[mirror_ubuntu-bionic-kernel.git] / net / bridge / br_netfilter_ipv6.c

/*
 *	Handle firewalling
 *	Linux ethernet bridge
 *
 *	Authors:
 *	Lennert Buytenhek		<buytenh@gnu.org>
 *	Bart De Schuymer		<bdschuym@pandora.be>
 *
 *	This program is free software; you can redistribute it and/or
 *	modify it under the terms of the GNU General Public License
 *	as published by the Free Software Foundation; either version
 *	2 of the License, or (at your option) any later version.
 *
 *	Lennert dedicates this file to Kerstin Wurdinger.
 */

#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/ip.h>
#include <linux/netdevice.h>
#include <linux/skbuff.h>
#include <linux/if_arp.h>
#include <linux/if_ether.h>
#include <linux/if_vlan.h>
#include <linux/if_pppox.h>
#include <linux/ppp_defs.h>
#include <linux/netfilter_bridge.h>
#include <linux/netfilter_ipv4.h>
#include <linux/netfilter_ipv6.h>
#include <linux/netfilter_arp.h>
#include <linux/in_route.h>
#include <linux/inetdevice.h>

#include <net/ip.h>
#include <net/ipv6.h>
#include <net/addrconf.h>
#include <net/route.h>
#include <net/netfilter/br_netfilter.h>

#include <linux/uaccess.h>
#include "br_private.h"
#ifdef CONFIG_SYSCTL
#include <linux/sysctl.h>
#endif

/* We only check the length. A bridge shouldn't do any hop-by-hop stuff
 * anyway
 */
static int br_nf_check_hbh_len(struct sk_buff *skb)
{
	unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
	u32 pkt_len;
	const unsigned char *nh = skb_network_header(skb);
	int off = raw - nh;
	int len = (raw[1] + 1) << 3;

	if ((raw + len) - skb->data > skb_headlen(skb))
		goto bad;

	off += 2;
	len -= 2;

	while (len > 0) {
		int optlen = nh[off + 1] + 2;

		switch (nh[off]) {
		case IPV6_TLV_PAD1:
			optlen = 1;
			break;

		case IPV6_TLV_PADN:
			break;

		case IPV6_TLV_JUMBO:
			if (nh[off + 1] != 4 || (off & 3) != 2)
				goto bad;
			pkt_len = ntohl(*(__be32 *)(nh + off + 2));
			if (pkt_len <= IPV6_MAXPLEN ||
			    ipv6_hdr(skb)->payload_len)
				goto bad;
			if (pkt_len > skb->len - sizeof(struct ipv6hdr))
				goto bad;
			if (pskb_trim_rcsum(skb,
					    pkt_len + sizeof(struct ipv6hdr)))
				goto bad;
			nh = skb_network_header(skb);
			break;
		default:
			if (optlen > len)
				goto bad;
			break;
		}
		off += optlen;
		len -= optlen;
	}
	if (len == 0)
		return 0;
bad:
	return -1;
}

int br_validate_ipv6(struct net *net, struct sk_buff *skb)
{
	const struct ipv6hdr *hdr;
	struct inet6_dev *idev = __in6_dev_get(skb->dev);
	u32 pkt_len;
	u8 ip6h_len = sizeof(struct ipv6hdr);

	if (!pskb_may_pull(skb, ip6h_len))
		goto inhdr_error;

	if (skb->len < ip6h_len)
		goto drop;

	hdr = ipv6_hdr(skb);

	if (hdr->version != 6)
		goto inhdr_error;

	pkt_len = ntohs(hdr->payload_len);

	if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
		if (pkt_len + ip6h_len > skb->len) {
			__IP6_INC_STATS(net, idev,
					IPSTATS_MIB_INTRUNCATEDPKTS);
			goto drop;
		}
		if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
			__IP6_INC_STATS(net, idev,
					IPSTATS_MIB_INDISCARDS);
			goto drop;
		}
		hdr = ipv6_hdr(skb);
	}
	if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb))
		goto drop;

	memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
	/* No IP options in IPv6 header; however it should be
	 * checked if some next headers need special treatment
	 */
	return 0;

inhdr_error:
	__IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
drop:
	return -1;
}

static inline bool
br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
			     const struct nf_bridge_info *nf_bridge)
{
	return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
		      sizeof(ipv6_hdr(skb)->daddr)) != 0;
}

/* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
 * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
 * for br_nf_pre_routing_finish(), same logic is used here but
 * equivalent IPv6 function ip6_route_input() called indirectly.
 */
static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb)
{
	struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
	struct rtable *rt;
	struct net_device *dev = skb->dev;
	const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();

	nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;

	if (nf_bridge->pkt_otherhost) {
		skb->pkt_type = PACKET_OTHERHOST;
		nf_bridge->pkt_otherhost = false;
	}
	nf_bridge->in_prerouting = 0;
	if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
		skb_dst_drop(skb);
		v6ops->route_input(skb);

		if (skb_dst(skb)->error) {
			kfree_skb(skb);
			return 0;
		}

		if (skb_dst(skb)->dev == dev) {
			skb->dev = nf_bridge->physindev;
			nf_bridge_update_protocol(skb);
			nf_bridge_push_encap_header(skb);
			br_nf_hook_thresh(NF_BR_PRE_ROUTING,
					  net, sk, skb, skb->dev, NULL,
					  br_nf_pre_routing_finish_bridge);
			return 0;
		}
		ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
		skb->pkt_type = PACKET_HOST;
	} else {
		rt = bridge_parent_rtable(nf_bridge->physindev);
		if (!rt) {
			kfree_skb(skb);
			return 0;
		}
		skb_dst_set_noref(skb, &rt->dst);
	}

	skb->dev = nf_bridge->physindev;
	nf_bridge_update_protocol(skb);
	nf_bridge_push_encap_header(skb);
	br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb,
			  skb->dev, NULL, br_handle_frame_finish);

	return 0;
}

/* Replicate the checks that IPv6 does on packet reception and pass the packet
 * to ip6tables.
 */
unsigned int br_nf_pre_routing_ipv6(void *priv,
				    struct sk_buff *skb,
				    const struct nf_hook_state *state)
{
	struct nf_bridge_info *nf_bridge;

	if (br_validate_ipv6(state->net, skb))
		return NF_DROP;

	nf_bridge_put(skb->nf_bridge);
	if (!nf_bridge_alloc(skb))
		return NF_DROP;
	if (!setup_pre_routing(skb, state->net))
		return NF_DROP;

	nf_bridge = nf_bridge_info_get(skb);
	nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;

	skb->protocol = htons(ETH_P_IPV6);
	skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);

	NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
		skb->dev, NULL,
		br_nf_pre_routing_finish_ipv6);

