1
2
3
4
5
6
7
8
9
10
11
12
13#include <linux/module.h>
14#include <linux/kernel.h>
15#include <linux/slab.h>
16#include <linux/ip.h>
17#include <linux/netdevice.h>
18#include <linux/skbuff.h>
19#include <linux/if_arp.h>
20#include <linux/if_ether.h>
21#include <linux/if_vlan.h>
22#include <linux/if_pppox.h>
23#include <linux/ppp_defs.h>
24#include <linux/netfilter_bridge.h>
25#include <uapi/linux/netfilter_bridge.h>
26#include <linux/netfilter_ipv4.h>
27#include <linux/netfilter_ipv6.h>
28#include <linux/netfilter_arp.h>
29#include <linux/in_route.h>
30#include <linux/rculist.h>
31#include <linux/inetdevice.h>
32
33#include <net/ip.h>
34#include <net/ipv6.h>
35#include <net/addrconf.h>
36#include <net/route.h>
37#include <net/netfilter/br_netfilter.h>
38#include <net/netns/generic.h>
39
40#include <linux/uaccess.h>
41#include "br_private.h"
42#ifdef CONFIG_SYSCTL
43#include <linux/sysctl.h>
44#endif
45
46static unsigned int brnf_net_id __read_mostly;
47
48struct brnf_net {
49 bool enabled;
50
51#ifdef CONFIG_SYSCTL
52 struct ctl_table_header *ctl_hdr;
53#endif
54
55
56 int call_iptables;
57 int call_ip6tables;
58 int call_arptables;
59
60
61 int filter_vlan_tagged;
62 int filter_pppoe_tagged;
63 int pass_vlan_indev;
64};
65
66#define IS_IP(skb) \
67 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_IP))
68
69#define IS_IPV6(skb) \
70 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_IPV6))
71
72#define IS_ARP(skb) \
73 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_ARP))
74
75static inline __be16 vlan_proto(const struct sk_buff *skb)
76{
77 if (skb_vlan_tag_present(skb))
78 return skb->protocol;
79 else if (skb->protocol == htons(ETH_P_8021Q))
80 return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
81 else
82 return 0;
83}
84
85static inline bool is_vlan_ip(const struct sk_buff *skb, const struct net *net)
86{
87 struct brnf_net *brnet = net_generic(net, brnf_net_id);
88
89 return vlan_proto(skb) == htons(ETH_P_IP) && brnet->filter_vlan_tagged;
90}
91
92static inline bool is_vlan_ipv6(const struct sk_buff *skb,
93 const struct net *net)
94{
95 struct brnf_net *brnet = net_generic(net, brnf_net_id);
96
97 return vlan_proto(skb) == htons(ETH_P_IPV6) &&
98 brnet->filter_vlan_tagged;
99}
100
101static inline bool is_vlan_arp(const struct sk_buff *skb, const struct net *net)
102{
103 struct brnf_net *brnet = net_generic(net, brnf_net_id);
104
105 return vlan_proto(skb) == htons(ETH_P_ARP) && brnet->filter_vlan_tagged;
106}
107
108static inline __be16 pppoe_proto(const struct sk_buff *skb)
109{
110 return *((__be16 *)(skb_mac_header(skb) + ETH_HLEN +
111 sizeof(struct pppoe_hdr)));
112}
113
114static inline bool is_pppoe_ip(const struct sk_buff *skb, const struct net *net)
115{
116 struct brnf_net *brnet = net_generic(net, brnf_net_id);
117
118 return skb->protocol == htons(ETH_P_PPP_SES) &&
119 pppoe_proto(skb) == htons(PPP_IP) && brnet->filter_pppoe_tagged;
120}
121
122static inline bool is_pppoe_ipv6(const struct sk_buff *skb,
123 const struct net *net)
124{
125 struct brnf_net *brnet = net_generic(net, brnf_net_id);
126
127 return skb->protocol == htons(ETH_P_PPP_SES) &&
128 pppoe_proto(skb) == htons(PPP_IPV6) &&
129 brnet->filter_pppoe_tagged;
130}
131
132
133#define NF_BRIDGE_MAX_MAC_HEADER_LENGTH (PPPOE_SES_HLEN + ETH_HLEN)
134
135struct brnf_frag_data {
136 char mac[NF_BRIDGE_MAX_MAC_HEADER_LENGTH];
137 u8 encap_size;
138 u8 size;
139 u16 vlan_tci;
140 __be16 vlan_proto;
141};
142
143static DEFINE_PER_CPU(struct brnf_frag_data, brnf_frag_data_storage);
144
145static void nf_bridge_info_free(struct sk_buff *skb)
