]> bbs.cooldavid.org Git - net-next-2.6.git/blame - net/bridge/br_netfilter.c
git://bbs.cooldavid.org / net-next-2.6.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[GENL]: Provide more information to userspace about registered genl families
[net-next-2.6.git] / net / bridge / br_netfilter.c
CommitLineData
1da177e4
LT		 1/*
2 * Handle firewalling
3 * Linux ethernet bridge
4 *
5 * Authors:
6 * Lennert Buytenhek <buytenh@gnu.org>
7 * Bart De Schuymer (maintainer) <bdschuym@pandora.be>
8 *
9 * Changes:
10 * Apr 29 2003: physdev module support (bdschuym)
11 * Jun 19 2003: let arptables see bridged ARP traffic (bdschuym)
12 * Oct 06 2003: filter encapsulated IP/ARP VLAN traffic on untagged bridge
13 * (bdschuym)
14 * Sep 01 2004: add IPv6 filtering (bdschuym)
15 *
16 * This program is free software; you can redistribute it and/or
17 * modify it under the terms of the GNU General Public License
18 * as published by the Free Software Foundation; either version
19 * 2 of the License, or (at your option) any later version.
20 *
21 * Lennert dedicates this file to Kerstin Wurdinger.
22 */
23
24#include <linux/module.h>
25#include <linux/kernel.h>
26#include <linux/ip.h>
27#include <linux/netdevice.h>
28#include <linux/skbuff.h>
14c85021 29#include <linux/if_arp.h>
1da177e4
LT		 30#include <linux/if_ether.h>
31#include <linux/if_vlan.h>
32#include <linux/netfilter_bridge.h>
33#include <linux/netfilter_ipv4.h>
34#include <linux/netfilter_ipv6.h>
35#include <linux/netfilter_arp.h>
36#include <linux/in_route.h>
14c85021 37
1da177e4
LT		 38#include <net/ip.h>
39#include <net/ipv6.h>
14c85021
ACM		 40#include <net/route.h>
41
1da177e4
LT		 42#include <asm/uaccess.h>
43#include <asm/checksum.h>
44#include "br_private.h"
45#ifdef CONFIG_SYSCTL
46#include <linux/sysctl.h>
47#endif
48
49#define skb_origaddr(skb) (((struct bridge_skb_cb *) \
50 (skb->nf_bridge->data))->daddr.ipv4)
51#define store_orig_dstaddr(skb) (skb_origaddr(skb) = (skb)->nh.iph->daddr)
52#define dnat_took_place(skb) (skb_origaddr(skb) != (skb)->nh.iph->daddr)
53
1da177e4
LT		 54#ifdef CONFIG_SYSCTL
55static struct ctl_table_header *brnf_sysctl_header;
56static int brnf_call_iptables = 1;
57static int brnf_call_ip6tables = 1;
58static int brnf_call_arptables = 1;
59static int brnf_filter_vlan_tagged = 1;
60#else
61#define brnf_filter_vlan_tagged 1
62#endif
63
10ea6ac8
PM		 64int brnf_deferred_hooks;
65EXPORT_SYMBOL_GPL(brnf_deferred_hooks);
66
8b42ec39
SH		 67static __be16 inline vlan_proto(const struct sk_buff *skb)
68{
69 return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
70}
71
72#define IS_VLAN_IP(skb) \
73 (skb->protocol == htons(ETH_P_8021Q) && \
74 vlan_proto(skb) == htons(ETH_P_IP) && \
75 brnf_filter_vlan_tagged)
76
77#define IS_VLAN_IPV6(skb) \
78 (skb->protocol == htons(ETH_P_8021Q) && \
79 vlan_proto(skb) == htons(ETH_P_IPV6) &&\
80 brnf_filter_vlan_tagged)
81
82#define IS_VLAN_ARP(skb) \
83 (skb->protocol == htons(ETH_P_8021Q) && \
84 vlan_proto(skb) == htons(ETH_P_ARP) && \
85 brnf_filter_vlan_tagged)
1da177e4
LT		 86
87/* We need these fake structures to make netfilter happy --
88 * lots of places assume that skb->dst != NULL, which isn't
89 * all that unreasonable.
