3 * Linux ethernet bridge
6 * Lennert Buytenhek <buytenh@gnu.org>
7 * Bart De Schuymer <bdschuym@pandora.be>
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * as published by the Free Software Foundation; either version
12 * 2 of the License, or (at your option) any later version.
14 * Lennert dedicates this file to Kerstin Wurdinger.
17 #include <linux/module.h>
18 #include <linux/kernel.h>
19 #include <linux/slab.h>
21 #include <linux/netdevice.h>
22 #include <linux/skbuff.h>
23 #include <linux/if_arp.h>
24 #include <linux/if_ether.h>
25 #include <linux/if_vlan.h>
26 #include <linux/if_pppox.h>
27 #include <linux/ppp_defs.h>
28 #include <linux/netfilter_bridge.h>
29 #include <linux/netfilter_ipv4.h>
30 #include <linux/netfilter_ipv6.h>
31 #include <linux/netfilter_arp.h>
32 #include <linux/in_route.h>
33 #include <linux/inetdevice.h>
37 #include <net/addrconf.h>
38 #include <net/route.h>
39 #include <net/netfilter/br_netfilter.h>
41 #include <linux/uaccess.h>
42 #include "br_private.h"
44 #include <linux/sysctl.h>
47 /* We only check the length. A bridge shouldn't do any hop-by-hop stuff
50 static int br_nf_check_hbh_len(struct sk_buff
*skb
)
52 unsigned char *raw
= (u8
*)(ipv6_hdr(skb
) + 1);
54 const unsigned char *nh
= skb_network_header(skb
);
56 int len
= (raw
[1] + 1) << 3;
58 if ((raw
+ len
) - skb
->data
> skb_headlen(skb
))
65 int optlen
= nh
[off
+ 1] + 2;
76 if (nh
[off
+ 1] != 4 || (off
& 3) != 2)
78 pkt_len
= ntohl(*(__be32
*)(nh
+ off
+ 2));
79 if (pkt_len
<= IPV6_MAXPLEN
||
80 ipv6_hdr(skb
)->payload_len
)
82 if (pkt_len
> skb
->len
- sizeof(struct ipv6hdr
))
84 if (pskb_trim_rcsum(skb
,
85 pkt_len
+ sizeof(struct ipv6hdr
)))
87 nh
= skb_network_header(skb
);
103 int br_validate_ipv6(struct net
*net
, struct sk_buff
*skb
)
105 const struct ipv6hdr
*hdr
;
106 struct inet6_dev
*idev
= __in6_dev_get(skb
->dev
);
108 u8 ip6h_len
= sizeof(struct ipv6hdr
);
110 if (!pskb_may_pull(skb
, ip6h_len
))
113 if (skb
->len
< ip6h_len
)
118 if (hdr
->version
!= 6)
121 pkt_len
= ntohs(hdr
->payload_len
);
123 if (pkt_len
|| hdr
->nexthdr
!= NEXTHDR_HOP
) {
124 if (pkt_len
+ ip6h_len
> skb
->len
) {
125 __IP6_INC_STATS(net
, idev
,
126 IPSTATS_MIB_INTRUNCATEDPKTS
);
129 if (pskb_trim_rcsum(skb
, pkt_len
+ ip6h_len
)) {
130 __IP6_INC_STATS(net
, idev
,
131 IPSTATS_MIB_INDISCARDS
);
135 if (hdr
->nexthdr
== NEXTHDR_HOP
&& br_nf_check_hbh_len(skb
))
138 memset(IP6CB(skb
), 0, sizeof(struct inet6_skb_parm
));
139 /* No IP options in IPv6 header; however it should be
140 * checked if some next headers need special treatment
145 __IP6_INC_STATS(net
, idev
, IPSTATS_MIB_INHDRERRORS
);
151 br_nf_ipv6_daddr_was_changed(const struct sk_buff
*skb
,
152 const struct nf_bridge_info
*nf_bridge
)
154 return memcmp(&nf_bridge
->ipv6_daddr
, &ipv6_hdr(skb
)->daddr
,
155 sizeof(ipv6_hdr(skb
)->daddr
)) != 0;
158 /* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
159 * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
160 * for br_nf_pre_routing_finish(), same logic is used here but
161 * equivalent IPv6 function ip6_route_input() called indirectly.
163 static int br_nf_pre_routing_finish_ipv6(struct net
*net
, struct sock
*sk
, struct sk_buff
*skb
)
165 struct nf_bridge_info
*nf_bridge
= nf_bridge_info_get(skb
);
167 struct net_device
*dev
= skb
->dev
;
168 const struct nf_ipv6_ops
*v6ops
= nf_get_ipv6_ops();
170 nf_bridge
->frag_max_size
= IP6CB(skb
)->frag_max_size
;
172 if (nf_bridge
->pkt_otherhost
) {
173 skb
->pkt_type
= PACKET_OTHERHOST
;
174 nf_bridge
->pkt_otherhost
= false;
176 nf_bridge
->in_prerouting
= 0;
177 if (br_nf_ipv6_daddr_was_changed(skb
, nf_bridge
)) {
179 v6ops
->route_input(skb
);
181 if (skb_dst(skb
)->error
) {
186 if (skb_dst(skb
)->dev
== dev
) {
187 skb
->dev
= nf_bridge
->physindev
;
188 nf_bridge_update_protocol(skb
);
189 nf_bridge_push_encap_header(skb
);
190 br_nf_hook_thresh(NF_BR_PRE_ROUTING
,
191 net
, sk
, skb
, skb
->dev
, NULL
,
192 br_nf_pre_routing_finish_bridge
);
195 ether_addr_copy(eth_hdr(skb
)->h_dest
, dev
->dev_addr
);
196 skb
->pkt_type
= PACKET_HOST
;
198 rt
= bridge_parent_rtable(nf_bridge
->physindev
);
203 skb_dst_set_noref(skb
, &rt
->dst
);
206 skb
->dev
= nf_bridge
->physindev
;
207 nf_bridge_update_protocol(skb
);
208 nf_bridge_push_encap_header(skb
);
209 br_nf_hook_thresh(NF_BR_PRE_ROUTING
, net
, sk
, skb
,
210 skb
->dev
, NULL
, br_handle_frame_finish
);
215 /* Replicate the checks that IPv6 does on packet reception and pass the packet
218 unsigned int br_nf_pre_routing_ipv6(void *priv
,
220 const struct nf_hook_state
*state
)
222 struct nf_bridge_info
*nf_bridge
;
224 if (br_validate_ipv6(state
->net
, skb
))
227 nf_bridge_put(skb
->nf_bridge
);
228 if (!nf_bridge_alloc(skb
))
230 if (!setup_pre_routing(skb
))
233 nf_bridge
= nf_bridge_info_get(skb
);
234 nf_bridge
->ipv6_daddr
= ipv6_hdr(skb
)->daddr
;
236 skb
->protocol
= htons(ETH_P_IPV6
);
237 NF_HOOK(NFPROTO_IPV6
, NF_INET_PRE_ROUTING
, state
->net
, state
->sk
, skb
,
239 br_nf_pre_routing_finish_ipv6
);