blob: 97e43937aaca2b090bf883428ea3cfdce94103c2 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * Handle firewalling
3 * Linux ethernet bridge
4 *
5 * Authors:
Bart De Schuymer82379082010-04-13 11:40:41 +02006 * Lennert Buytenhek <buytenh@gnu.org>
7 * Bart De Schuymer <bdschuym@pandora.be>
Linus Torvalds1da177e2005-04-16 15:20:36 -07008 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * as published by the Free Software Foundation; either version
12 * 2 of the License, or (at your option) any later version.
13 *
14 * Lennert dedicates this file to Kerstin Wurdinger.
15 */
16
17#include <linux/module.h>
18#include <linux/kernel.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090019#include <linux/slab.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020#include <linux/ip.h>
21#include <linux/netdevice.h>
22#include <linux/skbuff.h>
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -020023#include <linux/if_arp.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070024#include <linux/if_ether.h>
25#include <linux/if_vlan.h>
Michael Milner516299d2007-04-12 22:14:23 -070026#include <linux/if_pppox.h>
27#include <linux/ppp_defs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070028#include <linux/netfilter_bridge.h>
29#include <linux/netfilter_ipv4.h>
30#include <linux/netfilter_ipv6.h>
31#include <linux/netfilter_arp.h>
32#include <linux/in_route.h>
Bart De Schuymerf216f082006-12-05 13:45:21 -080033#include <linux/inetdevice.h>
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -020034
Linus Torvalds1da177e2005-04-16 15:20:36 -070035#include <net/ip.h>
36#include <net/ipv6.h>
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -020037#include <net/route.h>
38
Linus Torvalds1da177e2005-04-16 15:20:36 -070039#include <asm/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070040#include "br_private.h"
41#ifdef CONFIG_SYSCTL
42#include <linux/sysctl.h>
43#endif
44
45#define skb_origaddr(skb) (((struct bridge_skb_cb *) \
46 (skb->nf_bridge->data))->daddr.ipv4)
Arnaldo Carvalho de Meloeddc9ec2007-04-20 22:47:35 -070047#define store_orig_dstaddr(skb) (skb_origaddr(skb) = ip_hdr(skb)->daddr)
48#define dnat_took_place(skb) (skb_origaddr(skb) != ip_hdr(skb)->daddr)
Linus Torvalds1da177e2005-04-16 15:20:36 -070049
Linus Torvalds1da177e2005-04-16 15:20:36 -070050#ifdef CONFIG_SYSCTL
51static struct ctl_table_header *brnf_sysctl_header;
Brian Haley9c1ea142006-09-18 00:03:41 -070052static int brnf_call_iptables __read_mostly = 1;
53static int brnf_call_ip6tables __read_mostly = 1;
54static int brnf_call_arptables __read_mostly = 1;
Herbert Xu47e0e1c2009-01-12 00:06:03 +000055static int brnf_filter_vlan_tagged __read_mostly = 0;
56static int brnf_filter_pppoe_tagged __read_mostly = 0;
Pablo Neira Ayuso49816822012-05-08 19:36:44 +020057static int brnf_pass_vlan_indev __read_mostly = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -070058#else
Patrick McHardy4df53d82010-07-02 09:32:57 +020059#define brnf_call_iptables 1
60#define brnf_call_ip6tables 1
61#define brnf_call_arptables 1
Herbert Xu47e0e1c2009-01-12 00:06:03 +000062#define brnf_filter_vlan_tagged 0
63#define brnf_filter_pppoe_tagged 0
Pablo Neira Ayuso49816822012-05-08 19:36:44 +020064#define brnf_pass_vlan_indev 0
Linus Torvalds1da177e2005-04-16 15:20:36 -070065#endif
66
Florian Westphal739e4502012-03-06 01:22:54 +000067#define IS_IP(skb) \
68 (!vlan_tx_tag_present(skb) && skb->protocol == htons(ETH_P_IP))
69
70#define IS_IPV6(skb) \
71 (!vlan_tx_tag_present(skb) && skb->protocol == htons(ETH_P_IPV6))
72
73#define IS_ARP(skb) \
74 (!vlan_tx_tag_present(skb) && skb->protocol == htons(ETH_P_ARP))
75
Dave Jonesb6f99a22007-03-22 12:27:49 -070076static inline __be16 vlan_proto(const struct sk_buff *skb)
Stephen Hemminger8b42ec32006-03-20 22:58:05 -080077{
Jesse Gross13937912010-10-20 13:56:01 +000078 if (vlan_tx_tag_present(skb))
79 return skb->protocol;
80 else if (skb->protocol == htons(ETH_P_8021Q))
81 return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
82 else
83 return 0;
Stephen Hemminger8b42ec32006-03-20 22:58:05 -080084}
85
86#define IS_VLAN_IP(skb) \
Jesse Gross13937912010-10-20 13:56:01 +000087 (vlan_proto(skb) == htons(ETH_P_IP) && \
Stephen Hemminger8b42ec32006-03-20 22:58:05 -080088 brnf_filter_vlan_tagged)
89
90#define IS_VLAN_IPV6(skb) \
Jesse Gross13937912010-10-20 13:56:01 +000091 (vlan_proto(skb) == htons(ETH_P_IPV6) && \
Stephen Hemminger8b42ec32006-03-20 22:58:05 -080092 brnf_filter_vlan_tagged)
93
94#define IS_VLAN_ARP(skb) \
Jesse Gross13937912010-10-20 13:56:01 +000095 (vlan_proto(skb) == htons(ETH_P_ARP) && \
Stephen Hemminger8b42ec32006-03-20 22:58:05 -080096 brnf_filter_vlan_tagged)
Linus Torvalds1da177e2005-04-16 15:20:36 -070097
Michael Milner516299d2007-04-12 22:14:23 -070098static inline __be16 pppoe_proto(const struct sk_buff *skb)
99{
100 return *((__be16 *)(skb_mac_header(skb) + ETH_HLEN +
101 sizeof(struct pppoe_hdr)));
102}
103
104#define IS_PPPOE_IP(skb) \
105 (skb->protocol == htons(ETH_P_PPP_SES) && \
106 pppoe_proto(skb) == htons(PPP_IP) && \
107 brnf_filter_pppoe_tagged)
108
109#define IS_PPPOE_IPV6(skb) \
110 (skb->protocol == htons(ETH_P_PPP_SES) && \
111 pppoe_proto(skb) == htons(PPP_IPV6) && \
112 brnf_filter_pppoe_tagged)
113
Simon Wunderlich4adf0af2008-07-30 16:27:55 -0700114static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
115{
stephen hemmingerb5ed54e2010-11-15 06:38:13 +0000116 struct net_bridge_port *port;
117
118 port = br_port_get_rcu(dev);
119 return port ? &port->br->fake_rtable : NULL;
Simon Wunderlich4adf0af2008-07-30 16:27:55 -0700120}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700121
Stephen Hemminger5dce9712006-02-09 17:09:38 -0800122static inline struct net_device *bridge_parent(const struct net_device *dev)
123{
stephen hemmingerb5ed54e2010-11-15 06:38:13 +0000124 struct net_bridge_port *port;
Stephen Hemminger5dce9712006-02-09 17:09:38 -0800125
stephen hemmingerb5ed54e2010-11-15 06:38:13 +0000126 port = br_port_get_rcu(dev);
127 return port ? port->br->dev : NULL;
