)->frag_max_size;
345
346 if (nf_bridge->pkt_otherhost) {
347 skb->pkt_type = PACKET_OTHERHOST;
348 nf_bridge->pkt_otherhost = false;
349 }
350 nf_bridge->in_prerouting = 0;
351 if (br_nf_ipv4_daddr_was_changed(skb, nf_bridge)) {
352 if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
353 struct in_device *in_dev = __in_dev_get_rcu(dev);
354
355
356
357
358
359
360
361
362 if (err != -EHOSTUNREACH || !in_dev || IN_DEV_FORWARD(in_dev))
363 goto free_skb;
364
365 rt = ip_route_output(net, iph->daddr, 0,
366 RT_TOS(iph->tos), 0);
367 if (!IS_ERR(rt)) {
368
369
370 if (rt->dst.dev == dev) {
371 skb_dst_set(skb, &rt->dst);
372 goto bridged_dnat;
373 }
374 ip_rt_put(rt);
375 }
376free_skb:
377 kfree_skb(skb);
378 return 0;
379 } else {
380 if (skb_dst(skb)->dev == dev) {
381bridged_dnat:
382 skb->dev = nf_bridge->physindev;
383 nf_bridge_update_protocol(skb);
384 nf_bridge_push_encap_header(skb);
385 br_nf_hook_thresh(NF_BR_PRE_ROUTING,
386 net, sk, skb, skb->dev,
387 NULL,
388 br_nf_pre_routing_finish_bridge);
389 return 0;
390 }
391 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
392 skb->pkt_type = PACKET_HOST;
393 }
394 } else {
395 rt = bridge_parent_rtable(nf_bridge->physindev);
396 if (!rt) {
397 kfree_skb(skb);
398 return 0;
399 }
400 skb_dst_set_noref(skb, &rt->dst);
401 }
402
403 skb->dev = nf_bridge->physindev;
404 nf_bridge_update_protocol(skb);
405 nf_bridge_push_encap_header(skb);
406 br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb, skb->dev, NULL,
407 br_handle_frame_finish);
408 return 0;
409}
410
411static struct net_device *brnf_get_logical_dev(struct sk_buff *skb, const struct net_device *dev)
412{
413 struct net_device *vlan, *br;
414
415 br = bridge_parent(dev);
416 if (brnf_pass_vlan_indev == 0 || !skb_vlan_tag_present(skb))
417 return br;
418
419 vlan = __vlan_find_dev_deep_rcu(br, skb->vlan_proto,
420 skb_vlan_tag_get(skb) & VLAN_VID_MASK);
421
422 return vlan ? vlan : br;
423}
424
425
426struct net_device *setup_pre_routing(struct sk_buff *skb)
427{
428 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
429
430 if (skb->pkt_type == PACKET_OTHERHOST) {
431 skb->pkt_type = PACKET_HOST;
432 nf_bridge->pkt_otherhost = true;
433 }
434
435 nf_bridge->in_prerouting = 1;
436 nf_bridge->physindev = skb->dev;
437 skb->dev = brnf_get_logical_dev(skb, skb->dev);
438
439 if (skb->protocol == htons(ETH_P_8021Q))
440 nf_bridge->orig_proto = BRNF_PROTO_8021Q;
441 else if (skb->protocol == htons(ETH_P_PPP_SES))
442 nf_bridge->orig_proto = BRNF_PROTO_PPPOE;
443
444
445 skb_orphan(skb);
446 return skb->dev;
447}
448
449
450
451
452
453
454
455static unsigned int br_nf_pre_routing(void *priv,
456 struct sk_buff *skb,
457 const struct nf_hook_state *state)
458{
459 struct nf_bridge_info *nf_bridge;
460 struct net_bridge_port *p;
461 struct net_bridge *br;
462 __u32 len = nf_bridge_encap_header_len(skb);
463
464 if (unlikely(!pskb_may_pull(skb, len)))
465 return NF_DROP;
466
467 p = br_port_get_rcu(state->in);
468 if (p == NULL)
469 return NF_DROP;
470 br = p->br;
471
472 if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb)) {
473 if (!brnf_call_ip6tables &&
474 !br_opt_get(br, BROPT_NF_CALL_IP6TABLES))
475 return NF_ACCEPT;