146{
147 skb_ext_del(skb, SKB_EXT_BRIDGE_NF);
148}
149
150static inline struct net_device *bridge_parent(const struct net_device *dev)
151{
152 struct net_bridge_port *port;
153
154 port = br_port_get_rcu(dev);
155 return port ? port->br->dev : NULL;
156}
157
158static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
159{
160 return skb_ext_add(skb, SKB_EXT_BRIDGE_NF);
161}
162
163unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb)
164{
165 switch (skb->protocol) {
166 case __cpu_to_be16(ETH_P_8021Q):
167 return VLAN_HLEN;
168 case __cpu_to_be16(ETH_P_PPP_SES):
169 return PPPOE_SES_HLEN;
170 default:
171 return 0;
172 }
173}
174
175static inline void nf_bridge_pull_encap_header(struct sk_buff *skb)
176{
177 unsigned int len = nf_bridge_encap_header_len(skb);
178
179 skb_pull(skb, len);
180 skb->network_header += len;
181}
182
183static inline void nf_bridge_pull_encap_header_rcsum(struct sk_buff *skb)
184{
185 unsigned int len = nf_bridge_encap_header_len(skb);
186
187 skb_pull_rcsum(skb, len);
188 skb->network_header += len;
189}
190
191
192
193
194
195
196static int br_validate_ipv4(struct net *net, struct sk_buff *skb)
197{
198 const struct iphdr *iph;
199 u32 len;
200
201 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
202 goto inhdr_error;
203
204 iph = ip_hdr(skb);
205
206
207 if (iph->ihl < 5 || iph->version != 4)
208 goto inhdr_error;
209
210 if (!pskb_may_pull(skb, iph->ihl*4))
211 goto inhdr_error;
212
213 iph = ip_hdr(skb);
214 if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
215 goto csum_error;
216
217 len = ntohs(iph->tot_len);
218 if (skb->len < len) {
219 __IP_INC_STATS(net, IPSTATS_MIB_INTRUNCATEDPKTS);
220 goto drop;
221 } else if (len < (iph->ihl*4))
222 goto inhdr_error;
223
224 if (pskb_trim_rcsum(skb, len)) {
225 __IP_INC_STATS(net, IPSTATS_MIB_INDISCARDS);
226 goto drop;
227 }
228
229 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
230
231
232
233
234
235 return 0;
236
237csum_error:
238 __IP_INC_STATS(net, IPSTATS_MIB_CSUMERRORS);
239inhdr_error:
240 __IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
241drop:
242 return -1;
243}
244
245void nf_bridge_update_protocol(struct sk_buff *skb)
246{
247 const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
248
249 switch (nf_bridge->orig_proto) {
250 case BRNF_PROTO_8021Q:
251 skb->protocol = htons(ETH_P_8021Q);
252 break;
253 case BRNF_PROTO_PPPOE:
254 skb->protocol = htons(ETH_P_PPP_SES);
255 break;
256 case BRNF_PROTO_UNCHANGED:
257 break;
258 }
259}
260
261
262
263
264
265
266int br_nf_pre_routing_finish_bridge(struct net *net, struct sock *sk, struct sk_buff *skb)
267{
268 struct neighbour *neigh;
269 struct dst_entry *dst;
270
271 skb->dev = bridge_parent(skb->dev);
272 if (!skb->dev)
273 goto free_skb;
274 dst = skb_dst(skb);
275 neigh = dst_neigh_lookup_skb(dst, skb);
276 if (neigh) {
277 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
278 int ret;
279
280 if ((neigh->nud_state & NUD_CONNECTED) && neigh->hh.hh_len) {
281 neigh_hh_bridge(&neigh->hh, skb);
282 skb->dev = nf_bridge->physindev;
283 ret = br_handle_frame_finish(net, sk, skb);
284 } else {
285
286
287
288
289 skb_copy_from_linear_data_offset(skb,
290 -(ETH_HLEN-ETH_ALEN),
291 nf_bridge->neigh_header,
292 ETH_HLEN-ETH_ALEN);
293
294 nf_bridge->bridged_dnat = 1;
295
296 ret = neigh->output(neigh, skb);
297 }
298 neigh_release(neigh);
299 return ret;
300 }
301free_skb:
302 kfree_skb(skb);
303 return 0;
304}
305
306static inline bool
307br_nf_ipv4_daddr_was_changed(const struct sk_buff *skb,
308 const struct nf_bridge_info *nf_bridge)