Stephen Hemminger5dce9712006-02-09 17:09:38 -0800128}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700129
Stephen Hemmingerfdeabde2006-03-20 22:58:21 -0800130static inline struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
131{
132 skb->nf_bridge = kzalloc(sizeof(struct nf_bridge_info), GFP_ATOMIC);
133 if (likely(skb->nf_bridge))
134 atomic_set(&(skb->nf_bridge->use), 1);
135
136 return skb->nf_bridge;
137}
138
Patrick McHardy2dc2f202008-01-20 06:25:48 -0800139static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
140{
141 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
142
143 if (atomic_read(&nf_bridge->use) > 1) {
144 struct nf_bridge_info *tmp = nf_bridge_alloc(skb);
145
146 if (tmp) {
147 memcpy(tmp, nf_bridge, sizeof(struct nf_bridge_info));
148 atomic_set(&tmp->use, 1);
Patrick McHardy2dc2f202008-01-20 06:25:48 -0800149 }
Changli Gao4c3a76a2010-08-22 19:03:26 +0000150 nf_bridge_put(nf_bridge);
Patrick McHardy2dc2f202008-01-20 06:25:48 -0800151 nf_bridge = tmp;
152 }
153 return nf_bridge;
154}
155
Patrick McHardyfc385822007-05-03 03:36:16 -0700156static inline void nf_bridge_push_encap_header(struct sk_buff *skb)
157{
158 unsigned int len = nf_bridge_encap_header_len(skb);
159
160 skb_push(skb, len);
161 skb->network_header -= len;
162}
163
164static inline void nf_bridge_pull_encap_header(struct sk_buff *skb)
165{
166 unsigned int len = nf_bridge_encap_header_len(skb);
167
168 skb_pull(skb, len);
169 skb->network_header += len;
170}
171
172static inline void nf_bridge_pull_encap_header_rcsum(struct sk_buff *skb)
173{
174 unsigned int len = nf_bridge_encap_header_len(skb);
175
176 skb_pull_rcsum(skb, len);
177 skb->network_header += len;
178}
179
Stephen Hemmingerfdeabde2006-03-20 22:58:21 -0800180static inline void nf_bridge_save_header(struct sk_buff *skb)
181{
Patrick McHardyfc385822007-05-03 03:36:16 -0700182 int header_size = ETH_HLEN + nf_bridge_encap_header_len(skb);
Stephen Hemmingerfdeabde2006-03-20 22:58:21 -0800183
Arnaldo Carvalho de Melod626f622007-03-27 18:55:52 -0300184 skb_copy_from_linear_data_offset(skb, -header_size,
185 skb->nf_bridge->data, header_size);
Stephen Hemmingerfdeabde2006-03-20 22:58:21 -0800186}
187
Bandan Das462fb2a2010-09-19 09:34:33 +0000188/* When handing a packet over to the IP layer
189 * check whether we have a skb that is in the
190 * expected format
191 */
192
stephen hemmingerd0280232010-10-18 14:03:21 +0000193static int br_parse_ip_options(struct sk_buff *skb)
Bandan Das462fb2a2010-09-19 09:34:33 +0000194{
195 struct ip_options *opt;
Eric Dumazetb71d1d42011-04-22 04:53:02 +0000196 const struct iphdr *iph;
Bandan Das462fb2a2010-09-19 09:34:33 +0000197 struct net_device *dev = skb->dev;
198 u32 len;
199
Sarveshwar Bandi6caab7b2012-10-10 01:15:01 +0000200 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
201 goto inhdr_error;
202
Bandan Das462fb2a2010-09-19 09:34:33 +0000203 iph = ip_hdr(skb);
204 opt = &(IPCB(skb)->opt);
205
206 /* Basic sanity checks */
207 if (iph->ihl < 5 || iph->version != 4)
208 goto inhdr_error;
209
210 if (!pskb_may_pull(skb, iph->ihl*4))
211 goto inhdr_error;
212
213 iph = ip_hdr(skb);
214 if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
215 goto inhdr_error;
216
217 len = ntohs(iph->tot_len);
218 if (skb->len < len) {
219 IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INTRUNCATEDPKTS);
220 goto drop;
221 } else if (len < (iph->ihl*4))
222 goto inhdr_error;
223
224 if (pskb_trim_rcsum(skb, len)) {
225 IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INDISCARDS);
226 goto drop;
227 }
228
Eric Dumazetf8e98812011-04-12 13:39:14 -0700229 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
230 if (iph->ihl == 5)
Bandan Das462fb2a2010-09-19 09:34:33 +0000231 return 0;
Bandan Das462fb2a2010-09-19 09:34:33 +0000232
233 opt->optlen = iph->ihl*4 - sizeof(struct iphdr);
234 if (ip_options_compile(dev_net(dev), opt, skb))
235 goto inhdr_error;
236
237 /* Check correct handling of SRR option */
238 if (unlikely(opt->srr)) {
239 struct in_device *in_dev = __in_dev_get_rcu(dev);
240 if (in_dev && !IN_DEV_SOURCE_ROUTE(in_dev))
241 goto drop;
242
243 if (ip_options_rcv_srr(skb))
244 goto drop;
245 }
246
247 return 0;
248
249inhdr_error:
250 IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INHDRERRORS);
251drop:
252 return -1;
253}
254
Linus Torvalds1da177e2005-04-16 15:20:36 -0700255/* PF_BRIDGE/PRE_ROUTING *********************************************/
256/* Undo the changes made for ip6tables PREROUTING and continue the
257 * bridge PRE_ROUTING hook. */
258static int br_nf_pre_routing_finish_ipv6(struct sk_buff *skb)
259{
260 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
Eric Dumazet511c3f92009-06-02 05:14:27 +0000261 struct rtable *rt;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700262
Linus Torvalds1da177e2005-04-16 15:20:36 -0700263 if (nf_bridge->mask & BRNF_PKT_TYPE) {
264 skb->pkt_type = PACKET_OTHERHOST;
265 nf_bridge->mask ^= BRNF_PKT_TYPE;
266 }
267 nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
268
Eric Dumazet511c3f92009-06-02 05:14:27 +0000269 rt = bridge_parent_rtable(nf_bridge->physindev);
270 if (!rt) {
Simon Wunderlich4adf0af2008-07-30 16:27:55 -0700271 kfree_skb(skb);
272 return 0;
273 }
Patrick McHardyf9181f42010-06-15 17:31:06 +0200274 skb_dst_set_noref(skb, &rt->dst);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700275
276 skb->dev = nf_bridge->physindev;
Bart De Schuymere179e632010-04-15 12:26:39 +0200277 nf_bridge_update_protocol(skb);
Patrick McHardyfc385822007-05-03 03:36:16 -0700278 nf_bridge_push_encap_header(skb);
Jan Engelhardt713aefa2010-03-23 04:07:21 +0100279 NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700280 br_handle_frame_finish, 1);
281
282 return 0;
283}
284
Bart De Schuymere179e632010-04-15 12:26:39 +0200285/* Obtain the correct destination MAC address, while preserving the original
286 * source MAC address. If we already know this address, we just copy it. If we
287 * don't, we use the neighbour framework to find out. In both cases, we make
288 * sure that br_handle_frame_finish() is called afterwards.
