1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17#include <linux/module.h>
18#include <linux/kernel.h>
19#include <linux/slab.h>
20#include <linux/ip.h>
21#include <linux/netdevice.h>
22#include <linux/skbuff.h>
23#include <linux/if_arp.h>
24#include <linux/if_ether.h>
25#include <linux/if_vlan.h>
26#include <linux/if_pppox.h>
27#include <linux/ppp_defs.h>
28#include <linux/netfilter_bridge.h>
29#include <linux/netfilter_ipv4.h>
30#include <linux/netfilter_ipv6.h>
31#include <linux/netfilter_arp.h>
32#include <linux/in_route.h>
33#include <linux/inetdevice.h>
34
35#include <net/ip.h>
36#include <net/ipv6.h>
37#include <net/addrconf.h>
38#include <net/route.h>
39#include <net/netfilter/br_netfilter.h>
40#include <net/netns/generic.h>
41
42#include <asm/uaccess.h>
43#include "br_private.h"
44#ifdef CONFIG_SYSCTL
45#include <linux/sysctl.h>
46#endif
47
48static int brnf_net_id __read_mostly;
49
50struct brnf_net {
51 bool enabled;
52};
53
54#ifdef CONFIG_SYSCTL
55static struct ctl_table_header *brnf_sysctl_header;
56static int brnf_call_iptables __read_mostly = 1;
57static int brnf_call_ip6tables __read_mostly = 1;
58static int brnf_call_arptables __read_mostly = 1;
59static int brnf_filter_vlan_tagged __read_mostly;
60static int brnf_filter_pppoe_tagged __read_mostly;
61static int brnf_pass_vlan_indev __read_mostly;
62#else
63#define brnf_call_iptables 1
64#define brnf_call_ip6tables 1
65#define brnf_call_arptables 1
66#define brnf_filter_vlan_tagged 0
67#define brnf_filter_pppoe_tagged 0
68#define brnf_pass_vlan_indev 0
69#endif
70
71#define IS_IP(skb) \
72 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_IP))
73
74#define IS_IPV6(skb) \
75 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_IPV6))
76
77#define IS_ARP(skb) \
78 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_ARP))
79
80static inline __be16 vlan_proto(const struct sk_buff *skb)
81{
82 if (skb_vlan_tag_present(skb))
83 return skb->protocol;
84 else if (skb->protocol == htons(ETH_P_8021Q))
85 return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
86 else
87 return 0;
88}
89
90#define IS_VLAN_IP(skb) \
91 (vlan_proto(skb) == htons(ETH_P_IP) && \
92 brnf_filter_vlan_tagged)
93
94#define IS_VLAN_IPV6(skb) \
95 (vlan_proto(skb) == htons(ETH_P_IPV6) && \
96 brnf_filter_vlan_tagged)
97
98#define IS_VLAN_ARP(skb) \
99 (vlan_proto(skb) == htons(ETH_P_ARP) && \
100 brnf_filter_vlan_tagged)
101
102static inline __be16 pppoe_proto(const struct sk_buff *skb)
103{
104 return *((__be16 *)(skb_mac_header(skb) + ETH_HLEN +
105 sizeof(struct pppoe_hdr)));
106}
107
108#define IS_PPPOE_IP(skb) \
109 (skb->protocol == htons(ETH_P_PPP_SES) && \
110 pppoe_proto(skb) == htons(PPP_IP) && \
111 brnf_filter_pppoe_tagged)
112
113#define IS_PPPOE_IPV6(skb) \
114 (skb->protocol == htons(ETH_P_PPP_SES) && \
115 pppoe_proto(skb) == htons(PPP_IPV6) && \
116 brnf_filter_pppoe_tagged)
117
118
119#define NF_BRIDGE_MAX_MAC_HEADER_LENGTH (PPPOE_SES_HLEN + ETH_HLEN)
120
121struct brnf_frag_data {
122 char mac[NF_BRIDGE_MAX_MAC_HEADER_LENGTH];
123 u8 encap_size;
124 u8 size;
125 u16 vlan_tci;
126 __be16 vlan_proto;
127};
128
129static DEFINE_PER_CPU(struct brnf_frag_data, brnf_frag_data_storage);
