1/* 2 * Handle firewalling 3 * Linux ethernet bridge 4 * 5 * Authors: 6 * Lennert Buytenhek <buytenh@gnu.org> 7 * Bart De Schuymer <bdschuym@pandora.be> 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License 11 * as published by the Free Software Foundation; either version 12 * 2 of the License, or (at your option) any later version. 13 * 14 * Lennert dedicates this file to Kerstin Wurdinger. 15 */ 16 17#include <linux/module.h> 18#include <linux/kernel.h> 19#include <linux/slab.h> 20#include <linux/ip.h> 21#include <linux/netdevice.h> 22#include <linux/skbuff.h> 23#include <linux/if_arp.h> 24#include <linux/if_ether.h> 25#include <linux/if_vlan.h> 26#include <linux/if_pppox.h> 27#include <linux/ppp_defs.h> 28#include <linux/netfilter_bridge.h> 29#include <linux/netfilter_ipv4.h> 30#include <linux/netfilter_ipv6.h> 31#include <linux/netfilter_arp.h> 32#include <linux/in_route.h> 33#include <linux/inetdevice.h> 34 35#include <net/ip.h> 36#include <net/ipv6.h> 37#include <net/route.h> 38#include <net/netfilter/br_netfilter.h> 39 40#include <asm/uaccess.h> 41#include "br_private.h" 42#ifdef CONFIG_SYSCTL 43#include <linux/sysctl.h> 44#endif 45 46#ifdef CONFIG_SYSCTL 47static struct ctl_table_header *brnf_sysctl_header; 48static int brnf_call_iptables __read_mostly = 1; 49static int brnf_call_ip6tables __read_mostly = 1; 50static int brnf_call_arptables __read_mostly = 1; 51static int brnf_filter_vlan_tagged __read_mostly = 0; 52static int brnf_filter_pppoe_tagged __read_mostly = 0; 53static int brnf_pass_vlan_indev __read_mostly = 0; 54#else 55#define brnf_call_iptables 1 56#define brnf_call_ip6tables 1 57#define brnf_call_arptables 1 58#define brnf_filter_vlan_tagged 0 59#define brnf_filter_pppoe_tagged 0 60#define brnf_pass_vlan_indev 0 61#endif 62 63#define IS_IP(skb) \ 64 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_IP)) 65 66#define IS_IPV6(skb) \ 67 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_IPV6)) 68 69#define IS_ARP(skb) \ 70 (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_ARP)) 71 72static inline __be16 vlan_proto(const struct sk_buff *skb) 73{ 74 if (skb_vlan_tag_present(skb)) 75 return skb->protocol; 76 else if (skb->protocol == htons(ETH_P_8021Q)) 77 return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto; 78 else 79 return 0; 80} 81 82#define IS_VLAN_IP(skb) \ 83 (vlan_proto(skb) == htons(ETH_P_IP) && \ 84 brnf_filter_vlan_tagged) 85 86#define IS_VLAN_IPV6(skb) \ 87 (vlan_proto(skb) == htons(ETH_P_IPV6) && \ 88 brnf_filter_vlan_tagged) 89 90#define IS_VLAN_ARP(skb) \ 91 (vlan_proto(skb) == htons(ETH_P_ARP) && \ 92 brnf_filter_vlan_tagged) 93 94static inline __be16 pppoe_proto(const struct sk_buff *skb) 95{ 96 return *((__be16 *)(skb_mac_header(skb) + ETH_HLEN + 97 sizeof(struct pppoe_hdr))); 98} 99 100#define IS_PPPOE_IP(skb) \ 101 (skb->protocol == htons(ETH_P_PPP_SES) && \ 102 pppoe_proto(skb) == htons(PPP_IP) && \ 103 brnf_filter_pppoe_tagged) 104 105#define IS_PPPOE_IPV6(skb) \ 106 (skb->protocol == htons(ETH_P_PPP_SES) && \ 107 pppoe_proto(skb) == htons(PPP_IPV6) && \ 108 brnf_filter_pppoe_tagged) 109 110/* largest possible L2 header, see br_nf_dev_queue_xmit() */ 111#define NF_BRIDGE_MAX_MAC_HEADER_LENGTH (PPPOE_SES_HLEN + ETH_HLEN) 112 113#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) 114struct brnf_frag_data { 115 char mac[NF_BRIDGE_MAX_MAC_HEADER_LENGTH]; 116 u8 encap_size; 117 u8 size; 118}; 119 120static DEFINE_PER_CPU(struct brnf_frag_data, brnf_frag_data_storage); 121#endif 122 123static struct nf_bridge_info *nf_bridge_info_get(const struct sk_buff *skb) 124{ 125 return skb->nf_bridge; 126} 127 128static inline struct rtable *bridge_parent_rtable(const struct net_device *dev) 129{ 130 struct net_bridge_port *port; 131 132 port = br_port_get_rcu(dev); 133 return port ? &port->br->fake_rtable : NULL; 134} 135 136static inline struct net_device *bridge_parent(const struct net_device *dev) 137{ 138 struct net_bridge_port *port; 139 140 port = br_port_get_rcu(dev); 141 return port ? port->br->dev : NULL; 142} 143 144static inline struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb) 145{ 