br_netfilter_hooks.c 31 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * Handle firewalling
  4. * Linux ethernet bridge
  5. *
  6. * Authors:
  7. * Lennert Buytenhek <buytenh@gnu.org>
  8. * Bart De Schuymer <bdschuym@pandora.be>
  9. *
  10. * Lennert dedicates this file to Kerstin Wurdinger.
  11. */
  12. #include <linux/module.h>
  13. #include <linux/kernel.h>
  14. #include <linux/slab.h>
  15. #include <linux/ip.h>
  16. #include <linux/netdevice.h>
  17. #include <linux/skbuff.h>
  18. #include <linux/if_arp.h>
  19. #include <linux/if_ether.h>
  20. #include <linux/if_vlan.h>
  21. #include <linux/if_pppox.h>
  22. #include <linux/ppp_defs.h>
  23. #include <linux/netfilter_bridge.h>
  24. #include <uapi/linux/netfilter_bridge.h>
  25. #include <linux/netfilter_ipv4.h>
  26. #include <linux/netfilter_ipv6.h>
  27. #include <linux/netfilter_arp.h>
  28. #include <linux/in_route.h>
  29. #include <linux/rculist.h>
  30. #include <linux/inetdevice.h>
  31. #include <net/ip.h>
  32. #include <net/ipv6.h>
  33. #include <net/addrconf.h>
  34. #include <net/route.h>
  35. #include <net/netfilter/br_netfilter.h>
  36. #include <net/netns/generic.h>
  37. #include <linux/uaccess.h>
  38. #include "br_private.h"
  39. #ifdef CONFIG_SYSCTL
  40. #include <linux/sysctl.h>
  41. #endif
  42. static unsigned int brnf_net_id __read_mostly;
  43. struct brnf_net {
  44. bool enabled;
  45. #ifdef CONFIG_SYSCTL
  46. struct ctl_table_header *ctl_hdr;
  47. #endif
  48. /* default value is 1 */
  49. int call_iptables;
  50. int call_ip6tables;
  51. int call_arptables;
  52. /* default value is 0 */
  53. int filter_vlan_tagged;
  54. int filter_pppoe_tagged;
  55. int pass_vlan_indev;
  56. };
  57. #define IS_IP(skb) \
  58. (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_IP))
  59. #define IS_IPV6(skb) \
  60. (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_IPV6))
  61. #define IS_ARP(skb) \
  62. (!skb_vlan_tag_present(skb) && skb->protocol == htons(ETH_P_ARP))
  63. static inline __be16 vlan_proto(const struct sk_buff *skb)
  64. {
  65. if (skb_vlan_tag_present(skb))
  66. return skb->protocol;
  67. else if (skb->protocol == htons(ETH_P_8021Q))
  68. return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
  69. else
  70. return 0;
  71. }
  72. static inline bool is_vlan_ip(const struct sk_buff *skb, const struct net *net)
  73. {
  74. struct brnf_net *brnet = net_generic(net, brnf_net_id);
  75. return vlan_proto(skb) == htons(ETH_P_IP) && brnet->filter_vlan_tagged;
  76. }
  77. static inline bool is_vlan_ipv6(const struct sk_buff *skb,
  78. const struct net *net)
  79. {
  80. struct brnf_net *brnet = net_generic(net, brnf_net_id);
  81. return vlan_proto(skb) == htons(ETH_P_IPV6) &&
  82. brnet->filter_vlan_tagged;
  83. }
  84. static inline bool is_vlan_arp(const struct sk_buff *skb, const struct net *net)
  85. {
  86. struct brnf_net *brnet = net_generic(net, brnf_net_id);
  87. return vlan_proto(skb) == htons(ETH_P_ARP) && brnet->filter_vlan_tagged;
  88. }
  89. static inline __be16 pppoe_proto(const struct sk_buff *skb)
  90. {
  91. return *((__be16 *)(skb_mac_header(skb) + ETH_HLEN +
  92. sizeof(struct pppoe_hdr)));
  93. }
  94. static inline bool is_pppoe_ip(const struct sk_buff *skb, const struct net *net)
  95. {
  96. struct brnf_net *brnet = net_generic(net, brnf_net_id);
  97. return skb->protocol == htons(ETH_P_PPP_SES) &&
  98. pppoe_proto(skb) == htons(PPP_IP) && brnet->filter_pppoe_tagged;
  99. }
  100. static inline bool is_pppoe_ipv6(const struct sk_buff *skb,
  101. const struct net *net)
  102. {
  103. struct brnf_net *brnet = net_generic(net, brnf_net_id);
  104. return skb->protocol == htons(ETH_P_PPP_SES) &&
  105. pppoe_proto(skb) == htons(PPP_IPV6) &&
  106. brnet->filter_pppoe_tagged;
  107. }
  108. /* largest possible L2 header, see br_nf_dev_queue_xmit() */
  109. #define NF_BRIDGE_MAX_MAC_HEADER_LENGTH (PPPOE_SES_HLEN + ETH_HLEN)
  110. struct brnf_frag_data {
  111. char mac[NF_BRIDGE_MAX_MAC_HEADER_LENGTH];
  112. u8 encap_size;
  113. u8 size;
  114. u16 vlan_tci;
  115. __be16 vlan_proto;
  116. };
  117. static DEFINE_PER_CPU(struct brnf_frag_data, brnf_frag_data_storage);
  118. static void nf_bridge_info_free(struct sk_buff *skb)
  119. {
  120. skb_ext_del(skb, SKB_EXT_BRIDGE_NF);
  121. }
  122. static inline struct net_device *bridge_parent(const struct net_device *dev)
  123. {
  124. struct net_bridge_port *port;
  125. port = br_port_get_rcu(dev);
  126. return port ? port->br->dev : NULL;
  127. }
  128. static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
  129. {
  130. return skb_ext_add(skb, SKB_EXT_BRIDGE_NF);
  131. }
  132. unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb)
  133. {
  134. switch (skb->protocol) {
  135. case __cpu_to_be16(ETH_P_8021Q):
  136. return VLAN_HLEN;
  137. case __cpu_to_be16(ETH_P_PPP_SES):
  138. return PPPOE_SES_HLEN;
  139. default:
  140. return 0;
  141. }
  142. }
  143. static inline void nf_bridge_pull_encap_header(struct sk_buff *skb)
  144. {
  145. unsigned int len = nf_bridge_encap_header_len(skb);
  146. skb_pull(skb, len);
  147. skb->network_header += len;
  148. }
  149. static inline void nf_bridge_pull_encap_header_rcsum(struct sk_buff *skb)
  150. {
  151. unsigned int len = nf_bridge_encap_header_len(skb);
  152. skb_pull_rcsum(skb, len);
  153. skb->network_header += len;
  154. }
  155. /* When handing a packet over to the IP layer
  156. * check whether we have a skb that is in the
  157. * expected format
  158. */
  159. static int br_validate_ipv4(struct net *net, struct sk_buff *skb)
  160. {
  161. const struct iphdr *iph;
  162. u32 len;
  163. if (!pskb_may_pull(skb, sizeof(struct iphdr)))
  164. goto inhdr_error;
  165. iph = ip_hdr(skb);
  166. /* Basic sanity checks */
  167. if (iph->ihl < 5 || iph->version != 4)
  168. goto inhdr_error;
  169. if (!pskb_may_pull(skb, iph->ihl*4))
  170. goto inhdr_error;
  171. iph = ip_hdr(skb);
  172. if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
  173. goto csum_error;
  174. len = ntohs(iph->tot_len);
  175. if (skb->len < len) {
  176. __IP_INC_STATS(net, IPSTATS_MIB_INTRUNCATEDPKTS);
  177. goto drop;
  178. } else if (len < (iph->ihl*4))
  179. goto inhdr_error;
  180. if (pskb_trim_rcsum(skb, len)) {
  181. __IP_INC_STATS(net, IPSTATS_MIB_INDISCARDS);
  182. goto drop;
  183. }
  184. memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
  185. /* We should really parse IP options here but until
  186. * somebody who actually uses IP options complains to
  187. * us we'll just silently ignore the options because
  188. * we're lazy!
  189. */
  190. return 0;
  191. csum_error:
  192. __IP_INC_STATS(net, IPSTATS_MIB_CSUMERRORS);
  193. inhdr_error:
  194. __IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
  195. drop:
  196. return -1;
  197. }
  198. void nf_bridge_update_protocol(struct sk_buff *skb)
  199. {
  200. const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
  201. switch (nf_bridge->orig_proto) {
  202. case BRNF_PROTO_8021Q:
  203. skb->protocol = htons(ETH_P_8021Q);
  204. break;
  205. case BRNF_PROTO_PPPOE:
  206. skb->protocol = htons(ETH_P_PPP_SES);
  207. break;
  208. case BRNF_PROTO_UNCHANGED:
  209. break;
  210. }
  211. }
  212. /* Obtain the correct destination MAC address, while preserving the original
  213. * source MAC address. If we already know this address, we just copy it. If we
  214. * don't, we use the neighbour framework to find out. In both cases, we make
  215. * sure that br_handle_frame_finish() is called afterwards.
  216. */
  217. int br_nf_pre_routing_finish_bridge(struct net *net, struct sock *sk, struct sk_buff *skb)
  218. {
  219. struct neighbour *neigh;
  220. struct dst_entry *dst;
  221. skb->dev = bridge_parent(skb->dev);
  222. if (!skb->dev)
  223. goto free_skb;
  224. dst = skb_dst(skb);
  225. neigh = dst_neigh_lookup_skb(dst, skb);
  226. if (neigh) {
  227. struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
  228. int ret;
  229. if ((neigh->nud_state & NUD_CONNECTED) && neigh->hh.hh_len) {
  230. neigh_hh_bridge(&neigh->hh, skb);
  231. skb->dev = nf_bridge->physindev;
  232. ret = br_handle_frame_finish(net, sk, skb);
  233. } else {
  234. /* the neighbour function below overwrites the complete
  235. * MAC header, so we save the Ethernet source address and
  236. * protocol number.
  237. */
  238. skb_copy_from_linear_data_offset(skb,
  239. -(ETH_HLEN-ETH_ALEN),
  240. nf_bridge->neigh_header,
  241. ETH_HLEN-ETH_ALEN);
  242. /* tell br_dev_xmit to continue with forwarding */
  243. nf_bridge->bridged_dnat = 1;
  244. /* FIXME Need to refragment */
  245. ret = neigh->output(neigh, skb);
  246. }
  247. neigh_release(neigh);
  248. return ret;
  249. }
  250. free_skb:
  251. kfree_skb(skb);
  252. return 0;
  253. }
  254. static inline bool
  255. br_nf_ipv4_daddr_was_changed(const struct sk_buff *skb,
  256. const struct nf_bridge_info *nf_bridge)
  257. {
  258. return ip_hdr(skb)->daddr != nf_bridge->ipv4_daddr;
  259. }
  260. /* This requires some explaining. If DNAT has taken place,
  261. * we will need to fix up the destination Ethernet address.
