Blame view
net/bridge/br_netfilter_ipv6.c
5.78 KB
230ac490f netfilter: bridge... |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 |
/* * Handle firewalling * Linux ethernet bridge * * Authors: * Lennert Buytenhek <buytenh@gnu.org> * Bart De Schuymer <bdschuym@pandora.be> * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version * 2 of the License, or (at your option) any later version. * * Lennert dedicates this file to Kerstin Wurdinger. */ #include <linux/module.h> #include <linux/kernel.h> #include <linux/slab.h> #include <linux/ip.h> #include <linux/netdevice.h> #include <linux/skbuff.h> #include <linux/if_arp.h> #include <linux/if_ether.h> #include <linux/if_vlan.h> #include <linux/if_pppox.h> #include <linux/ppp_defs.h> #include <linux/netfilter_bridge.h> #include <linux/netfilter_ipv4.h> #include <linux/netfilter_ipv6.h> #include <linux/netfilter_arp.h> #include <linux/in_route.h> #include <linux/inetdevice.h> #include <net/ip.h> #include <net/ipv6.h> #include <net/addrconf.h> #include <net/route.h> #include <net/netfilter/br_netfilter.h> |
7c0f6ba68 Replace <asm/uacc... |
40 |
#include <linux/uaccess.h> |
230ac490f netfilter: bridge... |
41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 |
#include "br_private.h" #ifdef CONFIG_SYSCTL #include <linux/sysctl.h> #endif /* We only check the length. A bridge shouldn't do any hop-by-hop stuff * anyway */ static int br_nf_check_hbh_len(struct sk_buff *skb) { unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1); u32 pkt_len; const unsigned char *nh = skb_network_header(skb); int off = raw - nh; int len = (raw[1] + 1) << 3; if ((raw + len) - skb->data > skb_headlen(skb)) goto bad; off += 2; len -= 2; while (len > 0) { int optlen = nh[off + 1] + 2; switch (nh[off]) { case IPV6_TLV_PAD1: optlen = 1; break; case IPV6_TLV_PADN: break; case IPV6_TLV_JUMBO: if (nh[off + 1] != 4 || (off & 3) != 2) goto bad; pkt_len = ntohl(*(__be32 *)(nh + off + 2)); if (pkt_len <= IPV6_MAXPLEN || ipv6_hdr(skb)->payload_len) goto bad; if (pkt_len > skb->len - sizeof(struct ipv6hdr)) goto bad; if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr))) goto bad; nh = skb_network_header(skb); break; default: if (optlen > len) goto bad; break; } off += optlen; len -= optlen; } if (len == 0) return 0; bad: return -1; } |
c1444c635 bridge: Pass net ... |
101 |
int br_validate_ipv6(struct net *net, struct sk_buff *skb) |
230ac490f netfilter: bridge... |
102 103 |
{ const struct ipv6hdr *hdr; |
86e897180 netfilter: bridge... |
104 |
struct inet6_dev *idev = __in6_dev_get(skb->dev); |
230ac490f netfilter: bridge... |
105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 |
u32 pkt_len; u8 ip6h_len = sizeof(struct ipv6hdr); if (!pskb_may_pull(skb, ip6h_len)) goto inhdr_error; if (skb->len < ip6h_len) goto drop; hdr = ipv6_hdr(skb); if (hdr->version != 6) goto inhdr_error; pkt_len = ntohs(hdr->payload_len); if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) { if (pkt_len + ip6h_len > skb->len) { |
1d0155035 ipv6: rename IP6_... |
123 124 |
__IP6_INC_STATS(net, idev, IPSTATS_MIB_INTRUNCATEDPKTS); |
230ac490f netfilter: bridge... |
125 126 127 |
goto drop; } if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) { |
1d0155035 ipv6: rename IP6_... |
128 129 |
__IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS); |
230ac490f netfilter: bridge... |
130 131 |
goto drop; } |
66a011d15 net: Fix usage of... |
132 |
hdr = ipv6_hdr(skb); |
230ac490f netfilter: bridge... |
133 134 135 136 137 138 139 140 141 142 143 |
} if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb)) goto drop; memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); /* No IP options in IPv6 header; however it should be * checked if some next headers need special treatment */ return 0; inhdr_error: |
1d0155035 ipv6: rename IP6_... |
144 |
__IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS); |
230ac490f netfilter: bridge... |
145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 |
drop: return -1; } static inline bool br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb, const struct nf_bridge_info *nf_bridge) { return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr, sizeof(ipv6_hdr(skb)->daddr)) != 0; } /* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables * PREROUTING and continue the bridge PRE_ROUTING hook. See comment * for br_nf_pre_routing_finish(), same logic is used here but * equivalent IPv6 function ip6_route_input() called indirectly. */ |
0c4b51f00 netfilter: Pass n... |
162 |
static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb) |
230ac490f netfilter: bridge... |
163 164 165 166 167 168 169 170 171 172 173 174 |
{ struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); struct rtable *rt; struct net_device *dev = skb->dev; const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops(); nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size; if (nf_bridge->pkt_otherhost) { skb->pkt_type = PACKET_OTHERHOST; nf_bridge->pkt_otherhost = false; } |
72b1e5e4c netfilter: bridge... |
175 |
nf_bridge->in_prerouting = 0; |
230ac490f netfilter: bridge... |
176 177 178 179 180 181 182 183 184 185 186 187 188 |
if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) { skb_dst_drop(skb); v6ops->route_input(skb); if (skb_dst(skb)->error) { kfree_skb(skb); return 0; } if (skb_dst(skb)->dev == dev) { skb->dev = nf_bridge->physindev; nf_bridge_update_protocol(skb); nf_bridge_push_encap_header(skb); |
c5136b15e netfilter: bridge... |
189 190 191 |
br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb, skb->dev, NULL, br_nf_pre_routing_finish_bridge); |
230ac490f netfilter: bridge... |
192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 |
return 0; } ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr); skb->pkt_type = PACKET_HOST; } else { rt = bridge_parent_rtable(nf_bridge->physindev); if (!rt) { kfree_skb(skb); return 0; } skb_dst_set_noref(skb, &rt->dst); } skb->dev = nf_bridge->physindev; nf_bridge_update_protocol(skb); nf_bridge_push_encap_header(skb); |
c5136b15e netfilter: bridge... |
208 209 |
br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb, skb->dev, NULL, br_handle_frame_finish); |
230ac490f netfilter: bridge... |
210 211 212 213 214 215 216 |
return 0; } /* Replicate the checks that IPv6 does on packet reception and pass the packet * to ip6tables. */ |
06198b34a netfilter: Pass p... |
217 |
unsigned int br_nf_pre_routing_ipv6(void *priv, |
230ac490f netfilter: bridge... |
218 219 220 221 |
struct sk_buff *skb, const struct nf_hook_state *state) { struct nf_bridge_info *nf_bridge; |
c1444c635 bridge: Pass net ... |
222 |
if (br_validate_ipv6(state->net, skb)) |
230ac490f netfilter: bridge... |
223 224 225 226 227 228 229 230 231 232 233 234 |
return NF_DROP; nf_bridge_put(skb->nf_bridge); if (!nf_bridge_alloc(skb)) return NF_DROP; if (!setup_pre_routing(skb)) return NF_DROP; nf_bridge = nf_bridge_info_get(skb); nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr; skb->protocol = htons(ETH_P_IPV6); |
29a26a568 netfilter: Pass s... |
235 |
NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb, |
230ac490f netfilter: bridge... |
236 237 238 239 240 |
skb->dev, NULL, br_nf_pre_routing_finish_ipv6); return NF_STOLEN; } |