130
131static void nf_bridge_info_free(struct sk_buff *skb)
132{
133 if (skb->nf_bridge) {
134 nf_bridge_put(skb->nf_bridge);
135 skb->nf_bridge = NULL;
136 }
137}
138
139static inline struct net_device *bridge_parent(const struct net_device *dev)
140{
141 struct net_bridge_port *port;
142
143 port = br_port_get_rcu(dev);
144 return port ? port->br->dev : NULL;
145}
146
147static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
148{
149 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
150
151 if (atomic_read(&nf_bridge->use) > 1) {
152 struct nf_bridge_info *tmp = nf_bridge_alloc(skb);
153
154 if (tmp) {
155 memcpy(tmp, nf_bridge, sizeof(struct nf_bridge_info));
156 atomic_set(&tmp->use, 1);
157 }
158 nf_bridge_put(nf_bridge);
159 nf_bridge = tmp;
160 }
161 return nf_bridge;
162}
163
164unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb)
165{
166 switch (skb->protocol) {
167 case __cpu_to_be16(ETH_P_8021Q):
168 return VLAN_HLEN;
169 case __cpu_to_be16(ETH_P_PPP_SES):
170 return PPPOE_SES_HLEN;
171 default:
172 return 0;
173 }
174}
175
176static inline void nf_bridge_pull_encap_header(struct sk_buff *skb)
177{
178 unsigned int len = nf_bridge_encap_header_len(skb);
179
180 skb_pull(skb, len);
181 skb->network_header += len;
182}
183
184static inline void nf_bridge_pull_encap_header_rcsum(struct sk_buff *skb)
185{
186 unsigned int len = nf_bridge_encap_header_len(skb);
187
188 skb_pull_rcsum(skb, len);
189 skb->network_header += len;
190}
191
192
193
194
195
196
197static int br_validate_ipv4(struct net *net, struct sk_buff *skb)
198{
199 const struct iphdr *iph;
200 u32 len;
201
202 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
203 goto inhdr_error;
204
205 iph = ip_hdr(skb);
206
207
208 if (iph->ihl < 5 || iph->version != 4)
209 goto inhdr_error;
210
211 if (!pskb_may_pull(skb, iph->ihl*4))
212 goto inhdr_error;
213
214 iph = ip_hdr(skb);
215 if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
216 goto inhdr_error;
217
218 len = ntohs(iph->tot_len);
219 if (skb->len < len) {
220 IP_INC_STATS_BH(net, IPSTATS_MIB_INTRUNCATEDPKTS);
221 goto drop;
222 } else if (len < (iph->ihl*4))
223 goto inhdr_error;
224
225 if (pskb_trim_rcsum(skb, len)) {
226 IP_INC_STATS_BH(net, IPSTATS_MIB_INDISCARDS);
227 goto drop;
228 }
229
230 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
231
232
233
234
235
236 return 0;
237
238inhdr_error:
239 IP_INC_STATS_BH(net, IPSTATS_MIB_INHDRERRORS);
240drop:
241 return -1;
242}
243
244void nf_bridge_update_protocol(struct sk_buff *skb)
245{
246 switch (skb->nf_bridge->orig_proto) {
247 case BRNF_PROTO_8021Q:
248 skb->protocol = htons(ETH_P_8021Q);
249 break;
250 case BRNF_PROTO_PPPOE:
251 skb->protocol = htons(ETH_P_PPP_SES);
252 break;
253 case BRNF_PROTO_UNCHANGED:
254 break;
255 }
256}
257
258
259
260
261
262
263int br_nf_pre_routing_finish_bridge(struct net *net, struct sock *sk, struct sk_buff *skb)
264{
265 struct neighbour *neigh;
266 struct dst_entry *dst;
267
268 skb->dev = bridge_parent(skb->dev);
269 if (!skb->dev)
270 goto free_skb;
271 dst = skb_dst(skb);
272 neigh = dst_neigh_lookup_skb(dst, skb);
273 if (neigh) {
274 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
