[linux-block.git] / net / bridge / br_netfilter_ipv6.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *	Handle firewalling
 *	Linux ethernet bridge
 *
 *	Authors:
 *	Lennert Buytenhek		<buytenh@gnu.org>
 *	Bart De Schuymer		<bdschuym@pandora.be>
 *
 *	Lennert dedicates this file to Kerstin Wurdinger.
 */

#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/ip.h>
#include <linux/netdevice.h>
#include <linux/skbuff.h>
#include <linux/if_arp.h>
#include <linux/if_ether.h>
#include <linux/if_vlan.h>
#include <linux/if_pppox.h>
#include <linux/ppp_defs.h>
#include <linux/netfilter_bridge.h>
#include <linux/netfilter_ipv4.h>
#include <linux/netfilter_ipv6.h>
#include <linux/netfilter_arp.h>
#include <linux/in_route.h>
#include <linux/inetdevice.h>

#include <net/ip.h>
#include <net/ipv6.h>
#include <net/addrconf.h>
#include <net/route.h>
#include <net/netfilter/br_netfilter.h>

#include <linux/uaccess.h>
#include "br_private.h"
#ifdef CONFIG_SYSCTL
#include <linux/sysctl.h>
#endif

int br_validate_ipv6(struct net *net, struct sk_buff *skb)
{
	const struct ipv6hdr *hdr;
	struct inet6_dev *idev = __in6_dev_get(skb->dev);
	u32 pkt_len;
	u8 ip6h_len = sizeof(struct ipv6hdr);

	if (!pskb_may_pull(skb, ip6h_len))
		goto inhdr_error;

	if (skb->len < ip6h_len)
		goto drop;

	hdr = ipv6_hdr(skb);

	if (hdr->version != 6)
		goto inhdr_error;

	pkt_len = ntohs(hdr->payload_len);
	if (hdr->nexthdr == NEXTHDR_HOP && nf_ip6_check_hbh_len(skb, &pkt_len))
		goto drop;

	if (pkt_len + ip6h_len > skb->len) {
		__IP6_INC_STATS(net, idev,
				IPSTATS_MIB_INTRUNCATEDPKTS);
		goto drop;
	}
	if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
		__IP6_INC_STATS(net, idev,
				IPSTATS_MIB_INDISCARDS);
		goto drop;
	}

	memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
	/* No IP options in IPv6 header; however it should be
	 * checked if some next headers need special treatment
	 */
	return 0;

inhdr_error:
	__IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
drop:
	return -1;
}

static inline bool
br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
			     const struct nf_bridge_info *nf_bridge)
{
	return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
		      sizeof(ipv6_hdr(skb)->daddr)) != 0;
}

/* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
 * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
 * for br_nf_pre_routing_finish(), same logic is used here but
 * equivalent IPv6 function ip6_route_input() called indirectly.
 */
static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb)
{
	struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
	struct rtable *rt;
	struct net_device *dev = skb->dev, *br_indev;
	const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();

	br_indev = nf_bridge_get_physindev(skb, net);
	if (!br_indev) {
		kfree_skb(skb);
		return 0;
	}

	nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;

	if (nf_bridge->pkt_otherhost) {
		skb->pkt_type = PACKET_OTHERHOST;
		nf_bridge->pkt_otherhost = false;
	}
	nf_bridge->in_prerouting = 0;
	if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
		skb_dst_drop(skb);
		v6ops->route_input(skb);

		if (skb_dst(skb)->error) {
			kfree_skb(skb);
			return 0;
		}

		if (skb_dst(skb)->dev == dev) {
			skb->dev = br_indev;
			nf_bridge_update_protocol(skb);
			nf_bridge_push_encap_header(skb);
			br_nf_hook_thresh(NF_BR_PRE_ROUTING,
					  net, sk, skb, skb->dev, NULL,
					  br_nf_pre_routing_finish_bridge);
			return 0;
		}
		ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
		skb->pkt_type = PACKET_HOST;
	} else {
		rt = bridge_parent_rtable(br_indev);
		if (!rt) {
			kfree_skb(skb);
			return 0;
		}
		skb_dst_drop(skb);
		skb_dst_set_noref(skb, &rt->dst);
	}

	skb->dev = br_indev;
	nf_bridge_update_protocol(skb);
	nf_bridge_push_encap_header(skb);
	br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb,
			  skb->dev, NULL, br_handle_frame_finish);