309{
310 return ip_hdr(skb)->daddr != nf_bridge->ipv4_daddr;
311}
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
353{
354 struct net_device *dev = skb->dev;
355 struct iphdr *iph = ip_hdr(skb);
356 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
357 struct rtable *rt;
358 int err;
359
360 nf_bridge->frag_max_size = IPCB(skb)->frag_max_size;
361
362 if (nf_bridge->pkt_otherhost) {
363 skb->pkt_type = PACKET_OTHERHOST;
364 nf_bridge->pkt_otherhost = false;
365 }
366 nf_bridge->in_prerouting = 0;
367 if (br_nf_ipv4_daddr_was_changed(skb, nf_bridge)) {
368 if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
369 struct in_device *in_dev = __in_dev_get_rcu(dev);
370
371
372
373
374
375
376
377
378 if (err != -EHOSTUNREACH || !in_dev || IN_DEV_FORWARD(in_dev))
379 goto free_skb;
380
381 rt = ip_route_output(net, iph->daddr, 0,
382 RT_TOS(iph->tos), 0);
383 if (!IS_ERR(rt)) {
384
385
386 if (rt->dst.dev == dev) {
387 skb_dst_set(skb, &rt->dst);
388 goto bridged_dnat;
389 }
390 ip_rt_put(rt);
391 }
392free_skb:
393 kfree_skb(skb);
394 return 0;
395 } else {
396 if (skb_dst(skb)->dev == dev) {
397bridged_dnat:
398 skb->dev = nf_bridge->physindev;
399 nf_bridge_update_protocol(skb);
400 nf_bridge_push_encap_header(skb);
401 br_nf_hook_thresh(NF_BR_PRE_ROUTING,
402 net, sk, skb, skb->dev,
403 NULL,
404 br_nf_pre_routing_finish_bridge);
405 return 0;
406 }
407 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
408 skb->pkt_type = PACKET_HOST;
409 }
410 } else {
411 rt = bridge_parent_rtable(nf_bridge->physindev);
412 if (!rt) {
413 kfree_skb(skb);
414 return 0;
415 }
416 skb_dst_set_noref(skb, &rt->dst);
417 }
418
419 skb->dev = nf_bridge->physindev;
420 nf_bridge_update_protocol(skb);
421 nf_bridge_push_encap_header(skb);
422 br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb, skb->dev, NULL,
423 br_handle_frame_finish);
424 return 0;
425}
426
427static struct net_device *brnf_get_logical_dev(struct sk_buff *skb,
428 const struct net_device *dev,
429 const struct net *net)
430{
431 struct net_device *vlan, *br;
432 struct brnf_net *brnet = net_generic(net, brnf_net_id);
433
434 br = bridge_parent(dev);
435
436 if (brnet->pass_vlan_indev == 0 || !skb_vlan_tag_present(skb))
437 return br;
438
439 vlan = __vlan_find_dev_deep_rcu(br, skb->vlan_proto,
440 skb_vlan_tag_get(skb) & VLAN_VID_MASK);
441
442 return vlan ? vlan : br;
443}
444
445
446struct net_device *setup_pre_routing(struct sk_buff *skb, const struct net *net)
447{
448 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
449
450 if (skb->pkt_type == PACKET_OTHERHOST) {
451 skb->pkt_type = PACKET_HOST;
452 nf_bridge->pkt_otherhost = true;
453 }
454
455 nf_bridge->in_prerouting = 1;
456 nf_bridge->physindev = skb->dev;
457 skb->dev = brnf_get_logical_dev(skb, skb->dev, net);
458
459 if (skb->protocol == htons(ETH_P_8021Q))
460 nf_bridge->orig_proto = BRNF_PROTO_8021Q;
461 else if (skb->protocol == htons(ETH_P_PPP_SES))
462 nf_bridge->orig_proto = BRNF_PROTO_PPPOE;
463
464
465 skb_orphan(skb);
466 return skb->dev;
467}
468
469
470
471
472
473
474
475static unsigned int br_nf_pre_routing(void *priv,
476 struct sk_buff *skb,
477 const struct nf_hook_state *state)
478{
479 struct nf_bridge_info *nf_bridge;
480 struct net_bridge_port *p;
481 struct net_bridge *br;
482 __u32 len = nf_bridge_encap_header_len(skb);
483 struct brnf_net *brnet;
484
485 if (unlikely(!pskb_may_pull(skb, len)))
486 return NF_DROP;
487
488 p = br_port_get_rcu(state->in);
489 if (p == NULL)
490 return NF_DROP;
491 br = p->br;
492
493 brnet = net_generic(state->net, brnf_net_id);