275 int ret;
276
277 if (neigh->hh.hh_len) {
278 neigh_hh_bridge(&neigh->hh, skb);
279 skb->dev = nf_bridge->physindev;
280 ret = br_handle_frame_finish(net, sk, skb);
281 } else {
282
283
284
285
286 skb_copy_from_linear_data_offset(skb,
287 -(ETH_HLEN-ETH_ALEN),
288 nf_bridge->neigh_header,
289 ETH_HLEN-ETH_ALEN);
290
291 nf_bridge->bridged_dnat = 1;
292
293 ret = neigh->output(neigh, skb);
294 }
295 neigh_release(neigh);
296 return ret;
297 }
298free_skb:
299 kfree_skb(skb);
300 return 0;
301}
302
303static inline bool
304br_nf_ipv4_daddr_was_changed(const struct sk_buff *skb,
305 const struct nf_bridge_info *nf_bridge)
306{
307 return ip_hdr(skb)->daddr != nf_bridge->ipv4_daddr;
308}
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
350{
351 struct net_device *dev = skb->dev;
352 struct iphdr *iph = ip_hdr(skb);
353 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
354 struct rtable *rt;
355 int err;
356
357 nf_bridge->frag_max_size = IPCB(skb)->frag_max_size;
358
359 if (nf_bridge->pkt_otherhost) {
360 skb->pkt_type = PACKET_OTHERHOST;
361 nf_bridge->pkt_otherhost = false;
362 }
363 nf_bridge->in_prerouting = 0;
364 if (br_nf_ipv4_daddr_was_changed(skb, nf_bridge)) {
365 if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
366 struct in_device *in_dev = __in_dev_get_rcu(dev);
367
368
369
370
371
372
373
374
375 if (err != -EHOSTUNREACH || !in_dev || IN_DEV_FORWARD(in_dev))
376 goto free_skb;
377
378 rt = ip_route_output(net, iph->daddr, 0,
379 RT_TOS(iph->tos), 0);
380 if (!IS_ERR(rt)) {
381
382
383 if (rt->dst.dev == dev) {
384 skb_dst_set(skb, &rt->dst);
385 goto bridged_dnat;
386 }
387 ip_rt_put(rt);
388 }
389free_skb:
390 kfree_skb(skb);
391 return 0;
392 } else {
393 if (skb_dst(skb)->dev == dev) {
394bridged_dnat:
395 skb->dev = nf_bridge->physindev;
396 nf_bridge_update_protocol(skb);
397 nf_bridge_push_encap_header(skb);
398 NF_HOOK_THRESH(NFPROTO_BRIDGE,
399 NF_BR_PRE_ROUTING,
400 net, sk, skb, skb->dev, NULL,
401 br_nf_pre_routing_finish_bridge,
402 1);
403 return 0;
404 }
405 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
406 skb->pkt_type = PACKET_HOST;
407 }
408 } else {
409 rt = bridge_parent_rtable(nf_bridge->physindev);
410 if (!rt) {
411 kfree_skb(skb);
412 return 0;
413 }
414 skb_dst_set_noref(skb, &rt->dst);
415 }
416
417 skb->dev = nf_bridge->physindev;
418 nf_bridge_update_protocol(skb);
419 nf_bridge_push_encap_header(skb);
420 NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, net, sk, skb,
421 skb->dev, NULL,
422 br_handle_frame_finish, 1);
423
424 return 0;
425}
426
427static struct net_device *brnf_get_logical_dev(struct sk_buff *skb, const struct net_device *dev)
428{
429 struct net_device *vlan, *br;
430
431 br = bridge_parent(dev);
432 if (brnf_pass_vlan_indev == 0 || !skb_vlan_tag_present(skb))
433 return br;
434
435 vlan = __vlan_find_dev_deep_rcu(br, skb->vlan_proto,
436 skb_vlan_tag_get(skb) & VLAN_VID_MASK);
437
438 return vlan ? vlan : br;
439}
440
441
442struct net_device *setup_pre_routing(struct sk_buff *skb)
443{
444 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
445
446 if (skb->pkt_type == PACKET_OTHERHOST) {
447 skb->pkt_type = PACKET_HOST;
448 nf_bridge->pkt_otherhost = true;
