net/bridge/br_netfilter_ipv6.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Handle firewalling
   4  *      Linux ethernet bridge
   5  *
   6  *      Authors:
   7  *      Lennert Buytenhek               <buytenh@gnu.org>
   8  *      Bart De Schuymer                <bdschuym@pandora.be>
   9  *
  10  *      Lennert dedicates this file to Kerstin Wurdinger.
  11  */
  12
  13 #include <linux/module.h>
  14 #include <linux/kernel.h>
  15 #include <linux/slab.h>
  16 #include <linux/ip.h>
  17 #include <linux/netdevice.h>
  18 #include <linux/skbuff.h>
  19 #include <linux/if_arp.h>
  20 #include <linux/if_ether.h>
  21 #include <linux/if_vlan.h>
  22 #include <linux/if_pppox.h>
  23 #include <linux/ppp_defs.h>
  24 #include <linux/netfilter_bridge.h>
  25 #include <linux/netfilter_ipv4.h>
  26 #include <linux/netfilter_ipv6.h>
  27 #include <linux/netfilter_arp.h>
  28 #include <linux/in_route.h>
  29 #include <linux/inetdevice.h>
  30
  31 #include <net/ip.h>
  32 #include <net/ipv6.h>
  33 #include <net/addrconf.h>
  34 #include <net/route.h>
  35 #include <net/netfilter/br_netfilter.h>
  36
  37 #include <linux/uaccess.h>
  38 #include "br_private.h"
  39 #ifdef CONFIG_SYSCTL
  40 #include <linux/sysctl.h>
  41 #endif
  42
  43 int br_validate_ipv6(struct net *net, struct sk_buff *skb)
  44 {
  45         const struct ipv6hdr *hdr;
  46         struct inet6_dev *idev = __in6_dev_get(skb->dev);
  47         u32 pkt_len;
  48         u8 ip6h_len = sizeof(struct ipv6hdr);
  49
  50         if (!pskb_may_pull(skb, ip6h_len))
  51                 goto inhdr_error;
  52
  53         if (skb->len < ip6h_len)
  54                 goto drop;
  55
  56         hdr = ipv6_hdr(skb);
  57
  58         if (hdr->version != 6)
  59                 goto inhdr_error;
  60
  61         pkt_len = ntohs(hdr->payload_len);
  62         if (hdr->nexthdr == NEXTHDR_HOP && nf_ip6_check_hbh_len(skb, &pkt_len))
  63                 goto drop;
  64
  65         if (pkt_len + ip6h_len > skb->len) {
  66                 __IP6_INC_STATS(net, idev,
  67                                 IPSTATS_MIB_INTRUNCATEDPKTS);
  68                 goto drop;
  69         }
  70         if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
  71                 __IP6_INC_STATS(net, idev,
  72                                 IPSTATS_MIB_INDISCARDS);
  73                 goto drop;
  74         }
  75
  76         memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
  77         /* No IP options in IPv6 header; however it should be
  78          * checked if some next headers need special treatment
  79          */
  80         return 0;
  81
  82 inhdr_error:
  83         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
  84 drop:
  85         return -1;
  86 }
  87
  88 static inline bool
  89 br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
  90                              const struct nf_bridge_info *nf_bridge)
  91 {
  92         return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
  93                       sizeof(ipv6_hdr(skb)->daddr)) != 0;
  94 }
  95
  96 /* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
  97  * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
  98  * for br_nf_pre_routing_finish(), same logic is used here but
  99  * equivalent IPv6 function ip6_route_input() called indirectly.
 100  */
 101 static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb)
 102 {
 103         struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
 104         struct rtable *rt;
 105         struct net_device *dev = skb->dev, *br_indev;
 106         const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
 107
 108         br_indev = nf_bridge_get_physindev(skb, net);
 109         if (!br_indev) {
 110                 kfree_skb(skb);
 111                 return 0;
 112         }
 113
 114         nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
 115
 116         if (nf_bridge->pkt_otherhost) {
 117                 skb->pkt_type = PACKET_OTHERHOST;
 118                 nf_bridge->pkt_otherhost = false;
 119         }
 120         nf_bridge->in_prerouting = 0;
 121         if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
 122                 skb_dst_drop(skb);
 123                 v6ops->route_input(skb);
 124
 125                 if (skb_dst(skb)->error) {
 126                         kfree_skb(skb);
 127                         return 0;
 128                 }
 129
 130                 if (skb_dst(skb)->dev == dev) {
 131                         skb->dev = br_indev;
 132                         nf_bridge_update_protocol(skb);
 133                         nf_bridge_push_encap_header(skb);
 134                         br_nf_hook_thresh(NF_BR_PRE_ROUTING,
 135                                           net, sk, skb, skb->dev, NULL,
 136                                           br_nf_pre_routing_finish_bridge);
 137                         return 0;
 138                 }
 139                 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
 140                 skb->pkt_type = PACKET_HOST;
 141         } else {
 142                 rt = bridge_parent_rtable(br_indev);
 143                 if (!rt) {
 144                         kfree_skb(skb);
 145                         return 0;
 146                 }
 147                 skb_dst_drop(skb);
 148                 skb_dst_set_noref(skb, &rt->dst);
 149         }
 150
 151         skb->dev = br_indev;
 152         nf_bridge_update_protocol(skb);
 153         nf_bridge_push_encap_header(skb);
 154         br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb,
 155                           skb->dev, NULL, br_handle_frame_finish);
 156
 157         return 0;
 158 }
 159
 160 /* Replicate the checks that IPv6 does on packet reception and pass the packet
 161  * to ip6tables.
 162  */
 163 unsigned int br_nf_pre_routing_ipv6(void *priv,
 164                                     struct sk_buff *skb,
 165                                     const struct nf_hook_state *state)
 166 {
 167         struct nf_bridge_info *nf_bridge;
 168
 169         if (br_validate_ipv6(state->net, skb))
 170                 return NF_DROP_REASON(skb, SKB_DROP_REASON_IP_INHDR, 0);
 171
 172         nf_bridge = nf_bridge_alloc(skb);
 173         if (!nf_bridge)
 174                 return NF_DROP_REASON(skb, SKB_DROP_REASON_NOMEM, 0);
 175         if (!setup_pre_routing(skb, state->net))
 176                 return NF_DROP_REASON(skb, SKB_DROP_REASON_DEV_READY, 0);
 177
 178         nf_bridge = nf_bridge_info_get(skb);
 179         nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
 180
 181         skb->protocol = htons(ETH_P_IPV6);
 182         skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);
 183
 184         NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
 185                 skb->dev, NULL,
 186                 br_nf_pre_routing_finish_ipv6);
 187
 188         return NF_STOLEN;
 189 }