	return 0;
}

/* Replicate the checks that IPv6 does on packet reception and pass the packet
 * to ip6tables.
 */
unsigned int br_nf_pre_routing_ipv6(void *priv,
				    struct sk_buff *skb,
				    const struct nf_hook_state *state)
{
	struct nf_bridge_info *nf_bridge;

	if (br_validate_ipv6(state->net, skb))
		return NF_DROP_REASON(skb, SKB_DROP_REASON_IP_INHDR, 0);

	nf_bridge = nf_bridge_alloc(skb);
	if (!nf_bridge)
		return NF_DROP_REASON(skb, SKB_DROP_REASON_NOMEM, 0);
	if (!setup_pre_routing(skb, state->net))
		return NF_DROP_REASON(skb, SKB_DROP_REASON_DEV_READY, 0);

	nf_bridge = nf_bridge_info_get(skb);
	nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;

	skb->protocol = htons(ETH_P_IPV6);
	skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);

	NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
		skb->dev, NULL,
		br_nf_pre_routing_finish_ipv6);

	return NF_STOLEN;
}
Commit	Line	Data
2874c5fd	1	// SPDX-License-Identifier: GPL-2.0-or-later
230ac490 PNA	2	/*
	3	* Handle firewalling
	4	* Linux ethernet bridge
	5	*
	6	* Authors:
	7	* Lennert Buytenhek <buytenh@gnu.org>
	8	* Bart De Schuymer <bdschuym@pandora.be>
	9	*
230ac490 PNA	10	* Lennert dedicates this file to Kerstin Wurdinger.
	11	*/
	12
	13	#include <linux/module.h>
	14	#include <linux/kernel.h>
	15	#include <linux/slab.h>
	16	#include <linux/ip.h>
	17	#include <linux/netdevice.h>
	18	#include <linux/skbuff.h>
	19	#include <linux/if_arp.h>
	20	#include <linux/if_ether.h>
	21	#include <linux/if_vlan.h>
	22	#include <linux/if_pppox.h>
	23	#include <linux/ppp_defs.h>
	24	#include <linux/netfilter_bridge.h>
	25	#include <linux/netfilter_ipv4.h>
	26	#include <linux/netfilter_ipv6.h>
	27	#include <linux/netfilter_arp.h>
	28	#include <linux/in_route.h>
	29	#include <linux/inetdevice.h>
	30
	31	#include <net/ip.h>
	32	#include <net/ipv6.h>
	33	#include <net/addrconf.h>
	34	#include <net/route.h>
	35	#include <net/netfilter/br_netfilter.h>
	36
7c0f6ba6	37	#include <linux/uaccess.h>
230ac490 PNA	38	#include "br_private.h"
	39	#ifdef CONFIG_SYSCTL
	40	#include <linux/sysctl.h>
	41	#endif
	42
c1444c63	43	int br_validate_ipv6(struct net net, struct sk_buff skb)
230ac490 PNA	44	{
230ac490 PNA	45	const struct ipv6hdr *hdr;
86e89718	46	struct inet6_dev *idev = __in6_dev_get(skb->dev);
230ac490 PNA	47	u32 pkt_len;
	48	u8 ip6h_len = sizeof(struct ipv6hdr);
	49
	50	if (!pskb_may_pull(skb, ip6h_len))
	51	goto inhdr_error;
	52
	53	if (skb->len < ip6h_len)
	54	goto drop;
	55
	56	hdr = ipv6_hdr(skb);
	57
	58	if (hdr->version != 6)
	59	goto inhdr_error;
	60
	61	pkt_len = ntohs(hdr->payload_len);
28e144cf	62	if (hdr->nexthdr == NEXTHDR_HOP && nf_ip6_check_hbh_len(skb, &pkt_len))
0b24bd71	63	goto drop;
230ac490	64
0b24bd71 XL	65	if (pkt_len + ip6h_len > skb->len) {
	66	__IP6_INC_STATS(net, idev,
	67	IPSTATS_MIB_INTRUNCATEDPKTS);
	68	goto drop;
230ac490	69	}
0b24bd71 XL	70	if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
	71	__IP6_INC_STATS(net, idev,
	72	IPSTATS_MIB_INDISCARDS);
230ac490	73	goto drop;
0b24bd71	74	}
230ac490 PNA	75
	76	memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
	77	/* No IP options in IPv6 header; however it should be
	78	* checked if some next headers need special treatment
	79	*/
	80	return 0;
	81
	82	inhdr_error:
1d015503	83	__IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
230ac490 PNA	84	drop:
	85	return -1;
	86	}
	87
	88	static inline bool
	89	br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
	90	const struct nf_bridge_info *nf_bridge)
	91	{
	92	return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
	93	sizeof(ipv6_hdr(skb)->daddr)) != 0;
	94	}
	95
	96	/* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
	97	* PREROUTING and continue the bridge PRE_ROUTING hook. See comment
	98	* for br_nf_pre_routing_finish(), same logic is used here but
	99	* equivalent IPv6 function ip6_route_input() called indirectly.
	100	*/
0c4b51f0	101	static int br_nf_pre_routing_finish_ipv6(struct net net, struct sock sk, struct sk_buff *skb)
230ac490 PNA	102	{
	103	struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
	104	struct rtable *rt;
98748088	105	struct net_device dev = skb->dev, br_indev;
230ac490 PNA	106	const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
230ac490 PNA	107
98748088 PT	108	br_indev = nf_bridge_get_physindev(skb, net);
	109	if (!br_indev) {
	110	kfree_skb(skb);
	111	return 0;
	112	}
	113
230ac490 PNA	114	nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
	115
	116	if (nf_bridge->pkt_otherhost) {
	117	skb->pkt_type = PACKET_OTHERHOST;
	118	nf_bridge->pkt_otherhost = false;
	119	}
72b1e5e4	120	nf_bridge->in_prerouting = 0;
230ac490 PNA	121	if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
	122	skb_dst_drop(skb);
	123	v6ops->route_input(skb);
	124
	125	if (skb_dst(skb)->error) {
	126	kfree_skb(skb);
	127	return 0;
	128	}
	129
	130	if (skb_dst(skb)->dev == dev) {
98748088	131	skb->dev = br_indev;
230ac490 PNA	132	nf_bridge_update_protocol(skb);
230ac490 PNA	133	nf_bridge_push_encap_header(skb);
c5136b15 FW	134	br_nf_hook_thresh(NF_BR_PRE_ROUTING,
	135	net, sk, skb, skb->dev, NULL,
	136	br_nf_pre_routing_finish_bridge);
230ac490 PNA	137	return 0;
	138	}
	139	ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
	140	skb->pkt_type = PACKET_HOST;
	141	} else {
98748088	142	rt = bridge_parent_rtable(br_indev);
230ac490 PNA	143	if (!rt) {
	144	kfree_skb(skb);
	145	return 0;
	146	}
d047283a	147	skb_dst_drop(skb);
230ac490 PNA	148	skb_dst_set_noref(skb, &rt->dst);
	149	}
	150
98748088	151	skb->dev = br_indev;
230ac490 PNA	152	nf_bridge_update_protocol(skb);
230ac490 PNA	153	nf_bridge_push_encap_header(skb);
c5136b15 FW	154	br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb,
c5136b15 FW	155	skb->dev, NULL, br_handle_frame_finish);
230ac490 PNA	156
	157	return 0;
	158	}
	159
	160	/* Replicate the checks that IPv6 does on packet reception and pass the packet
	161	* to ip6tables.
	162	*/
06198b34	163	unsigned int br_nf_pre_routing_ipv6(void *priv,
230ac490 PNA	164	struct sk_buff *skb,
	165	const struct nf_hook_state *state)
	166	{
	167	struct nf_bridge_info *nf_bridge;
	168
c1444c63	169	if (br_validate_ipv6(state->net, skb))
cf8b7c1a	170	return NF_DROP_REASON(skb, SKB_DROP_REASON_IP_INHDR, 0);
230ac490	171
de8bda1d FW	172	nf_bridge = nf_bridge_alloc(skb);
de8bda1d FW	173	if (!nf_bridge)
cf8b7c1a	174	return NF_DROP_REASON(skb, SKB_DROP_REASON_NOMEM, 0);
ff6d090d	175	if (!setup_pre_routing(skb, state->net))
cf8b7c1a	176	return NF_DROP_REASON(skb, SKB_DROP_REASON_DEV_READY, 0);
230ac490 PNA	177
	178	nf_bridge = nf_bridge_info_get(skb);
	179	nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
	180
	181	skb->protocol = htons(ETH_P_IPV6);
e166e4fd XL	182	skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);
e166e4fd XL	183
29a26a56	184	NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
230ac490 PNA	185	skb->dev, NULL,
	186	br_nf_pre_routing_finish_ipv6);
	187
	188	return NF_STOLEN;
	189	}