449 }
450
451 nf_bridge->in_prerouting = 1;
452 nf_bridge->physindev = skb->dev;
453 skb->dev = brnf_get_logical_dev(skb, skb->dev);
454
455 if (skb->protocol == htons(ETH_P_8021Q))
456 nf_bridge->orig_proto = BRNF_PROTO_8021Q;
457 else if (skb->protocol == htons(ETH_P_PPP_SES))
458 nf_bridge->orig_proto = BRNF_PROTO_PPPOE;
459
460
461 skb_orphan(skb);
462 return skb->dev;
463}
464
465
466
467
468
469
470
471static unsigned int br_nf_pre_routing(void *priv,
472 struct sk_buff *skb,
473 const struct nf_hook_state *state)
474{
475 struct nf_bridge_info *nf_bridge;
476 struct net_bridge_port *p;
477 struct net_bridge *br;
478 __u32 len = nf_bridge_encap_header_len(skb);
479
480 if (unlikely(!pskb_may_pull(skb, len)))
481 return NF_DROP;
482
483 p = br_port_get_rcu(state->in);
484 if (p == NULL)
485 return NF_DROP;
486 br = p->br;
487
488 if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb)) {
489 if (!brnf_call_ip6tables && !br->nf_call_ip6tables)
490 return NF_ACCEPT;
491
492 nf_bridge_pull_encap_header_rcsum(skb);
493 return br_nf_pre_routing_ipv6(priv, skb, state);
494 }
495
496 if (!brnf_call_iptables && !br->nf_call_iptables)
497 return NF_ACCEPT;
498
499 if (!IS_IP(skb) && !IS_VLAN_IP(skb) && !IS_PPPOE_IP(skb))
500 return NF_ACCEPT;
501
502 nf_bridge_pull_encap_header_rcsum(skb);
503
504 if (br_validate_ipv4(state->net, skb))
505 return NF_DROP;
506
507 nf_bridge_put(skb->nf_bridge);
508 if (!nf_bridge_alloc(skb))
509 return NF_DROP;
510 if (!setup_pre_routing(skb))
511 return NF_DROP;
512
513 nf_bridge = nf_bridge_info_get(skb);
514 nf_bridge->ipv4_daddr = ip_hdr(skb)->daddr;
515
516 skb->protocol = htons(ETH_P_IP);
517
518 NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
519 skb->dev, NULL,
520 br_nf_pre_routing_finish);
521
522 return NF_STOLEN;
523}
524
525
526
527
528
529
530
531
532
533static unsigned int br_nf_local_in(void *priv,
534 struct sk_buff *skb,
535 const struct nf_hook_state *state)
536{
537 br_drop_fake_rtable(skb);
538 return NF_ACCEPT;
539}
540
541
542static int br_nf_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
543{
544 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
545 struct net_device *in;
546
547 if (!IS_ARP(skb) && !IS_VLAN_ARP(skb)) {
548
549 if (skb->protocol == htons(ETH_P_IP))
550 nf_bridge->frag_max_size = IPCB(skb)->frag_max_size;
551
552 if (skb->protocol == htons(ETH_P_IPV6))
553 nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
554
555 in = nf_bridge->physindev;
556 if (nf_bridge->pkt_otherhost) {
557 skb->pkt_type = PACKET_OTHERHOST;
558 nf_bridge->pkt_otherhost = false;
559 }
560 nf_bridge_update_protocol(skb);
561 } else {
562 in = *((struct net_device **)(skb->cb));
563 }
564 nf_bridge_push_encap_header(skb);
565
566 NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_FORWARD, net, sk, skb,
567 in, skb->dev, br_forward_finish, 1);
568 return 0;
569}
570
571
572
573
574
575
576
577static unsigned int br_nf_forward_ip(void *priv,
578 struct sk_buff *skb,
579 const struct nf_hook_state *state)
580{
581 struct nf_bridge_info *nf_bridge;
582 struct net_device *parent;
583 u_int8_t pf;
584
585 if (!skb->nf_bridge)
586 return NF_ACCEPT;
587
588
589
590 if (!nf_bridge_unshare(skb))
