]>
Commit | Line | Data |
---|---|---|
230ac490 PNA |
1 | /* |
2 | * Handle firewalling | |
3 | * Linux ethernet bridge | |
4 | * | |
5 | * Authors: | |
6 | * Lennert Buytenhek <buytenh@gnu.org> | |
7 | * Bart De Schuymer <bdschuym@pandora.be> | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or | |
10 | * modify it under the terms of the GNU General Public License | |
11 | * as published by the Free Software Foundation; either version | |
12 | * 2 of the License, or (at your option) any later version. | |
13 | * | |
14 | * Lennert dedicates this file to Kerstin Wurdinger. | |
15 | */ | |
16 | ||
17 | #include <linux/module.h> | |
18 | #include <linux/kernel.h> | |
19 | #include <linux/slab.h> | |
20 | #include <linux/ip.h> | |
21 | #include <linux/netdevice.h> | |
22 | #include <linux/skbuff.h> | |
23 | #include <linux/if_arp.h> | |
24 | #include <linux/if_ether.h> | |
25 | #include <linux/if_vlan.h> | |
26 | #include <linux/if_pppox.h> | |
27 | #include <linux/ppp_defs.h> | |
28 | #include <linux/netfilter_bridge.h> | |
29 | #include <linux/netfilter_ipv4.h> | |
30 | #include <linux/netfilter_ipv6.h> | |
31 | #include <linux/netfilter_arp.h> | |
32 | #include <linux/in_route.h> | |
33 | #include <linux/inetdevice.h> | |
34 | ||
35 | #include <net/ip.h> | |
36 | #include <net/ipv6.h> | |
37 | #include <net/addrconf.h> | |
38 | #include <net/route.h> | |
39 | #include <net/netfilter/br_netfilter.h> | |
40 | ||
41 | #include <asm/uaccess.h> | |
42 | #include "br_private.h" | |
43 | #ifdef CONFIG_SYSCTL | |
44 | #include <linux/sysctl.h> | |
45 | #endif | |
46 | ||
47 | /* We only check the length. A bridge shouldn't do any hop-by-hop stuff | |
48 | * anyway | |
49 | */ | |
50 | static int br_nf_check_hbh_len(struct sk_buff *skb) | |
51 | { | |
52 | unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1); | |
53 | u32 pkt_len; | |
54 | const unsigned char *nh = skb_network_header(skb); | |
55 | int off = raw - nh; | |
56 | int len = (raw[1] + 1) << 3; | |
57 | ||
58 | if ((raw + len) - skb->data > skb_headlen(skb)) | |
59 | goto bad; | |
60 | ||
61 | off += 2; | |
62 | len -= 2; | |
63 | ||
64 | while (len > 0) { | |
65 | int optlen = nh[off + 1] + 2; | |
66 | ||
67 | switch (nh[off]) { | |
68 | case IPV6_TLV_PAD1: | |
69 | optlen = 1; | |
70 | break; | |
71 | ||
72 | case IPV6_TLV_PADN: | |
73 | break; | |
74 | ||
75 | case IPV6_TLV_JUMBO: | |
76 | if (nh[off + 1] != 4 || (off & 3) != 2) | |
77 | goto bad; | |
78 | pkt_len = ntohl(*(__be32 *)(nh + off + 2)); | |
79 | if (pkt_len <= IPV6_MAXPLEN || | |
80 | ipv6_hdr(skb)->payload_len) | |
81 | goto bad; | |
82 | if (pkt_len > skb->len - sizeof(struct ipv6hdr)) | |
83 | goto bad; | |
84 | if (pskb_trim_rcsum(skb, | |
85 | pkt_len + sizeof(struct ipv6hdr))) | |
86 | goto bad; | |
87 | nh = skb_network_header(skb); | |
88 | break; | |
89 | default: | |
90 | if (optlen > len) | |
91 | goto bad; | |
92 | break; | |
93 | } | |
94 | off += optlen; | |
95 | len -= optlen; | |
96 | } | |
97 | if (len == 0) | |
98 | return 0; | |
99 | bad: | |
100 | return -1; | |
101 | } | |
102 | ||
103 | int br_validate_ipv6(struct sk_buff *skb) | |
104 | { | |
105 | const struct ipv6hdr *hdr; | |
106 | struct net_device *dev = skb->dev; | |
86e89718 | 107 | struct inet6_dev *idev = __in6_dev_get(skb->dev); |
230ac490 PNA |
108 | u32 pkt_len; |
109 | u8 ip6h_len = sizeof(struct ipv6hdr); | |
110 | ||
111 | if (!pskb_may_pull(skb, ip6h_len)) | |
112 | goto inhdr_error; | |
113 | ||
114 | if (skb->len < ip6h_len) | |
115 | goto drop; | |
116 | ||
117 | hdr = ipv6_hdr(skb); | |
118 | ||
119 | if (hdr->version != 6) | |
120 | goto inhdr_error; | |
121 | ||
122 | pkt_len = ntohs(hdr->payload_len); | |
123 | ||
124 | if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) { | |
125 | if (pkt_len + ip6h_len > skb->len) { | |
126 | IP6_INC_STATS_BH(dev_net(dev), idev, | |
127 | IPSTATS_MIB_INTRUNCATEDPKTS); | |
128 | goto drop; | |
129 | } | |
130 | if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) { | |
131 | IP6_INC_STATS_BH(dev_net(dev), idev, | |