146 skb->nf_bridge = kzalloc(sizeof(struct nf_bridge_info), GFP_ATOMIC); 147 if (likely(skb->nf_bridge)) 148 atomic_set(&(skb->nf_bridge->use), 1); 149 150 return skb->nf_bridge; 151} 152 153static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb) 154{ 155 struct nf_bridge_info *nf_bridge = skb->nf_bridge; 156 157 if (atomic_read(&nf_bridge->use) > 1) { 158 struct nf_bridge_info *tmp = nf_bridge_alloc(skb); 159 160 if (tmp) { 161 memcpy(tmp, nf_bridge, sizeof(struct nf_bridge_info)); 162 atomic_set(&tmp->use, 1); 163 } 164 nf_bridge_put(nf_bridge); 165 nf_bridge = tmp; 166 } 167 return nf_bridge; 168} 169 170static unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb) 171{ 172 switch (skb->protocol) { 173 case __cpu_to_be16(ETH_P_8021Q): 174 return VLAN_HLEN; 175 case __cpu_to_be16(ETH_P_PPP_SES): 176 return PPPOE_SES_HLEN; 177 default: 178 return 0; 179 } 180} 181 182static inline void nf_bridge_push_encap_header(struct sk_buff *skb) 183{ 184 unsigned int len = nf_bridge_encap_header_len(skb); 185 186 skb_push(skb, len); 187 skb->network_header -= len; 188} 189 190static inline void nf_bridge_pull_encap_header(struct sk_buff *skb) 191{ 192 unsigned int len = nf_bridge_encap_header_len(skb); 193 194 skb_pull(skb, len); 195 skb->network_header += len; 196} 197 198static inline void nf_bridge_pull_encap_header_rcsum(struct sk_buff *skb) 199{ 200 unsigned int len = nf_bridge_encap_header_len(skb); 201 202 skb_pull_rcsum(skb, len); 203 skb->network_header += len; 204} 205 206/* When handing a packet over to the IP layer 207 * check whether we have a skb that is in the 208 * expected format 209 */ 210 211static int br_parse_ip_options(struct sk_buff *skb) 212{ 213 const struct iphdr *iph; 214 struct net_device *dev = skb->dev; 215 u32 len; 216 217 if (!pskb_may_pull(skb, sizeof(struct iphdr))) 218 goto inhdr_error; 219 220 iph = ip_hdr(skb); 221 222 /* Basic sanity checks */ 223 if (iph->ihl < 5 || iph->version != 4) 224 goto inhdr_error; 225 226 if (!pskb_may_pull(skb, iph->ihl*4)) 227 goto inhdr_error; 228 229 iph = ip_hdr(skb); 230 if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl))) 231 goto inhdr_error; 232 233 len = ntohs(iph->tot_len); 234 if (skb->len < len) { 235 IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INTRUNCATEDPKTS); 236 goto drop; 237 } else if (len < (iph->ihl*4)) 238 goto inhdr_error; 239 240 if (pskb_trim_rcsum(skb, len)) { 241 IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INDISCARDS); 242 goto drop; 243 } 244 245 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); 246 /* We should really parse IP options here but until 247 * somebody who actually uses IP options complains to 248 * us we'll just silently ignore the options because 249 * we're lazy! 250 */ 251 return 0; 252 253inhdr_error: 254 IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INHDRERRORS); 255drop: 256 return -1; 257} 258 259static void nf_bridge_update_protocol(struct sk_buff *skb) 260{ 261 switch (skb->nf_bridge->orig_proto) { 262 case BRNF_PROTO_8021Q: 263 skb->protocol = htons(ETH_P_8021Q); 264 break; 265 case BRNF_PROTO_PPPOE: 266 skb->protocol = htons(ETH_P_PPP_SES); 267 break; 268 case BRNF_PROTO_UNCHANGED: 269 break; 270 } 271} 272 273/* PF_BRIDGE/PRE_ROUTING *********************************************/ 274/* Undo the changes made for ip6tables PREROUTING and continue the 275 * bridge PRE_ROUTING hook. */ 276static int br_nf_pre_routing_finish_ipv6(struct sock *sk, struct sk_buff *skb) 277{ 278 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); 279 struct rtable *rt; 280 281 if (nf_bridge->pkt_otherhost) { 282 skb->pkt_type = PACKET_OTHERHOST; 283 nf_bridge->pkt_otherhost = false; 284 } 285 nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING; 286 287 rt = bridge_parent_rtable(nf_bridge->physindev); 288 if (!rt) { 289 kfree_skb(skb); 290 return 0; 291 } 292 skb_dst_set_noref(skb, &rt->dst); 293 294 skb->dev = nf_bridge->physindev; 295 nf_bridge_update_protocol(skb); 296 nf_bridge_push_encap_header(skb); 297 NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, sk, skb, 298 skb->dev, NULL, 299 br_handle_frame_finish, 1); 300 301 return 0; 302} 303 304/* Obtain the correct destination MAC address, while preserving the original 305 * source MAC address. If we already know this address, we just copy it. If we 306 * don't, we use the neighbour framework to find out. In both cases, we make 307 * sure that br_handle_frame_finish() is called afterwards. 