1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Handle firewalling 4 * Linux ethernet bridge 5 * 6 * Authors: 7 * Lennert Buytenhek <buytenh@gnu.org> 8 * Bart De Schuymer <bdschuym@pandora.be> 9 * 10 * Lennert dedicates this file to Kerstin Wurdinger. 11 */ 12 13 #include <linux/module.h> 14 #include <linux/kernel.h> 15 #include <linux/slab.h> 16 #include <linux/ip.h> 17 #include <linux/netdevice.h> 18 #include <linux/skbuff.h> 19 #include <linux/if_arp.h> 20 #include <linux/if_ether.h> 21 #include <linux/if_vlan.h> 22 #include <linux/if_pppox.h> 23 #include <linux/ppp_defs.h> 24 #include <linux/netfilter_bridge.h> 25 #include <linux/netfilter_ipv4.h> 26 #include <linux/netfilter_ipv6.h> 27 #include <linux/netfilter_arp.h> 28 #include <linux/in_route.h> 29 #include <linux/inetdevice.h> 30 31 #include <net/ip.h> 32 #include <net/ipv6.h> 33 #include <net/addrconf.h> 34 #include <net/route.h> 35 #include <net/netfilter/br_netfilter.h> 36 37 #include <linux/uaccess.h> 38 #include "br_private.h" 39 #ifdef CONFIG_SYSCTL 40 #include <linux/sysctl.h> 41 #endif 42 43 /* We only check the length. A bridge shouldn't do any hop-by-hop stuff 44 * anyway 45 */ 46 static int br_nf_check_hbh_len(struct sk_buff *skb) 47 { 48 unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1); 49 u32 pkt_len; 50 const unsigned char *nh = skb_network_header(skb); 51 int off = raw - nh; 52 int len = (raw[1] + 1) << 3; 53 54 if ((raw + len) - skb->data > skb_headlen(skb)) 55 goto bad; 56 57 off += 2; 58 len -= 2; 59 60 while (len > 0) { 61 int optlen = nh[off + 1] + 2; 62 63 switch (nh[off]) { 64 case IPV6_TLV_PAD1: 65 optlen = 1; 66 break; 67 68 case IPV6_TLV_PADN: 69 break; 70 71 case IPV6_TLV_JUMBO: 72 if (nh[off + 1] != 4 || (off & 3) != 2) 73 goto bad; 74 pkt_len = ntohl(*(__be32 *)(nh + off + 2)); 75 if (pkt_len <= IPV6_MAXPLEN || 76 ipv6_hdr(skb)->payload_len) 77 goto bad; 78 if (pkt_len > skb->len - sizeof(struct ipv6hdr)) 79 goto bad; 80 if (pskb_trim_rcsum(skb, 81 pkt_len + sizeof(struct ipv6hdr))) 82 goto bad; 83 nh = skb_network_header(skb); 84 break; 85 default: 86 if (optlen > len) 87 goto bad; 88 break; 89 } 90 off += optlen; 91 len -= optlen; 92 } 93 if (len == 0) 94 return 0; 95 bad: 96 return -1; 97 } 98 99 int br_validate_ipv6(struct net *net, struct sk_buff *skb) 100 { 101 const struct ipv6hdr *hdr; 102 struct inet6_dev *idev = __in6_dev_get(skb->dev); 103 u32 pkt_len; 104 u8 ip6h_len = sizeof(struct ipv6hdr); 105 106 if (!pskb_may_pull(skb, ip6h_len)) 107 goto inhdr_error; 108 109 if (skb->len < ip6h_len) 110 goto drop; 111 112 hdr = ipv6_hdr(skb); 113 114 if (hdr->version != 6) 115 goto inhdr_error; 116 117 pkt_len = ntohs(hdr->payload_len); 118 119 if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) { 120 if (pkt_len + ip6h_len > skb->len) { 121 __IP6_INC_STATS(net, idev, 122 IPSTATS_MIB_INTRUNCATEDPKTS); 123 goto drop; 124 } 125 if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) { 126 __IP6_INC_STATS(net, idev, 127 IPSTATS_MIB_INDISCARDS); 128 goto drop; 129 } 130 hdr = ipv6_hdr(skb); 131 } 132 if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb)) 133 goto drop; 134 135 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); 136 /* No IP options in IPv6 header; however it should be 137 * checked if some next headers need special treatment 138 */ 139 return 0; 140 141 inhdr_error: 142 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS); 143 drop: 144 return -1; 145 } 146 147 static inline bool 148 br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb, 149 const struct nf_bridge_info *nf_bridge) 150 { 151 return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr, 152 sizeof(ipv6_hdr(skb)->daddr)) != 0; 153 } 154 155 /* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables 156 * PREROUTING and continue the bridge PRE_ROUTING hook. See comment 157 * for br_nf_pre_routing_finish(), same logic is used here but 158 * equivalent IPv6 function ip6_route_input() called indirectly. 159 */ 160 static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb) 161 { 162 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); 163 struct rtable *rt; 164 struct net_device *dev = skb->dev; 165 const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops(); 166 167 nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size; 168 169 if (nf_bridge->pkt_otherhost) { 170 skb->pkt_type = PACKET_OTHERHOST; 171 nf_bridge->pkt_otherhost = false; 172 } 173 nf_bridge->in_prerouting = 0; 174 if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) { 175 skb_dst_drop(skb); 176 v6ops->route_input(skb); 177 178 if (skb_dst(skb)->error) { 179 kfree_skb(skb); 180 return 0; 181 } 182 183 if (skb_dst(skb)->dev == dev) { 184 skb->dev = nf_bridge->physindev; 185 nf_bridge_update_protocol(skb); 186 nf_bridge_push_encap_header(skb); 187 br_nf_hook_thresh(NF_BR_PRE_ROUTING, 188 net, sk, skb, skb->dev, NULL, 189 br_nf_pre_routing_finish_bridge); 190 return 0; 191 } 192 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr); 193 skb->pkt_type = PACKET_HOST; 194 } else { 195 rt = bridge_parent_rtable(nf_bridge->physindev); 196 if (!rt) { 197 kfree_skb(skb); 198 return 0; 199 } 200 skb_dst_set_noref(skb, &rt->dst); 201 } 202 203 skb->dev = nf_bridge->physindev; 204 nf_bridge_update_protocol(skb); 205 nf_bridge_push_encap_header(skb); 206 br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb, 207 skb->dev, NULL, br_handle_frame_finish); 208 209 return 0; 210 } 211 212 /* Replicate the checks that IPv6 does on packet reception and pass the packet 213 * to ip6tables. 214 */ 215 unsigned int br_nf_pre_routing_ipv6(void *priv, 216 struct sk_buff *skb, 217 const struct nf_hook_state *state) 218 { 219 struct nf_bridge_info *nf_bridge; 220 221 if (br_validate_ipv6(state->net, skb)) 222 return NF_DROP; 223 224 nf_bridge = nf_bridge_alloc(skb); 225 if (!nf_bridge) 226 return NF_DROP; 227 if (!setup_pre_routing(skb)) 228 return NF_DROP; 229 230 nf_bridge = nf_bridge_info_get(skb); 231 nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr; 232 233 skb->protocol = htons(ETH_P_IPV6); 234 skb->transport_header = skb->network_header + sizeof(struct ipv6hdr); 235 236 NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb, 237 skb->dev, NULL, 238 br_nf_pre_routing_finish_ipv6); 239 240 return NF_STOLEN; 241 } 242