591 return NF_DROP;
592
593 nf_bridge = nf_bridge_info_get(skb);
594 if (!nf_bridge)
595 return NF_DROP;
596
597 parent = bridge_parent(state->out);
598 if (!parent)
599 return NF_DROP;
600
601 if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
602 pf = NFPROTO_IPV4;
603 else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
604 pf = NFPROTO_IPV6;
605 else
606 return NF_ACCEPT;
607
608 nf_bridge_pull_encap_header(skb);
609
610 if (skb->pkt_type == PACKET_OTHERHOST) {
611 skb->pkt_type = PACKET_HOST;
612 nf_bridge->pkt_otherhost = true;
613 }
614
615 if (pf == NFPROTO_IPV4) {
616 if (br_validate_ipv4(state->net, skb))
617 return NF_DROP;
618 IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
619 }
620
621 if (pf == NFPROTO_IPV6) {
622 if (br_validate_ipv6(state->net, skb))
623 return NF_DROP;
624 IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
625 }
626
627 nf_bridge->physoutdev = skb->dev;
628 if (pf == NFPROTO_IPV4)
629 skb->protocol = htons(ETH_P_IP);
630 else
631 skb->protocol = htons(ETH_P_IPV6);
632
633 NF_HOOK(pf, NF_INET_FORWARD, state->net, NULL, skb,
634 brnf_get_logical_dev(skb, state->in),
635 parent, br_nf_forward_finish);
636
637 return NF_STOLEN;
638}
639
640static unsigned int br_nf_forward_arp(void *priv,
641 struct sk_buff *skb,
642 const struct nf_hook_state *state)
643{
644 struct net_bridge_port *p;
645 struct net_bridge *br;
646 struct net_device **d = (struct net_device **)(skb->cb);
647
648 p = br_port_get_rcu(state->out);
649 if (p == NULL)
650 return NF_ACCEPT;
651 br = p->br;
652
653 if (!brnf_call_arptables && !br->nf_call_arptables)
654 return NF_ACCEPT;
655
656 if (!IS_ARP(skb)) {
657 if (!IS_VLAN_ARP(skb))
658 return NF_ACCEPT;
659 nf_bridge_pull_encap_header(skb);
660 }
661
662 if (arp_hdr(skb)->ar_pln != 4) {
663 if (IS_VLAN_ARP(skb))
664 nf_bridge_push_encap_header(skb);
665 return NF_ACCEPT;
666 }
667 *d = state->in;
668 NF_HOOK(NFPROTO_ARP, NF_ARP_FORWARD, state->net, state->sk, skb,
669 state->in, state->out, br_nf_forward_finish);
670
671 return NF_STOLEN;
672}
673
674static int br_nf_push_frag_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
675{
676 struct brnf_frag_data *data;
677 int err;
678
679 data = this_cpu_ptr(&brnf_frag_data_storage);
680 err = skb_cow_head(skb, data->size);
681
682 if (err) {
683 kfree_skb(skb);
684 return 0;
685 }
686
687 if (data->vlan_tci) {
688 skb->vlan_tci = data->vlan_tci;
689 skb->vlan_proto = data->vlan_proto;
690 }
691
692 skb_copy_to_linear_data_offset(skb, -data->size, data->mac, data->size);
693 __skb_push(skb, data->encap_size);
694
695 nf_bridge_info_free(skb);
696 return br_dev_queue_push_xmit(net, sk, skb);
697}
698
699static int
700br_nf_ip_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
701 int (*output)(struct net *, struct sock *, struct sk_buff *))
702{
703 unsigned int mtu = ip_skb_dst_mtu(skb);
704 struct iphdr *iph = ip_hdr(skb);
705
706 if (unlikely(((iph->frag_off & htons(IP_DF)) && !skb->ignore_df) ||
707 (IPCB(skb)->frag_max_size &&
708 IPCB(skb)->frag_max_size > mtu))) {
709 IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
710 kfree_skb(skb);
711 return -EMSGSIZE;
712 }
713
714 return ip_do_fragment(net, sk, skb, output);