308 */ 309static int br_nf_pre_routing_finish_bridge(struct sock *sk, struct sk_buff *skb) 310{ 311 struct neighbour *neigh; 312 struct dst_entry *dst; 313 314 skb->dev = bridge_parent(skb->dev); 315 if (!skb->dev) 316 goto free_skb; 317 dst = skb_dst(skb); 318 neigh = dst_neigh_lookup_skb(dst, skb); 319 if (neigh) { 320 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); 321 int ret; 322 323 if (neigh->hh.hh_len) { 324 neigh_hh_bridge(&neigh->hh, skb); 325 skb->dev = nf_bridge->physindev; 326 ret = br_handle_frame_finish(sk, skb); 327 } else { 328 /* the neighbour function below overwrites the complete 329 * MAC header, so we save the Ethernet source address and 330 * protocol number. 331 */ 332 skb_copy_from_linear_data_offset(skb, 333 -(ETH_HLEN-ETH_ALEN), 334 nf_bridge->neigh_header, 335 ETH_HLEN-ETH_ALEN); 336 /* tell br_dev_xmit to continue with forwarding */ 337 nf_bridge->mask |= BRNF_BRIDGED_DNAT; 338 /* FIXME Need to refragment */ 339 ret = neigh->output(neigh, skb); 340 } 341 neigh_release(neigh); 342 return ret; 343 } 344free_skb: 345 kfree_skb(skb); 346 return 0; 347} 348 349static bool daddr_was_changed(const struct sk_buff *skb, 350 const struct nf_bridge_info *nf_bridge) 351{ 352 return ip_hdr(skb)->daddr != nf_bridge->ipv4_daddr; 353} 354 355/* This requires some explaining. If DNAT has taken place, 356 * we will need to fix up the destination Ethernet address. 357 * This is also true when SNAT takes place (for the reply direction). 358 * 359 * There are two cases to consider: 360 * 1. The packet was DNAT'ed to a device in the same bridge 361 * port group as it was received on. We can still bridge 362 * the packet. 363 * 2. The packet was DNAT'ed to a different device, either 364 * a non-bridged device or another bridge port group. 365 * The packet will need to be routed. 366 * 367 * The correct way of distinguishing between these two cases is to 368 * call ip_route_input() and to look at skb->dst->dev, which is 369 * changed to the destination device if ip_route_input() succeeds. 370 * 371 * Let's first consider the case that ip_route_input() succeeds: 372 * 373 * If the output device equals the logical bridge device the packet 374 * came in on, we can consider this bridging. The corresponding MAC 375 * address will be obtained in br_nf_pre_routing_finish_bridge. 376 * Otherwise, the packet is considered to be routed and we just 377 * change the destination MAC address so that the packet will 378 * later be passed up to the IP stack to be routed. For a redirected 379 * packet, ip_route_input() will give back the localhost as output device, 380 * which differs from the bridge device. 381 * 382 * Let's now consider the case that ip_route_input() fails: 383 * 384 * This can be because the destination address is martian, in which case 385 * the packet will be dropped. 386 * If IP forwarding is disabled, ip_route_input() will fail, while 387 * ip_route_output_key() can return success. The source 388 * address for ip_route_output_key() is set to zero, so ip_route_output_key() 389 * thinks we're handling a locally generated packet and won't care 390 * if IP forwarding is enabled. If the output device equals the logical bridge 391 * device, we proceed as if ip_route_input() succeeded. If it differs from the 392 * logical bridge port or if ip_route_output_key() fails we drop the packet. 