476
477 nf_bridge_pull_encap_header_rcsum(skb);
478 return br_nf_pre_routing_ipv6(priv, skb, state);
479 }
480
481 if (!brnf_call_iptables && !br_opt_get(br, BROPT_NF_CALL_IPTABLES))
482 return NF_ACCEPT;
483
484 if (!IS_IP(skb) && !IS_VLAN_IP(skb) && !IS_PPPOE_IP(skb))
485 return NF_ACCEPT;
486
487 nf_bridge_pull_encap_header_rcsum(skb);
488
489 if (br_validate_ipv4(state->net, skb))
490 return NF_DROP;
491
492 if (!nf_bridge_alloc(skb))
493 return NF_DROP;
494 if (!setup_pre_routing(skb))
495 return NF_DROP;
496
497 nf_bridge = nf_bridge_info_get(skb);
498 nf_bridge->ipv4_daddr = ip_hdr(skb)->daddr;
499
500 skb->protocol = htons(ETH_P_IP);
501 skb->transport_header = skb->network_header + ip_hdr(skb)->ihl * 4;
502
503 NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
504 skb->dev, NULL,
505 br_nf_pre_routing_finish);
506
507 return NF_STOLEN;
508}
509
510
511
512static int br_nf_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
513{
514 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
515 struct net_device *in;
516
517 if (!IS_ARP(skb) && !IS_VLAN_ARP(skb)) {
518
519 if (skb->protocol == htons(ETH_P_IP))
520 nf_bridge->frag_max_size = IPCB(skb)->frag_max_size;
521
522 if (skb->protocol == htons(ETH_P_IPV6))
523 nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
524
525 in = nf_bridge->physindev;
526 if (nf_bridge->pkt_otherhost) {
527 skb->pkt_type = PACKET_OTHERHOST;
528 nf_bridge->pkt_otherhost = false;
529 }
530 nf_bridge_update_protocol(skb);
531 } else {
532 in = *((struct net_device **)(skb->cb));
533 }
534 nf_bridge_push_encap_header(skb);
535
536 br_nf_hook_thresh(NF_BR_FORWARD, net, sk, skb, in, skb->dev,
537 br_forward_finish);
538 return 0;
539}
540
541
542
543
544
545
546
547static unsigned int br_nf_forward_ip(void *priv,
548 struct sk_buff *skb,
549 const struct nf_hook_state *state)
550{
551 struct nf_bridge_info *nf_bridge;
552 struct net_device *parent;
553 u_int8_t pf;
554
555 nf_bridge = nf_bridge_info_get(skb);
556 if (!nf_bridge)
557 return NF_ACCEPT;
558
559
560
561 if (!nf_bridge_unshare(skb))
562 return NF_DROP;
563
564 nf_bridge = nf_bridge_info_get(skb);
565 if (!nf_bridge)
566 return NF_DROP;
567
568 parent = bridge_parent(state->out);
569 if (!parent)
570 return NF_DROP;
571
572 if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
573 pf = NFPROTO_IPV4;
574 else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
575 pf = NFPROTO_IPV6;
576 else
577 return NF_ACCEPT;
578
579 nf_bridge_pull_encap_header(skb);
580
581 if (skb->pkt_type == PACKET_OTHERHOST) {
582 skb->pkt_type = PACKET_HOST;
583 nf_bridge->pkt_otherhost = true;
584 }
585
586 if (pf == NFPROTO_IPV4) {
587 if (br_validate_ipv4(state->net, skb))
588 return NF_DROP;
589 IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
590 }
591
592 if (pf == NFPROTO_IPV6) {
593 if (br_validate_ipv6(state->net, skb))
594 return NF_DROP;
595 IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
596 }
597
598 nf_bridge->physoutdev = skb->dev;
599 if (pf == NFPROTO_IPV4)
600 skb->protocol = htons(ETH_P_IP);
601 else
602 skb->protocol = htons(ETH_P_IPV6);
603
604 NF_HOOK(pf, NF_INET_FORWARD, state->net, NULL, skb,
605 brnf_get_logical_dev(skb, state->in),