289 */
290static int br_nf_pre_routing_finish_bridge(struct sk_buff *skb)
291{
292 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
David S. Millerf6b72b62011-07-14 07:53:20 -0700293 struct neighbour *neigh;
Bart De Schuymere179e632010-04-15 12:26:39 +0200294 struct dst_entry *dst;
295
296 skb->dev = bridge_parent(skb->dev);
297 if (!skb->dev)
298 goto free_skb;
299 dst = skb_dst(skb);
David S. Millerf9d75162012-07-02 22:12:59 -0700300 neigh = dst_neigh_lookup_skb(dst, skb);
301 if (neigh) {
302 int ret;
303
304 if (neigh->hh.hh_len) {
305 neigh_hh_bridge(&neigh->hh, skb);
306 skb->dev = nf_bridge->physindev;
307 ret = br_handle_frame_finish(skb);
308 } else {
309 /* the neighbour function below overwrites the complete
310 * MAC header, so we save the Ethernet source address and
311 * protocol number.
312 */
313 skb_copy_from_linear_data_offset(skb,
314 -(ETH_HLEN-ETH_ALEN),
315 skb->nf_bridge->data,
316 ETH_HLEN-ETH_ALEN);
317 /* tell br_dev_xmit to continue with forwarding */
318 nf_bridge->mask |= BRNF_BRIDGED_DNAT;
319 ret = neigh->output(neigh, skb);
320 }
321 neigh_release(neigh);
322 return ret;
Bart De Schuymere179e632010-04-15 12:26:39 +0200323 }
324free_skb:
325 kfree_skb(skb);
326 return 0;
327}
328
Linus Torvalds1da177e2005-04-16 15:20:36 -0700329/* This requires some explaining. If DNAT has taken place,
Bart De Schuymerea2d9b42010-04-15 12:14:51 +0200330 * we will need to fix up the destination Ethernet address.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700331 *
332 * There are two cases to consider:
333 * 1. The packet was DNAT'ed to a device in the same bridge
334 * port group as it was received on. We can still bridge
335 * the packet.
336 * 2. The packet was DNAT'ed to a different device, either
337 * a non-bridged device or another bridge port group.
338 * The packet will need to be routed.
339 *
340 * The correct way of distinguishing between these two cases is to
341 * call ip_route_input() and to look at skb->dst->dev, which is
342 * changed to the destination device if ip_route_input() succeeds.
343 *
Bart De Schuymerea2d9b42010-04-15 12:14:51 +0200344 * Let's first consider the case that ip_route_input() succeeds:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700345 *
Bart De Schuymerea2d9b42010-04-15 12:14:51 +0200346 * If the output device equals the logical bridge device the packet
347 * came in on, we can consider this bridging. The corresponding MAC
348 * address will be obtained in br_nf_pre_routing_finish_bridge.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700349 * Otherwise, the packet is considered to be routed and we just
350 * change the destination MAC address so that the packet will
Bart De Schuymerf216f082006-12-05 13:45:21 -0800351 * later be passed up to the IP stack to be routed. For a redirected
352 * packet, ip_route_input() will give back the localhost as output device,
353 * which differs from the bridge device.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700354 *
Bart De Schuymerea2d9b42010-04-15 12:14:51 +0200355 * Let's now consider the case that ip_route_input() fails:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700356 *
Bart De Schuymerf216f082006-12-05 13:45:21 -0800357 * This can be because the destination address is martian, in which case
358 * the packet will be dropped.
Bart De Schuymerea2d9b42010-04-15 12:14:51 +0200359 * If IP forwarding is disabled, ip_route_input() will fail, while
360 * ip_route_output_key() can return success. The source
361 * address for ip_route_output_key() is set to zero, so ip_route_output_key()
Linus Torvalds1da177e2005-04-16 15:20:36 -0700362 * thinks we're handling a locally generated packet and won't care
Bart De Schuymerea2d9b42010-04-15 12:14:51 +0200363 * if IP forwarding is enabled. If the output device equals the logical bridge
364 * device, we proceed as if ip_route_input() succeeded. If it differs from the
365 * logical bridge port or if ip_route_output_key() fails we drop the packet.
366 */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700367static int br_nf_pre_routing_finish(struct sk_buff *skb)
368{
369 struct net_device *dev = skb->dev;
Arnaldo Carvalho de Meloeddc9ec2007-04-20 22:47:35 -0700370 struct iphdr *iph = ip_hdr(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700371 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
Eric Dumazet511c3f92009-06-02 05:14:27 +0000372 struct rtable *rt;
Bart De Schuymerf216f082006-12-05 13:45:21 -0800373 int err;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700374
Linus Torvalds1da177e2005-04-16 15:20:36 -0700375 if (nf_bridge->mask & BRNF_PKT_TYPE) {
376 skb->pkt_type = PACKET_OTHERHOST;
377 nf_bridge->mask ^= BRNF_PKT_TYPE;
378 }
379 nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700380 if (dnat_took_place(skb)) {
Bart De Schuymerf216f082006-12-05 13:45:21 -0800381 if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
Eric Dumazetf3abc9b2009-08-24 19:35:38 +0200382 struct in_device *in_dev = __in_dev_get_rcu(dev);
Bart De Schuymerf216f082006-12-05 13:45:21 -0800383
384 /* If err equals -EHOSTUNREACH the error is due to a
385 * martian destination or due to the fact that
386 * forwarding is disabled. For most martian packets,
387 * ip_route_output_key() will fail. It won't fail for 2 types of
388 * martian destinations: loopback destinations and destination
389 * 0.0.0.0. In both cases the packet will be dropped because the
390 * destination is the loopback device and not the bridge. */
391 if (err != -EHOSTUNREACH || !in_dev || IN_DEV_FORWARD(in_dev))
392 goto free_skb;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700393
David S. Miller78fbfd82011-03-12 00:00:52 -0500394 rt = ip_route_output(dev_net(dev), iph->daddr, 0,
395 RT_TOS(iph->tos), 0);
David S. Millerb23dd4f2011-03-02 14:31:35 -0800396 if (!IS_ERR(rt)) {
Bart De Schuymer1c011be2005-09-14 20:55:16 -0700397 /* - Bridged-and-DNAT'ed traffic doesn't
Bart De Schuymerf216f082006-12-05 13:45:21 -0800398 * require ip_forwarding. */
David S. Millerb23dd4f2011-03-02 14:31:35 -0800399 if (rt->dst.dev == dev) {
400 skb_dst_set(skb, &rt->dst);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700401 goto bridged_dnat;
402 }
