~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/bridge/br_netfilter_ipv6.c

Version: ~ [ linux-5.4-rc3 ] ~ [ linux-5.3.6 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.79 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.149 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.196 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.196 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.75 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  *      Handle firewalling
  3  *      Linux ethernet bridge
  4  *
  5  *      Authors:
  6  *      Lennert Buytenhek               <buytenh@gnu.org>
  7  *      Bart De Schuymer                <bdschuym@pandora.be>
  8  *
  9  *      This program is free software; you can redistribute it and/or
 10  *      modify it under the terms of the GNU General Public License
 11  *      as published by the Free Software Foundation; either version
 12  *      2 of the License, or (at your option) any later version.
 13  *
 14  *      Lennert dedicates this file to Kerstin Wurdinger.
 15  */
 16 
 17 #include <linux/module.h>
 18 #include <linux/kernel.h>
 19 #include <linux/slab.h>
 20 #include <linux/ip.h>
 21 #include <linux/netdevice.h>
 22 #include <linux/skbuff.h>
 23 #include <linux/if_arp.h>
 24 #include <linux/if_ether.h>
 25 #include <linux/if_vlan.h>
 26 #include <linux/if_pppox.h>
 27 #include <linux/ppp_defs.h>
 28 #include <linux/netfilter_bridge.h>
 29 #include <linux/netfilter_ipv4.h>
 30 #include <linux/netfilter_ipv6.h>
 31 #include <linux/netfilter_arp.h>
 32 #include <linux/in_route.h>
 33 #include <linux/inetdevice.h>
 34 
 35 #include <net/ip.h>
 36 #include <net/ipv6.h>
 37 #include <net/addrconf.h>
 38 #include <net/route.h>
 39 #include <net/netfilter/br_netfilter.h>
 40 
 41 #include <linux/uaccess.h>
 42 #include "br_private.h"
 43 #ifdef CONFIG_SYSCTL
 44 #include <linux/sysctl.h>
 45 #endif
 46 
 47 /* We only check the length. A bridge shouldn't do any hop-by-hop stuff
 48  * anyway
 49  */
 50 static int br_nf_check_hbh_len(struct sk_buff *skb)
 51 {
 52         unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
 53         u32 pkt_len;
 54         const unsigned char *nh = skb_network_header(skb);
 55         int off = raw - nh;
 56         int len = (raw[1] + 1) << 3;
 57 
 58         if ((raw + len) - skb->data > skb_headlen(skb))
 59                 goto bad;
 60 
 61         off += 2;
 62         len -= 2;
 63 
 64         while (len > 0) {
 65                 int optlen = nh[off + 1] + 2;
 66 
 67                 switch (nh[off]) {
 68                 case IPV6_TLV_PAD1:
 69                         optlen = 1;
 70                         break;
 71 
 72                 case IPV6_TLV_PADN:
 73                         break;
 74 
 75                 case IPV6_TLV_JUMBO:
 76                         if (nh[off + 1] != 4 || (off & 3) != 2)
 77                                 goto bad;
 78                         pkt_len = ntohl(*(__be32 *)(nh + off + 2));
 79                         if (pkt_len <= IPV6_MAXPLEN ||
 80                             ipv6_hdr(skb)->payload_len)
 81                                 goto bad;
 82                         if (pkt_len > skb->len - sizeof(struct ipv6hdr))
 83                                 goto bad;
 84                         if (pskb_trim_rcsum(skb,
 85                                             pkt_len + sizeof(struct ipv6hdr)))
 86                                 goto bad;
 87                         nh = skb_network_header(skb);
 88                         break;
 89                 default:
 90                         if (optlen > len)
 91                                 goto bad;
 92                         break;
 93                 }
 94                 off += optlen;
 95                 len -= optlen;
 96         }
 97         if (len == 0)
 98                 return 0;
 99 bad:
100         return -1;
101 }
102 
103 int br_validate_ipv6(struct net *net, struct sk_buff *skb)
104 {
105         const struct ipv6hdr *hdr;
106         struct inet6_dev *idev = __in6_dev_get(skb->dev);
107         u32 pkt_len;
108         u8 ip6h_len = sizeof(struct ipv6hdr);
109 
110         if (!pskb_may_pull(skb, ip6h_len))
111                 goto inhdr_error;
112 
113         if (skb->len < ip6h_len)
114                 goto drop;
115 
116         hdr = ipv6_hdr(skb);
117 
118         if (hdr->version != 6)
119                 goto inhdr_error;
120 
121         pkt_len = ntohs(hdr->payload_len);
122 
123         if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
124                 if (pkt_len + ip6h_len > skb->len) {
125                         __IP6_INC_STATS(net, idev,
