linux/net/bridge/br_netfilter_ipv6.c
<<
>>
Prefs
   1/*
   2 *      Handle firewalling
   3 *      Linux ethernet bridge
   4 *
   5 *      Authors:
   6 *      Lennert Buytenhek               <buytenh@gnu.org>
   7 *      Bart De Schuymer                <bdschuym@pandora.be>
   8 *
   9 *      This program is free software; you can redistribute it and/or
  10 *      modify it under the terms of the GNU General Public License
  11 *      as published by the Free Software Foundation; either version
  12 *      2 of the License, or (at your option) any later version.
  13 *
  14 *      Lennert dedicates this file to Kerstin Wurdinger.
  15 */
  16
  17#include <linux/module.h>
  18#include <linux/kernel.h>
  19#include <linux/slab.h>
  20#include <linux/ip.h>
  21#include <linux/netdevice.h>
  22#include <linux/skbuff.h>
  23#include <linux/if_arp.h>
  24#include <linux/if_ether.h>
  25#include <linux/if_vlan.h>
  26#include <linux/if_pppox.h>
  27#include <linux/ppp_defs.h>
  28#include <linux/netfilter_bridge.h>
  29#include <linux/netfilter_ipv4.h>
  30#include <linux/netfilter_ipv6.h>
  31#include <linux/netfilter_arp.h>
  32#include <linux/in_route.h>
  33#include <linux/inetdevice.h>
  34
  35#include <net/ip.h>
  36#include <net/ipv6.h>
  37#include <net/addrconf.h>
  38#include <net/route.h>
  39#include <net/netfilter/br_netfilter.h>
  40
  41#include <linux/uaccess.h>
  42#include "br_private.h"
  43#ifdef CONFIG_SYSCTL
  44#include <linux/sysctl.h>
  45#endif
  46
  47/* We only check the length. A bridge shouldn't do any hop-by-hop stuff
  48 * anyway
  49 */
  50static int br_nf_check_hbh_len(struct sk_buff *skb)
  51{
  52        unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
  53        u32 pkt_len;
  54        const unsigned char *nh = skb_network_header(skb);
  55        int off = raw - nh;
  56        int len = (raw[1] + 1) << 3;
  57
  58        if ((raw + len) - skb->data > skb_headlen(skb))
  59                goto bad;
  60
  61        off += 2;
  62        len -= 2;
  63
  64        while (len > 0) {
  65                int optlen = nh[off + 1] + 2;
  66
  67                switch (nh[off]) {
  68                case IPV6_TLV_PAD1:
  69                        optlen = 1;
  70                        break;
  71
  72                case IPV6_TLV_PADN:
  73                        break;
  74
  75                case IPV6_TLV_JUMBO:
  76                        if (nh[off + 1] != 4 || (off & 3) != 2)
  77                                goto bad;
  78                        pkt_len = ntohl(*(__be32 *)(nh + off + 2));
  79                        if (pkt_len <= IPV6_MAXPLEN ||
  80                            ipv6_hdr(skb)->payload_len)
  81                                goto bad;
  82                        if (pkt_len > skb->len - sizeof(struct ipv6hdr))
  83                                goto bad;
  84                        if (pskb_trim_rcsum(skb,
  85                                            pkt_len + sizeof(struct ipv6hdr)))
  86                                goto bad;
  87                        nh = skb_network_header(skb);
  88                        break;
  89                default:
  90                        if (optlen > len)
  91                                goto bad;
  92                        break;
  93                }
  94                off += optlen;
  95                len -= optlen;
  96        }
  97        if (len == 0)
  98                return 0;
  99bad:
 100        return -1;
 101}
 102
 103int br_validate_ipv6(struct net *net, struct sk_buff *skb)
 104{
 105        const struct ipv6hdr *hdr;
 106        struct inet6_dev *idev = __in6_dev_get(skb->dev);
 107        u32 pkt_len;
 108        u8 ip6h_len = sizeof(struct ipv6hdr);
 109
 110        if (!pskb_may_pull(skb, ip6h_len))
 111                goto inhdr_error;
 112
 113        if (skb->len < ip6h_len)
 114                goto drop;
 115
 116        hdr = ipv6_hdr(skb);
 117
 118        if (hdr->version != 6)
 119                goto inhdr_error;
 120
 121        pkt_len = ntohs(hdr->payload_len);
 122
 123        if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
 124                if (pkt_len + ip6h_len > skb->len) {
 125                        __IP6_INC_STATS(net, idev,
 126                                        IPSTATS_MIB_INTRUNCATEDPKTS);
 127                        goto drop;
 128                }