David S. Millerb23dd4f2011-03-02 14:31:35 -0800403 ip_rt_put(rt);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700404 }
Bart De Schuymerf216f082006-12-05 13:45:21 -0800405free_skb:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700406 kfree_skb(skb);
407 return 0;
408 } else {
Eric Dumazetadf30902009-06-02 05:19:30 +0000409 if (skb_dst(skb)->dev == dev) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700410bridged_dnat:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700411 skb->dev = nf_bridge->physindev;
Bart De Schuymere179e632010-04-15 12:26:39 +0200412 nf_bridge_update_protocol(skb);
Patrick McHardyfc385822007-05-03 03:36:16 -0700413 nf_bridge_push_encap_header(skb);
Jan Engelhardt713aefa2010-03-23 04:07:21 +0100414 NF_HOOK_THRESH(NFPROTO_BRIDGE,
415 NF_BR_PRE_ROUTING,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700416 skb, skb->dev, NULL,
417 br_nf_pre_routing_finish_bridge,
418 1);
419 return 0;
420 }
Joe Perches04091142014-02-23 00:05:26 -0800421 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700422 skb->pkt_type = PACKET_HOST;
423 }
424 } else {
Eric Dumazet511c3f92009-06-02 05:14:27 +0000425 rt = bridge_parent_rtable(nf_bridge->physindev);
426 if (!rt) {
Simon Wunderlich4adf0af2008-07-30 16:27:55 -0700427 kfree_skb(skb);
428 return 0;
429 }
Patrick McHardyf9181f42010-06-15 17:31:06 +0200430 skb_dst_set_noref(skb, &rt->dst);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700431 }
432
433 skb->dev = nf_bridge->physindev;
Bart De Schuymere179e632010-04-15 12:26:39 +0200434 nf_bridge_update_protocol(skb);
Patrick McHardyfc385822007-05-03 03:36:16 -0700435 nf_bridge_push_encap_header(skb);
Jan Engelhardt713aefa2010-03-23 04:07:21 +0100436 NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700437 br_handle_frame_finish, 1);
438
439 return 0;
440}
441
Pablo Neira Ayuso49816822012-05-08 19:36:44 +0200442static struct net_device *brnf_get_logical_dev(struct sk_buff *skb, const struct net_device *dev)
443{
444 struct net_device *vlan, *br;
445
446 br = bridge_parent(dev);
447 if (brnf_pass_vlan_indev == 0 || !vlan_tx_tag_present(skb))
448 return br;
449
dingtianhongf06c7f92014-05-09 14:58:05 +0800450 vlan = __vlan_find_dev_deep_rcu(br, skb->vlan_proto,
Patrick McHardy1fd9b1f2013-04-19 02:04:29 +0000451 vlan_tx_tag_get(skb) & VLAN_VID_MASK);
Pablo Neira Ayuso49816822012-05-08 19:36:44 +0200452
453 return vlan ? vlan : br;
454}
455
Linus Torvalds1da177e2005-04-16 15:20:36 -0700456/* Some common code for IPv4/IPv6 */
Stephen Hemminger5dce9712006-02-09 17:09:38 -0800457static struct net_device *setup_pre_routing(struct sk_buff *skb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700458{
459 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
460
461 if (skb->pkt_type == PACKET_OTHERHOST) {
462 skb->pkt_type = PACKET_HOST;
463 nf_bridge->mask |= BRNF_PKT_TYPE;
464 }
465
466 nf_bridge->mask |= BRNF_NF_BRIDGE_PREROUTING;
467 nf_bridge->physindev = skb->dev;
Pablo Neira Ayuso49816822012-05-08 19:36:44 +0200468 skb->dev = brnf_get_logical_dev(skb, skb->dev);
Bart De Schuymere179e632010-04-15 12:26:39 +0200469 if (skb->protocol == htons(ETH_P_8021Q))
470 nf_bridge->mask |= BRNF_8021Q;
471 else if (skb->protocol == htons(ETH_P_PPP_SES))
472 nf_bridge->mask |= BRNF_PPPoE;
Stephen Hemminger5dce9712006-02-09 17:09:38 -0800473
Florian Westphal6b8dbcf2013-10-24 21:32:42 +0200474 /* Must drop socket now because of tproxy. */
475 skb_orphan(skb);
Stephen Hemminger5dce9712006-02-09 17:09:38 -0800476 return skb->dev;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700477}
478
479/* We only check the length. A bridge shouldn't do any hop-by-hop stuff anyway */
480static int check_hbh_len(struct sk_buff *skb)
481{
Arnaldo Carvalho de Melo0660e032007-04-25 17:54:47 -0700482 unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700483 u32 pkt_len;
Arnaldo Carvalho de Melod56f90a2007-04-10 20:50:43 -0700484 const unsigned char *nh = skb_network_header(skb);
485 int off = raw - nh;
Stephen Hemminger789bc3e2006-03-20 22:57:32 -0800486 int len = (raw[1] + 1) << 3;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700487
488 if ((raw + len) - skb->data > skb_headlen(skb))
489 goto bad;
490
491 off += 2;
492 len -= 2;
493
494 while (len > 0) {
Arnaldo Carvalho de Melod56f90a2007-04-10 20:50:43 -0700495 int optlen = nh[off + 1] + 2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700496
Arnaldo Carvalho de Melod56f90a2007-04-10 20:50:43 -0700497 switch (nh[off]) {
Eldad Zack1de5a712012-05-17 06:00:25 +0000498 case IPV6_TLV_PAD1:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700499 optlen = 1;
500 break;
501
502 case IPV6_TLV_PADN:
503 break;
504
505 case IPV6_TLV_JUMBO:
Arnaldo Carvalho de Melod56f90a2007-04-10 20:50:43 -0700506 if (nh[off + 1] != 4 || (off & 3) != 2)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700507 goto bad;
Arnaldo Carvalho de Melod56f90a2007-04-10 20:50:43 -0700508 pkt_len = ntohl(*(__be32 *) (nh + off + 2));
Bart De Schuymerb0366482005-12-19 14:00:08 -0800509 if (pkt_len <= IPV6_MAXPLEN ||
Arnaldo Carvalho de Melo0660e032007-04-25 17:54:47 -0700510 ipv6_hdr(skb)->payload_len)
Bart De Schuymerb0366482005-12-19 14:00:08 -0800511 goto bad;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700512 if (pkt_len > skb->len - sizeof(struct ipv6hdr))
513 goto bad;
Bart De Schuymerb0366482005-12-19 14:00:08 -0800514 if (pskb_trim_rcsum(skb,
Stephen Hemminger789bc3e2006-03-20 22:57:32 -0800515 pkt_len + sizeof(struct ipv6hdr)))
Bart De Schuymerb0366482005-12-19 14:00:08 -0800516 goto bad;
Arnaldo Carvalho de Melod56f90a2007-04-10 20:50:43 -0700517 nh = skb_network_header(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700518 break;
519 default:
520 if (optlen > len)
521 goto bad;
522 break;
523 }
524 off += optlen;
525 len -= optlen;
526 }
527 if (len == 0)
528 return 0;
529bad:
530 return -1;
531
532}
533
534/* Replicate the checks that IPv6 does on packet reception and pass the packet
535 * to ip6tables, which doesn't support NAT, so things are fairly simple. */
Patrick McHardy795aa6e2013-10-10 09:21:55 +0200536static unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,
Stephen Hemminger789bc3e2006-03-20 22:57:32 -0800537 struct sk_buff *skb,