494 if (IS_IPV6(skb) || is_vlan_ipv6(skb, state->net) ||
495 is_pppoe_ipv6(skb, state->net)) {
496 if (!brnet->call_ip6tables &&
497 !br_opt_get(br, BROPT_NF_CALL_IP6TABLES))
498 return NF_ACCEPT;
499 if (!ipv6_mod_enabled()) {
500 pr_warn_once("Module ipv6 is disabled, so call_ip6tables is not supported.");
501 return NF_DROP;
502 }
503
504 nf_bridge_pull_encap_header_rcsum(skb);
505 return br_nf_pre_routing_ipv6(priv, skb, state);
506 }
507
508 if (!brnet->call_iptables && !br_opt_get(br, BROPT_NF_CALL_IPTABLES))
509 return NF_ACCEPT;
510
511 if (!IS_IP(skb) && !is_vlan_ip(skb, state->net) &&
512 !is_pppoe_ip(skb, state->net))
513 return NF_ACCEPT;
514
515 nf_bridge_pull_encap_header_rcsum(skb);
516
517 if (br_validate_ipv4(state->net, skb))
518 return NF_DROP;
519
520 if (!nf_bridge_alloc(skb))
521 return NF_DROP;
522 if (!setup_pre_routing(skb, state->net))
523 return NF_DROP;
524
525 nf_bridge = nf_bridge_info_get(skb);
526 nf_bridge->ipv4_daddr = ip_hdr(skb)->daddr;
527
528 skb->protocol = htons(ETH_P_IP);
529 skb->transport_header = skb->network_header + ip_hdr(skb)->ihl * 4;
530
531 NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
532 skb->dev, NULL,
533 br_nf_pre_routing_finish);
534
535 return NF_STOLEN;
536}
537
538
539
540static int br_nf_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
541{
542 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
543 struct net_device *in;
544
545 if (!IS_ARP(skb) && !is_vlan_arp(skb, net)) {
546
547 if (skb->protocol == htons(ETH_P_IP))
548 nf_bridge->frag_max_size = IPCB(skb)->frag_max_size;
549
550 if (skb->protocol == htons(ETH_P_IPV6))
551 nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
552
553 in = nf_bridge->physindev;
554 if (nf_bridge->pkt_otherhost) {
555 skb->pkt_type = PACKET_OTHERHOST;
556 nf_bridge->pkt_otherhost = false;
557 }
558 nf_bridge_update_protocol(skb);
559 } else {
560 in = *((struct net_device **)(skb->cb));
561 }
562 nf_bridge_push_encap_header(skb);
563
564 br_nf_hook_thresh(NF_BR_FORWARD, net, sk, skb, in, skb->dev,
565 br_forward_finish);
566 return 0;
567}
568
569
570
571
572
573
574
575static unsigned int br_nf_forward_ip(void *priv,
576 struct sk_buff *skb,
577 const struct nf_hook_state *state)
578{
579 struct nf_bridge_info *nf_bridge;
580 struct net_device *parent;
581 u_int8_t pf;
582
583 nf_bridge = nf_bridge_info_get(skb);
584 if (!nf_bridge)
585 return NF_ACCEPT;
586
587
588
589 if (!nf_bridge_unshare(skb))
590 return NF_DROP;
591
592 nf_bridge = nf_bridge_info_get(skb);
593 if (!nf_bridge)
594 return NF_DROP;
595
596 parent = bridge_parent(state->out);
597 if (!parent)
598 return NF_DROP;
599
600 if (IS_IP(skb) || is_vlan_ip(skb, state->net) ||
601 is_pppoe_ip(skb, state->net))
602 pf = NFPROTO_IPV4;
603 else if (IS_IPV6(skb) || is_vlan_ipv6(skb, state->net) ||
604 is_pppoe_ipv6(skb, state->net))
605 pf = NFPROTO_IPV6;
606 else
607 return NF_ACCEPT;
608
609 nf_bridge_pull_encap_header(skb);
610
611 if (skb->pkt_type == PACKET_OTHERHOST) {
612 skb->pkt_type = PACKET_HOST;
613 nf_bridge->pkt_otherhost = true;
614 }
615
616 if (pf == NFPROTO_IPV4) {
617 if (br_validate_ipv4(state->net, skb))
618 return NF_DROP;
619 IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
620 }
621
622 if (pf == NFPROTO_IPV6) {
623 if (br_validate_ipv6(state->net, skb))
624 return NF_DROP;
625 IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
626 }
627
628 nf_bridge->physoutdev = skb->dev;
629 if (pf == NFPROTO_IPV4)
630 skb->protocol = htons(ETH_P_IP);
631 else
632 skb->protocol = htons(ETH_P_IPV6);
633