393 */ 394static int br_nf_pre_routing_finish(struct sock *sk, struct sk_buff *skb) 395{ 396 struct net_device *dev = skb->dev; 397 struct iphdr *iph = ip_hdr(skb); 398 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); 399 struct rtable *rt; 400 int err; 401 int frag_max_size; 402 403 frag_max_size = IPCB(skb)->frag_max_size; 404 BR_INPUT_SKB_CB(skb)->frag_max_size = frag_max_size; 405 406 if (nf_bridge->pkt_otherhost) { 407 skb->pkt_type = PACKET_OTHERHOST; 408 nf_bridge->pkt_otherhost = false; 409 } 410 nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING; 411 if (daddr_was_changed(skb, nf_bridge)) { 412 if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) { 413 struct in_device *in_dev = __in_dev_get_rcu(dev); 414 415 /* If err equals -EHOSTUNREACH the error is due to a 416 * martian destination or due to the fact that 417 * forwarding is disabled. For most martian packets, 418 * ip_route_output_key() will fail. It won't fail for 2 types of 419 * martian destinations: loopback destinations and destination 420 * 0.0.0.0. In both cases the packet will be dropped because the 421 * destination is the loopback device and not the bridge. */ 422 if (err != -EHOSTUNREACH || !in_dev || IN_DEV_FORWARD(in_dev)) 423 goto free_skb; 424 425 rt = ip_route_output(dev_net(dev), iph->daddr, 0, 426 RT_TOS(iph->tos), 0); 427 if (!IS_ERR(rt)) { 428 /* - Bridged-and-DNAT'ed traffic doesn't 429 * require ip_forwarding. */ 430 if (rt->dst.dev == dev) { 431 skb_dst_set(skb, &rt->dst); 432 goto bridged_dnat; 433 } 434 ip_rt_put(rt); 435 } 436free_skb: 437 kfree_skb(skb); 438 return 0; 439 } else { 440 if (skb_dst(skb)->dev == dev) { 441bridged_dnat: 442 skb->dev = nf_bridge->physindev; 443 nf_bridge_update_protocol(skb); 444 nf_bridge_push_encap_header(skb); 445 NF_HOOK_THRESH(NFPROTO_BRIDGE, 446 NF_BR_PRE_ROUTING, 447 sk, skb, skb->dev, NULL, 448 br_nf_pre_routing_finish_bridge, 449 1); 450 return 0; 451 } 452 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr); 453 skb->pkt_type = PACKET_HOST; 454 } 455 } else { 456 rt = bridge_parent_rtable(nf_bridge->physindev); 457 if (!rt) { 458 kfree_skb(skb); 459 return 0; 460 } 461 skb_dst_set_noref(skb, &rt->dst); 462 } 463 464 skb->dev = nf_bridge->physindev; 465 nf_bridge_update_protocol(skb); 466 nf_bridge_push_encap_header(skb); 467 NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, sk, skb, 468 skb->dev, NULL, 469 br_handle_frame_finish, 1); 470 471 return 0; 472} 473 474static struct net_device *brnf_get_logical_dev(struct sk_buff *skb, const struct net_device *dev) 475{ 476 struct net_device *vlan, *br; 477 478 br = bridge_parent(dev); 479 if (brnf_pass_vlan_indev == 0 || !skb_vlan_tag_present(skb)) 480 return br; 481 482 vlan = __vlan_find_dev_deep_rcu(br, skb->vlan_proto, 483 skb_vlan_tag_get(skb) & VLAN_VID_MASK); 484 485 return vlan ? vlan : br; 486} 487 488/* Some common code for IPv4/IPv6 */ 489static struct net_device *setup_pre_routing(struct sk_buff *skb) 490{ 491 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); 492 493 if (skb->pkt_type == PACKET_OTHERHOST) { 494 skb->pkt_type = PACKET_HOST; 495 nf_bridge->pkt_otherhost = true; 496 } 497 498 nf_bridge->mask |= BRNF_NF_BRIDGE_PREROUTING; 499 nf_bridge->physindev = skb->dev; 500 skb->dev = brnf_get_logical_dev(skb, skb->dev); 501 502 if (skb->protocol == htons(ETH_P_8021Q)) 503 nf_bridge->orig_proto = BRNF_PROTO_8021Q; 504 else if (skb->protocol == htons(ETH_P_PPP_SES)) 505 nf_bridge->orig_proto = BRNF_PROTO_PPPOE; 506 507 /* Must drop socket now because of tproxy. */ 508 skb_orphan(skb); 509 return skb->dev; 510} 511 512/* We only check the length. A bridge shouldn't do any hop-by-hop stuff anyway */ 513static int check_hbh_len(struct sk_buff *skb) 514{ 515 unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1); 516 u32 pkt_len; 517 const unsigned char *nh = skb_network_header(skb); 518 int off = raw - nh; 519 int len = (raw[1] + 1) << 3; 520 521 if ((raw + len) - skb->data > skb_headlen(skb)) 522 goto bad; 523 524 off += 2; 525 len -= 2; 526 527 while (len > 0) { 528 int optlen = nh[off + 1] + 2; 529 530 switch (nh[off]) { 531 case IPV6_TLV_PAD1: 532 optlen = 1; 533 break; 534 535 case IPV6_TLV_PADN: 536 break; 537 538 case IPV6_TLV_JUMBO: 539 if (nh[off + 1] != 4 || (off & 3) != 2) 540 goto bad; 541 pkt_len = ntohl(*(__be32 *) (nh + off + 2)); 542 if (pkt_len <= IPV6_MAXPLEN || 543 ipv6_hdr(skb)->payload_len) 544 goto bad; 545 if (pkt_len > skb->len - sizeof(struct ipv6hdr)) 546 goto bad; 547 if (pskb_trim_rcsum(skb, 548 pkt_len + sizeof(struct ipv6hdr))) 549 goto