538 const struct net_device *in,
539 const struct net_device *out,
540 int (*okfn)(struct sk_buff *))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700541{
Eric Dumazetb71d1d42011-04-22 04:53:02 +0000542 const struct ipv6hdr *hdr;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700543 u32 pkt_len;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700544
545 if (skb->len < sizeof(struct ipv6hdr))
Herbert Xudeef4b52010-12-09 17:38:11 +0000546 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700547
548 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
Herbert Xudeef4b52010-12-09 17:38:11 +0000549 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700550
Arnaldo Carvalho de Melo0660e032007-04-25 17:54:47 -0700551 hdr = ipv6_hdr(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700552
553 if (hdr->version != 6)
Herbert Xudeef4b52010-12-09 17:38:11 +0000554 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700555
556 pkt_len = ntohs(hdr->payload_len);
557
558 if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
559 if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
Herbert Xudeef4b52010-12-09 17:38:11 +0000560 return NF_DROP;
Herbert Xub38dfee2006-06-09 16:13:01 -0700561 if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
Herbert Xudeef4b52010-12-09 17:38:11 +0000562 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700563 }
564 if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb))
Herbert Xudeef4b52010-12-09 17:38:11 +0000565 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700566
Stephen Hemminger789bc3e2006-03-20 22:57:32 -0800567 nf_bridge_put(skb->nf_bridge);
Stephen Hemmingerfdeabde2006-03-20 22:58:21 -0800568 if (!nf_bridge_alloc(skb))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700569 return NF_DROP;
Stephen Hemminger5dce9712006-02-09 17:09:38 -0800570 if (!setup_pre_routing(skb))
571 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700572
Bart De Schuymere179e632010-04-15 12:26:39 +0200573 skb->protocol = htons(ETH_P_IPV6);
Jan Engelhardt713aefa2010-03-23 04:07:21 +0100574 NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700575 br_nf_pre_routing_finish_ipv6);
576
577 return NF_STOLEN;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700578}
579
580/* Direct IPv6 traffic to br_nf_pre_routing_ipv6.
581 * Replicate the checks that IPv4 does on packet reception.
582 * Set skb->dev to the bridge device (i.e. parent of the
583 * receiving device) to make netfilter happy, the REDIRECT
584 * target in particular. Save the original destination IP
585 * address to be able to detect DNAT afterwards. */
Patrick McHardy795aa6e2013-10-10 09:21:55 +0200586static unsigned int br_nf_pre_routing(const struct nf_hook_ops *ops,
587 struct sk_buff *skb,
Stephen Hemmingeree02b3a2006-01-06 13:13:29 -0800588 const struct net_device *in,
589 const struct net_device *out,
590 int (*okfn)(struct sk_buff *))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700591{
Patrick McHardy4df53d82010-07-02 09:32:57 +0200592 struct net_bridge_port *p;
593 struct net_bridge *br;
Evgeniy Polyakove7c243c2007-08-24 23:36:29 -0700594 __u32 len = nf_bridge_encap_header_len(skb);
595
Evgeniy Polyakove7c243c2007-08-24 23:36:29 -0700596 if (unlikely(!pskb_may_pull(skb, len)))
Herbert Xudeef4b52010-12-09 17:38:11 +0000597 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700598
David S. Millere490c1de2010-07-02 22:42:06 -0700599 p = br_port_get_rcu(in);
Patrick McHardy4df53d82010-07-02 09:32:57 +0200600 if (p == NULL)
Herbert Xudeef4b52010-12-09 17:38:11 +0000601 return NF_DROP;
Patrick McHardy4df53d82010-07-02 09:32:57 +0200602 br = p->br;
603
Florian Westphal739e4502012-03-06 01:22:54 +0000604 if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb)) {
Patrick McHardy4df53d82010-07-02 09:32:57 +0200605 if (!brnf_call_ip6tables && !br->nf_call_ip6tables)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700606 return NF_ACCEPT;
Patrick McHardy4df53d82010-07-02 09:32:57 +0200607
Patrick McHardyfc385822007-05-03 03:36:16 -0700608 nf_bridge_pull_encap_header_rcsum(skb);
Patrick McHardy795aa6e2013-10-10 09:21:55 +0200609 return br_nf_pre_routing_ipv6(ops, skb, in, out, okfn);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700610 }
Patrick McHardy4df53d82010-07-02 09:32:57 +0200611
612 if (!brnf_call_iptables && !br->nf_call_iptables)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700613 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700614
Florian Westphal739e4502012-03-06 01:22:54 +0000615 if (!IS_IP(skb) && !IS_VLAN_IP(skb) && !IS_PPPOE_IP(skb))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700616 return NF_ACCEPT;
617
Patrick McHardyfc385822007-05-03 03:36:16 -0700618 nf_bridge_pull_encap_header_rcsum(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700619
Bandan Das462fb2a2010-09-19 09:34:33 +0000620 if (br_parse_ip_options(skb))
Herbert Xudeef4b52010-12-09 17:38:11 +0000621 return NF_DROP;
Herbert Xu17762062010-07-05 21:29:28 +0000622
Stephen Hemminger789bc3e2006-03-20 22:57:32 -0800623 nf_bridge_put(skb->nf_bridge);
Stephen Hemmingerfdeabde2006-03-20 22:58:21 -0800624 if (!nf_bridge_alloc(skb))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700625 return NF_DROP;
Stephen Hemminger5dce9712006-02-09 17:09:38 -0800626 if (!setup_pre_routing(skb))
627 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700628 store_orig_dstaddr(skb);
Bart De Schuymere179e632010-04-15 12:26:39 +0200629 skb->protocol = htons(ETH_P_IP);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700630
Jan Engelhardt713aefa2010-03-23 04:07:21 +0100631 NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700632 br_nf_pre_routing_finish);
633
634 return NF_STOLEN;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700635}
636
637
638/* PF_BRIDGE/LOCAL_IN ************************************************/
639/* The packet is locally destined, which requires a real
640 * dst_entry, so detach the fake one. On the way up, the
641 * packet would pass through PRE_ROUTING again (which already
642 * took place when the packet entered the bridge), but we
643 * register an IPv4 PRE_ROUTING 'sabotage' hook that will
644 * prevent this from happening. */
