1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Handle firewalling
4 * Linux ethernet bridge
5 *
6 * Authors:
7 * Lennert Buytenhek <buytenh@gnu.org>
8 * Bart De Schuymer <bdschuym@pandora.be>
9 *
10 * Lennert dedicates this file to Kerstin Wurdinger.
11 */
12
13 #include <linux/module.h>
14 #include <linux/kernel.h>
15 #include <linux/slab.h>
16 #include <linux/ip.h>
17 #include <linux/netdevice.h>
18 #include <linux/skbuff.h>
19 #include <linux/if_arp.h>
20 #include <linux/if_ether.h>
21 #include <linux/if_vlan.h>
22 #include <linux/if_pppox.h>
23 #include <linux/ppp_defs.h>
24 #include <linux/netfilter_bridge.h>
25 #include <linux/netfilter_ipv4.h>
26 #include <linux/netfilter_ipv6.h>
27 #include <linux/netfilter_arp.h>
28 #include <linux/in_route.h>
29 #include <linux/inetdevice.h>
30
31 #include <net/ip.h>
32 #include <net/ipv6.h>
33 #include <net/addrconf.h>
34 #include <net/route.h>
35 #include <net/netfilter/br_netfilter.h>
36
37 #include <linux/uaccess.h>
38 #include "br_private.h"
39 #ifdef CONFIG_SYSCTL
40 #include <linux/sysctl.h>
41 #endif
42
43 /* We only check the length. A bridge shouldn't do any hop-by-hop stuff
44 * anyway
45 */
br_nf_check_hbh_len(struct sk_buff * skb)46 static int br_nf_check_hbh_len(struct sk_buff *skb)
47 {
48 unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
49 u32 pkt_len;
50 const unsigned char *nh = skb_network_header(skb);
51 int off = raw - nh;
52 int len = (raw[1] + 1) << 3;
53
54 if ((raw + len) - skb->data > skb_headlen(skb))
55 goto bad;
56
57 off += 2;
58 len -= 2;
59
60 while (len > 0) {
61 int optlen = nh[off + 1] + 2;
62
63 switch (nh[off]) {
64 case IPV6_TLV_PAD1:
65 optlen = 1;
66 break;
67
68 case IPV6_TLV_PADN:
69 break;
70
71 case IPV6_TLV_JUMBO:
72 if (nh[off + 1] != 4 || (off & 3) != 2)
73 goto bad;
74 pkt_len = ntohl(*(__be32 *)(nh + off + 2));
75 if (pkt_len <= IPV6_MAXPLEN ||
76 ipv6_hdr(skb)->payload_len)
77 goto bad;
78 if (pkt_len > skb->len - sizeof(struct ipv6hdr))
79 goto bad;
80 if (pskb_trim_rcsum(skb,
81 pkt_len + sizeof(struct ipv6hdr)))
82 goto bad;
83 nh = skb_network_header(skb);
84 break;
85 default:
86 if (optlen > len)
87 goto bad;
88 break;
89 }
90 off += optlen;
91 len -= optlen;
92 }
93 if (len == 0)
94 return 0;
95 bad:
96 return -1;
97 }
98
br_validate_ipv6(struct net * net,struct sk_buff * skb)99 int br_validate_ipv6(struct net *net, struct sk_buff *skb)
100 {
101 const struct ipv6hdr *hdr;
102 struct inet6_dev *idev = __in6_dev_get(skb->dev);
103 u32 pkt_len;
104 u8 ip6h_len = sizeof(struct ipv6hdr);
105
106 if (!pskb_may_pull(skb, ip6h_len))
107 goto inhdr_error;
108
109 if (skb->len < ip6h_len)
110 goto drop;
111
112 hdr = ipv6_hdr(skb);
113
114 if (hdr->version != 6)
115 goto inhdr_error;
116
117 pkt_len = ntohs(hdr->payload_len);
118
119 if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
120 if (pkt_len + ip6h_len > skb->len) {
121 __IP6_INC_STATS(net, idev,
122 IPSTATS_MIB_INTRUNCATEDPKTS);
123 goto drop;
124 }
125 if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
126 __IP6_INC_STATS(net, idev,
127 IPSTATS_MIB_INDISCARDS);
128 goto drop;
129 }
130 hdr = ipv6_hdr(skb);
131 }
132 if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb))
133 goto drop;
134
135 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
136 /* No IP options in IPv6 header; however it should be
137 * checked if some next headers need special treatment
138 */
139 return 0;
140
141 inhdr_error:
142 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
143 drop:
144 return -1;
145 }
146
147 static inline bool
br_nf_ipv6_daddr_was_changed(const struct sk_buff * skb,const struct nf_bridge_info * nf_bridge)148 br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
149 const struct nf_bridge_info *nf_bridge)
150 {
151 return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
152 sizeof(ipv6_hdr(skb)->daddr)) != 0;
153 }
154
155 /* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
156 * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
157 * for br_nf_pre_routing_finish(), same logic is used here but
158 * equivalent IPv6 function ip6_route_input() called indirectly.
159 */
br_nf_pre_routing_finish_ipv6(struct net * net,struct sock * sk,struct sk_buff * skb)160 static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb)
161 {
162 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
163 struct rtable *rt;
164 struct net_device *dev = skb->dev;
165 const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
166
167 nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
168
169 if (nf_bridge->pkt_otherhost) {
170 skb->pkt_type = PACKET_OTHERHOST;
171 nf_bridge->pkt_otherhost = false;
172 }
173 nf_bridge->in_prerouting = 0;
174 if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
175 skb_dst_drop(skb);
176 v6ops->route_input(skb);
177
178 if (skb_dst(skb)->error) {
179 kfree_skb(skb);
180 return 0;
181 }
182
183 if (skb_dst(skb)->dev == dev) {
184 skb->dev = nf_bridge->physindev;
185 nf_bridge_update_protocol(skb);
186 nf_bridge_push_encap_header(skb);
187 br_nf_hook_thresh(NF_BR_PRE_ROUTING,
188 net, sk, skb, skb->dev, NULL,
189 br_nf_pre_routing_finish_bridge);
190 return 0;
191 }
192 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
193 skb->pkt_type = PACKET_HOST;
194 } else {
195 rt = bridge_parent_rtable(nf_bridge->physindev);
196 if (!rt) {
197 kfree_skb(skb);
198 return 0;
199 }
200 skb_dst_drop(skb);
201 skb_dst_set_noref(skb, &rt->dst);
202 }
203
204 skb->dev = nf_bridge->physindev;
205 nf_bridge_update_protocol(skb);
206 nf_bridge_push_encap_header(skb);
207 br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb,
208 skb->dev, NULL, br_handle_frame_finish);
209
210 return 0;
211 }
212
213 /* Replicate the checks that IPv6 does on packet reception and pass the packet
214 * to ip6tables.
215 */
br_nf_pre_routing_ipv6(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)216 unsigned int br_nf_pre_routing_ipv6(void *priv,
217 struct sk_buff *skb,
218 const struct nf_hook_state *state)
219 {
220 struct nf_bridge_info *nf_bridge;
221
222 if (br_validate_ipv6(state->net, skb))
223 return NF_DROP;
224
225 nf_bridge = nf_bridge_alloc(skb);
226 if (!nf_bridge)
227 return NF_DROP;
228 if (!setup_pre_routing(skb, state->net))
229 return NF_DROP;
230
231 nf_bridge = nf_bridge_info_get(skb);
232 nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
233
234 skb->protocol = htons(ETH_P_IPV6);
235 skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);
236
237 NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
238 skb->dev, NULL,
239 br_nf_pre_routing_finish_ipv6);
240
241 return NF_STOLEN;
242 }
243