606 parent, br_nf_forward_finish);
607
608 return NF_STOLEN;
609}
610
611static unsigned int br_nf_forward_arp(void *priv,
612 struct sk_buff *skb,
613 const struct nf_hook_state *state)
614{
615 struct net_bridge_port *p;
616 struct net_bridge *br;
617 struct net_device **d = (struct net_device **)(skb->cb);
618
619 p = br_port_get_rcu(state->out);
620 if (p == NULL)
621 return NF_ACCEPT;
622 br = p->br;
623
624 if (!brnf_call_arptables && !br_opt_get(br, BROPT_NF_CALL_ARPTABLES))
625 return NF_ACCEPT;
626
627 if (!IS_ARP(skb)) {
628 if (!IS_VLAN_ARP(skb))
629 return NF_ACCEPT;
630 nf_bridge_pull_encap_header(skb);
631 }
632
633 if (arp_hdr(skb)->ar_pln != 4) {
634 if (IS_VLAN_ARP(skb))
635 nf_bridge_push_encap_header(skb);
636 return NF_ACCEPT;
637 }
638 *d = state->in;
639 NF_HOOK(NFPROTO_ARP, NF_ARP_FORWARD, state->net, state->sk, skb,
640 state->in, state->out, br_nf_forward_finish);
641
642 return NF_STOLEN;
643}
644
645static int br_nf_push_frag_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
646{
647 struct brnf_frag_data *data;
648 int err;
649
650 data = this_cpu_ptr(&brnf_frag_data_storage);
651 err = skb_cow_head(skb, data->size);
652
653 if (err) {
654 kfree_skb(skb);
655 return 0;
656 }
657
658 if (data->vlan_proto)
659 __vlan_hwaccel_put_tag(skb, data->vlan_proto, data->vlan_tci);
660
661 skb_copy_to_linear_data_offset(skb, -data->size, data->mac, data->size);
662 __skb_push(skb, data->encap_size);
663
664 nf_bridge_info_free(skb);
665 return br_dev_queue_push_xmit(net, sk, skb);
666}
667
668static int
669br_nf_ip_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
670 int (*output)(struct net *, struct sock *, struct sk_buff *))
671{
672 unsigned int mtu = ip_skb_dst_mtu(sk, skb);
673 struct iphdr *iph = ip_hdr(skb);
674
675 if (unlikely(((iph->frag_off & htons(IP_DF)) && !skb->ignore_df) ||
676 (IPCB(skb)->frag_max_size &&
677 IPCB(skb)->frag_max_size > mtu))) {
678 IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
679 kfree_skb(skb);
680 return -EMSGSIZE;
681 }
682
683 return ip_do_fragment(net, sk, skb, output);
684}
685
686static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb)
687{
688 const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
689
690 if (nf_bridge->orig_proto == BRNF_PROTO_PPPOE)
691 return PPPOE_SES_HLEN;
692 return 0;
693}
694
695static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
696{
697 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
698 unsigned int mtu, mtu_reserved;
699
700 mtu_reserved = nf_bridge_mtu_reduction(skb);
701 mtu = skb->dev->mtu;
702
703 if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
704 mtu = nf_bridge->frag_max_size;
705
706 if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) {
707 nf_bridge_info_free(skb);
708 return br_dev_queue_push_xmit(net, sk, skb);
709 }
710
711
712
713
714 if (IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) &&
715 skb->protocol == htons(ETH_P_IP)) {
716 struct brnf_frag_data *data;
717
718 if (br_validate_ipv4(net, skb))
719 goto drop;
720
721 IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
722
723 nf_bridge_update_protocol(skb);
724
725 data = this_cpu_ptr(&brnf_frag_data_storage);
