net/bridge/netfilter/nf_tables_bridge.c

   1 /*
   2  * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
   3  * Copyright (c) 2013 Pablo Neira Ayuso <pablo@netfilter.org>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  10  */
  11
  12 #include <linux/init.h>
  13 #include <linux/module.h>
  14 #include <linux/netfilter_bridge.h>
  15 #include <net/netfilter/nf_tables.h>
  16 #include <linux/ip.h>
  17 #include <linux/ipv6.h>
  18 #include <net/netfilter/nf_tables_ipv4.h>
  19 #include <net/netfilter/nf_tables_ipv6.h>
  20
  21 static unsigned int
  22 nft_do_chain_bridge(void *priv,
  23                     struct sk_buff *skb,
  24                     const struct nf_hook_state *state)
  25 {
  26         struct nft_pktinfo pkt;
  27
  28         nft_set_pktinfo(&pkt, skb, state);
  29
  30         switch (eth_hdr(skb)->h_proto) {
  31         case htons(ETH_P_IP):
  32                 nft_set_pktinfo_ipv4_validate(&pkt, skb);
  33                 break;
  34         case htons(ETH_P_IPV6):
  35                 nft_set_pktinfo_ipv6_validate(&pkt, skb);
  36                 break;
  37         default:
  38                 nft_set_pktinfo_unspec(&pkt, skb);
  39                 break;
  40         }
  41
  42         return nft_do_chain(&pkt, priv);
  43 }
  44
  45 static struct nft_af_info nft_af_bridge __read_mostly = {
  46         .family         = NFPROTO_BRIDGE,
  47         .nhooks         = NF_BR_NUMHOOKS,
  48         .owner          = THIS_MODULE,
  49         .hooks          = {
  50                 [NF_BR_PRE_ROUTING]     = nft_do_chain_bridge,
  51                 [NF_BR_LOCAL_IN]        = nft_do_chain_bridge,
  52                 [NF_BR_FORWARD]         = nft_do_chain_bridge,
  53                 [NF_BR_LOCAL_OUT]       = nft_do_chain_bridge,
  54                 [NF_BR_POST_ROUTING]    = nft_do_chain_bridge,
  55         },
  56 };
  57
  58 static int nf_tables_bridge_init_net(struct net *net)
  59 {
  60         net->nft.bridge = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);
  61         if (net->nft.bridge == NULL)
  62                 return -ENOMEM;
  63
  64         memcpy(net->nft.bridge, &nft_af_bridge, sizeof(nft_af_bridge));
  65
  66         if (nft_register_afinfo(net, net->nft.bridge) < 0)
  67                 goto err;
  68
  69         return 0;
  70 err:
  71         kfree(net->nft.bridge);
  72         return -ENOMEM;
  73 }
  74
  75 static void nf_tables_bridge_exit_net(struct net *net)
  76 {
  77         nft_unregister_afinfo(net, net->nft.bridge);
  78         kfree(net->nft.bridge);
  79 }
  80
  81 static struct pernet_operations nf_tables_bridge_net_ops = {
  82         .init   = nf_tables_bridge_init_net,
  83         .exit   = nf_tables_bridge_exit_net,
  84 };
  85
  86 static const struct nf_chain_type filter_bridge = {
  87         .name           = "filter",
  88         .type           = NFT_CHAIN_T_DEFAULT,
  89         .family         = NFPROTO_BRIDGE,
  90         .owner          = THIS_MODULE,
  91         .hook_mask      = (1 << NF_BR_PRE_ROUTING) |
  92                           (1 << NF_BR_LOCAL_IN) |
  93                           (1 << NF_BR_FORWARD) |
  94                           (1 << NF_BR_LOCAL_OUT) |
  95                           (1 << NF_BR_POST_ROUTING),
  96 };
  97
  98 static void nf_br_saveroute(const struct sk_buff *skb,
  99                             struct nf_queue_entry *entry)
 100 {
 101 }
 102
 103 static int nf_br_reroute(struct net *net, struct sk_buff *skb,
 104                          const struct nf_queue_entry *entry)
 105 {
 106         return 0;
 107 }
 108
 109 static __sum16 nf_br_checksum(struct sk_buff *skb, unsigned int hook,
 110                               unsigned int dataoff, u_int8_t protocol)
 111 {
 112         return 0;
 113 }
 114
 115 static __sum16 nf_br_checksum_partial(struct sk_buff *skb, unsigned int hook,
 116                                       unsigned int dataoff, unsigned int len,
 117                                       u_int8_t protocol)
 118 {
 119         return 0;
 120 }
 121
 122 static int nf_br_route(struct net *net, struct dst_entry **dst,
 123                        struct flowi *fl, bool strict __always_unused)
 124 {
 125         return 0;
 126 }
 127
 128 static const struct nf_afinfo nf_br_afinfo = {
 129         .family                 = AF_BRIDGE,
 130         .checksum               = nf_br_checksum,
 131         .checksum_partial       = nf_br_checksum_partial,
 132         .route                  = nf_br_route,
 133         .saveroute              = nf_br_saveroute,
 134         .reroute                = nf_br_reroute,
 135         .route_key_size         = 0,
 136 };
 137
 138 static int __init nf_tables_bridge_init(void)
 139 {
 140         int ret;
 141
 142         nf_register_afinfo(&nf_br_afinfo);
 143         ret = nft_register_chain_type(&filter_bridge);
 144         if (ret < 0)
 145                 goto err1;
 146
 147         ret = register_pernet_subsys(&nf_tables_bridge_net_ops);
 148         if (ret < 0)
 149                 goto err2;
 150
 151         return ret;
 152
 153 err2:
 154         nft_unregister_chain_type(&filter_bridge);
 155 err1:
 156         nf_unregister_afinfo(&nf_br_afinfo);
 157         return ret;
 158 }
 159
 160 static void __exit nf_tables_bridge_exit(void)
 161 {
 162         unregister_pernet_subsys(&nf_tables_bridge_net_ops);
 163         nft_unregister_chain_type(&filter_bridge);
 164         nf_unregister_afinfo(&nf_br_afinfo);
 165 }
 166
 167 module_init(nf_tables_bridge_init);
 168 module_exit(nf_tables_bridge_exit);
 169
 170 MODULE_LICENSE("GPL");
 171 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 172 MODULE_ALIAS_NFT_FAMILY(AF_BRIDGE);