715}
716
717static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb)
718{
719 if (skb->nf_bridge->orig_proto == BRNF_PROTO_PPPOE)
720 return PPPOE_SES_HLEN;
721 return 0;
722}
723
724static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
725{
726 struct nf_bridge_info *nf_bridge;
727 unsigned int mtu_reserved;
728
729 mtu_reserved = nf_bridge_mtu_reduction(skb);
730
731 if (skb_is_gso(skb) || skb->len + mtu_reserved <= skb->dev->mtu) {
732 nf_bridge_info_free(skb);
733 return br_dev_queue_push_xmit(net, sk, skb);
734 }
735
736 nf_bridge = nf_bridge_info_get(skb);
737
738
739
740
741 if (IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) &&
742 skb->protocol == htons(ETH_P_IP)) {
743 struct brnf_frag_data *data;
744
745 if (br_validate_ipv4(net, skb))
746 goto drop;
747
748 IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
749
750 nf_bridge_update_protocol(skb);
751
752 data = this_cpu_ptr(&brnf_frag_data_storage);
753
754 data->vlan_tci = skb->vlan_tci;
755 data->vlan_proto = skb->vlan_proto;
756 data->encap_size = nf_bridge_encap_header_len(skb);
757 data->size = ETH_HLEN + data->encap_size;
758
759 skb_copy_from_linear_data_offset(skb, -data->size, data->mac,
760 data->size);
761
762 return br_nf_ip_fragment(net, sk, skb, br_nf_push_frag_xmit);
763 }
764 if (IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) &&
765 skb->protocol == htons(ETH_P_IPV6)) {
766 const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
767 struct brnf_frag_data *data;
768
769 if (br_validate_ipv6(net, skb))
770 goto drop;
771
772 IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
773
774 nf_bridge_update_protocol(skb);
775
776 data = this_cpu_ptr(&brnf_frag_data_storage);
777 data->encap_size = nf_bridge_encap_header_len(skb);
778 data->size = ETH_HLEN + data->encap_size;
779
780 skb_copy_from_linear_data_offset(skb, -data->size, data->mac,
781 data->size);
782
783 if (v6ops)
784 return v6ops->fragment(net, sk, skb, br_nf_push_frag_xmit);
785
786 kfree_skb(skb);
787 return -EMSGSIZE;
788 }
789 nf_bridge_info_free(skb);
790 return br_dev_queue_push_xmit(net, sk, skb);
791 drop:
792 kfree_skb(skb);
793 return 0;
794}
795
796
797static unsigned int br_nf_post_routing(void *priv,
798 struct sk_buff *skb,
799 const struct nf_hook_state *state)
800{
801 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
802 struct net_device *realoutdev = bridge_parent(skb->dev);
803 u_int8_t pf;
804
805
806
807
808
809
810 if (!nf_bridge || !nf_bridge->physoutdev)
811 return NF_ACCEPT;
812
813 if (!realoutdev)
814 return NF_DROP;
815
816 if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
817 pf = NFPROTO_IPV4;
818 else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
819 pf = NFPROTO_IPV6;
820 else
821 return NF_ACCEPT;
822
823
824
825 if (skb->pkt_type == PACKET_OTHERHOST) {
826 skb->pkt_type = PACKET_HOST;
827 nf_bridge->pkt_otherhost = true;
828 }
829
830 nf_bridge_pull_encap_header(skb);
831 if (pf == NFPROTO_IPV4)
832 skb->protocol = htons(ETH_P_IP);
833 else
834 skb->protocol = htons(ETH_P_IPV6);
835
836 NF_HOOK(pf, NF_INET_POST_ROUTING, state->net, state->sk, skb,
837 NULL, realoutdev,
838 br_nf_dev_queue_xmit);
839