726
727 if (skb_vlan_tag_present(skb)) {
728 data->vlan_tci = skb->vlan_tci;
729 data->vlan_proto = skb->vlan_proto;
730 } else {
731 data->vlan_proto = 0;
732 }
733
734 data->encap_size = nf_bridge_encap_header_len(skb);
735 data->size = ETH_HLEN + data->encap_size;
736
737 skb_copy_from_linear_data_offset(skb, -data->size, data->mac,
738 data->size);
739
740 return br_nf_ip_fragment(net, sk, skb, br_nf_push_frag_xmit);
741 }
742 if (IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) &&
743 skb->protocol == htons(ETH_P_IPV6)) {
744 const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
745 struct brnf_frag_data *data;
746
747 if (br_validate_ipv6(net, skb))
748 goto drop;
749
750 IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
751
752 nf_bridge_update_protocol(skb);
753
754 data = this_cpu_ptr(&brnf_frag_data_storage);
755 data->encap_size = nf_bridge_encap_header_len(skb);
756 data->size = ETH_HLEN + data->encap_size;
757
758 skb_copy_from_linear_data_offset(skb, -data->size, data->mac,
759 data->size);
760
761 if (v6ops)
762 return v6ops->fragment(net, sk, skb, br_nf_push_frag_xmit);
763
764 kfree_skb(skb);
765 return -EMSGSIZE;
766 }
767 nf_bridge_info_free(skb);
768 return br_dev_queue_push_xmit(net, sk, skb);
769 drop:
770 kfree_skb(skb);
771 return 0;
772}
773
774
775static unsigned int br_nf_post_routing(void *priv,
776 struct sk_buff *skb,
777 const struct nf_hook_state *state)
778{
779 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
780 struct net_device *realoutdev = bridge_parent(skb->dev);
781 u_int8_t pf;
782
783
784
785
786
787
788 if (!nf_bridge || !nf_bridge->physoutdev)
789 return NF_ACCEPT;
790
791 if (!realoutdev)
792 return NF_DROP;
793
794 if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
795 pf = NFPROTO_IPV4;
796 else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
797 pf = NFPROTO_IPV6;
798 else
799 return NF_ACCEPT;
800
801
802
803 if (skb->pkt_type == PACKET_OTHERHOST) {
804 skb->pkt_type = PACKET_HOST;
805 nf_bridge->pkt_otherhost = true;
806 }
807
808 nf_bridge_pull_encap_header(skb);
809 if (pf == NFPROTO_IPV4)
810 skb->protocol = htons(ETH_P_IP);
811 else
812 skb->protocol = htons(ETH_P_IPV6);
813
814 NF_HOOK(pf, NF_INET_POST_ROUTING, state->net, state->sk, skb,
815 NULL, realoutdev,
816 br_nf_dev_queue_xmit);
817
818 return NF_STOLEN;
819}
820
821
822
823
824static unsigned int ip_sabotage_in(void *priv,
825 struct sk_buff *skb,
826 const struct nf_hook_state *state)
827{
828 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
829
830 if (nf_bridge && !nf_bridge->in_prerouting &&
831 !netif_is_l3_master(skb->dev) &&
832 !netif_is_l3_slave(skb->dev)) {
833 state->okfn(state->net, state->sk, skb);
834 return NF_STOLEN;
835 }
836
837 return NF_ACCEPT;
838}
839
840
841
842
843
844
845
846
847
848
849static void br_nf_pre_routing_finish_bridge_slow(struct sk_buff *skb)
850{
851 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
852
853 skb_pull(skb, ETH_HLEN);
854 nf_bridge->bridged_dnat = 0;
855
856 BUILD_BUG_ON(sizeof(nf_bridge->neigh_header) != (ETH_HLEN - ETH_ALEN));
857
858 skb_copy_to_linear_data_offset(skb, -(ETH_HLEN - ETH_ALEN),
859 nf_bridge->neigh_header,