634 NF_HOOK(pf, NF_INET_FORWARD, state->net, NULL, skb,
635 brnf_get_logical_dev(skb, state->in, state->net),
636 parent, br_nf_forward_finish);
637
638 return NF_STOLEN;
639}
640
641static unsigned int br_nf_forward_arp(void *priv,
642 struct sk_buff *skb,
643 const struct nf_hook_state *state)
644{
645 struct net_bridge_port *p;
646 struct net_bridge *br;
647 struct net_device **d = (struct net_device **)(skb->cb);
648 struct brnf_net *brnet;
649
650 p = br_port_get_rcu(state->out);
651 if (p == NULL)
652 return NF_ACCEPT;
653 br = p->br;
654
655 brnet = net_generic(state->net, brnf_net_id);
656 if (!brnet->call_arptables && !br_opt_get(br, BROPT_NF_CALL_ARPTABLES))
657 return NF_ACCEPT;
658
659 if (!IS_ARP(skb)) {
660 if (!is_vlan_arp(skb, state->net))
661 return NF_ACCEPT;
662 nf_bridge_pull_encap_header(skb);
663 }
664
665 if (unlikely(!pskb_may_pull(skb, sizeof(struct arphdr))))
666 return NF_DROP;
667
668 if (arp_hdr(skb)->ar_pln != 4) {
669 if (is_vlan_arp(skb, state->net))
670 nf_bridge_push_encap_header(skb);
671 return NF_ACCEPT;
672 }
673 *d = state->in;
674 NF_HOOK(NFPROTO_ARP, NF_ARP_FORWARD, state->net, state->sk, skb,
675 state->in, state->out, br_nf_forward_finish);
676
677 return NF_STOLEN;
678}
679
680static int br_nf_push_frag_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
681{
682 struct brnf_frag_data *data;
683 int err;
684
685 data = this_cpu_ptr(&brnf_frag_data_storage);
686 err = skb_cow_head(skb, data->size);
687
688 if (err) {
689 kfree_skb(skb);
690 return 0;
691 }
692
693 if (data->vlan_proto)
694 __vlan_hwaccel_put_tag(skb, data->vlan_proto, data->vlan_tci);
695
696 skb_copy_to_linear_data_offset(skb, -data->size, data->mac, data->size);
697 __skb_push(skb, data->encap_size);
698
699 nf_bridge_info_free(skb);
700 return br_dev_queue_push_xmit(net, sk, skb);
701}
702
703static int
704br_nf_ip_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
705 int (*output)(struct net *, struct sock *, struct sk_buff *))
706{
707 unsigned int mtu = ip_skb_dst_mtu(sk, skb);
708 struct iphdr *iph = ip_hdr(skb);
709
710 if (unlikely(((iph->frag_off & htons(IP_DF)) && !skb->ignore_df) ||
711 (IPCB(skb)->frag_max_size &&
712 IPCB(skb)->frag_max_size > mtu))) {
713 IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
714 kfree_skb(skb);
715 return -EMSGSIZE;
716 }
717
718 return ip_do_fragment(net, sk, skb, output);
719}
720
721static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb)
722{
723 const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
724
725 if (nf_bridge->orig_proto == BRNF_PROTO_PPPOE)
726 return PPPOE_SES_HLEN;
727 return 0;
728}
729
730static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
731{
732 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
733 unsigned int mtu, mtu_reserved;
734
735 mtu_reserved = nf_bridge_mtu_reduction(skb);
736 mtu = skb->dev->mtu;
737
738 if (nf_bridge->pkt_otherhost) {
739 skb->pkt_type = PACKET_OTHERHOST;
740 nf_bridge->pkt_otherhost = false;
741 }
742
743 if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
744 mtu = nf_bridge->frag_max_size;
745
746 if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) {
747 nf_bridge_info_free(skb);
748 return br_dev_queue_push_xmit(net, sk, skb);
749 }
750
751
752
753
754 if (IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) &&
755 skb->protocol == htons(ETH_P_IP)) {
756 struct brnf_frag_data *data;
757
758 if (br_validate_ipv4(net, skb))
759 goto drop;
760
761 IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
762
763 nf_bridge_update_protocol(skb);
764
765 data = this_cpu_ptr(&brnf_frag_data_storage);