	return NF_STOLEN;
}
Commit	Line	Data
230ac490 PNA	1	/*
	2	* Handle firewalling
	3	* Linux ethernet bridge
	4	*
	5	* Authors:
	6	* Lennert Buytenhek <buytenh@gnu.org>
	7	* Bart De Schuymer <bdschuym@pandora.be>
	8	*
	9	* This program is free software; you can redistribute it and/or
	10	* modify it under the terms of the GNU General Public License
	11	* as published by the Free Software Foundation; either version
	12	* 2 of the License, or (at your option) any later version.
	13	*
	14	* Lennert dedicates this file to Kerstin Wurdinger.
	15	*/
	16
	17	#include <linux/module.h>
	18	#include <linux/kernel.h>
	19	#include <linux/slab.h>
	20	#include <linux/ip.h>
	21	#include <linux/netdevice.h>
	22	#include <linux/skbuff.h>
	23	#include <linux/if_arp.h>
	24	#include <linux/if_ether.h>
	25	#include <linux/if_vlan.h>
	26	#include <linux/if_pppox.h>
	27	#include <linux/ppp_defs.h>
	28	#include <linux/netfilter_bridge.h>
	29	#include <linux/netfilter_ipv4.h>
	30	#include <linux/netfilter_ipv6.h>
	31	#include <linux/netfilter_arp.h>
	32	#include <linux/in_route.h>
	33	#include <linux/inetdevice.h>
	34
	35	#include <net/ip.h>
	36	#include <net/ipv6.h>
	37	#include <net/addrconf.h>
	38	#include <net/route.h>
	39	#include <net/netfilter/br_netfilter.h>
	40
7c0f6ba6	41	#include <linux/uaccess.h>
230ac490 PNA	42	#include "br_private.h"
	43	#ifdef CONFIG_SYSCTL
	44	#include <linux/sysctl.h>
	45	#endif
	46
	47	/* We only check the length. A bridge shouldn't do any hop-by-hop stuff
	48	* anyway
	49	*/
	50	static int br_nf_check_hbh_len(struct sk_buff *skb)
	51	{
	52	unsigned char raw = (u8 )(ipv6_hdr(skb) + 1);
	53	u32 pkt_len;
	54	const unsigned char *nh = skb_network_header(skb);
	55	int off = raw - nh;
	56	int len = (raw[1] + 1) << 3;
	57
	58	if ((raw + len) - skb->data > skb_headlen(skb))
	59	goto bad;
	60
	61	off += 2;
	62	len -= 2;
	63
	64	while (len > 0) {
	65	int optlen = nh[off + 1] + 2;
	66
	67	switch (nh[off]) {
	68	case IPV6_TLV_PAD1:
	69	optlen = 1;
	70	break;
	71
	72	case IPV6_TLV_PADN:
	73	break;
	74
	75	case IPV6_TLV_JUMBO:
	76	if (nh[off + 1] != 4 \|\| (off & 3) != 2)
	77	goto bad;
	78	pkt_len = ntohl((__be32 )(nh + off + 2));
	79	if (pkt_len <= IPV6_MAXPLEN \|\|
	80	ipv6_hdr(skb)->payload_len)
	81	goto bad;
	82	if (pkt_len > skb->len - sizeof(struct ipv6hdr))
	83	goto bad;
	84	if (pskb_trim_rcsum(skb,
	85	pkt_len + sizeof(struct ipv6hdr)))
	86	goto bad;
	87	nh = skb_network_header(skb);
	88	break;
	89	default:
	90	if (optlen > len)
	91	goto bad;
	92	break;
	93	}
	94	off += optlen;
	95	len -= optlen;
	96	}
	97	if (len == 0)
	98	return 0;
	99	bad:
	100	return -1;
	101	}
	102
c1444c63	103	int br_validate_ipv6(struct net net, struct sk_buff skb)
230ac490 PNA	104	{
230ac490 PNA	105	const struct ipv6hdr *hdr;
86e89718	106	struct inet6_dev *idev = __in6_dev_get(skb->dev);
230ac490 PNA	107	u32 pkt_len;
	108	u8 ip6h_len = sizeof(struct ipv6hdr);
	109
	110	if (!pskb_may_pull(skb, ip6h_len))
	111	goto inhdr_error;
	112
	113	if (skb->len < ip6h_len)
	114	goto drop;
	115
	116	hdr = ipv6_hdr(skb);
	117
	118	if (hdr->version != 6)
	119	goto inhdr_error;
	120
	121	pkt_len = ntohs(hdr->payload_len);
	122
	123	if (pkt_len \|\| hdr->nexthdr != NEXTHDR_HOP) {
	124	if (pkt_len + ip6h_len > skb->len) {
1d015503 ED	125	__IP6_INC_STATS(net, idev,
1d015503 ED	126	IPSTATS_MIB_INTRUNCATEDPKTS);
230ac490 PNA	127	goto drop;
	128	}
	129	if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
1d015503 ED	130	__IP6_INC_STATS(net, idev,
1d015503 ED	131	IPSTATS_MIB_INDISCARDS);
230ac490 PNA	132	goto drop;
230ac490 PNA	133	}
fc4dee53	134	hdr = ipv6_hdr(skb);