90 *
91 * Currently, we fill in the PMTU entry because netfilter
92 * refragmentation needs it, and the rt_flags entry because
93 * ipt_REJECT needs it. Future netfilter modules might
94 * require us to fill additional fields. */
95static struct net_device __fake_net_device = {
96 .hard_header_len = ETH_HLEN
97};
98
99static struct rtable __fake_rtable = {
100 .u = {
101 .dst = {
102 .__refcnt = ATOMIC_INIT(1),
103 .dev = &__fake_net_device,
104 .path = &__fake_rtable.u.dst,
105 .metrics = {[RTAX_MTU - 1] = 1500},
42cf93cd 106 .flags = DST_NOXFRM,
1da177e4
LT		 107 }
108 },
109 .rt_flags = 0,
110};
111
5dce971a
SH		 112static inline struct net_device *bridge_parent(const struct net_device *dev)
113{
114 struct net_bridge_port *port = rcu_dereference(dev->br_port);
115
116 return port ? port->br->dev : NULL;
117}
1da177e4 118
fdeabdef
SH		 119static inline struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
120{
121 skb->nf_bridge = kzalloc(sizeof(struct nf_bridge_info), GFP_ATOMIC);
122 if (likely(skb->nf_bridge))
123 atomic_set(&(skb->nf_bridge->use), 1);
124
125 return skb->nf_bridge;
126}
127
128static inline void nf_bridge_save_header(struct sk_buff *skb)
129{
07317621 130 int header_size = ETH_HLEN;
fdeabdef
SH		 131
132 if (skb->protocol == htons(ETH_P_8021Q))
07317621 133 header_size += VLAN_HLEN;
fdeabdef
SH		 134
135 memcpy(skb->nf_bridge->data, skb->data - header_size, header_size);
136}
137
07317621
SH		 138/*
139 * When forwarding bridge frames, we save a copy of the original
140 * header before processing.
141 */
142int nf_bridge_copy_header(struct sk_buff *skb)
143{
144 int err;
145 int header_size = ETH_HLEN;
146
147 if (skb->protocol == htons(ETH_P_8021Q))
148 header_size += VLAN_HLEN;
149
150 err = skb_cow(skb, header_size);
151 if (err)
152 return err;
153
154 memcpy(skb->data - header_size, skb->nf_bridge->data, header_size);
155
156 if (skb->protocol == htons(ETH_P_8021Q))
157 __skb_push(skb, VLAN_HLEN);
158 return 0;
159}
160
1da177e4
LT		 161/* PF_BRIDGE/PRE_ROUTING *********************************************/
162/* Undo the changes made for ip6tables PREROUTING and continue the
163 * bridge PRE_ROUTING hook. */
164static int br_nf_pre_routing_finish_ipv6(struct sk_buff *skb)
165{
166 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
167
1da177e4
LT		 168 if (nf_bridge->mask & BRNF_PKT_TYPE) {
169 skb->pkt_type = PACKET_OTHERHOST;
170 nf_bridge->mask ^= BRNF_PKT_TYPE;
171 }
172 nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
173
174 skb->dst = (struct dst_entry *)&__fake_rtable;
175 dst_hold(skb->dst);
176
177 skb->dev = nf_bridge->physindev;
f8a26028 178 if (skb->protocol == htons(ETH_P_8021Q)) {
1da177e4
LT		 179 skb_push(skb, VLAN_HLEN);
180 skb->nh.raw -= VLAN_HLEN;
181 }
182 NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
183 br_handle_frame_finish, 1);
184
185 return 0;
186}
187
188static void __br_dnat_complain(void)
189{
190 static unsigned long last_complaint;
191
192 if (jiffies - last_complaint >= 5 * HZ) {
193 printk(KERN_WARNING "Performing cross-bridge DNAT requires IP "
789bc3e5 194 "forwarding to be enabled\n");
1da177e4
LT		 195 last_complaint = jiffies;
196 }
197}
198
199/* This requires some explaining. If DNAT has taken place,
200 * we will need to fix up the destination Ethernet address,
201 * and this is a tricky process.
202 *
203 * There are two cases to consider:
204 * 1. The packet was DNAT'ed to a device in the same bridge
205 * port group as it was received on. We can still bridge
206 * the packet.
207 * 2. The packet was DNAT'ed to a different device, either
208 * a non-bridged device or another bridge port group.
209 * The packet will need to be routed.
210 *
211 * The correct way of distinguishing between these two cases is to
212 * call ip_route_input() and to look at skb->dst->dev, which is
213 * changed to the destination device if ip_route_input() succeeds.
214 *
215 * Let us first consider the case that ip_route_input() succeeds:
216 *
217 * If skb->dst->dev equals the logical bridge device the packet
218 * came in on, we can consider this bridging. We then call
219 * skb->dst->output() which will make the packet enter br_nf_local_out()
220 * not much later. In that function it is assured that the iptables
221 * FORWARD chain is traversed for the packet.