 129                if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
 130                        __IP6_INC_STATS(net, idev,
 131                                        IPSTATS_MIB_INDISCARDS);
 132                        goto drop;
 133                }
 134        }
 135        if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb))
 136                goto drop;
 137
 138        memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
 139        /* No IP options in IPv6 header; however it should be
 140         * checked if some next headers need special treatment
 141         */
 142        return 0;
 143
 144inhdr_error:
 145        __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 146drop:
 147        return -1;
 148}
 149
 150static inline bool
 151br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
 152                             const struct nf_bridge_info *nf_bridge)
 153{
 154        return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
 155                      sizeof(ipv6_hdr(skb)->daddr)) != 0;
 156}
 157
 158/* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
 159 * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
 160 * for br_nf_pre_routing_finish(), same logic is used here but
 161 * equivalent IPv6 function ip6_route_input() called indirectly.
 162 */
 163static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb)
 164{
 165        struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
 166        struct rtable *rt;
 167        struct net_device *dev = skb->dev;
 168        const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
 169
 170        nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
 171
 172        if (nf_bridge->pkt_otherhost) {
 173                skb->pkt_type = PACKET_OTHERHOST;
 174                nf_bridge->pkt_otherhost = false;
 175        }
 176        nf_bridge->in_prerouting = 0;
 177        if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
 178                skb_dst_drop(skb);
 179                v6ops->route_input(skb);
 180
 181                if (skb_dst(skb)->error) {
 182                        kfree_skb(skb);
 183                        return 0;
 184                }
 185
 186                if (skb_dst(skb)->dev == dev) {
 187                        skb->dev = nf_bridge->physindev;
 188                        nf_bridge_update_protocol(skb);
 189                        nf_bridge_push_encap_header(skb);
 190                        br_nf_hook_thresh(NF_BR_PRE_ROUTING,
 191                                          net, sk, skb, skb->dev, NULL,
 192                                          br_nf_pre_routing_finish_bridge);
 193                        return 0;
 194                }
 195                ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
 196                skb->pkt_type = PACKET_HOST;
 197        } else {
 198                rt = bridge_parent_rtable(nf_bridge->physindev);
 199                if (!rt) {
 200                        kfree_skb(skb);
 201                        return 0;
 202                }
 203                skb_dst_set_noref(skb, &rt->dst);
 204        }
 205
 206        skb->dev = nf_bridge->physindev;
 207        nf_bridge_update_protocol(skb);
 208        nf_bridge_push_encap_header(skb);
 209        br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb,
 210                          skb->dev, NULL, br_handle_frame_finish);
 211
 212        return 0;
 213}
 214
 215/* Replicate the checks that IPv6 does on packet reception and pass the packet
 216 * to ip6tables.
 217 */
 218unsigned int br_nf_pre_routing_ipv6(void *priv,
 219                                    struct sk_buff *skb,
 220                                    const struct nf_hook_state *state)
 221{
 222        struct nf_bridge_info *nf_bridge;
 223
 224        if (br_validate_ipv6(state->net, skb))
 225                return NF_DROP;
 226
 227        nf_bridge_put(skb->nf_bridge);
 228        if (!nf_bridge_alloc(skb))
 229                return NF_DROP;
 230        if (!setup_pre_routing(skb))
 231                return NF_DROP;
 232
 233        nf_bridge = nf_bridge_info_get(skb);
 234        nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
 235
 236        skb->protocol = htons(ETH_P_IPV6);
 237        NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
 238                skb->dev, NULL,
 239                br_nf_pre_routing_finish_ipv6);
 240
 241        return NF_STOLEN;
 242}
 243