766
767 if (skb_vlan_tag_present(skb)) {
768 data->vlan_tci = skb->vlan_tci;
769 data->vlan_proto = skb->vlan_proto;
770 } else {
771 data->vlan_proto = 0;
772 }
773
774 data->encap_size = nf_bridge_encap_header_len(skb);
775 data->size = ETH_HLEN + data->encap_size;
776
777 skb_copy_from_linear_data_offset(skb, -data->size, data->mac,
778 data->size);
779
780 return br_nf_ip_fragment(net, sk, skb, br_nf_push_frag_xmit);
781 }
782 if (IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) &&
783 skb->protocol == htons(ETH_P_IPV6)) {
784 const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
785 struct brnf_frag_data *data;
786
787 if (br_validate_ipv6(net, skb))
788 goto drop;
789
790 IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
791
792 nf_bridge_update_protocol(skb);
793
794 data = this_cpu_ptr(&brnf_frag_data_storage);
795 data->encap_size = nf_bridge_encap_header_len(skb);
796 data->size = ETH_HLEN + data->encap_size;
797
798 skb_copy_from_linear_data_offset(skb, -data->size, data->mac,
799 data->size);
800
801 if (v6ops)
802 return v6ops->fragment(net, sk, skb, br_nf_push_frag_xmit);
803
804 kfree_skb(skb);
805 return -EMSGSIZE;
806 }
807 nf_bridge_info_free(skb);
808 return br_dev_queue_push_xmit(net, sk, skb);
809 drop:
810 kfree_skb(skb);
811 return 0;
812}
813
814
815static unsigned int br_nf_post_routing(void *priv,
816 struct sk_buff *skb,
817 const struct nf_hook_state *state)
818{
819 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
820 struct net_device *realoutdev = bridge_parent(skb->dev);
821 u_int8_t pf;
822
823
824
825
826
827
828 if (!nf_bridge || !nf_bridge->physoutdev)
829 return NF_ACCEPT;
830
831 if (!realoutdev)
832 return NF_DROP;
833
834 if (IS_IP(skb) || is_vlan_ip(skb, state->net) ||
835 is_pppoe_ip(skb, state->net))
836 pf = NFPROTO_IPV4;
837 else if (IS_IPV6(skb) || is_vlan_ipv6(skb, state->net) ||
838 is_pppoe_ipv6(skb, state->net))
839 pf = NFPROTO_IPV6;
840 else
841 return NF_ACCEPT;
842
843 if (skb->pkt_type == PACKET_OTHERHOST) {
844 skb->pkt_type = PACKET_HOST;
845 nf_bridge->pkt_otherhost = true;
846 }
847
848 nf_bridge_pull_encap_header(skb);
849 if (pf == NFPROTO_IPV4)
850 skb->protocol = htons(ETH_P_IP);
851 else
852 skb->protocol = htons(ETH_P_IPV6);
853
854 NF_HOOK(pf, NF_INET_POST_ROUTING, state->net, state->sk, skb,
855 NULL, realoutdev,
856 br_nf_dev_queue_xmit);
857
858 return NF_STOLEN;
859}
860
861
862
863
864static unsigned int ip_sabotage_in(void *priv,
865 struct sk_buff *skb,
866 const struct nf_hook_state *state)
867{
868 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
869
870 if (nf_bridge && !nf_bridge->in_prerouting &&
871 !netif_is_l3_master(skb->dev) &&
872 !netif_is_l3_slave(skb->dev)) {
873 state->okfn(state->net, state->sk, skb);
874 return NF_STOLEN;
875 }
876
877 return NF_ACCEPT;
878}
879
880
881
882
883
884
885
886
887
888
889static void br_nf_pre_routing_finish_bridge_slow(struct sk_buff *skb)
890{
891 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
892
893 skb_pull(skb, ETH_HLEN);
894 nf_bridge->bridged_dnat = 0;
895
896 BUILD_BUG_ON(sizeof(nf_bridge->neigh_header) != (ETH_HLEN - ETH_ALEN));
897
898 skb_copy_to_linear_data_offset(skb, -(ETH_HLEN - ETH_ALEN),
899 nf_bridge->neigh_header,
900 ETH_HLEN - ETH_ALEN);
901 skb->dev = nf_bridge->physindev;
902
903 nf_bridge->physoutdev = NULL;
904 br_handle_frame_finish(dev_net(skb->dev), NULL, skb);
905}
906
907static int br_nf_dev_xmit(struct sk_buff *skb)
908{
909 const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
910
911 if (nf_bridge && nf_bridge->bridged_dnat) {