  262. * This is also true when SNAT takes place (for the reply direction).
  263. *
  264. * There are two cases to consider:
  265. * 1. The packet was DNAT'ed to a device in the same bridge
  266. * port group as it was received on. We can still bridge
  267. * the packet.
  268. * 2. The packet was DNAT'ed to a different device, either
  269. * a non-bridged device or another bridge port group.
  270. * The packet will need to be routed.
  271. *
  272. * The correct way of distinguishing between these two cases is to
  273. * call ip_route_input() and to look at skb->dst->dev, which is
  274. * changed to the destination device if ip_route_input() succeeds.
  275. *
  276. * Let's first consider the case that ip_route_input() succeeds:
  277. *
  278. * If the output device equals the logical bridge device the packet
  279. * came in on, we can consider this bridging. The corresponding MAC
  280. * address will be obtained in br_nf_pre_routing_finish_bridge.
  281. * Otherwise, the packet is considered to be routed and we just
  282. * change the destination MAC address so that the packet will
  283. * later be passed up to the IP stack to be routed. For a redirected
  284. * packet, ip_route_input() will give back the localhost as output device,
  285. * which differs from the bridge device.
  286. *
  287. * Let's now consider the case that ip_route_input() fails:
  288. *
  289. * This can be because the destination address is martian, in which case
  290. * the packet will be dropped.
  291. * If IP forwarding is disabled, ip_route_input() will fail, while
  292. * ip_route_output_key() can return success. The source
  293. * address for ip_route_output_key() is set to zero, so ip_route_output_key()
  294. * thinks we're handling a locally generated packet and won't care
  295. * if IP forwarding is enabled. If the output device equals the logical bridge
  296. * device, we proceed as if ip_route_input() succeeded. If it differs from the
  297. * logical bridge port or if ip_route_output_key() fails we drop the packet.
  298. */
  299. static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
  300. {
  301. struct net_device *dev = skb->dev;
  302. struct iphdr *iph = ip_hdr(skb);
  303. struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
  304. struct rtable *rt;
  305. int err;
  306. nf_bridge->frag_max_size = IPCB(skb)->frag_max_size;
  307. if (nf_bridge->pkt_otherhost) {
  308. skb->pkt_type = PACKET_OTHERHOST;
  309. nf_bridge->pkt_otherhost = false;
  310. }
  311. nf_bridge->in_prerouting = 0;
  312. if (br_nf_ipv4_daddr_was_changed(skb, nf_bridge)) {
  313. if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
  314. struct in_device *in_dev = __in_dev_get_rcu(dev);
  315. /* If err equals -EHOSTUNREACH the error is due to a
  316. * martian destination or due to the fact that
  317. * forwarding is disabled. For most martian packets,
  318. * ip_route_output_key() will fail. It won't fail for 2 types of
  319. * martian destinations: loopback destinations and destination
  320. * 0.0.0.0. In both cases the packet will be dropped because the
  321. * destination is the loopback device and not the bridge. */
  322. if (err != -EHOSTUNREACH || !in_dev || IN_DEV_FORWARD(in_dev))
  323. goto free_skb;
  324. rt = ip_route_output(net, iph->daddr, 0,
  325. RT_TOS(iph->tos), 0);
  326. if (!IS_ERR(rt)) {
  327. /* - Bridged-and-DNAT'ed traffic doesn't
  328. * require ip_forwarding. */
  329. if (rt->dst.dev == dev) {
  330. skb_dst_set(skb, &rt->dst);
  331. goto bridged_dnat;
  332. }
  333. ip_rt_put(rt);
  334. }
  335. free_skb:
  336. kfree_skb(skb);
  337. return 0;
  338. } else {
  339. if (skb_dst(skb)->dev == dev) {
  340. bridged_dnat:
  341. skb->dev = nf_bridge->physindev;
  342. nf_bridge_update_protocol(skb);
  343. nf_bridge_push_encap_header(skb);
  344. br_nf_hook_thresh(NF_BR_PRE_ROUTING,
  345. net, sk, skb, skb->dev,
  346. NULL,
  347. br_nf_pre_routing_finish_bridge);
  348. return 0;
  349. }
  350. ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
  351. skb->pkt_type = PACKET_HOST;
  352. }
  353. } else {
  354. rt = bridge_parent_rtable(nf_bridge->physindev);
  355. if (!rt) {
  356. kfree_skb(skb);
  357. return 0;
  358. }
  359. skb_dst_set_noref(skb, &rt->dst);
  360. }
  361. skb->dev = nf_bridge->physindev;
  362. nf_bridge_update_protocol(skb);
  363. nf_bridge_push_encap_header(skb);
  364. br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb, skb->dev, NULL,
  365. br_handle_frame_finish);
  366. return 0;
  367. }
  368. static struct net_device *brnf_get_logical_dev(struct sk_buff *skb,
  369. const struct net_device *dev,
  370. const struct net *net)
  371. {
  372. struct net_device *vlan, *br;
  373. struct brnf_net *brnet = net_generic(net, brnf_net_id);
  374. br = bridge_parent(dev);
  375. if (brnet->pass_vlan_indev == 0 || !skb_vlan_tag_present(skb))
  376. return br;
  377. vlan = __vlan_find_dev_deep_rcu(br, skb->vlan_proto,
  378. skb_vlan_tag_get(skb) & VLAN_VID_MASK);
  379. return vlan ? vlan : br;
  380. }
  381. /* Some common code for IPv4/IPv6 */
  382. struct net_device *setup_pre_routing(struct sk_buff *skb, const struct net *net)
  383. {
  384. struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
  385. if (skb->pkt_type == PACKET_OTHERHOST) {
  386. skb->pkt_type = PACKET_HOST;
  387. nf_bridge->pkt_otherhost = true;
  388. }
  389. nf_bridge->in_prerouting = 1;
  390. nf_bridge->physindev = skb->dev;
  391. skb->dev = brnf_get_logical_dev(skb, skb->dev, net);
  392. if (skb->protocol == htons(ETH_P_8021Q))
  393. nf_bridge->orig_proto = BRNF_PROTO_8021Q;
  394. else if (skb->protocol == htons(ETH_P_PPP_SES))
  395. nf_bridge->orig_proto = BRNF_PROTO_PPPOE;
  396. /* Must drop socket now because of tproxy. */
  397. skb_orphan(skb);
  398. return skb->dev;
  399. }
  400. /* Direct IPv6 traffic to br_nf_pre_routing_ipv6.
  401. * Replicate the checks that IPv4 does on packet reception.
  402. * Set skb->dev to the bridge device (i.e. parent of the
  403. * receiving device) to make netfilter happy, the REDIRECT
  404. * target in particular. Save the original destination IP
  405. * address to be able to detect DNAT afterwards. */
  406. static unsigned int br_nf_pre_routing(void *priv,
  407. struct sk_buff *skb,
  408. const struct nf_hook_state *state)
  409. {
  410. struct nf_bridge_info *nf_bridge;
  411. struct net_bridge_port *p;
  412. struct net_bridge *br;
  413. __u32 len = nf_bridge_encap_header_len(skb);
  414. struct brnf_net *brnet;
  415. if (unlikely(!pskb_may_pull(skb, len)))
  416. return NF_DROP;
  417. p = br_port_get_rcu(state->in);
  418. if (p == NULL)
  419. return NF_DROP;
  420. br = p->br;
  421. brnet = net_generic(state->net, brnf_net_id);
  422. if (IS_IPV6(skb) || is_vlan_ipv6(skb, state->net) ||
  423. is_pppoe_ipv6(skb, state->net)) {
  424. if (!brnet->call_ip6tables &&
  425. !br_opt_get(br, BROPT_NF_CALL_IP6TABLES))
  426. return NF_ACCEPT;
  427. if (!ipv6_mod_enabled()) {
  428. pr_warn_once("Module ipv6 is disabled, so call_ip6tables is not supported.");
  429. return NF_DROP;
  430. }
  431. nf_bridge_pull_encap_header_rcsum(skb);
  432. return br_nf_pre_routing_ipv6(priv, skb, state);
  433. }
  434. if (!brnet->call_iptables && !br_opt_get(br, BROPT_NF_CALL_IPTABLES))
  435. return NF_ACCEPT;
  436. if (!IS_IP(skb) && !is_vlan_ip(skb, state->net) &&
  437. !is_pppoe_ip(skb, state->net))
  438. return NF_ACCEPT;
  439. nf_bridge_pull_encap_header_rcsum(skb);
  440. if (br_validate_ipv4(state->net, skb))
  441. return NF_DROP;
  442. if (!nf_bridge_alloc(skb))
  443. return NF_DROP;
  444. if (!setup_pre_routing(skb, state->net))
  445. return NF_DROP;
  446. nf_bridge = nf_bridge_info_get(skb);
  447. nf_bridge->ipv4_daddr = ip_hdr(skb)->daddr;
  448. skb->protocol = htons(ETH_P_IP);
  449. skb->transport_header = skb->network_header + ip_hdr(skb)->ihl * 4;
  450. NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
  451. skb->dev, NULL,
  452. br_nf_pre_routing_finish);
  453. return NF_STOLEN;
  454. }
  455. /* PF_BRIDGE/FORWARD *************************************************/
  456. static int br_nf_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
  457. {
  458. struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
  459. struct net_device *in;
  460. if (!IS_ARP(skb) && !is_vlan_arp(skb, net)) {
  461. if (skb->protocol == htons(ETH_P_IP))
  462. nf_bridge->frag_max_size = IPCB(skb)->frag_max_size;
  463. if (skb->protocol == htons(ETH_P_IPV6))
  464. nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
  465. in = nf_bridge->physindev;
  466. if (nf_bridge->pkt_otherhost) {
  467. skb->pkt_type = PACKET_OTHERHOST;
  468. nf_bridge->pkt_otherhost = false;
  469. }
  470. nf_bridge_update_protocol(skb);
  471. } else {
  472. in = *((struct net_device **)(skb->cb));
  473. }
  474. nf_bridge_push_encap_header(skb);
  475. br_nf_hook_thresh(NF_BR_FORWARD, net, sk, skb, in, skb->dev,
  476. br_forward_finish);
  477. return 0;
  478. }
  479. /* This is the 'purely bridged' case. For IP, we pass the packet to
  480. * netfilter with indev and outdev set to the bridge device,
  481. * but we are still able to filter on the 'real' indev/outdev
  482. * because of the physdev module. For ARP, indev and outdev are the
  483. * bridge ports. */
  484. static unsigned int br_nf_forward_ip(void *priv,
  485. struct sk_buff *skb,
  486. const struct nf_hook_state *state)
  487. {
  488. struct nf_bridge_info *nf_bridge;
  489. struct net_device *parent;
  490. u_int8_t pf;
  491. nf_bridge = nf_bridge_info_get(skb);
  492. if (!nf_bridge)
  493. return NF_ACCEPT;
  494. /* Need exclusive nf_bridge_info since we might have multiple
  495. * different physoutdevs. */
  496. if (!nf_bridge_unshare(skb))
  497. return NF_DROP;
  498. nf_bridge = nf_bridge_info_get(skb);
  499. if (!nf_bridge)
  500. return NF_DROP;
  501. parent = bridge_parent(state->out);
  502. if (!parent)
  503. return NF_DROP;
  504. if (IS_IP(skb) || is_vlan_ip(skb, state->net) ||
  505. is_pppoe_ip(skb, state->net))
  506. pf = NFPROTO_IPV4;
  507. else if (IS_IPV6(skb) || is_vlan_ipv6(skb, state->net) ||
  508. is_pppoe_ipv6(skb, state->net))
  509. pf = NFPROTO_IPV6;
  510. else
  511. return NF_ACCEPT;
  512. nf_bridge_pull_encap_header(skb);
  513. if (skb->pkt_type == PACKET_OTHERHOST) {
  514. skb->pkt_type = PACKET_HOST;
  515. nf_bridge->pkt_otherhost = true;
  516. }
  517. if (pf == NFPROTO_IPV4) {
  518. if (br_validate_ipv4(state->net, skb))
  519. return NF_DROP;
  520. IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
  521. }
  522. if (pf == NFPROTO_IPV6) {
  523. if (br_validate_ipv6(state->net, skb))
  524. return NF_DROP;
  525. IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
  526. }
  527. nf_bridge->physoutdev = skb->dev;
  528. if (pf == NFPROTO_IPV4)
  529. skb->protocol = htons(ETH_P_IP);
  530. else
  531. skb->protocol = htons(ETH_P_IPV6);
  532. NF_HOOK(pf, NF_INET_FORWARD, state->net, NULL, skb,
  533. brnf_get_logical_dev(skb, state->in, state->net),
  534. parent, br_nf_forward_finish);
  535. return NF_STOLEN;
  536. }
  537. static unsigned int br_nf_forward_arp(void *priv,
  538. struct sk_buff *skb,
  539. const struct nf_hook_state *state)
  540. {
  541. struct net_bridge_port *p;
  542. struct net_bridge *br;
  543. struct net_device **d = (struct net_device **)(skb->cb);
  544. struct brnf_net *brnet;
  545. p = br_port_get_rcu(state->out);
  546. if (p == NULL)
  547. return NF_ACCEPT;
  548. br = p->br;
  549. brnet = net_generic(state->net, brnf_net_id);
  550. if (!brnet->call_arptables && !br_opt_get(br, BROPT_NF_CALL_ARPTABLES))
  551. return NF_ACCEPT;
  552. if (!IS_ARP(skb)) {
  553. if (!is_vlan_arp(skb, state->net))
  554. return NF_ACCEPT;
  555. nf_bridge_pull_encap_header(skb);
  556. }
  557. if (unlikely(!pskb_may_pull(skb, sizeof(struct arphdr))))
  558. return NF_DROP;
  559. if (arp_hdr(skb)->ar_pln != 4) {
  560. if (is_vlan_arp(skb, state->net))
  561. nf_bridge_push_encap_header(skb);
  562. return NF_ACCEPT;
  563. }
  564. *d = state->in;
  565. NF_HOOK(NFPROTO_ARP, NF_ARP_FORWARD, state->net, state->sk, skb,
  566. state->in, state->out, br_nf_forward_finish);
  567. return NF_STOLEN;
  568. }
  569. static int br_nf_push_frag_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
  570. {
  571. struct brnf_frag_data *data;
  572. int err;
  573. data = this_cpu_ptr(&brnf_frag_data_storage);
  574. err = skb_cow_head(skb, data->size);
  575. if (err) {
  576. kfree_skb(skb);
  577. return 0;
  578. }
  579. if (data->vlan_proto)
  580. __vlan_hwaccel_put_tag(skb, data->vlan_proto, data->vlan_tci);
  581. skb_copy_to_linear_data_offset(skb, -data->size, data->mac, data->size);
  582. __skb_push(skb, data->encap_size);
  583. nf_bridge_info_free(skb);
  584. return br_dev_queue_push_xmit(net, sk, skb);
  585. }
  586. static int
  587. br_nf_ip_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
  588. int (*output)(struct net *, struct sock *, struct sk_buff *))
  589. {
  590. unsigned int mtu = ip_skb_dst_mtu(sk, skb);
  591. struct iphdr *iph = ip_hdr(skb);
  592. if (unlikely(((iph->frag_off & htons(IP_DF)) && !skb->ignore_df) ||
  593. (IPCB(skb)->frag_max_size &&
  594. IPCB(skb)->frag_max_size > mtu))) {
  595. IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
  596. kfree_skb(skb);
  597. return -EMSGSIZE;
  598. }
  599. return ip_do_fragment(net, sk, skb, output);
  600. }
  601. static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb)
  602. {
  603. const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
  604. if (nf_bridge->orig_proto == BRNF_PROTO_PPPOE)
  605. return PPPOE_SES_HLEN;
  606. return 0;
  607. }
  608. static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
  609. {
  610. struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
  611. unsigned int mtu, mtu_reserved;
  612. mtu_reserved = nf_bridge_mtu_reduction(skb);
  613. mtu = skb->dev->mtu;
  614. if (nf_bridge->pkt_otherhost) {
  615. skb->pkt_type = PACKET_OTHERHOST;
  616. nf_bridge->pkt_otherhost = false;
  617. }
  618. if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
  619. mtu = nf_bridge->frag_max_size;
  620. nf_bridge_update_protocol(skb);
  621. nf_bridge_push_encap_header(skb);
  622. if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) {
  623. nf_bridge_info_free(skb);
  624. return br_dev_queue_push_xmit(net, sk, skb);
  625. }
  626. /* This is wrong! We should preserve the original fragment
  627. * boundaries by preserving frag_list rather than refragmenting.
  628. */
  629. if (IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) &&
  630. skb->protocol == htons(ETH_P_IP)) {
  631. struct brnf_frag_data *data;
  632. if (br_validate_ipv4(net, skb))
  633. goto drop;
  634. IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
  635. data = this_cpu_ptr(&brnf_frag_data_storage);
  636. if (skb_vlan_tag_present(skb)) {
  637. data->vlan_tci = skb->vlan_tci;
  638. data->vlan_proto = skb->vlan_proto;
  639. } else {
  640. data->vlan_proto = 0;
  641. }
  642. data->encap_size = nf_bridge_encap_header_len(skb);
  643. data->size = ETH_HLEN + data->encap_size;
  644. skb_copy_from_linear_data_offset(skb, -data->size, data->mac,
  645. data->size);
  646. return br_nf_ip_fragment(net, sk, skb, br_nf_push_frag_xmit);
  647. }
  648. if (IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) &&
  649. skb->protocol == htons(ETH_P_IPV6)) {
  650. const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
  651. struct brnf_frag_data *data;
  652. if (br_validate_ipv6(net, skb))
  653. goto drop;
  654. IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
  655. data = this_cpu_ptr(&brnf_frag_data_storage);
  656. data->encap_size = nf_bridge_encap_header_len(skb);
  657. data->size = ETH_HLEN + data->encap_size;
  658. skb_copy_from_linear_data_offset(skb, -data->size, data->mac,
  659. data->size);
  660. if (v6ops)
  661. return v6ops->fragment(net, sk, skb, br_nf_push_frag_xmit);
  662. kfree_skb(skb);
  663. return -EMSGSIZE;
  664. }
  665. nf_bridge_info_free(skb);
  666. return br_dev_queue_push_xmit(net, sk, skb);
  667. drop:
  668. kfree_skb(skb);
  669. return 0;
  670. }
  671. /* PF_BRIDGE/POST_ROUTING ********************************************/
  672. static unsigned int br_nf_post_routing(void *priv,
  673. struct sk_buff *skb,
  674. const struct nf_hook_state *state)
  675. {
  676. struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
  677. struct net_device *realoutdev = bridge_parent(skb->dev);
  678. u_int8_t pf;
  679. /* if nf_bridge is set, but ->physoutdev is NULL, this packet came in
  680. * on a bridge, but was delivered locally and is now being routed:
  681. *
  682. * POST_ROUTING was already invoked from the ip stack.
  683. */
  684. if (!nf_bridge || !nf_bridge->physoutdev)
  685. return NF_ACCEPT;
  686. if (!realoutdev)
  687. return NF_DROP;
  688. if (IS_IP(skb) || is_vlan_ip(skb, state->net) ||
  689. is_pppoe_ip(skb, state->net))
  690. pf = NFPROTO_IPV4;
  691. else if (IS_IPV6(skb) || is_vlan_ipv6(skb, state->net) ||
  692. is_pppoe_ipv6(skb, state->net))
  693. pf = NFPROTO_IPV6;
  694. else
  695. return NF_ACCEPT;
  696. if (skb->pkt_type == PACKET_OTHERHOST) {
  697. skb->pkt_type = PACKET_HOST;
  698. nf_bridge->pkt_otherhost = true;
  699. }
  700. nf_bridge_pull_encap_header(skb);
  701. if (pf == NFPROTO_IPV4)
  702. skb->protocol = htons(ETH_P_IP);
  703. else
  704. skb->protocol = htons(ETH_P_IPV6);
  705. NF_HOOK(pf, NF_INET_POST_ROUTING, state->net, state->sk, skb,
  706. NULL, realoutdev,
  707. br_nf_dev_queue_xmit);
  708. return NF_STOLEN;
  709. }
  710. /* IP/SABOTAGE *****************************************************/
  711. /* Don't hand locally destined packets to PF_INET(6)/PRE_ROUTING
  712. * for the second time. */
  713. static unsigned int ip_sabotage_in(void *priv,
  714. struct sk_buff *skb,
  715. const struct nf_hook_state *state)
  716. {
  717. struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
  718. if (nf_bridge && !nf_bridge->in_prerouting &&
  719. !netif_is_l3_master(skb->dev) &&
  720. !netif_is_l3_slave(skb->dev)) {
  721. state->okfn(state->net, state->sk, skb);
  722. return NF_STOLEN;
  723. }
  724. return NF_ACCEPT;
  725. }
  726. /* This is called when br_netfilter has called into iptables/netfilter,
  727. * and DNAT has taken place on a bridge-forwarded packet.
  728. *
  729. * neigh->output has created a new MAC header, with local br0 MAC
  730. * as saddr.
  731. *
  732. * This restores the original MAC saddr of the bridged packet
  733. * before invoking bridge forward logic to transmit the packet.
  734. */
  735. static void br_nf_pre_routing_finish_bridge_slow(struct sk_buff *skb)
  736. {
  737. struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
  738. skb_pull(skb, ETH_HLEN);
  739. nf_bridge->bridged_dnat = 0;
  740. BUILD_BUG_ON(sizeof(nf_bridge->neigh_header) != (ETH_HLEN - ETH_ALEN));
  741. skb_copy_to_linear_data_offset(skb, -(ETH_HLEN - ETH_ALEN),
  742. nf_bridge->neigh_header,
  743. ETH_HLEN - ETH_ALEN);
  744. skb->dev = nf_bridge->physindev;
  745. nf_bridge->physoutdev = NULL;
  746. br_handle_frame_finish(dev_net(skb->dev), NULL, skb);
  747. }
  748. static int br_nf_dev_xmit(struct sk_buff *skb)
  749. {
  750. const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
  751. if (nf_bridge && nf_bridge->bridged_dnat) {
  752. br_nf_pre_routing_finish_bridge_slow(skb);
  753. return 1;
  754. }
  755. return 0;
  756. }
  757. static const struct nf_br_ops br_ops = {
  758. .br_dev_xmit_hook = br_nf_dev_xmit,
  759. };
  760. /* For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
  761. * br_dev_queue_push_xmit is called afterwards */
  762. static const struct nf_hook_ops br_nf_ops[] = {
  763. {
  764. .hook = br_nf_pre_routing,
  765. .pf = NFPROTO_BRIDGE,
  766. .hooknum = NF_BR_PRE_ROUTING,
  767. .priority = NF_BR_PRI_BRNF,
  768. },
  769. {
  770. .hook = br_nf_forward_ip,
  771. .pf = NFPROTO_BRIDGE,
  772. .hooknum = NF_BR_FORWARD,
  773. .priority = NF_BR_PRI_BRNF - 1,
  774. },
  775. {
  776. .hook = br_nf_forward_arp,
  777. .pf = NFPROTO_BRIDGE,
  778. .hooknum = NF_BR_FORWARD,
  779. .priority = NF_BR_PRI_BRNF,
  780. },
  781. {
  782. .hook = br_nf_post_routing,
  783. .pf = NFPROTO_BRIDGE,
  784. .hooknum = NF_BR_POST_ROUTING,
  785. .priority = NF_BR_PRI_LAST,
  786. },
  787. {
  788. .hook = ip_sabotage_in,
  789. .pf = NFPROTO_IPV4,
  790. .hooknum = NF_INET_PRE_ROUTING,
  791. .priority = NF_IP_PRI_FIRST,
  792. },
  793. {
  794. .hook = ip_sabotage_in,
  795. .pf = NFPROTO_IPV6,
  796. .hooknum = NF_INET_PRE_ROUTING,
  797. .priority = NF_IP6_PRI_FIRST,
  798. },
  799. };
  800. static int brnf_device_event(struct notifier_block *unused, unsigned long event,
  801. void *ptr)
  802. {
  803. struct net_device *dev = netdev_notifier_info_to_dev(ptr);
  804. struct brnf_net *brnet;
  805. struct net *net;
  806. int ret;
  807. if (event != NETDEV_REGISTER || !(dev->priv_flags & IFF_EBRIDGE))
  808. return NOTIFY_DONE;
  809. ASSERT_RTNL();
  810. net = dev_net(dev);
  811. brnet = net_generic(net, brnf_net_id);
  812. if (brnet->enabled)
  813. return NOTIFY_OK;
  814. ret = nf_register_net_hooks(net, br_nf_ops, ARRAY_SIZE(br_nf_ops));
  815. if (ret)
  816. return NOTIFY_BAD;
  817. brnet->enabled = true;
  818. return NOTIFY_OK;
  819. }
  820. static struct notifier_block brnf_notifier __read_mostly = {
  821. .notifier_call = brnf_device_event,
  822. };
  823. /* recursively invokes nf_hook_slow (again), skipping already-called
  824. * hooks (< NF_BR_PRI_BRNF).
  825. *
  826. * Called with rcu read lock held.
  827. */
  828. int br_nf_hook_thresh(unsigned int hook, struct net *net,
  829. struct sock *sk, struct sk_buff *skb,
  830. struct net_device *indev,
  831. struct net_device *outdev,
  832. int (*okfn)(struct net *, struct sock *,
  833. struct sk_buff *))
  834. {
  835. const struct nf_hook_entries *e;
  836. struct nf_hook_state state;
  837. struct nf_hook_ops **ops;
  838. unsigned int i;
  839. int ret;
  840. e = rcu_dereference(net->nf.hooks_bridge[hook]);
  841. if (!e)
  842. return okfn(net, sk, skb);
  843. ops = nf_hook_entries_get_hook_ops(e);
  844. for (i = 0; i < e->num_hook_entries &&
  845. ops[i]->priority <= NF_BR_PRI_BRNF; i++)
  846. ;
  847. nf_hook_state_init(&state, hook, NFPROTO_BRIDGE, indev, outdev,
  848. sk, net, okfn);
  849. ret = nf_hook_slow(skb, &state, e, i);
  850. if (ret == 1)
  851. ret = okfn(net, sk, skb);
  852. return ret;
  853. }
  854. #ifdef CONFIG_SYSCTL
  855. static
  856. int brnf_sysctl_call_tables(struct ctl_table *ctl, int write,
  857. void *buffer, size_t *lenp, loff_t *ppos)
  858. {
  859. int ret;
  860. ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
  861. if (write && *(int *)(ctl->data))
  862. *(int *)(ctl->data) = 1;
  863. return ret;
  864. }
  865. static struct ctl_table brnf_table[] = {
  866. {
  867. .procname = "bridge-nf-call-arptables",
  868. .maxlen = sizeof(int),
  869. .mode = 0644,
  870. .proc_handler = brnf_sysctl_call_tables,
  871. },
  872. {
  873. .procname = "bridge-nf-call-iptables",
  874. .maxlen = sizeof(int),
  875. .mode = 0644,
  876. .proc_handler = brnf_sysctl_call_tables,
  877. },
  878. {
  879. .procname = "bridge-nf-call-ip6tables",
  880. .maxlen = sizeof(int),
  881. .mode = 0644,
  882. .proc_handler = brnf_sysctl_call_tables,
  883. },
  884. {
  885. .procname = "bridge-nf-filter-vlan-tagged",
  886. .maxlen = sizeof(int),
  887. .mode = 0644,
  888. .proc_handler = brnf_sysctl_call_tables,
  889. },
  890. {
  891. .procname = "bridge-nf-filter-pppoe-tagged",
  892. .maxlen = sizeof(int),
  893. .mode = 0644,
  894. .proc_handler = brnf_sysctl_call_tables,
  895. },
  896. {
  897. .procname = "bridge-nf-pass-vlan-input-dev",
  898. .maxlen = sizeof(int),
  899. .mode = 0644,
  900. .proc_handler = brnf_sysctl_call_tables,
  901. },
  902. { }
  903. };
  904. static inline void br_netfilter_sysctl_default(struct brnf_net *brnf)
  905. {
  906. brnf->call_iptables = 1;
  907. brnf->call_ip6tables = 1;
  908. brnf->call_arptables = 1;
  909. brnf->filter_vlan_tagged = 0;
  910. brnf->filter_pppoe_tagged = 0;
  911. brnf->pass_vlan_indev = 0;
  912. }
  913. static int br_netfilter_sysctl_init_net(struct net *net)
  914. {
  915. struct ctl_table *table = brnf_table;
  916. struct brnf_net *brnet;
  917. if (!net_eq(net, &init_net)) {
  918. table = kmemdup(table, sizeof(brnf_table), GFP_KERNEL);
  919. if (!table)
  920. return -ENOMEM;
  921. }
  922. brnet = net_generic(net, brnf_net_id);
  923. table[0].data = &brnet->call_arptables;
  924. table[1].data = &brnet->call_iptables;
  925. table[2].data = &brnet->call_ip6tables;
  926. table[3].data = &brnet->filter_vlan_tagged;
  927. table[4].data = &brnet->filter_pppoe_tagged;
  928. table[5].data = &brnet->pass_vlan_indev;
  929. br_netfilter_sysctl_default(brnet);
  930. brnet->ctl_hdr = register_net_sysctl(net, "net/bridge", table);
  931. if (!brnet->ctl_hdr) {
  932. if (!net_eq(net, &init_net))
  933. kfree(table);
  934. return -ENOMEM;
  935. }
  936. return 0;
  937. }
  938. static void br_netfilter_sysctl_exit_net(struct net *net,
  939. struct brnf_net *brnet)
  940. {
  941. struct ctl_table *table = brnet->ctl_hdr->ctl_table_arg;
  942. unregister_net_sysctl_table(brnet->ctl_hdr);
  943. if (!net_eq(net, &init_net))
  944. kfree(table);
  945. }
  946. static int __net_init brnf_init_net(struct net *net)
  947. {
  948. return br_netfilter_sysctl_init_net(net);
  949. }
  950. #endif
  951. static void __net_exit brnf_exit_net(struct net *net)
  952. {
  953. struct brnf_net *brnet;
  954. brnet = net_generic(net, brnf_net_id);
  955. if (brnet->enabled) {
  956. nf_unregister_net_hooks(net, br_nf_ops, ARRAY_SIZE(br_nf_ops));
  957. brnet->enabled = false;
  958. }
  959. #ifdef CONFIG_SYSCTL
  960. br_netfilter_sysctl_exit_net(net, brnet);
  961. #endif
  962. }
  963. static struct pernet_operations brnf_net_ops __read_mostly = {
  964. #ifdef CONFIG_SYSCTL
  965. .init = brnf_init_net,
  966. #endif
  967. .exit = brnf_exit_net,
  968. .id = &brnf_net_id,
  969. .size = sizeof(struct brnf_net),
  970. };
  971. static int __init br_netfilter_init(void)
  972. {
  973. int ret;
  974. ret = register_pernet_subsys(&brnf_net_ops);
  975. if (ret < 0)
  976. return ret;
  977. ret = register_netdevice_notifier(&brnf_notifier);
  978. if (ret < 0) {
  979. unregister_pernet_subsys(&brnf_net_ops);
  980. return ret;
  981. }
  982. RCU_INIT_POINTER(nf_br_ops, &br_ops);
  983. printk(KERN_NOTICE "Bridge firewalling registered\n");
  984. return 0;
  985. }
  986. static void __exit br_netfilter_fini(void)
  987. {
  988. RCU_INIT_POINTER(nf_br_ops, NULL);
  989. unregister_netdevice_notifier(&brnf_notifier);
  990. unregister_pernet_subsys(&brnf_net_ops);
  991. }
  992. module_init(br_netfilter_init);
  993. module_exit(br_netfilter_fini);
  994. MODULE_LICENSE("GPL");
  995. MODULE_AUTHOR("Lennert Buytenhek <buytenh@gnu.org>");
  996. MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
  997. MODULE_DESCRIPTION("Linux ethernet netfilter firewall bridge");