222 *
223 * Otherwise, the packet is considered to be routed and we just
224 * change the destination MAC address so that the packet will
225 * later be passed up to the IP stack to be routed.
226 *
227 * Let us now consider the case that ip_route_input() fails:
228 *
229 * After a "echo '0' > /proc/sys/net/ipv4/ip_forward" ip_route_input()
230 * will fail, while __ip_route_output_key() will return success. The source
231 * address for __ip_route_output_key() is set to zero, so __ip_route_output_key
232 * thinks we're handling a locally generated packet and won't care
233 * if IP forwarding is allowed. We send a warning message to the users's
234 * log telling her to put IP forwarding on.
235 *
236 * ip_route_input() will also fail if there is no route available.
237 * In that case we just drop the packet.
238 *
239 * --Lennert, 20020411
240 * --Bart, 20020416 (updated)
241 * --Bart, 20021007 (updated) */
242static int br_nf_pre_routing_finish_bridge(struct sk_buff *skb)
243{
1da177e4
LT		 244 if (skb->pkt_type == PACKET_OTHERHOST) {
245 skb->pkt_type = PACKET_HOST;
246 skb->nf_bridge->mask |= BRNF_PKT_TYPE;
247 }
248 skb->nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
249
250 skb->dev = bridge_parent(skb->dev);
5dce971a
SH		 251 if (!skb->dev)
252 kfree_skb(skb);
253 else {
f8a26028 254 if (skb->protocol == htons(ETH_P_8021Q)) {
5dce971a
SH		 255 skb_pull(skb, VLAN_HLEN);
256 skb->nh.raw += VLAN_HLEN;
257 }
258 skb->dst->output(skb);
1da177e4 259 }
1da177e4
LT		 260 return 0;
261}
262
263static int br_nf_pre_routing_finish(struct sk_buff *skb)
264{
265 struct net_device *dev = skb->dev;
266 struct iphdr *iph = skb->nh.iph;
267 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
268
1da177e4
LT		 269 if (nf_bridge->mask & BRNF_PKT_TYPE) {
270 skb->pkt_type = PACKET_OTHERHOST;
271 nf_bridge->mask ^= BRNF_PKT_TYPE;
272 }
273 nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
274
275 if (dnat_took_place(skb)) {
789bc3e5 276 if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev)) {
1da177e4 277 struct rtable *rt;
789bc3e5
SH		 278 struct flowi fl = {
279 .nl_u = {
280 .ip4_u = {
281 .daddr = iph->daddr,
282 .saddr = 0,
283 .tos = RT_TOS(iph->tos) },
284 },
285 .proto = 0,
286 };
1da177e4
LT		 287
288 if (!ip_route_output_key(&rt, &fl)) {
1c011bed
BDS		 289 /* - Bridged-and-DNAT'ed traffic doesn't
290 * require ip_forwarding.
291 * - Deal with redirected traffic. */
292 if (((struct dst_entry *)rt)->dev == dev ||
293 rt->rt_type == RTN_LOCAL) {
1da177e4
LT		 294 skb->dst = (struct dst_entry *)rt;
295 goto bridged_dnat;
296 }
297 __br_dnat_complain();
298 dst_release((struct dst_entry *)rt);
299 }
300 kfree_skb(skb);
301 return 0;
302 } else {
303 if (skb->dst->dev == dev) {
304bridged_dnat:
305 /* Tell br_nf_local_out this is a
306 * bridged frame */
307 nf_bridge->mask |= BRNF_BRIDGED_DNAT;
308 skb->dev = nf_bridge->physindev;
309 if (skb->protocol ==
f8a26028 310 htons(ETH_P_8021Q)) {
1da177e4
LT		 311 skb_push(skb, VLAN_HLEN);
312 skb->nh.raw -= VLAN_HLEN;
313 }
314 NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING,
315 skb, skb->dev, NULL,
316 br_nf_pre_routing_finish_bridge,
317 1);
318 return 0;
319 }
789bc3e5 320 memcpy(eth_hdr(skb)->h_dest, dev->dev_addr, ETH_ALEN);
1da177e4
LT		 321 skb->pkt_type = PACKET_HOST;
322 }
323 } else {
324 skb->dst = (struct dst_entry *)&__fake_rtable;
325 dst_hold(skb->dst);
326 }
327
328 skb->dev = nf_bridge->physindev;
f8a26028 329 if (skb->protocol == htons(ETH_P_8021Q)) {
1da177e4
LT		 330 skb_push(skb, VLAN_HLEN);