912 br_nf_pre_routing_finish_bridge_slow(skb);
913 return 1;
914 }
915 return 0;
916}
917
918static const struct nf_br_ops br_ops = {
919 .br_dev_xmit_hook = br_nf_dev_xmit,
920};
921
922
923
924static const struct nf_hook_ops br_nf_ops[] = {
925 {
926 .hook = br_nf_pre_routing,
927 .pf = NFPROTO_BRIDGE,
928 .hooknum = NF_BR_PRE_ROUTING,
929 .priority = NF_BR_PRI_BRNF,
930 },
931 {
932 .hook = br_nf_forward_ip,
933 .pf = NFPROTO_BRIDGE,
934 .hooknum = NF_BR_FORWARD,
935 .priority = NF_BR_PRI_BRNF - 1,
936 },
937 {
938 .hook = br_nf_forward_arp,
939 .pf = NFPROTO_BRIDGE,
940 .hooknum = NF_BR_FORWARD,
941 .priority = NF_BR_PRI_BRNF,
942 },
943 {
944 .hook = br_nf_post_routing,
945 .pf = NFPROTO_BRIDGE,
946 .hooknum = NF_BR_POST_ROUTING,
947 .priority = NF_BR_PRI_LAST,
948 },
949 {
950 .hook = ip_sabotage_in,
951 .pf = NFPROTO_IPV4,
952 .hooknum = NF_INET_PRE_ROUTING,
953 .priority = NF_IP_PRI_FIRST,
954 },
955 {
956 .hook = ip_sabotage_in,
957 .pf = NFPROTO_IPV6,
958 .hooknum = NF_INET_PRE_ROUTING,
959 .priority = NF_IP6_PRI_FIRST,
960 },
961};
962
963static int brnf_device_event(struct notifier_block *unused, unsigned long event,
964 void *ptr)
965{
966 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
967 struct brnf_net *brnet;
968 struct net *net;
969 int ret;
970
971 if (event != NETDEV_REGISTER || !(dev->priv_flags & IFF_EBRIDGE))
972 return NOTIFY_DONE;
973
974 ASSERT_RTNL();
975
976 net = dev_net(dev);
977 brnet = net_generic(net, brnf_net_id);
978 if (brnet->enabled)
979 return NOTIFY_OK;
980
981 ret = nf_register_net_hooks(net, br_nf_ops, ARRAY_SIZE(br_nf_ops));
982 if (ret)
983 return NOTIFY_BAD;
984
985 brnet->enabled = true;
986 return NOTIFY_OK;
987}
988
989static struct notifier_block brnf_notifier __read_mostly = {
990 .notifier_call = brnf_device_event,
991};
992
993
994
995
996
997
998int br_nf_hook_thresh(unsigned int hook, struct net *net,
999 struct sock *sk, struct sk_buff *skb,
1000 struct net_device *indev,
1001 struct net_device *outdev,
1002 int (*okfn)(struct net *, struct sock *,
1003 struct sk_buff *))
1004{
1005 const struct nf_hook_entries *e;
1006 struct nf_hook_state state;
1007 struct nf_hook_ops **ops;
1008 unsigned int i;
1009 int ret;
1010
1011 e = rcu_dereference(net->nf.hooks_bridge[hook]);
1012 if (!e)
1013 return okfn(net, sk, skb);
1014
1015 ops = nf_hook_entries_get_hook_ops(e);
1016 for (i = 0; i < e->num_hook_entries &&
1017 ops[i]->priority <= NF_BR_PRI_BRNF; i++)
1018 ;
1019
1020 nf_hook_state_init(&state, hook, NFPROTO_BRIDGE, indev, outdev,
1021 sk, net, okfn);
1022
1023 ret = nf_hook_slow(skb, &state, e, i);
1024 if (ret == 1)
1025 ret = okfn(net, sk, skb);
1026
1027 return ret;
1028}
1029
1030#ifdef CONFIG_SYSCTL
1031static
1032int brnf_sysctl_call_tables(struct ctl_table *ctl, int write,
1033 void *buffer, size_t *lenp, loff_t *ppos)
1034{
1035 int ret;
1036
1037 ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
1038
1039 if (write && *(int *)(ctl->data))
1040 *(int *)(ctl->data) = 1;
1041 return ret;
1042}
1043
1044static struct ctl_table brnf_table[] = {
1045 {
1046 .procname = "bridge-nf-call-arptables",
1047 .maxlen = sizeof(int),
1048 .mode = 0644,
1049 .proc_handler = brnf_sysctl_call_tables,
1050 },
1051 {
1052 .procname = "bridge-nf-call-iptables",
1053 .maxlen = sizeof(int),
1054 .mode = 0644,
1055 .proc_handler = brnf_sysctl_call_tables,
1056 },
1057 {
1058 .procname = "bridge-nf-call-ip6tables",
1059 .maxlen = sizeof(int),
1060 .mode = 0644,
1061 .proc_handler = brnf_sysctl_call_tables,
1062 },
1063 {
1064 .procname = "bridge-nf-filter-vlan-tagged",
1065 .maxlen = sizeof(int),
1066 .mode = 0644,
1067 .proc_handler = brnf_sysctl_call_tables,
1068 },
1069 {
1070 .procname = "bridge-nf-filter-pppoe-tagged",
1071 .maxlen = sizeof(int),
1072 .mode = 0644,
1073 .proc_handler = brnf_sysctl_call_tables,
1074 },
1075 {
1076 .procname = "bridge-nf-pass-vlan-input-dev",
1077 .maxlen = sizeof(int),
1078 .mode = 0644,
1079 .proc_handler = brnf_sysctl_call_tables,
1080 },
1081 { }
1082};
1083
1084static inline void br_netfilter_sysctl_default(struct brnf_net *brnf)
1085{
1086 brnf->call_iptables = 1;
1087 brnf->call_ip6tables = 1;
1088 brnf->call_arptables = 1;
1089 brnf->filter_vlan_tagged = 0;
1090 brnf->filter_pppoe_tagged = 0;
1091 brnf->pass_vlan_indev = 0;
1092}
1093
1094static int br_netfilter_sysctl_init_net(struct net *net)
1095{
1096 struct ctl_table *table = brnf_table;
1097 struct brnf_net *brnet;
1098
1099 if (!net_eq(net, &init_net)) {
1100 table = kmemdup(table, sizeof(brnf_table), GFP_KERNEL);
1101 if (!table)
1102 return -ENOMEM;
1103 }
1104
1105 brnet = net_generic(net, brnf_net_id);
1106 table[0].data = &brnet->call_arptables;
1107 table[1].data = &brnet->call_iptables;
1108 table[2].data = &brnet->call_ip6tables;
1109 table[3].data = &brnet->filter_vlan_tagged;
1110 table[4].data = &brnet->filter_pppoe_tagged;
1111 table[5].data = &brnet->pass_vlan_indev;
1112
1113 br_netfilter_sysctl_default(brnet);
1114
1115 brnet->ctl_hdr = register_net_sysctl(net, "net/bridge", table);
1116 if (!brnet->ctl_hdr) {
1117 if (!net_eq(net, &init_net))
1118 kfree(table);
1119
1120 return -ENOMEM;
1121 }
1122
1123 return 0;
1124}
1125
1126static void br_netfilter_sysctl_exit_net(struct net *net,
1127 struct brnf_net *brnet)
1128{
1129 struct ctl_table *table = brnet->ctl_hdr->ctl_table_arg;
1130
1131 unregister_net_sysctl_table(brnet->ctl_hdr);
1132 if (!net_eq(net, &init_net))
1133 kfree(table);
1134}
1135
1136static int __net_init brnf_init_net(struct net *net)
1137{
1138 return br_netfilter_sysctl_init_net(net);
1139}
1140#endif
1141
1142static void __net_exit brnf_exit_net(struct net *net)
1143{
1144 struct brnf_net *brnet;
1145
1146 brnet = net_generic(net, brnf_net_id);
1147 if (brnet->enabled) {
1148 nf_unregister_net_hooks(net, br_nf_ops, ARRAY_SIZE(br_nf_ops));
1149 brnet->enabled = false;
1150 }
1151
1152#ifdef CONFIG_SYSCTL
1153 br_netfilter_sysctl_exit_net(net, brnet);
1154#endif
1155}
1156
1157static struct pernet_operations brnf_net_ops __read_mostly = {
1158#ifdef CONFIG_SYSCTL
1159 .init = brnf_init_net,
1160#endif
1161 .exit = brnf_exit_net,
1162 .id = &brnf_net_id,
1163 .size = sizeof(struct brnf_net),
1164};
1165
1166static int __init br_netfilter_init(void)
1167{
1168 int ret;
1169
1170 ret = register_pernet_subsys(&brnf_net_ops);
1171 if (ret < 0)
1172 return ret;
1173
1174 ret = register_netdevice_notifier(&brnf_notifier);
1175 if (ret < 0) {
1176 unregister_pernet_subsys(&brnf_net_ops);
1177 return ret;
1178 }
1179
1180 RCU_INIT_POINTER(nf_br_ops, &br_ops);
1181 printk(KERN_NOTICE "Bridge firewalling registered\n");
1182 return 0;
1183}
1184
1185static void __exit br_netfilter_fini(void)
1186{
1187 RCU_INIT_POINTER(nf_br_ops, NULL);
1188 unregister_netdevice_notifier(&brnf_notifier);
1189 unregister_pernet_subsys(&brnf_net_ops);
1190}
1191
1192module_init(br_netfilter_init);
1193module_exit(br_netfilter_fini);
1194
1195MODULE_LICENSE("GPL");
1196MODULE_AUTHOR("Lennert Buytenhek <buytenh@gnu.org>");
1197MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
1198MODULE_DESCRIPTION("Linux ethernet netfilter firewall bridge");
1199