860 ETH_HLEN - ETH_ALEN);
861 skb->dev = nf_bridge->physindev;
862
863 nf_bridge->physoutdev = NULL;
864 br_handle_frame_finish(dev_net(skb->dev), NULL, skb);
865}
866
867static int br_nf_dev_xmit(struct sk_buff *skb)
868{
869 const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
870
871 if (nf_bridge && nf_bridge->bridged_dnat) {
872 br_nf_pre_routing_finish_bridge_slow(skb);
873 return 1;
874 }
875 return 0;
876}
877
878static const struct nf_br_ops br_ops = {
879 .br_dev_xmit_hook = br_nf_dev_xmit,
880};
881
882
883
884static const struct nf_hook_ops br_nf_ops[] = {
885 {
886 .hook = br_nf_pre_routing,
887 .pf = NFPROTO_BRIDGE,
888 .hooknum = NF_BR_PRE_ROUTING,
889 .priority = NF_BR_PRI_BRNF,
890 },
891 {
892 .hook = br_nf_forward_ip,
893 .pf = NFPROTO_BRIDGE,
894 .hooknum = NF_BR_FORWARD,
895 .priority = NF_BR_PRI_BRNF - 1,
896 },
897 {
898 .hook = br_nf_forward_arp,
899 .pf = NFPROTO_BRIDGE,
900 .hooknum = NF_BR_FORWARD,
901 .priority = NF_BR_PRI_BRNF,
902 },
903 {
904 .hook = br_nf_post_routing,
905 .pf = NFPROTO_BRIDGE,
906 .hooknum = NF_BR_POST_ROUTING,
907 .priority = NF_BR_PRI_LAST,
908 },
909 {
910 .hook = ip_sabotage_in,
911 .pf = NFPROTO_IPV4,
912 .hooknum = NF_INET_PRE_ROUTING,
913 .priority = NF_IP_PRI_FIRST,
914 },
915 {
916 .hook = ip_sabotage_in,
917 .pf = NFPROTO_IPV6,
918 .hooknum = NF_INET_PRE_ROUTING,
919 .priority = NF_IP6_PRI_FIRST,
920 },
921};
922
923static int brnf_device_event(struct notifier_block *unused, unsigned long event,
924 void *ptr)
925{
926 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
927 struct brnf_net *brnet;
928 struct net *net;
929 int ret;
930
931 if (event != NETDEV_REGISTER || !(dev->priv_flags & IFF_EBRIDGE))
932 return NOTIFY_DONE;
933
934 ASSERT_RTNL();
935
936 net = dev_net(dev);
937 brnet = net_generic(net, brnf_net_id);
938 if (brnet->enabled)
939 return NOTIFY_OK;
940
941 ret = nf_register_net_hooks(net, br_nf_ops, ARRAY_SIZE(br_nf_ops));
942 if (ret)
943 return NOTIFY_BAD;
944
945 brnet->enabled = true;
946 return NOTIFY_OK;
947}
948
949static void __net_exit brnf_exit_net(struct net *net)
950{
951 struct brnf_net *brnet = net_generic(net, brnf_net_id);
952
953 if (!brnet->enabled)
954 return;
955
956 nf_unregister_net_hooks(net, br_nf_ops, ARRAY_SIZE(br_nf_ops));
957 brnet->enabled = false;
958}
959
960static struct pernet_operations brnf_net_ops __read_mostly = {
961 .exit = brnf_exit_net,
962 .id = &brnf_net_id,
963 .size = sizeof(struct brnf_net),
964};
965
966static struct notifier_block brnf_notifier __read_mostly = {
967 .notifier_call = brnf_device_event,
968};
969
970
971
972
973
974
975int br_nf_hook_thresh(unsigned int hook, struct net *net,
976 struct sock *sk, struct sk_buff *skb,
977 struct net_device *indev,
978 struct net_device *outdev,
979 int (*okfn)(struct net *, struct sock *,
980 struct sk_buff *))
981{
982 const struct nf_hook_entries *e;
983 struct nf_hook_state state;
984 struct nf_hook_ops **ops;
985 unsigned int i;
986 int ret;
987
988 e = rcu_dereference(net->nf.hooks_bridge[hook]);
989 if (!e)
990 return okfn(net, sk, skb);
991
992 ops = nf_hook_entries_get_hook_ops(e);
993 for (i = 0; i < e->num_hook_entries &&
994 ops[i]->priority <= NF_BR_PRI_BRNF; i++)