840 return NF_STOLEN;
841}
842
843
844
845
846static unsigned int ip_sabotage_in(void *priv,
847 struct sk_buff *skb,
848 const struct nf_hook_state *state)
849{
850 if (skb->nf_bridge && !skb->nf_bridge->in_prerouting)
851 return NF_STOP;
852
853 return NF_ACCEPT;
854}
855
856
857
858
859
860
861
862
863
864
865static void br_nf_pre_routing_finish_bridge_slow(struct sk_buff *skb)
866{
867 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
868
869 skb_pull(skb, ETH_HLEN);
870 nf_bridge->bridged_dnat = 0;
871
872 BUILD_BUG_ON(sizeof(nf_bridge->neigh_header) != (ETH_HLEN - ETH_ALEN));
873
874 skb_copy_to_linear_data_offset(skb, -(ETH_HLEN - ETH_ALEN),
875 nf_bridge->neigh_header,
876 ETH_HLEN - ETH_ALEN);
877 skb->dev = nf_bridge->physindev;
878
879 nf_bridge->physoutdev = NULL;
880 br_handle_frame_finish(dev_net(skb->dev), NULL, skb);
881}
882
883static int br_nf_dev_xmit(struct sk_buff *skb)
884{
885 if (skb->nf_bridge && skb->nf_bridge->bridged_dnat) {
886 br_nf_pre_routing_finish_bridge_slow(skb);
887 return 1;
888 }
889 return 0;
890}
891
892static const struct nf_br_ops br_ops = {
893 .br_dev_xmit_hook = br_nf_dev_xmit,
894};
895
896void br_netfilter_enable(void)
897{
898}
899EXPORT_SYMBOL_GPL(br_netfilter_enable);
900
901
902
903static struct nf_hook_ops br_nf_ops[] __read_mostly = {
904 {
905 .hook = br_nf_pre_routing,
906 .pf = NFPROTO_BRIDGE,
907 .hooknum = NF_BR_PRE_ROUTING,
908 .priority = NF_BR_PRI_BRNF,
909 },
910 {
911 .hook = br_nf_local_in,
912 .pf = NFPROTO_BRIDGE,
913 .hooknum = NF_BR_LOCAL_IN,
914 .priority = NF_BR_PRI_BRNF,
915 },
916 {
917 .hook = br_nf_forward_ip,
918 .pf = NFPROTO_BRIDGE,
919 .hooknum = NF_BR_FORWARD,
920 .priority = NF_BR_PRI_BRNF - 1,
921 },
922 {
923 .hook = br_nf_forward_arp,
924 .pf = NFPROTO_BRIDGE,
925 .hooknum = NF_BR_FORWARD,
926 .priority = NF_BR_PRI_BRNF,
927 },
928 {
929 .hook = br_nf_post_routing,
930 .pf = NFPROTO_BRIDGE,
931 .hooknum = NF_BR_POST_ROUTING,
932 .priority = NF_BR_PRI_LAST,
933 },
934 {
935 .hook = ip_sabotage_in,
936 .pf = NFPROTO_IPV4,
937 .hooknum = NF_INET_PRE_ROUTING,
938 .priority = NF_IP_PRI_FIRST,
939 },
940 {
941 .hook = ip_sabotage_in,
942 .pf = NFPROTO_IPV6,
943 .hooknum = NF_INET_PRE_ROUTING,
944 .priority = NF_IP6_PRI_FIRST,
945 },
946};
947
948static int brnf_device_event(struct notifier_block *unused, unsigned long event,
949 void *ptr)
950{
951 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
952 struct brnf_net *brnet;
953 struct net *net;
954 int ret;
955
956 if (event != NETDEV_REGISTER || !(dev->priv_flags & IFF_EBRIDGE))
957 return NOTIFY_DONE;
958
959 ASSERT_RTNL();
960
961 net = dev_net(dev);
962 brnet = net_generic(net, brnf_net_id);
963 if (brnet->enabled)
964 return NOTIFY_OK;
965
966 ret = nf_register_net_hooks(net, br_nf_ops, ARRAY_SIZE(br_nf_ops));
967 if (ret)
968 return NOTIFY_BAD;
969
970 brnet->enabled = true;
971 return NOTIFY_OK;
972}
973
974static void __net_exit brnf_exit_net(struct net *net)
975{
976 struct brnf_net *brnet = net_generic(net, brnf_net_id);
977
978 if (!brnet->enabled)
979 return;
980
981 nf_unregister_net_hooks(net, br_nf_ops, ARRAY_SIZE(br_nf_ops));
982 brnet->enabled = false;
983}
984