Patrick McHardy795aa6e2013-10-10 09:21:55 +0200645static unsigned int br_nf_local_in(const struct nf_hook_ops *ops,
646 struct sk_buff *skb,
Stephen Hemminger789bc3e2006-03-20 22:57:32 -0800647 const struct net_device *in,
648 const struct net_device *out,
649 int (*okfn)(struct sk_buff *))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700650{
Peter Huang (Peng)a881e962012-04-19 20:12:51 +0000651 br_drop_fake_rtable(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700652 return NF_ACCEPT;
653}
654
Linus Torvalds1da177e2005-04-16 15:20:36 -0700655/* PF_BRIDGE/FORWARD *************************************************/
656static int br_nf_forward_finish(struct sk_buff *skb)
657{
658 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
659 struct net_device *in;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700660
Florian Westphal739e4502012-03-06 01:22:54 +0000661 if (!IS_ARP(skb) && !IS_VLAN_ARP(skb)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700662 in = nf_bridge->physindev;
663 if (nf_bridge->mask & BRNF_PKT_TYPE) {
664 skb->pkt_type = PACKET_OTHERHOST;
665 nf_bridge->mask ^= BRNF_PKT_TYPE;
666 }
Bart De Schuymere94c6742010-05-13 14:55:34 +0200667 nf_bridge_update_protocol(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700668 } else {
669 in = *((struct net_device **)(skb->cb));
670 }
Patrick McHardyfc385822007-05-03 03:36:16 -0700671 nf_bridge_push_encap_header(skb);
Bart De Schuymere179e632010-04-15 12:26:39 +0200672
Jan Engelhardt713aefa2010-03-23 04:07:21 +0100673 NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, in,
Stephen Hemminger789bc3e2006-03-20 22:57:32 -0800674 skb->dev, br_forward_finish, 1);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700675 return 0;
676}
677
Florian Westphal739e4502012-03-06 01:22:54 +0000678
Linus Torvalds1da177e2005-04-16 15:20:36 -0700679/* This is the 'purely bridged' case. For IP, we pass the packet to
680 * netfilter with indev and outdev set to the bridge device,
681 * but we are still able to filter on the 'real' indev/outdev
682 * because of the physdev module. For ARP, indev and outdev are the
683 * bridge ports. */
Patrick McHardy795aa6e2013-10-10 09:21:55 +0200684static unsigned int br_nf_forward_ip(const struct nf_hook_ops *ops,
685 struct sk_buff *skb,
Stephen Hemminger789bc3e2006-03-20 22:57:32 -0800686 const struct net_device *in,
687 const struct net_device *out,
688 int (*okfn)(struct sk_buff *))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700689{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700690 struct nf_bridge_info *nf_bridge;
Stephen Hemminger5dce9712006-02-09 17:09:38 -0800691 struct net_device *parent;
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200692 u_int8_t pf;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700693
694 if (!skb->nf_bridge)
695 return NF_ACCEPT;
696
Patrick McHardy2dc2f202008-01-20 06:25:48 -0800697 /* Need exclusive nf_bridge_info since we might have multiple
698 * different physoutdevs. */
699 if (!nf_bridge_unshare(skb))
700 return NF_DROP;
701
Stephen Hemminger5dce9712006-02-09 17:09:38 -0800702 parent = bridge_parent(out);
703 if (!parent)
704 return NF_DROP;
705
Florian Westphal739e4502012-03-06 01:22:54 +0000706 if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
Alban Crequyaa740f42012-05-14 03:56:36 +0000707 pf = NFPROTO_IPV4;
Florian Westphal739e4502012-03-06 01:22:54 +0000708 else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
Alban Crequyaa740f42012-05-14 03:56:36 +0000709 pf = NFPROTO_IPV6;
Herbert Xua2bd40a2009-01-12 00:06:02 +0000710 else
711 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700712
Herbert Xu3db05fe2007-10-15 00:53:15 -0700713 nf_bridge_pull_encap_header(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700714
Linus Torvalds1da177e2005-04-16 15:20:36 -0700715 nf_bridge = skb->nf_bridge;
716 if (skb->pkt_type == PACKET_OTHERHOST) {
717 skb->pkt_type = PACKET_HOST;
718 nf_bridge->mask |= BRNF_PKT_TYPE;
719 }
720
Alban Crequyaa740f42012-05-14 03:56:36 +0000721 if (pf == NFPROTO_IPV4 && br_parse_ip_options(skb))
Herbert Xu6b1e9602011-03-18 05:27:28 +0000722 return NF_DROP;
723
Linus Torvalds1da177e2005-04-16 15:20:36 -0700724 /* The physdev module checks on this */
725 nf_bridge->mask |= BRNF_BRIDGED;
726 nf_bridge->physoutdev = skb->dev;
Alban Crequyaa740f42012-05-14 03:56:36 +0000727 if (pf == NFPROTO_IPV4)
Bart De Schuymere179e632010-04-15 12:26:39 +0200728 skb->protocol = htons(ETH_P_IP);
729 else
730 skb->protocol = htons(ETH_P_IPV6);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700731
Pablo Neira Ayuso49816822012-05-08 19:36:44 +0200732 NF_HOOK(pf, NF_INET_FORWARD, skb, brnf_get_logical_dev(skb, in), parent,
Stephen Hemminger5dce9712006-02-09 17:09:38 -0800733 br_nf_forward_finish);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700734
735 return NF_STOLEN;
736}
737
Patrick McHardy795aa6e2013-10-10 09:21:55 +0200738static unsigned int br_nf_forward_arp(const struct nf_hook_ops *ops,
739 struct sk_buff *skb,
Stephen Hemminger789bc3e2006-03-20 22:57:32 -0800740 const struct net_device *in,
741 const struct net_device *out,
742 int (*okfn)(struct sk_buff *))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700743{
Patrick McHardy4df53d82010-07-02 09:32:57 +0200744 struct net_bridge_port *p;
745 struct net_bridge *br;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700746 struct net_device **d = (struct net_device **)(skb->cb);
747
David S. Millere490c1de2010-07-02 22:42:06 -0700748 p = br_port_get_rcu(out);
Patrick McHardy4df53d82010-07-02 09:32:57 +0200749 if (p == NULL)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700750 return NF_ACCEPT;
Patrick McHardy4df53d82010-07-02 09:32:57 +0200751 br = p->br;
752
753 if (!brnf_call_arptables && !br->nf_call_arptables)
754 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700755
Florian Westphal739e4502012-03-06 01:22:54 +0000756 if (!IS_ARP(skb)) {
Stephen Hemminger8b42ec32006-03-20 22:58:05 -0800757 if (!IS_VLAN_ARP(skb))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700758 return NF_ACCEPT;
Herbert Xu3db05fe2007-10-15 00:53:15 -0700759 nf_bridge_pull_encap_header(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700760 }
761