230ac490 PNA	135	}
	136	if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb))
	137	goto drop;
	138
	139	memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
	140	/* No IP options in IPv6 header; however it should be
	141	* checked if some next headers need special treatment
	142	*/
	143	return 0;
	144
	145	inhdr_error:
1d015503	146	__IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
230ac490 PNA	147	drop:
	148	return -1;
	149	}
	150
	151	static inline bool
	152	br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
	153	const struct nf_bridge_info *nf_bridge)
	154	{
	155	return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
	156	sizeof(ipv6_hdr(skb)->daddr)) != 0;
	157	}
	158
	159	/* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
	160	* PREROUTING and continue the bridge PRE_ROUTING hook. See comment
	161	* for br_nf_pre_routing_finish(), same logic is used here but
	162	* equivalent IPv6 function ip6_route_input() called indirectly.
	163	*/
0c4b51f0	164	static int br_nf_pre_routing_finish_ipv6(struct net net, struct sock sk, struct sk_buff *skb)
230ac490 PNA	165	{
	166	struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
	167	struct rtable *rt;
	168	struct net_device *dev = skb->dev;
	169	const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
	170
	171	nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
	172
	173	if (nf_bridge->pkt_otherhost) {
	174	skb->pkt_type = PACKET_OTHERHOST;
	175	nf_bridge->pkt_otherhost = false;
	176	}
72b1e5e4	177	nf_bridge->in_prerouting = 0;
230ac490 PNA	178	if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
	179	skb_dst_drop(skb);
	180	v6ops->route_input(skb);
	181
	182	if (skb_dst(skb)->error) {
	183	kfree_skb(skb);
	184	return 0;
	185	}
	186
	187	if (skb_dst(skb)->dev == dev) {
	188	skb->dev = nf_bridge->physindev;
	189	nf_bridge_update_protocol(skb);
	190	nf_bridge_push_encap_header(skb);
c5136b15 FW	191	br_nf_hook_thresh(NF_BR_PRE_ROUTING,
	192	net, sk, skb, skb->dev, NULL,
	193	br_nf_pre_routing_finish_bridge);
230ac490 PNA	194	return 0;
	195	}
	196	ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
	197	skb->pkt_type = PACKET_HOST;
	198	} else {
	199	rt = bridge_parent_rtable(nf_bridge->physindev);
	200	if (!rt) {
	201	kfree_skb(skb);
	202	return 0;
	203	}
	204	skb_dst_set_noref(skb, &rt->dst);
	205	}
	206
	207	skb->dev = nf_bridge->physindev;
	208	nf_bridge_update_protocol(skb);
	209	nf_bridge_push_encap_header(skb);
c5136b15 FW	210	br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb,
c5136b15 FW	211	skb->dev, NULL, br_handle_frame_finish);
230ac490 PNA	212
	213	return 0;
	214	}
	215
	216	/* Replicate the checks that IPv6 does on packet reception and pass the packet
	217	* to ip6tables.
	218	*/
06198b34	219	unsigned int br_nf_pre_routing_ipv6(void *priv,
230ac490 PNA	220	struct sk_buff *skb,
	221	const struct nf_hook_state *state)
	222	{
	223	struct nf_bridge_info *nf_bridge;
	224
c1444c63	225	if (br_validate_ipv6(state->net, skb))
230ac490 PNA	226	return NF_DROP;
	227
	228	nf_bridge_put(skb->nf_bridge);
	229	if (!nf_bridge_alloc(skb))
	230	return NF_DROP;
fb0b8628	231	if (!setup_pre_routing(skb, state->net))
230ac490 PNA	232	return NF_DROP;
	233
	234	nf_bridge = nf_bridge_info_get(skb);
	235	nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
	236
	237	skb->protocol = htons(ETH_P_IPV6);
3442e060 XL	238	skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);
3442e060 XL	239
29a26a56	240	NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
230ac490 PNA	241	skb->dev, NULL,
	242	br_nf_pre_routing_finish_ipv6);
	243
	244	return NF_STOLEN;
	245	}