bad; 550 nh = skb_network_header(skb); 551 break; 552 default: 553 if (optlen > len) 554 goto bad; 555 break; 556 } 557 off += optlen; 558 len -= optlen; 559 } 560 if (len == 0) 561 return 0; 562bad: 563 return -1; 564 565} 566 567/* Replicate the checks that IPv6 does on packet reception and pass the packet 568 * to ip6tables, which doesn't support NAT, so things are fairly simple. */ 569static unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops, 570 struct sk_buff *skb, 571 const struct nf_hook_state *state) 572{ 573 const struct ipv6hdr *hdr; 574 u32 pkt_len; 575 576 if (skb->len < sizeof(struct ipv6hdr)) 577 return NF_DROP; 578 579 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr))) 580 return NF_DROP; 581 582 hdr = ipv6_hdr(skb); 583 584 if (hdr->version != 6) 585 return NF_DROP; 586 587 pkt_len = ntohs(hdr->payload_len); 588 589 if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) { 590 if (pkt_len + sizeof(struct ipv6hdr) > skb->len) 591 return NF_DROP; 592 if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr))) 593 return NF_DROP; 594 } 595 if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb)) 596 return NF_DROP; 597 598 nf_bridge_put(skb->nf_bridge); 599 if (!nf_bridge_alloc(skb)) 600 return NF_DROP; 601 if (!setup_pre_routing(skb)) 602 return NF_DROP; 603 604 skb->protocol = htons(ETH_P_IPV6); 605 NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->sk, skb, 606 skb->dev, NULL, 607 br_nf_pre_routing_finish_ipv6); 608 609 return NF_STOLEN; 610} 611 612/* Direct IPv6 traffic to br_nf_pre_routing_ipv6. 613 * Replicate the checks that IPv4 does on packet reception. 614 * Set skb->dev to the bridge device (i.e. parent of the 615 * receiving device) to make netfilter happy, the REDIRECT 616 * target in particular. Save the original destination IP 617 * address to be able to detect DNAT afterwards. */ 618static unsigned int br_nf_pre_routing(const struct nf_hook_ops *ops, 619 struct sk_buff *skb, 620 const struct nf_hook_state *state) 621{ 622 struct nf_bridge_info *nf_bridge; 623 struct net_bridge_port *p; 624 struct net_bridge *br; 625 __u32 len = nf_bridge_encap_header_len(skb); 626 627 if (unlikely(!pskb_may_pull(skb, len))) 628 return NF_DROP; 629 630 p = br_port_get_rcu(state->in); 631 if (p == NULL) 632 return NF_DROP; 633 br = p->br; 634 635 if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb)) { 636 if (!brnf_call_ip6tables && !br->nf_call_ip6tables) 637 return NF_ACCEPT; 638 639 nf_bridge_pull_encap_header_rcsum(skb); 640 return br_nf_pre_routing_ipv6(ops, skb, state); 641 } 642 643 if (!brnf_call_iptables && !br->nf_call_iptables) 644 return NF_ACCEPT; 645 646 if (!IS_IP(skb) && !IS_VLAN_IP(skb) && !IS_PPPOE_IP(skb)) 647 return NF_ACCEPT; 648 649 nf_bridge_pull_encap_header_rcsum(skb); 650 651 if (br_parse_ip_options(skb)) 652 return NF_DROP; 653 654 nf_bridge_put(skb->nf_bridge); 655 if (!nf_bridge_alloc(skb)) 656 return NF_DROP; 657 if (!setup_pre_routing(skb)) 658 return NF_DROP; 659 660 nf_bridge = nf_bridge_info_get(skb); 661 nf_bridge->ipv4_daddr = ip_hdr(skb)->daddr; 662 663 skb->protocol = htons(ETH_P_IP); 664 665 NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, state->sk, skb, 666 skb->dev, NULL, 667 br_nf_pre_routing_finish); 668 669 return NF_STOLEN; 670} 671 672 673/* PF_BRIDGE/LOCAL_IN ************************************************/ 674/* The packet is locally destined, which requires a real 675 * dst_entry, so detach the fake one. On the way up, the 676 * packet would pass through PRE_ROUTING again (which already 677 * took place when the packet entered the bridge), but we 678 * register an IPv4 PRE_ROUTING 'sabotage' hook that will 679 * prevent this from happening. */ 680static unsigned int br_nf_local_in(const struct nf_hook_ops *ops, 681 struct sk_buff *skb, 682 const struct nf_hook_state *state) 683{ 684 br_drop_fake_rtable(skb); 685 return NF_ACCEPT; 686} 687 688/* PF_BRIDGE/FORWARD *************************************************/ 689static int br_nf_forward_finish(struct sock *sk, struct sk_buff *skb) 690{ 691 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); 692 struct