995 ;
996
997 nf_hook_state_init(&state, hook, NFPROTO_BRIDGE, indev, outdev,
998 sk, net, okfn);
999
1000 ret = nf_hook_slow(skb, &state, e, i);
1001 if (ret == 1)
1002 ret = okfn(net, sk, skb);
1003
1004 return ret;
1005}
1006
1007#ifdef CONFIG_SYSCTL
1008static
1009int brnf_sysctl_call_tables(struct ctl_table *ctl, int write,
1010 void __user *buffer, size_t *lenp, loff_t *ppos)
1011{
1012 int ret;
1013
1014 ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
1015
1016 if (write && *(int *)(ctl->data))
1017 *(int *)(ctl->data) = 1;
1018 return ret;
1019}
1020
1021static struct ctl_table brnf_table[] = {
1022 {
1023 .procname = "bridge-nf-call-arptables",
1024 .data = &brnf_call_arptables,
1025 .maxlen = sizeof(int),
1026 .mode = 0644,
1027 .proc_handler = brnf_sysctl_call_tables,
1028 },
1029 {
1030 .procname = "bridge-nf-call-iptables",
1031 .data = &brnf_call_iptables,
1032 .maxlen = sizeof(int),
1033 .mode = 0644,
1034 .proc_handler = brnf_sysctl_call_tables,
1035 },
1036 {
1037 .procname = "bridge-nf-call-ip6tables",
1038 .data = &brnf_call_ip6tables,
1039 .maxlen = sizeof(int),
1040 .mode = 0644,
1041 .proc_handler = brnf_sysctl_call_tables,
1042 },
1043 {
1044 .procname = "bridge-nf-filter-vlan-tagged",
1045 .data = &brnf_filter_vlan_tagged,
1046 .maxlen = sizeof(int),
1047 .mode = 0644,
1048 .proc_handler = brnf_sysctl_call_tables,
1049 },
1050 {
1051 .procname = "bridge-nf-filter-pppoe-tagged",
1052 .data = &brnf_filter_pppoe_tagged,
1053 .maxlen = sizeof(int),
1054 .mode = 0644,
1055 .proc_handler = brnf_sysctl_call_tables,
1056 },
1057 {
1058 .procname = "bridge-nf-pass-vlan-input-dev",
1059 .data = &brnf_pass_vlan_indev,
1060 .maxlen = sizeof(int),
1061 .mode = 0644,
1062 .proc_handler = brnf_sysctl_call_tables,
1063 },
1064 { }
1065};
1066#endif
1067
1068static int __init br_netfilter_init(void)
1069{
1070 int ret;
1071
1072 ret = register_pernet_subsys(&brnf_net_ops);
1073 if (ret < 0)
1074 return ret;
1075
1076 ret = register_netdevice_notifier(&brnf_notifier);
1077 if (ret < 0) {
1078 unregister_pernet_subsys(&brnf_net_ops);
1079 return ret;
1080 }
1081
1082#ifdef CONFIG_SYSCTL
1083 brnf_sysctl_header = register_net_sysctl(&init_net, "net/bridge", brnf_table);
1084 if (brnf_sysctl_header == NULL) {
1085 printk(KERN_WARNING
1086 "br_netfilter: can't register to sysctl.\n");
1087 unregister_netdevice_notifier(&brnf_notifier);
1088 unregister_pernet_subsys(&brnf_net_ops);
1089 return -ENOMEM;
1090 }
1091#endif
1092 RCU_INIT_POINTER(nf_br_ops, &br_ops);
1093 printk(KERN_NOTICE "Bridge firewalling registered\n");
1094 return 0;
1095}
1096
1097static void __exit br_netfilter_fini(void)
1098{
1099 RCU_INIT_POINTER(nf_br_ops, NULL);
1100 unregister_netdevice_notifier(&brnf_notifier);
1101 unregister_pernet_subsys(&brnf_net_ops);
1102#ifdef CONFIG_SYSCTL
1103 unregister_net_sysctl_table(brnf_sysctl_header);
1104#endif
1105}
1106
1107module_init(br_netfilter_init);
1108module_exit(br_netfilter_fini);
1109
1110MODULE_LICENSE("GPL");
1111MODULE_AUTHOR("Lennert Buytenhek <buytenh@gnu.org>");
1112MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
1113MODULE_DESCRIPTION("Linux ethernet netfilter firewall bridge");
1114