126                                         IPSTATS_MIB_INTRUNCATEDPKTS);
127                         goto drop;
128                 }
129                 if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
130                         __IP6_INC_STATS(net, idev,
131                                         IPSTATS_MIB_INDISCARDS);
132                         goto drop;
133                 }
134         }
135         if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb))
136                 goto drop;
137 
138         memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
139         /* No IP options in IPv6 header; however it should be
140          * checked if some next headers need special treatment
141          */
142         return 0;
143 
144 inhdr_error:
145         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
146 drop:
147         return -1;
148 }
149 
150 static inline bool
151 br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
152                              const struct nf_bridge_info *nf_bridge)
153 {
154         return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
155                       sizeof(ipv6_hdr(skb)->daddr)) != 0;
156 }
157 
158 /* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
159  * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
160  * for br_nf_pre_routing_finish(), same logic is used here but
161  * equivalent IPv6 function ip6_route_input() called indirectly.
162  */
163 static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb)
164 {
165         struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
166         struct rtable *rt;
167         struct net_device *dev = skb->dev;
168         const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
169 
170         nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
171 
172         if (nf_bridge->pkt_otherhost) {
173                 skb->pkt_type = PACKET_OTHERHOST;
174                 nf_bridge->pkt_otherhost = false;
175         }
176         nf_bridge->in_prerouting = 0;
177         if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
178                 skb_dst_drop(skb);
179                 v6ops->route_input(skb);
180 
181                 if (skb_dst(skb)->error) {
182                         kfree_skb(skb);
183                         return 0;
184                 }
185 
186                 if (skb_dst(skb)->dev == dev) {
187                         skb->dev = nf_bridge->physindev;
188                         nf_bridge_update_protocol(skb);
189                         nf_bridge_push_encap_header(skb);
190                         br_nf_hook_thresh(NF_BR_PRE_ROUTING,
191                                           net, sk, skb, skb->dev, NULL,
192                                           br_nf_pre_routing_finish_bridge);
193                         return 0;
194                 }
195                 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
196                 skb->pkt_type = PACKET_HOST;
197         } else {
198                 rt = bridge_parent_rtable(nf_bridge->physindev);
199                 if (!rt) {
200                         kfree_skb(skb);
201                         return 0;
202                 }
203                 skb_dst_set_noref(skb, &rt->dst);
204         }
205 
206         skb->dev = nf_bridge->physindev;
207         nf_bridge_update_protocol(skb);
208         nf_bridge_push_encap_header(skb);
209         br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb,
210                           skb->dev, NULL, br_handle_frame_finish);
211 
212         return 0;
213 }
214 
215 /* Replicate the checks that IPv6 does on packet reception and pass the packet
216  * to ip6tables.
217  */
218 unsigned int br_nf_pre_routing_ipv6(void *priv,
219                                     struct sk_buff *skb,
220                                     const struct nf_hook_state *state)
221 {
222         struct nf_bridge_info *nf_bridge;
223 
224         if (br_validate_ipv6(state->net, skb))
225                 return NF_DROP;
226 
227         nf_bridge_put(skb->nf_bridge);
228         if (!nf_bridge_alloc(skb))
229                 return NF_DROP;
230         if (!setup_pre_routing(skb))
231                 return NF_DROP;
232 
233         nf_bridge = nf_bridge_info_get(skb);
234         nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
235 
236         skb->protocol = htons(ETH_P_IPV6);
237         NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
238                 skb->dev, NULL,
239                 br_nf_pre_routing_finish_ipv6);
240 
241         return NF_STOLEN;
242 }
243 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp