net/bridge/br_netfilter_ipv6.c

   1 /*
   2  *      Handle firewalling
   3  *      Linux ethernet bridge
   4  *
   5  *      Authors:
   6  *      Lennert Buytenhek               <buytenh@gnu.org>
   7  *      Bart De Schuymer                <bdschuym@pandora.be>
   8  *
   9  *      This program is free software; you can redistribute it and/or
  10  *      modify it under the terms of the GNU General Public License
  11  *      as published by the Free Software Foundation; either version
  12  *      2 of the License, or (at your option) any later version.
  13  *
  14  *      Lennert dedicates this file to Kerstin Wurdinger.
  15  */
  16
  17 #include <linux/module.h>
  18 #include <linux/kernel.h>
  19 #include <linux/slab.h>
  20 #include <linux/ip.h>
  21 #include <linux/netdevice.h>
  22 #include <linux/skbuff.h>
  23 #include <linux/if_arp.h>
  24 #include <linux/if_ether.h>
  25 #include <linux/if_vlan.h>
  26 #include <linux/if_pppox.h>
  27 #include <linux/ppp_defs.h>
  28 #include <linux/netfilter_bridge.h>
  29 #include <linux/netfilter_ipv4.h>
  30 #include <linux/netfilter_ipv6.h>
  31 #include <linux/netfilter_arp.h>
  32 #include <linux/in_route.h>
  33 #include <linux/inetdevice.h>
  34
  35 #include <net/ip.h>
  36 #include <net/ipv6.h>
  37 #include <net/addrconf.h>
  38 #include <net/route.h>
  39 #include <net/netfilter/br_netfilter.h>
  40
  41 #include <asm/uaccess.h>
  42 #include "br_private.h"
  43 #ifdef CONFIG_SYSCTL
  44 #include <linux/sysctl.h>
  45 #endif
  46
  47 /* We only check the length. A bridge shouldn't do any hop-by-hop stuff
  48  * anyway
  49  */
  50 static int br_nf_check_hbh_len(struct sk_buff *skb)
  51 {
  52         unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
  53         u32 pkt_len;
  54         const unsigned char *nh = skb_network_header(skb);
  55         int off = raw - nh;
  56         int len = (raw[1] + 1) << 3;
  57
  58         if ((raw + len) - skb->data > skb_headlen(skb))
  59                 goto bad;
  60
  61         off += 2;
  62         len -= 2;
  63
  64         while (len > 0) {
  65                 int optlen = nh[off + 1] + 2;
  66
  67                 switch (nh[off]) {
  68                 case IPV6_TLV_PAD1:
  69                         optlen = 1;
  70                         break;
  71
  72                 case IPV6_TLV_PADN:
  73                         break;
  74
  75                 case IPV6_TLV_JUMBO:
  76                         if (nh[off + 1] != 4 || (off & 3) != 2)
  77                                 goto bad;
  78                         pkt_len = ntohl(*(__be32 *)(nh + off + 2));
  79                         if (pkt_len <= IPV6_MAXPLEN ||
  80                             ipv6_hdr(skb)->payload_len)
  81                                 goto bad;
  82                         if (pkt_len > skb->len - sizeof(struct ipv6hdr))
  83                                 goto bad;
  84                         if (pskb_trim_rcsum(skb,
  85                                             pkt_len + sizeof(struct ipv6hdr)))
  86                                 goto bad;
  87                         nh = skb_network_header(skb);
  88                         break;
  89                 default:
  90                         if (optlen > len)
  91                                 goto bad;
  92                         break;
  93                 }
  94                 off += optlen;
  95                 len -= optlen;
  96         }
  97         if (len == 0)
  98                 return 0;
  99 bad:
 100         return -1;
 101 }
 102
 103 int br_validate_ipv6(struct sk_buff *skb)
 104 {
 105         const struct ipv6hdr *hdr;
 106         struct net_device *dev = skb->dev;
 107         struct inet6_dev *idev = __in6_dev_get(skb->dev);
 108         u32 pkt_len;
 109         u8 ip6h_len = sizeof(struct ipv6hdr);
 110
 111         if (!pskb_may_pull(skb, ip6h_len))
 112                 goto inhdr_error;
 113
 114         if (skb->len < ip6h_len)
 115                 goto drop;
 116
 117         hdr = ipv6_hdr(skb);
 118
 119         if (hdr->version != 6)
 120                 goto inhdr_error;
 121
 122         pkt_len = ntohs(hdr->payload_len);
 123
 124         if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
 125                 if (pkt_len + ip6h_len > skb->len) {
 126                         IP6_INC_STATS_BH(dev_net(dev), idev,
 127                                          IPSTATS_MIB_INTRUNCATEDPKTS);
 128                         goto drop;
 129                 }
 130                 if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
 131                         IP6_INC_STATS_BH(dev_net(dev), idev,
 132                                          IPSTATS_MIB_INDISCARDS);
 133                         goto drop;
 134                 }
 135         }
 136         if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb))
 137                 goto drop;
 138
 139         memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
 140         /* No IP options in IPv6 header; however it should be
 141          * checked if some next headers need special treatment
 142          */
 143         return 0;
 144
 145 inhdr_error:
 146         IP6_INC_STATS_BH(dev_net(dev), idev, IPSTATS_MIB_INHDRERRORS);
 147 drop:
 148         return -1;
 149 }
 150
 151 static inline bool
 152 br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
 153                              const struct nf_bridge_info *nf_bridge)
 154 {
 155         return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
 156                       sizeof(ipv6_hdr(skb)->daddr)) != 0;
 157 }
 158
 159 /* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
 160  * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
 161  * for br_nf_pre_routing_finish(), same logic is used here but
 162  * equivalent IPv6 function ip6_route_input() called indirectly.
 163  */
 164 static int br_nf_pre_routing_finish_ipv6(struct sock *sk, struct sk_buff *skb)
 165 {
 166         struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
 167         struct rtable *rt;
 168         struct net_device *dev = skb->dev;
 169         const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
 170
 171         nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
 172
 173         if (nf_bridge->pkt_otherhost) {
 174                 skb->pkt_type = PACKET_OTHERHOST;
 175                 nf_bridge->pkt_otherhost = false;
 176         }
 177         nf_bridge->mask &= ~BRNF_NF_BRIDGE_PREROUTING;
 178         if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
 179                 skb_dst_drop(skb);
 180                 v6ops->route_input(skb);
 181
 182                 if (skb_dst(skb)->error) {
 183                         kfree_skb(skb);
 184                         return 0;
 185                 }
 186
 187                 if (skb_dst(skb)->dev == dev) {
 188                         skb->dev = nf_bridge->physindev;
 189                         nf_bridge_update_protocol(skb);
 190                         nf_bridge_push_encap_header(skb);
 191                         NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING,
 192                                        sk, skb, skb->dev, NULL,
 193                                        br_nf_pre_routing_finish_bridge,
 194                                        1);
 195                         return 0;
 196                 }
 197                 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
 198                 skb->pkt_type = PACKET_HOST;
 199         } else {
 200                 rt = bridge_parent_rtable(nf_bridge->physindev);
 201                 if (!rt) {
 202                         kfree_skb(skb);
 203                         return 0;
 204                 }
 205                 skb_dst_set_noref(skb, &rt->dst);
 206         }
 207
 208         skb->dev = nf_bridge->physindev;
 209         nf_bridge_update_protocol(skb);
 210         nf_bridge_push_encap_header(skb);
 211         NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, sk, skb,
 212                        skb->dev, NULL,
 213                        br_handle_frame_finish, 1);
 214
 215         return 0;
 216 }
 217
 218 /* Replicate the checks that IPv6 does on packet reception and pass the packet
 219  * to ip6tables.
 220  */
 221 unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,
 222                                     struct sk_buff *skb,
 223                                     const struct nf_hook_state *state)
 224 {
 225         struct nf_bridge_info *nf_bridge;
 226
 227         if (br_validate_ipv6(skb))
 228                 return NF_DROP;
 229
 230         nf_bridge_put(skb->nf_bridge);
 231         if (!nf_bridge_alloc(skb))
 232                 return NF_DROP;
 233         if (!setup_pre_routing(skb))
 234                 return NF_DROP;
 235
 236         nf_bridge = nf_bridge_info_get(skb);
 237         nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
 238
 239         skb->protocol = htons(ETH_P_IPV6);
 240         NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->sk, skb,
 241                 skb->dev, NULL,
 242                 br_nf_pre_routing_finish_ipv6);
 243
 244         return NF_STOLEN;
 245 }