Arnaldo Carvalho de Melod0a92be2007-03-12 20:56:31 -0300762 if (arp_hdr(skb)->ar_pln != 4) {
Patrick McHardyfc385822007-05-03 03:36:16 -0700763 if (IS_VLAN_ARP(skb))
Herbert Xu3db05fe2007-10-15 00:53:15 -0700764 nf_bridge_push_encap_header(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700765 return NF_ACCEPT;
766 }
767 *d = (struct net_device *)in;
Jan Engelhardtfdc93142008-10-20 03:34:51 -0700768 NF_HOOK(NFPROTO_ARP, NF_ARP_FORWARD, skb, (struct net_device *)in,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700769 (struct net_device *)out, br_nf_forward_finish);
770
771 return NF_STOLEN;
772}
773
Vasily Averinaff09ce2014-05-05 00:17:48 +0400774#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
Patrick McHardy2e2f7ae2006-04-04 13:42:35 -0700775static int br_nf_dev_queue_xmit(struct sk_buff *skb)
776{
Bandan Das462fb2a2010-09-19 09:34:33 +0000777 int ret;
778
Vasily Averinaff09ce2014-05-05 00:17:48 +0400779 if (skb->protocol == htons(ETH_P_IP) &&
Bart De Schuymer6c79bf02010-04-20 16:22:01 +0200780 skb->len + nf_bridge_mtu_reduction(skb) > skb->dev->mtu &&
David S. Miller87f94b42010-09-01 18:06:39 -0700781 !skb_is_gso(skb)) {
Bandan Das462fb2a2010-09-19 09:34:33 +0000782 if (br_parse_ip_options(skb))
783 /* Drop invalid packet */
784 return NF_DROP;
785 ret = ip_fragment(skb, br_dev_queue_push_xmit);
David S. Miller87f94b42010-09-01 18:06:39 -0700786 } else
Bandan Das462fb2a2010-09-19 09:34:33 +0000787 ret = br_dev_queue_push_xmit(skb);
788
789 return ret;
Patrick McHardy2e2f7ae2006-04-04 13:42:35 -0700790}
hummerbliss@gmail.comc197fac2009-04-20 17:12:35 +0200791#else
792static int br_nf_dev_queue_xmit(struct sk_buff *skb)
793{
794 return br_dev_queue_push_xmit(skb);
795}
796#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -0700797
798/* PF_BRIDGE/POST_ROUTING ********************************************/
Patrick McHardy795aa6e2013-10-10 09:21:55 +0200799static unsigned int br_nf_post_routing(const struct nf_hook_ops *ops,
800 struct sk_buff *skb,
Stephen Hemminger789bc3e2006-03-20 22:57:32 -0800801 const struct net_device *in,
802 const struct net_device *out,
803 int (*okfn)(struct sk_buff *))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700804{
Herbert Xu3db05fe2007-10-15 00:53:15 -0700805 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700806 struct net_device *realoutdev = bridge_parent(skb->dev);
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200807 u_int8_t pf;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700808
Bart De Schuymerea2d9b42010-04-15 12:14:51 +0200809 if (!nf_bridge || !(nf_bridge->mask & BRNF_BRIDGED))
Patrick McHardy81d9dda2007-11-13 02:58:44 -0800810 return NF_ACCEPT;
811
Stephen Hemminger5dce9712006-02-09 17:09:38 -0800812 if (!realoutdev)
813 return NF_DROP;
814
Florian Westphal739e4502012-03-06 01:22:54 +0000815 if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
Alban Crequyaa740f42012-05-14 03:56:36 +0000816 pf = NFPROTO_IPV4;
Florian Westphal739e4502012-03-06 01:22:54 +0000817 else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
Alban Crequyaa740f42012-05-14 03:56:36 +0000818 pf = NFPROTO_IPV6;
Herbert Xua2bd40a2009-01-12 00:06:02 +0000819 else
820 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700821
Linus Torvalds1da177e2005-04-16 15:20:36 -0700822 /* We assume any code from br_dev_queue_push_xmit onwards doesn't care
823 * about the value of skb->pkt_type. */
824 if (skb->pkt_type == PACKET_OTHERHOST) {
825 skb->pkt_type = PACKET_HOST;
826 nf_bridge->mask |= BRNF_PKT_TYPE;
827 }
828
Patrick McHardyfc385822007-05-03 03:36:16 -0700829 nf_bridge_pull_encap_header(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700830 nf_bridge_save_header(skb);
Alban Crequyaa740f42012-05-14 03:56:36 +0000831 if (pf == NFPROTO_IPV4)
Bart De Schuymere179e632010-04-15 12:26:39 +0200832 skb->protocol = htons(ETH_P_IP);
833 else
834 skb->protocol = htons(ETH_P_IPV6);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700835
Patrick McHardy6e23ae22007-11-19 18:53:30 -0800836 NF_HOOK(pf, NF_INET_POST_ROUTING, skb, NULL, realoutdev,
Patrick McHardy2e2f7ae2006-04-04 13:42:35 -0700837 br_nf_dev_queue_xmit);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700838
839 return NF_STOLEN;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700840}
841
Linus Torvalds1da177e2005-04-16 15:20:36 -0700842/* IP/SABOTAGE *****************************************************/
843/* Don't hand locally destined packets to PF_INET(6)/PRE_ROUTING
844 * for the second time. */
Patrick McHardy795aa6e2013-10-10 09:21:55 +0200845static unsigned int ip_sabotage_in(const struct nf_hook_ops *ops,
846 struct sk_buff *skb,
Stephen Hemminger789bc3e2006-03-20 22:57:32 -0800847 const struct net_device *in,
848 const struct net_device *out,
849 int (*okfn)(struct sk_buff *))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700850{
Herbert Xu3db05fe2007-10-15 00:53:15 -0700851 if (skb->nf_bridge &&
852 !(skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700853 return NF_STOP;
854 }
855
856 return NF_ACCEPT;
857}
858
Bart De Schuymerea2d9b42010-04-15 12:14:51 +0200859/* For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
860 * br_dev_queue_push_xmit is called afterwards */
Patrick McHardy19994142007-12-05 01:23:00 -0800861static struct nf_hook_ops br_nf_ops[] __read_mostly = {
Cyrill Gorcunov1490fd82009-07-03 20:11:57 +0000862 {
863 .hook = br_nf_pre_routing,
864 .owner = THIS_MODULE,
Alban Crequyaa740f42012-05-14 03:56:36 +0000865 .pf = NFPROTO_BRIDGE,
Cyrill Gorcunov1490fd82009-07-03 20:11:57 +0000866 .hooknum = NF_BR_PRE_ROUTING,
867 .priority = NF_BR_PRI_BRNF,
868 },
869 {
870 .hook = br_nf_local_in,
871 .owner = THIS_MODULE,
Alban Crequyaa740f42012-05-14 03:56:36 +0000872 .pf = NFPROTO_BRIDGE,
Cyrill Gorcunov1490fd82009-07-03 20:11:57 +0000873 .hooknum = NF_BR_LOCAL_IN,
874 .priority = NF_BR_PRI_BRNF,
875 },
876 {
877 .hook = br_nf_forward_ip,
878 .owner = THIS_MODULE,
Alban Crequyaa740f42012-05-14 03:56:36 +0000879 .pf = NFPROTO_BRIDGE,
Cyrill Gorcunov1490fd82009-07-03 20:11:57 +0000880 .hooknum = NF_BR_FORWARD,
881 .priority = NF_BR_PRI_BRNF - 1,
882 },
883 {
884 .hook = br_nf_forward_arp,
885 .owner = THIS_MODULE,