132 | IPSTATS_MIB_INDISCARDS); | |
133 | goto drop; | |
134 | } | |
135 | } | |
136 | if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb)) | |
137 | goto drop; | |
138 | ||
139 | memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); | |
140 | /* No IP options in IPv6 header; however it should be | |
141 | * checked if some next headers need special treatment | |
142 | */ | |
143 | return 0; | |
144 | ||
145 | inhdr_error: | |
146 | IP6_INC_STATS_BH(dev_net(dev), idev, IPSTATS_MIB_INHDRERRORS); | |
147 | drop: | |
148 | return -1; | |
149 | } | |
150 | ||
151 | static inline bool | |
152 | br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb, | |
153 | const struct nf_bridge_info *nf_bridge) | |
154 | { | |
155 | return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr, | |
156 | sizeof(ipv6_hdr(skb)->daddr)) != 0; | |
157 | } | |
158 | ||
159 | /* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables | |
160 | * PREROUTING and continue the bridge PRE_ROUTING hook. See comment | |
161 | * for br_nf_pre_routing_finish(), same logic is used here but | |
162 | * equivalent IPv6 function ip6_route_input() called indirectly. | |
163 | */ | |
0c4b51f0 | 164 | static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb) |
230ac490 PNA |
165 | { |
166 | struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); | |
167 | struct rtable *rt; | |
168 | struct net_device *dev = skb->dev; | |
169 | const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops(); | |
170 | ||
171 | nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size; | |
172 | ||
173 | if (nf_bridge->pkt_otherhost) { | |
174 | skb->pkt_type = PACKET_OTHERHOST; | |
175 | nf_bridge->pkt_otherhost = false; | |
176 | } | |
72b1e5e4 | 177 | nf_bridge->in_prerouting = 0; |
230ac490 PNA |
178 | if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) { |
179 | skb_dst_drop(skb); | |
180 | v6ops->route_input(skb); | |
181 | ||
182 | if (skb_dst(skb)->error) { | |
183 | kfree_skb(skb); | |
184 | return 0; | |
185 | } | |
186 | ||
187 | if (skb_dst(skb)->dev == dev) { | |
188 | skb->dev = nf_bridge->physindev; | |
189 | nf_bridge_update_protocol(skb); | |
190 | nf_bridge_push_encap_header(skb); | |
191 | NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, | |
29a26a56 | 192 | net, sk, skb, skb->dev, NULL, |
230ac490 PNA |
193 | br_nf_pre_routing_finish_bridge, |
194 | 1); | |
195 | return 0; | |
196 | } | |
197 | ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr); | |
198 | skb->pkt_type = PACKET_HOST; | |
199 | } else { | |
200 | rt = bridge_parent_rtable(nf_bridge->physindev); | |
201 | if (!rt) { | |
202 | kfree_skb(skb); | |
203 | return 0; | |
204 | } | |
205 | skb_dst_set_noref(skb, &rt->dst); | |
206 | } | |
207 | ||
208 | skb->dev = nf_bridge->physindev; | |
209 | nf_bridge_update_protocol(skb); | |
210 | nf_bridge_push_encap_header(skb); | |
29a26a56 | 211 | NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, net, sk, skb, |
230ac490 PNA |
212 | skb->dev, NULL, |
213 | br_handle_frame_finish, 1); | |
214 | ||
215 | return 0; | |
216 | } | |
217 | ||
218 | /* Replicate the checks that IPv6 does on packet reception and pass the packet | |
219 | * to ip6tables. | |
220 | */ | |
06198b34 | 221 | unsigned int br_nf_pre_routing_ipv6(void *priv, |
230ac490 PNA |
222 | struct sk_buff *skb, |
223 | const struct nf_hook_state *state) | |
224 | { | |
225 | struct nf_bridge_info *nf_bridge; | |
226 | ||
227 | if (br_validate_ipv6(skb)) | |
228 | return NF_DROP; | |
229 | ||
230 | nf_bridge_put(skb->nf_bridge); | |
231 | if (!nf_bridge_alloc(skb)) | |
232 | return NF_DROP; | |
233 | if (!setup_pre_routing(skb)) | |
234 | return NF_DROP; | |
235 | ||
236 | nf_bridge = nf_bridge_info_get(skb); | |
237 | nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr; | |
238 | ||
239 | skb->protocol = htons(ETH_P_IPV6); | |
29a26a56 | 240 | NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb, |
230ac490 PNA |
241 | skb->dev, NULL, |
242 | br_nf_pre_routing_finish_ipv6); | |
243 | ||
244 | return NF_STOLEN; | |
245 | } |