net_device *in; 693 694 if (!IS_ARP(skb) && !IS_VLAN_ARP(skb)) { 695 int frag_max_size; 696 697 if (skb->protocol == htons(ETH_P_IP)) { 698 frag_max_size = IPCB(skb)->frag_max_size; 699 BR_INPUT_SKB_CB(skb)->frag_max_size = frag_max_size; 700 } 701 702 in = nf_bridge->physindev; 703 if (nf_bridge->pkt_otherhost) { 704 skb->pkt_type = PACKET_OTHERHOST; 705 nf_bridge->pkt_otherhost = false; 706 } 707 nf_bridge_update_protocol(skb); 708 } else { 709 in = *((struct net_device **)(skb->cb)); 710 } 711 nf_bridge_push_encap_header(skb); 712 713 NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_FORWARD, sk, skb, 714 in, skb->dev, br_forward_finish, 1); 715 return 0; 716} 717 718 719/* This is the 'purely bridged' case. For IP, we pass the packet to 720 * netfilter with indev and outdev set to the bridge device, 721 * but we are still able to filter on the 'real' indev/outdev 722 * because of the physdev module. For ARP, indev and outdev are the 723 * bridge ports. */ 724static unsigned int br_nf_forward_ip(const struct nf_hook_ops *ops, 725 struct sk_buff *skb, 726 const struct nf_hook_state *state) 727{ 728 struct nf_bridge_info *nf_bridge; 729 struct net_device *parent; 730 u_int8_t pf; 731 732 if (!skb->nf_bridge) 733 return NF_ACCEPT; 734 735 /* Need exclusive nf_bridge_info since we might have multiple 736 * different physoutdevs. */ 737 if (!nf_bridge_unshare(skb)) 738 return NF_DROP; 739 740 nf_bridge = nf_bridge_info_get(skb); 741 if (!nf_bridge) 742 return NF_DROP; 743 744 parent = bridge_parent(state->out); 745 if (!parent) 746 return NF_DROP; 747 748 if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb)) 749 pf = NFPROTO_IPV4; 750 else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb)) 751 pf = NFPROTO_IPV6; 752 else 753 return NF_ACCEPT; 754 755 nf_bridge_pull_encap_header(skb); 756 757 if (skb->pkt_type == PACKET_OTHERHOST) { 758 skb->pkt_type = PACKET_HOST; 759 nf_bridge->pkt_otherhost = true; 760 } 761 762 if (pf == NFPROTO_IPV4) { 763 int frag_max = BR_INPUT_SKB_CB(skb)->frag_max_size; 764 765 if (br_parse_ip_options(skb)) 766 return NF_DROP; 767 768 IPCB(skb)->frag_max_size = frag_max; 769 } 770 771 nf_bridge->physoutdev = skb->dev; 772 if (pf == NFPROTO_IPV4) 773 skb->protocol = htons(ETH_P_IP); 774 else 775 skb->protocol = htons(ETH_P_IPV6); 776 777 NF_HOOK(pf, NF_INET_FORWARD, NULL, skb, 778 brnf_get_logical_dev(skb, state->in), 779 parent, br_nf_forward_finish); 780 781 return NF_STOLEN; 782} 783 784static unsigned int br_nf_forward_arp(const struct nf_hook_ops *ops, 785 struct sk_buff *skb, 786 const struct nf_hook_state *state) 787{ 788 struct net_bridge_port *p; 789 struct net_bridge *br; 790 struct net_device **d = (struct net_device **)(skb->cb); 791 792 p = br_port_get_rcu(state->out); 793 if (p == NULL) 794 return NF_ACCEPT; 795 br = p->br; 796 797 if (!brnf_call_arptables && !br->nf_call_arptables) 798 return NF_ACCEPT; 799 800 if (!IS_ARP(skb)) { 801 if (!IS_VLAN_ARP(skb)) 802 return NF_ACCEPT; 803 nf_bridge_pull_encap_header(skb); 804 } 805 806 if (arp_hdr(skb)->ar_pln != 4) { 807 if (IS_VLAN_ARP(skb)) 808 nf_bridge_push_encap_header(skb); 809 return NF_ACCEPT; 810 } 811 *d = state->in; 812 NF_HOOK(NFPROTO_ARP, NF_ARP_FORWARD, state->sk, skb, 813 state->in, state->out, br_nf_forward_finish); 814 815 return NF_STOLEN; 816} 817 818#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) 819static int br_nf_push_frag_xmit(struct sock *sk, struct sk_buff *skb) 820{ 821 struct brnf_frag_data *data; 822 int err; 823 824 data = this_cpu_ptr(&brnf_frag_data_storage); 825 err = skb_cow_head(skb, data->size); 826 827 if (err) { 828 kfree_skb(skb); 829 return 0; 830 } 831 832 skb_copy_to_linear_data_offset(skb, -data->size, data->mac, data->size); 833 __skb_push(skb, data->encap_size); 834 835 return br_dev_queue_push_xmit(sk, skb); 836} 837 838static int br_nf_dev_queue_xmit(struct sock *sk, struct sk_buff *skb) 839{ 840 int ret; 841 int frag_max_size; 842 unsigned int mtu_reserved; 843 844 if (skb_is_gso(skb) || skb->protocol != htons(ETH_P_IP)) 845 return br_dev_queue_push_xmit(sk, skb); 846 847 mtu_reserved = nf_bridge_mtu_reduction(skb); 848 /* This is wrong! We should preserve the original fragment 849 * boundaries by preserving frag_list rather than refragmenting. 850 */ 851 if (skb->len + mtu_reserved > skb->dev->mtu) { 852 struct brnf_frag_data *data; 853 854 frag_max_size = BR_INPUT_SKB_CB(skb)->frag_max_size; 855 if (br_parse_ip_options(skb)) 856 /* Drop invalid packet */ 857 return NF_DROP; 858 IPCB(skb)->frag_max_size = frag_max_size; 859 860 nf_bridge_update_protocol(skb); 861 862 data = this_cpu_ptr(&brnf_frag_data_storage); 863 data->encap_size = nf_bridge_encap_header_len(skb); 864 data->size = ETH_HLEN + data->encap_size; 865 866 skb_copy_from_linear_data_offset(skb, -data->size, data->mac, 867 data->size); 868 869 ret = ip_fragment(sk, skb, br_nf_push_frag_xmit); 870 } else { 871 ret = br_dev_queue_push_xmit(sk, skb); 872 } 873 874 return ret; 875} 876#else 877static int br_nf_dev_queue_xmit(struct sock *sk, struct sk_buff *skb) 878{ 879 return br_dev_queue_push_xmit(sk, skb); 880} 881#endif 882 883/* PF_BRIDGE/POST_ROUTING ********************************************/ 884static unsigned int br_nf_post_routing(const struct nf_hook_ops *ops, 885 struct sk_buff *skb, 886 const struct nf_hook_state *state) 887{ 888 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); 889 struct net_device *realoutdev = bridge_parent(skb->dev); 890 u_int8_t pf; 891 892 /* if nf_bridge is set, but ->physoutdev is NULL, this packet came in 893 * on a bridge, but was delivered locally and is now being routed: 894 * 895 * POST_ROUTING was already invoked from the ip stack. 896 */ 897 if (!nf_bridge || !nf_bridge->physoutdev) 898 return NF_ACCEPT; 899 900 if (!realoutdev) 901 return NF_DROP; 902 903 if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb)) 904 pf = NFPROTO_IPV4; 905 else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb)) 906 pf = NFPROTO_IPV6; 907 else 908 return NF_ACCEPT; 909 910 /* We assume any code from br_dev_queue_push_xmit onwards doesn't care 911 * about the value of skb->pkt_type. */ 912 if (skb->pkt_type == PACKET_OTHERHOST) { 913 skb->pkt_type = PACKET_HOST; 914 nf_bridge->pkt_otherhost = true; 915 } 916 917 nf_bridge_pull_encap_header(skb); 918 if (pf == NFPROTO_IPV4) 919 skb->protocol = htons(ETH_P_IP); 920 else 921 skb->protocol = htons(ETH_P_IPV6); 922 923 NF_HOOK(pf, NF_INET_POST_ROUTING, state->sk, skb, 924 NULL, realoutdev, 925 br_nf_dev_queue_xmit); 926 927 return NF_STOLEN; 928} 929 930/* IP/SABOTAGE *****************************************************/ 931/* Don't hand locally destined packets to PF_INET(6)/PRE_ROUTING 932 * for the second time. */ 933static unsigned int ip_sabotage_in(const struct nf_hook_ops *ops, 934 struct sk_buff *skb, 935 const struct nf_hook_state *state) 936{ 937 if (skb->nf_bridge && 938 !(skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)) { 939 return NF_STOP; 940 } 941 942 return NF_ACCEPT; 943} 944 945/* This is called when br_netfilter has called into iptables/netfilter, 946 * and DNAT has taken place on a bridge-forwarded packet. 947 * 948 * neigh->output has created a new MAC header, with local br0 MAC 949 * as saddr. 950 * 951 * This restores the original MAC saddr of the bridged packet 952 * before invoking bridge forward logic to transmit the packet. 953 */ 954static void br_nf_pre_routing_finish_bridge_slow(struct sk_buff *skb) 955{ 956 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); 957 958 skb_pull(skb, ETH_HLEN); 959 nf_bridge->mask &= ~BRNF_BRIDGED_DNAT; 960 961 BUILD_BUG_ON(sizeof(nf_bridge->neigh_header) != (ETH_HLEN - ETH_ALEN)); 962 963 skb_copy_to_linear_data_offset(skb, -(ETH_HLEN - ETH_ALEN), 964 nf_bridge->neigh_header, 965 ETH_HLEN - ETH_ALEN); 966 skb->dev = nf_bridge->physindev; 967 br_handle_frame_finish(NULL, skb); 968} 969 970static int br_nf_dev_xmit(struct sk_buff *skb) 971{ 972 if (skb->nf_bridge && (skb->nf_bridge->mask & BRNF_BRIDGED_DNAT)) { 973 br_nf_pre_routing_finish_bridge_slow(skb); 974 return 1; 975 } 976 return 0; 977} 978 979static const struct nf_br_ops br_ops = { 980 .br_dev_xmit_hook = br_nf_dev_xmit, 981}; 982 983void br_netfilter_enable(void) 984{ 985} 