Alban Crequyaa740f42012-05-14 03:56:36 +0000886 .pf = NFPROTO_BRIDGE,
Cyrill Gorcunov1490fd82009-07-03 20:11:57 +0000887 .hooknum = NF_BR_FORWARD,
888 .priority = NF_BR_PRI_BRNF,
889 },
890 {
Cyrill Gorcunov1490fd82009-07-03 20:11:57 +0000891 .hook = br_nf_post_routing,
892 .owner = THIS_MODULE,
Alban Crequyaa740f42012-05-14 03:56:36 +0000893 .pf = NFPROTO_BRIDGE,
Cyrill Gorcunov1490fd82009-07-03 20:11:57 +0000894 .hooknum = NF_BR_POST_ROUTING,
895 .priority = NF_BR_PRI_LAST,
896 },
897 {
898 .hook = ip_sabotage_in,
899 .owner = THIS_MODULE,
Alban Crequyaa740f42012-05-14 03:56:36 +0000900 .pf = NFPROTO_IPV4,
Cyrill Gorcunov1490fd82009-07-03 20:11:57 +0000901 .hooknum = NF_INET_PRE_ROUTING,
902 .priority = NF_IP_PRI_FIRST,
903 },
904 {
905 .hook = ip_sabotage_in,
906 .owner = THIS_MODULE,
Alban Crequyaa740f42012-05-14 03:56:36 +0000907 .pf = NFPROTO_IPV6,
Cyrill Gorcunov1490fd82009-07-03 20:11:57 +0000908 .hooknum = NF_INET_PRE_ROUTING,
909 .priority = NF_IP6_PRI_FIRST,
910 },
Linus Torvalds1da177e2005-04-16 15:20:36 -0700911};
912
913#ifdef CONFIG_SYSCTL
914static
Joe Perchesfe2c6332013-06-11 23:04:25 -0700915int brnf_sysctl_call_tables(struct ctl_table *ctl, int write,
tanxiaojun56b148e2013-12-19 13:28:13 +0800916 void __user *buffer, size_t *lenp, loff_t *ppos)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700917{
918 int ret;
919
Alexey Dobriyan8d65af72009-09-23 15:57:19 -0700920 ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700921
922 if (write && *(int *)(ctl->data))
923 *(int *)(ctl->data) = 1;
924 return ret;
925}
926
Joe Perchesfe2c6332013-06-11 23:04:25 -0700927static struct ctl_table brnf_table[] = {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700928 {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700929 .procname = "bridge-nf-call-arptables",
930 .data = &brnf_call_arptables,
931 .maxlen = sizeof(int),
932 .mode = 0644,
Alexey Dobriyan6d9f2392008-11-03 18:21:05 -0800933 .proc_handler = brnf_sysctl_call_tables,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700934 },
935 {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700936 .procname = "bridge-nf-call-iptables",
937 .data = &brnf_call_iptables,
938 .maxlen = sizeof(int),
939 .mode = 0644,
Alexey Dobriyan6d9f2392008-11-03 18:21:05 -0800940 .proc_handler = brnf_sysctl_call_tables,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700941 },
942 {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700943 .procname = "bridge-nf-call-ip6tables",
944 .data = &brnf_call_ip6tables,
945 .maxlen = sizeof(int),
946 .mode = 0644,
Alexey Dobriyan6d9f2392008-11-03 18:21:05 -0800947 .proc_handler = brnf_sysctl_call_tables,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700948 },
949 {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700950 .procname = "bridge-nf-filter-vlan-tagged",
951 .data = &brnf_filter_vlan_tagged,
952 .maxlen = sizeof(int),
953 .mode = 0644,
Alexey Dobriyan6d9f2392008-11-03 18:21:05 -0800954 .proc_handler = brnf_sysctl_call_tables,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700955 },
Michael Milner516299d2007-04-12 22:14:23 -0700956 {
Michael Milner516299d2007-04-12 22:14:23 -0700957 .procname = "bridge-nf-filter-pppoe-tagged",
958 .data = &brnf_filter_pppoe_tagged,
959 .maxlen = sizeof(int),
960 .mode = 0644,
Alexey Dobriyan6d9f2392008-11-03 18:21:05 -0800961 .proc_handler = brnf_sysctl_call_tables,
Michael Milner516299d2007-04-12 22:14:23 -0700962 },
Pablo Neira Ayuso49816822012-05-08 19:36:44 +0200963 {
964 .procname = "bridge-nf-pass-vlan-input-dev",
965 .data = &brnf_pass_vlan_indev,
966 .maxlen = sizeof(int),
967 .mode = 0644,
968 .proc_handler = brnf_sysctl_call_tables,
969 },
Eric W. Biedermanf8572d82009-11-05 13:32:03 -0800970 { }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700971};
Linus Torvalds1da177e2005-04-16 15:20:36 -0700972#endif
973
Pablo Neira Ayuso34666d42014-09-18 11:29:03 +0200974static int __init br_netfilter_init(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700975{
Patrick McHardy5eb87f42007-02-07 15:07:22 -0800976 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700977
Pablo Neira Ayuso34666d42014-09-18 11:29:03 +0200978 ret = nf_register_hooks(br_nf_ops, ARRAY_SIZE(br_nf_ops));
Patrick McHardy5eb87f42007-02-07 15:07:22 -0800979 if (ret < 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700980 return ret;
Eric Dumazetfc66f952010-10-08 06:37:34 +0000981
Linus Torvalds1da177e2005-04-16 15:20:36 -0700982#ifdef CONFIG_SYSCTL
Eric W. Biedermanec8f23c2012-04-19 13:44:49 +0000983 brnf_sysctl_header = register_net_sysctl(&init_net, "net/bridge", brnf_table);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700984 if (brnf_sysctl_header == NULL) {
Stephen Hemminger789bc3e2006-03-20 22:57:32 -0800985 printk(KERN_WARNING
986 "br_netfilter: can't register to sysctl.\n");
Pablo Neira Ayuso34666d42014-09-18 11:29:03 +0200987 ret = -ENOMEM;
988 goto err1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700989 }
990#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -0700991 printk(KERN_NOTICE "Bridge firewalling registered\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700992 return 0;
Pablo Neira Ayuso34666d42014-09-18 11:29:03 +0200993err1:
994 nf_unregister_hooks(br_nf_ops, ARRAY_SIZE(br_nf_ops));
995 return ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700996}
997
Pablo Neira Ayuso34666d42014-09-18 11:29:03 +0200998static void __exit br_netfilter_fini(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700999{
Patrick McHardy5eb87f42007-02-07 15:07:22 -08001000 nf_unregister_hooks(br_nf_ops, ARRAY_SIZE(br_nf_ops));
Linus Torvalds1da177e2005-04-16 15:20:36 -07001001#ifdef CONFIG_SYSCTL
Eric W. Biederman5dd3df12012-04-19 13:24:33 +00001002 unregister_net_sysctl_table(brnf_sysctl_header);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001003#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07001004}
Pablo Neira Ayuso34666d42014-09-18 11:29:03 +02001005
1006module_init(br_netfilter_init);
1007module_exit(br_netfilter_fini);
1008
1009MODULE_LICENSE("GPL");
1010MODULE_AUTHOR("Lennert Buytenhek <buytenh@gnu.org>");
1011MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
1012MODULE_DESCRIPTION("Linux ethernet netfilter firewall bridge");