985static struct pernet_operations brnf_net_ops __read_mostly = {
986 .exit = brnf_exit_net,
987 .id = &brnf_net_id,
988 .size = sizeof(struct brnf_net),
989};
990
991static struct notifier_block brnf_notifier __read_mostly = {
992 .notifier_call = brnf_device_event,
993};
994
995#ifdef CONFIG_SYSCTL
996static
997int brnf_sysctl_call_tables(struct ctl_table *ctl, int write,
998 void __user *buffer, size_t *lenp, loff_t *ppos)
999{
1000 int ret;
1001
1002 ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
1003
1004 if (write && *(int *)(ctl->data))
1005 *(int *)(ctl->data) = 1;
1006 return ret;
1007}
1008
1009static struct ctl_table brnf_table[] = {
1010 {
1011 .procname = "bridge-nf-call-arptables",
1012 .data = &brnf_call_arptables,
1013 .maxlen = sizeof(int),
1014 .mode = 0644,
1015 .proc_handler = brnf_sysctl_call_tables,
1016 },
1017 {
1018 .procname = "bridge-nf-call-iptables",
1019 .data = &brnf_call_iptables,
1020 .maxlen = sizeof(int),
1021 .mode = 0644,
1022 .proc_handler = brnf_sysctl_call_tables,
1023 },
1024 {
1025 .procname = "bridge-nf-call-ip6tables",
1026 .data = &brnf_call_ip6tables,
1027 .maxlen = sizeof(int),
1028 .mode = 0644,
1029 .proc_handler = brnf_sysctl_call_tables,
1030 },
1031 {
1032 .procname = "bridge-nf-filter-vlan-tagged",
1033 .data = &brnf_filter_vlan_tagged,
1034 .maxlen = sizeof(int),
1035 .mode = 0644,
1036 .proc_handler = brnf_sysctl_call_tables,
1037 },
1038 {
1039 .procname = "bridge-nf-filter-pppoe-tagged",
1040 .data = &brnf_filter_pppoe_tagged,
1041 .maxlen = sizeof(int),
1042 .mode = 0644,
1043 .proc_handler = brnf_sysctl_call_tables,
1044 },
1045 {
1046 .procname = "bridge-nf-pass-vlan-input-dev",
1047 .data = &brnf_pass_vlan_indev,
1048 .maxlen = sizeof(int),
1049 .mode = 0644,
1050 .proc_handler = brnf_sysctl_call_tables,
1051 },
1052 { }
1053};
1054#endif
1055
1056static int __init br_netfilter_init(void)
1057{
1058 int ret;
1059
1060 ret = register_pernet_subsys(&brnf_net_ops);
1061 if (ret < 0)
1062 return ret;
1063
1064 ret = register_netdevice_notifier(&brnf_notifier);
1065 if (ret < 0) {
1066 unregister_pernet_subsys(&brnf_net_ops);
1067 return ret;
1068 }
1069
1070#ifdef CONFIG_SYSCTL
1071 brnf_sysctl_header = register_net_sysctl(&init_net, "net/bridge", brnf_table);
1072 if (brnf_sysctl_header == NULL) {
1073 printk(KERN_WARNING
1074 "br_netfilter: can't register to sysctl.\n");
1075 unregister_netdevice_notifier(&brnf_notifier);
1076 unregister_pernet_subsys(&brnf_net_ops);
1077 return -ENOMEM;
1078 }
1079#endif
1080 RCU_INIT_POINTER(nf_br_ops, &br_ops);
1081 printk(KERN_NOTICE "Bridge firewalling registered\n");
1082 return 0;
1083}
1084
1085static void __exit br_netfilter_fini(void)
1086{
1087 RCU_INIT_POINTER(nf_br_ops, NULL);
1088 unregister_netdevice_notifier(&brnf_notifier);
1089 unregister_pernet_subsys(&brnf_net_ops);
1090#ifdef CONFIG_SYSCTL
1091 unregister_net_sysctl_table(brnf_sysctl_header);
1092#endif
1093}
1094
1095module_init(br_netfilter_init);
1096module_exit(br_netfilter_fini);
1097
1098MODULE_LICENSE("GPL");
1099MODULE_AUTHOR("Lennert Buytenhek <buytenh@gnu.org>");
1100MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
1101MODULE_DESCRIPTION("Linux ethernet netfilter firewall bridge");
1102