986EXPORT_SYMBOL_GPL(br_netfilter_enable); 987 988/* For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because 989 * br_dev_queue_push_xmit is called afterwards */ 990static struct nf_hook_ops br_nf_ops[] __read_mostly = { 991 { 992 .hook = br_nf_pre_routing, 993 .owner = THIS_MODULE, 994 .pf = NFPROTO_BRIDGE, 995 .hooknum = NF_BR_PRE_ROUTING, 996 .priority = NF_BR_PRI_BRNF, 997 }, 998 { 999 .hook = br_nf_local_in, 1000 .owner = THIS_MODULE, 1001 .pf = NFPROTO_BRIDGE, 1002 .hooknum = NF_BR_LOCAL_IN, 1003 .priority = NF_BR_PRI_BRNF, 1004 }, 1005 { 1006 .hook = br_nf_forward_ip, 1007 .owner = THIS_MODULE, 1008 .pf = NFPROTO_BRIDGE, 1009 .hooknum = NF_BR_FORWARD, 1010 .priority = NF_BR_PRI_BRNF - 1, 1011 }, 1012 { 1013 .hook = br_nf_forward_arp, 1014 .owner = THIS_MODULE, 1015 .pf = NFPROTO_BRIDGE, 1016 .hooknum = NF_BR_FORWARD, 1017 .priority = NF_BR_PRI_BRNF, 1018 }, 1019 { 1020 .hook = br_nf_post_routing, 1021 .owner = THIS_MODULE, 1022 .pf = NFPROTO_BRIDGE, 1023 .hooknum = NF_BR_POST_ROUTING, 1024 .priority = NF_BR_PRI_LAST, 1025 }, 1026 { 1027 .hook = ip_sabotage_in, 1028 .owner = THIS_MODULE, 1029 .pf = NFPROTO_IPV4, 1030 .hooknum = NF_INET_PRE_ROUTING, 1031 .priority = NF_IP_PRI_FIRST, 1032 }, 1033 { 1034 .hook = ip_sabotage_in, 1035 .owner = THIS_MODULE, 1036 .pf = NFPROTO_IPV6, 1037 .hooknum = NF_INET_PRE_ROUTING, 1038 .priority = NF_IP6_PRI_FIRST, 1039 }, 1040}; 1041 1042#ifdef CONFIG_SYSCTL 1043static 1044int brnf_sysctl_call_tables(struct ctl_table *ctl, int write, 1045 void __user *buffer, size_t *lenp, loff_t *ppos) 1046{ 1047 int ret; 1048 1049 ret = proc_dointvec(ctl, write, buffer, lenp, ppos); 1050 1051 if (write && *(int *)(ctl->data)) 1052 *(int *)(ctl->data) = 1; 1053 return ret; 1054} 1055 1056static struct ctl_table brnf_table[] = { 1057 { 1058 .procname = "bridge-nf-call-arptables", 1059 .data = &brnf_call_arptables, 1060 .maxlen = sizeof(int), 1061 .mode = 0644, 1062 .proc_handler = brnf_sysctl_call_tables, 1063 }, 1064 { 1065 .procname = "bridge-nf-call-iptables", 1066 .data = &brnf_call_iptables, 1067 .maxlen = sizeof(int), 1068 .mode = 0644, 1069 .proc_handler = brnf_sysctl_call_tables, 1070 }, 1071 { 1072 .procname = "bridge-nf-call-ip6tables", 1073 .data = &brnf_call_ip6tables, 1074 .maxlen = sizeof(int), 1075 .mode = 0644, 1076 .proc_handler = brnf_sysctl_call_tables, 1077 }, 1078 { 1079 .procname = "bridge-nf-filter-vlan-tagged", 1080 .data = &brnf_filter_vlan_tagged, 1081 .maxlen = sizeof(int), 1082 .mode = 0644, 1083 .proc_handler = brnf_sysctl_call_tables, 1084 }, 1085 { 1086 .procname = "bridge-nf-filter-pppoe-tagged", 1087 .data = &brnf_filter_pppoe_tagged, 1088 .maxlen = sizeof(int), 1089 .mode = 0644, 1090 .proc_handler = brnf_sysctl_call_tables, 1091 }, 1092 { 1093 .procname = "bridge-nf-pass-vlan-input-dev", 1094 .data = &brnf_pass_vlan_indev, 1095 .maxlen = sizeof(int), 1096 .mode = 0644, 1097 .proc_handler = brnf_sysctl_call_tables, 1098 }, 1099 { } 1100}; 1101#endif 1102 1103static int __init br_netfilter_init(void) 1104{ 1105 int ret; 1106 1107 ret = nf_register_hooks(br_nf_ops, ARRAY_SIZE(br_nf_ops)); 1108 if (ret < 0) 1109 return ret; 1110 1111#ifdef CONFIG_SYSCTL 1112 brnf_sysctl_header = register_net_sysctl(&init_net, "net/bridge", brnf_table); 1113 if (brnf_sysctl_header == NULL) { 1114 printk(KERN_WARNING 1115 "br_netfilter: can't register to sysctl.\n"); 1116 nf_unregister_hooks(br_nf_ops, ARRAY_SIZE(br_nf_ops)); 1117 return -ENOMEM; 1118 } 1119#endif 1120 RCU_INIT_POINTER(nf_br_ops, &br_ops); 1121 printk(KERN_NOTICE "Bridge firewalling registered\n"); 1122 return 0; 1123} 1124 1125static void __exit br_netfilter_fini(void) 1126{ 1127 RCU_INIT_POINTER(nf_br_ops, NULL); 1128 nf_unregister_hooks(br_nf_ops, ARRAY_SIZE(br_nf_ops)); 1129#ifdef CONFIG_SYSCTL 1130 unregister_net_sysctl_table(brnf_sysctl_header); 1131#endif 1132} 1133 1134module_init(br_netfilter_init); 1135module_exit(br_netfilter_fini); 1136 1137MODULE_LICENSE("GPL"); 1138MODULE_AUTHOR("Lennert Buytenhek <buytenh@gnu.org>"); 1139MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>"); 1140MODULE_DESCRIPTION("Linux ethernet netfilter firewall bridge"); 1141