331 skb->nh.raw -= VLAN_HLEN;
332 }
333 NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
334 br_handle_frame_finish, 1);
335
336 return 0;
337}
338
339/* Some common code for IPv4/IPv6 */
5dce971a 340static struct net_device *setup_pre_routing(struct sk_buff *skb)
1da177e4
LT		 341{
342 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
343
344 if (skb->pkt_type == PACKET_OTHERHOST) {
345 skb->pkt_type = PACKET_HOST;
346 nf_bridge->mask |= BRNF_PKT_TYPE;
347 }
348
349 nf_bridge->mask |= BRNF_NF_BRIDGE_PREROUTING;
350 nf_bridge->physindev = skb->dev;
351 skb->dev = bridge_parent(skb->dev);
5dce971a
SH		 352
353 return skb->dev;
1da177e4
LT		 354}
355
356/* We only check the length. A bridge shouldn't do any hop-by-hop stuff anyway */
357static int check_hbh_len(struct sk_buff *skb)
358{
789bc3e5 359 unsigned char *raw = (u8 *) (skb->nh.ipv6h + 1);
1da177e4
LT		 360 u32 pkt_len;
361 int off = raw - skb->nh.raw;
789bc3e5 362 int len = (raw[1] + 1) << 3;
1da177e4
LT		 363
364 if ((raw + len) - skb->data > skb_headlen(skb))
365 goto bad;
366
367 off += 2;
368 len -= 2;
369
370 while (len > 0) {
789bc3e5 371 int optlen = skb->nh.raw[off + 1] + 2;
1da177e4
LT		 372
373 switch (skb->nh.raw[off]) {
374 case IPV6_TLV_PAD0:
375 optlen = 1;
376 break;
377
378 case IPV6_TLV_PADN:
379 break;
380
381 case IPV6_TLV_JUMBO:
789bc3e5 382 if (skb->nh.raw[off + 1] != 4 || (off & 3) != 2)
1da177e4 383 goto bad;
789bc3e5 384 pkt_len = ntohl(*(u32 *) (skb->nh.raw + off + 2));
b0366486
BDS		 385 if (pkt_len <= IPV6_MAXPLEN ||
386 skb->nh.ipv6h->payload_len)
387 goto bad;
1da177e4
LT		 388 if (pkt_len > skb->len - sizeof(struct ipv6hdr))
389 goto bad;
b0366486 390 if (pskb_trim_rcsum(skb,
789bc3e5 391 pkt_len + sizeof(struct ipv6hdr)))
b0366486 392 goto bad;
1da177e4
LT		 393 break;
394 default:
395 if (optlen > len)
396 goto bad;
397 break;
398 }
399 off += optlen;
400 len -= optlen;
401 }
402 if (len == 0)
403 return 0;
404bad:
405 return -1;
406
407}
408
409/* Replicate the checks that IPv6 does on packet reception and pass the packet
410 * to ip6tables, which doesn't support NAT, so things are fairly simple. */
411static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
789bc3e5
SH		 412 struct sk_buff *skb,
413 const struct net_device *in,
414 const struct net_device *out,
415 int (*okfn)(struct sk_buff *))
1da177e4
LT		 416{
417 struct ipv6hdr *hdr;
418 u32 pkt_len;
1da177e4
LT		 419
420 if (skb->len < sizeof(struct ipv6hdr))
421 goto inhdr_error;
422
423 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
424 goto inhdr_error;
425
426 hdr = skb->nh.ipv6h;
427
428 if (hdr->version != 6)
429 goto inhdr_error;
430
431 pkt_len = ntohs(hdr->payload_len);
432
433 if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
434 if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
435 goto inhdr_error;
b38dfee3
HX		 436 if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
437 goto inhdr_error;
1da177e4
LT		 438 }
439 if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb))
789bc3e5 440 goto inhdr_error;
1da177e4 441
789bc3e5 442 nf_bridge_put(skb->nf_bridge);
fdeabdef 443 if (!nf_bridge_alloc(skb))
1da177e4 444 return NF_DROP;
5dce971a
SH		 445 if (!setup_pre_routing(skb))
446 return NF_DROP;
1da177e4
LT		 447
448 NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL,
449 br_nf_pre_routing_finish_ipv6);
450
451 return NF_STOLEN;
452
453inhdr_error:
454 return NF_DROP;
455}
456
457/* Direct IPv6 traffic to br_nf_pre_routing_ipv6.
458 * Replicate the checks that IPv4 does on packet reception.
459 * Set skb->dev to the bridge device (i.e. parent of the
460 * receiving device) to make netfilter happy, the REDIRECT
461 * target in particular. Save the original destination IP
462 * address to be able to detect DNAT afterwards. */
463static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
ee02b3a6
SH		 464 const struct net_device *in,
465 const struct net_device *out,
466 int (*okfn)(struct sk_buff *))
1da177e4
LT		 467{
468 struct iphdr *iph;
469 __u32 len;
470 struct sk_buff *skb = *pskb;
1da177e4 471
8b42ec39 472 if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb)) {
1da177e4
LT		 473#ifdef CONFIG_SYSCTL
474 if (!brnf_call_ip6tables)
475 return NF_ACCEPT;
476#endif
477 if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
478 goto out;
479
f8a26028 480 if (skb->protocol == htons(ETH_P_8021Q)) {
cbb042f9 481 skb_pull_rcsum(skb, VLAN_HLEN);
ee02b3a6 482 skb->nh.raw += VLAN_HLEN;
1da177e4
LT		 483 }
484 return br_nf_pre_routing_ipv6(hook, skb, in, out, okfn);
485 }
486#ifdef CONFIG_SYSCTL
487 if (!brnf_call_iptables)
488 return NF_ACCEPT;
489#endif
490
8b42ec39 491 if (skb->protocol != htons(ETH_P_IP) && !IS_VLAN_IP(skb))
1da177e4
LT		 492 return NF_ACCEPT;
493
494 if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
495 goto out;
496
f8a26028 497 if (skb->protocol == htons(ETH_P_8021Q)) {
cbb042f9 498 skb_pull_rcsum(skb, VLAN_HLEN);
ee02b3a6 499 skb->nh.raw += VLAN_HLEN;
1da177e4
LT		 500 }
501
502 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
503 goto inhdr_error;
504
505 iph = skb->nh.iph;
506 if (iph->ihl < 5 || iph->version != 4)
507 goto inhdr_error;
508
789bc3e5 509 if (!pskb_may_pull(skb, 4 * iph->ihl))
1da177e4
LT		 510 goto inhdr_error;
511
512 iph = skb->nh.iph;
789bc3e5 513 if (ip_fast_csum((__u8 *) iph, iph->ihl) != 0)
1da177e4
LT		 514 goto inhdr_error;
515
516 len = ntohs(iph->tot_len);
789bc3e5 517 if (skb->len < len || len < 4 * iph->ihl)
1da177e4
LT		 518 goto inhdr_error;
519
b38dfee3 520 pskb_trim_rcsum(skb, len);
1da177e4 521
789bc3e5 522 nf_bridge_put(skb->nf_bridge);
fdeabdef 523 if (!nf_bridge_alloc(skb))
1da177e4 524 return NF_DROP;
5dce971a
SH		 525 if (!setup_pre_routing(skb))
526 return NF_DROP;
1da177e4
LT		 527 store_orig_dstaddr(skb);
528
529 NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL,
530 br_nf_pre_routing_finish);
531
532 return NF_STOLEN;
533
534inhdr_error:
789bc3e5 535// IP_INC_STATS_BH(IpInHdrErrors);
1da177e4
LT		 536out:
537 return NF_DROP;
538}
539
540
541/* PF_BRIDGE/LOCAL_IN ************************************************/
542/* The packet is locally destined, which requires a real
543 * dst_entry, so detach the fake one. On the way up, the
544 * packet would pass through PRE_ROUTING again (which already
545 * took place when the packet entered the bridge), but we
546 * register an IPv4 PRE_ROUTING 'sabotage' hook that will
547 * prevent this from happening. */
548static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff **pskb,
789bc3e5
SH		 549 const struct net_device *in,
550 const struct net_device *out,
551 int (*okfn)(struct sk_buff *))
1da177e4
LT		 552{
553 struct sk_buff *skb = *pskb;
554
555 if (skb->dst == (struct dst_entry *)&__fake_rtable) {
556 dst_release(skb->dst);
557 skb->dst = NULL;
558 }
559
560 return NF_ACCEPT;
561}
562
1da177e4
LT		 563/* PF_BRIDGE/FORWARD *************************************************/
564static int br_nf_forward_finish(struct sk_buff *skb)
565{
566 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
567 struct net_device *in;
1da177e4 568
8b42ec39 569 if (skb->protocol != htons(ETH_P_ARP) && !IS_VLAN_ARP(skb)) {
1da177e4
LT		 570 in = nf_bridge->physindev;
571 if (nf_bridge->mask & BRNF_PKT_TYPE) {
572 skb->pkt_type = PACKET_OTHERHOST;
573 nf_bridge->mask ^= BRNF_PKT_TYPE;
574 }
575 } else {
576 in = *((struct net_device **)(skb->cb));
577 }
f8a26028 578 if (skb->protocol == htons(ETH_P_8021Q)) {
1da177e4
LT		 579 skb_push(skb, VLAN_HLEN);
580 skb->nh.raw -= VLAN_HLEN;
581 }
582 NF_HOOK_THRESH(PF_BRIDGE, NF_BR_FORWARD, skb, in,
789bc3e5 583 skb->dev, br_forward_finish, 1);
1da177e4
LT		 584 return 0;
585}
586
587/* This is the 'purely bridged' case. For IP, we pass the packet to
588 * netfilter with indev and outdev set to the bridge device,
589 * but we are still able to filter on the 'real' indev/outdev
590 * because of the physdev module. For ARP, indev and outdev are the
591 * bridge ports. */
592static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff **pskb,
789bc3e5
SH		 593 const struct net_device *in,
594 const struct net_device *out,
595 int (*okfn)(struct sk_buff *))
1da177e4
LT		 596{
597 struct sk_buff *skb = *pskb;
598 struct nf_bridge_info *nf_bridge;
5dce971a 599 struct net_device *parent;
1da177e4
LT		 600 int pf;
601
602 if (!skb->nf_bridge)
603 return NF_ACCEPT;
604
5dce971a
SH		 605 parent = bridge_parent(out);
606 if (!parent)
607 return NF_DROP;
608
8b42ec39 609 if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb))
1da177e4
LT		 610 pf = PF_INET;
611 else
612 pf = PF_INET6;
613
f8a26028 614 if (skb->protocol == htons(ETH_P_8021Q)) {
1da177e4
LT		 615 skb_pull(*pskb, VLAN_HLEN);
616 (*pskb)->nh.raw += VLAN_HLEN;
617 }
618
1da177e4
LT		 619 nf_bridge = skb->nf_bridge;
620 if (skb->pkt_type == PACKET_OTHERHOST) {
621 skb->pkt_type = PACKET_HOST;
622 nf_bridge->mask |= BRNF_PKT_TYPE;
623 }
624
625 /* The physdev module checks on this */
626 nf_bridge->mask |= BRNF_BRIDGED;
627 nf_bridge->physoutdev = skb->dev;
628
5dce971a
SH		 629 NF_HOOK(pf, NF_IP_FORWARD, skb, bridge_parent(in), parent,
630 br_nf_forward_finish);
1da177e4
LT		 631
632 return NF_STOLEN;
633}
634
635static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff **pskb,
789bc3e5
SH		 636 const struct net_device *in,
637 const struct net_device *out,
638 int (*okfn)(struct sk_buff *))
1da177e4
LT		 639{
640 struct sk_buff *skb = *pskb;
1da177e4
LT		 641 struct net_device **d = (struct net_device **)(skb->cb);
642
643#ifdef CONFIG_SYSCTL
644 if (!brnf_call_arptables)
645 return NF_ACCEPT;
646#endif
647
f8a26028 648 if (skb->protocol != htons(ETH_P_ARP)) {
8b42ec39 649 if (!IS_VLAN_ARP(skb))
1da177e4
LT		 650 return NF_ACCEPT;
651 skb_pull(*pskb, VLAN_HLEN);
652 (*pskb)->nh.raw += VLAN_HLEN;
653 }
654
1da177e4 655 if (skb->nh.arph->ar_pln != 4) {
8b42ec39 656 if (IS_VLAN_ARP(skb)) {
1da177e4
LT		 657 skb_push(*pskb, VLAN_HLEN);
658 (*pskb)->nh.raw -= VLAN_HLEN;
659 }
660 return NF_ACCEPT;
661 }
662 *d = (struct net_device *)in;
663 NF_HOOK(NF_ARP, NF_ARP_FORWARD, skb, (struct net_device *)in,
664 (struct net_device *)out, br_nf_forward_finish);
665
666 return NF_STOLEN;
667}
668
1da177e4
LT		 669/* PF_BRIDGE/LOCAL_OUT ***********************************************/
670static int br_nf_local_out_finish(struct sk_buff *skb)
671{
f8a26028 672 if (skb->protocol == htons(ETH_P_8021Q)) {
1da177e4
LT		 673 skb_push(skb, VLAN_HLEN);
674 skb->nh.raw -= VLAN_HLEN;
675 }
676
677 NF_HOOK_THRESH(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
789bc3e5 678 br_forward_finish, NF_BR_PRI_FIRST + 1);
1da177e4
LT		 679
680 return 0;
681}
682
683/* This function sees both locally originated IP packets and forwarded
684 * IP packets (in both cases the destination device is a bridge
685 * device). It also sees bridged-and-DNAT'ed packets.
686 * To be able to filter on the physical bridge devices (with the physdev
687 * module), we steal packets destined to a bridge device away from the
688 * PF_INET/FORWARD and PF_INET/OUTPUT hook functions, and give them back later,
689 * when we have determined the real output device. This is done in here.
690 *
691 * If (nf_bridge->mask & BRNF_BRIDGED_DNAT) then the packet is bridged
692 * and we fake the PF_BRIDGE/FORWARD hook. The function br_nf_forward()
693 * will then fake the PF_INET/FORWARD hook. br_nf_local_out() has priority
694 * NF_BR_PRI_FIRST, so no relevant PF_BRIDGE/INPUT functions have been nor
695 * will be executed.
696 * Otherwise, if nf_bridge->physindev is NULL, the bridge-nf code never touched
697 * this packet before, and so the packet was locally originated. We fake
698 * the PF_INET/LOCAL_OUT hook.
699 * Finally, if nf_bridge->physindev isn't NULL, then the packet was IP routed,
700 * so we fake the PF_INET/FORWARD hook. ip_sabotage_out() makes sure
701 * even routed packets that didn't arrive on a bridge interface have their
702 * nf_bridge->physindev set. */
703static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff **pskb,
789bc3e5
SH		 704 const struct net_device *in,
705 const struct net_device *out,
706 int (*okfn)(struct sk_buff *))
1da177e4
LT		 707{
708 struct net_device *realindev, *realoutdev;
709 struct sk_buff *skb = *pskb;
710 struct nf_bridge_info *nf_bridge;
1da177e4
LT		 711 int pf;
712
713 if (!skb->nf_bridge)
714 return NF_ACCEPT;
715
8b42ec39 716 if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb))
1da177e4
LT		 717 pf = PF_INET;
718 else
719 pf = PF_INET6;
720
1da177e4
LT		 721 nf_bridge = skb->nf_bridge;
722 nf_bridge->physoutdev = skb->dev;
723 realindev = nf_bridge->physindev;
724
725 /* Bridged, take PF_BRIDGE/FORWARD.
726 * (see big note in front of br_nf_pre_routing_finish) */
727 if (nf_bridge->mask & BRNF_BRIDGED_DNAT) {
728 if (nf_bridge->mask & BRNF_PKT_TYPE) {
729 skb->pkt_type = PACKET_OTHERHOST;
730 nf_bridge->mask ^= BRNF_PKT_TYPE;
731 }
f8a26028 732 if (skb->protocol == htons(ETH_P_8021Q)) {
1da177e4
LT		 733 skb_push(skb, VLAN_HLEN);
734 skb->nh.raw -= VLAN_HLEN;
735 }
736
737 NF_HOOK(PF_BRIDGE, NF_BR_FORWARD, skb, realindev,
738 skb->dev, br_forward_finish);
739 goto out;
740 }
741 realoutdev = bridge_parent(skb->dev);
5dce971a
SH		 742 if (!realoutdev)
743 return NF_DROP;
1da177e4
LT		 744
745#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
746 /* iptables should match -o br0.x */
747 if (nf_bridge->netoutdev)
748 realoutdev = nf_bridge->netoutdev;
749#endif
f8a26028 750 if (skb->protocol == htons(ETH_P_8021Q)) {
1da177e4
LT		 751 skb_pull(skb, VLAN_HLEN);
752 (*pskb)->nh.raw += VLAN_HLEN;
753 }
754 /* IP forwarded traffic has a physindev, locally
755 * generated traffic hasn't. */
756 if (realindev != NULL) {
789bc3e5 757 if (!(nf_bridge->mask & BRNF_DONT_TAKE_PARENT)) {
5dce971a
SH		 758 struct net_device *parent = bridge_parent(realindev);
759 if (parent)
760 realindev = parent;
761 }
1da177e4
LT		 762
763 NF_HOOK_THRESH(pf, NF_IP_FORWARD, skb, realindev,
764 realoutdev, br_nf_local_out_finish,
765 NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD + 1);
766 } else {
1da177e4
LT		 767 NF_HOOK_THRESH(pf, NF_IP_LOCAL_OUT, skb, realindev,
768 realoutdev, br_nf_local_out_finish,
769 NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT + 1);
770 }
771
772out:
773 return NF_STOLEN;
774}
775
2e2f7aef
PM		 776static int br_nf_dev_queue_xmit(struct sk_buff *skb)
777{
778 if (skb->protocol == htons(ETH_P_IP) &&
779 skb->len > skb->dev->mtu &&
89114afd 780 !skb_is_gso(skb))
2e2f7aef
PM		 781 return ip_fragment(skb, br_dev_queue_push_xmit);
782 else
783 return br_dev_queue_push_xmit(skb);
784}
1da177e4
LT		 785
786/* PF_BRIDGE/POST_ROUTING ********************************************/
787static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
789bc3e5
SH		 788 const struct net_device *in,
789 const struct net_device *out,
790 int (*okfn)(struct sk_buff *))
1da177e4
LT		 791{
792 struct sk_buff *skb = *pskb;
793 struct nf_bridge_info *nf_bridge = (*pskb)->nf_bridge;
1da177e4
LT		 794 struct net_device *realoutdev = bridge_parent(skb->dev);
795 int pf;
796
797#ifdef CONFIG_NETFILTER_DEBUG
798 /* Be very paranoid. This probably won't happen anymore, but let's
799 * keep the check just to be sure... */
800 if (skb->mac.raw < skb->head || skb->mac.raw + ETH_HLEN > skb->data) {
801 printk(KERN_CRIT "br_netfilter: Argh!! br_nf_post_routing: "
8394e9b2 802 "bad mac.raw pointer.\n");
1da177e4
LT		 803 goto print_error;
804 }
805#endif
806
807 if (!nf_bridge)
808 return NF_ACCEPT;
809
5dce971a
SH		 810 if (!realoutdev)
811 return NF_DROP;
812
8b42ec39 813 if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb))
1da177e4
LT		 814 pf = PF_INET;
815 else
816 pf = PF_INET6;
817
818#ifdef CONFIG_NETFILTER_DEBUG
819 if (skb->dst == NULL) {
8394e9b2 820 printk(KERN_INFO "br_netfilter post_routing: skb->dst == NULL\n");
1da177e4
LT		 821 goto print_error;
822 }
1da177e4
LT		 823#endif
824
825 /* We assume any code from br_dev_queue_push_xmit onwards doesn't care
826 * about the value of skb->pkt_type. */
827 if (skb->pkt_type == PACKET_OTHERHOST) {
828 skb->pkt_type = PACKET_HOST;
829 nf_bridge->mask |= BRNF_PKT_TYPE;
830 }
831
f8a26028 832 if (skb->protocol == htons(ETH_P_8021Q)) {
1da177e4
LT		 833 skb_pull(skb, VLAN_HLEN);
834 skb->nh.raw += VLAN_HLEN;
835 }
836
837 nf_bridge_save_header(skb);
838
839#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
840 if (nf_bridge->netoutdev)
841 realoutdev = nf_bridge->netoutdev;
842#endif
843 NF_HOOK(pf, NF_IP_POST_ROUTING, skb, NULL, realoutdev,
2e2f7aef 844 br_nf_dev_queue_xmit);
1da177e4
LT		 845
846 return NF_STOLEN;
847
848#ifdef CONFIG_NETFILTER_DEBUG
849print_error:
850 if (skb->dev != NULL) {
851 printk("[%s]", skb->dev->name);
178a3259
SH		 852 if (realoutdev)
853 printk("[%s]", realoutdev->name);
1da177e4
LT		 854 }
855 printk(" head:%p, raw:%p, data:%p\n", skb->head, skb->mac.raw,
789bc3e5 856 skb->data);
8394e9b2 857 dump_stack();
1da177e4
LT		 858 return NF_ACCEPT;
859#endif
860}
861
1da177e4
LT		 862/* IP/SABOTAGE *****************************************************/
863/* Don't hand locally destined packets to PF_INET(6)/PRE_ROUTING
864 * for the second time. */
865static unsigned int ip_sabotage_in(unsigned int hook, struct sk_buff **pskb,
789bc3e5
SH		 866 const struct net_device *in,
867 const struct net_device *out,
868 int (*okfn)(struct sk_buff *))
1da177e4
LT		 869{
870 if ((*pskb)->nf_bridge &&
871 !((*pskb)->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)) {
872 return NF_STOP;
873 }
874
875 return NF_ACCEPT;
876}
877
878/* Postpone execution of PF_INET(6)/FORWARD, PF_INET(6)/LOCAL_OUT
879 * and PF_INET(6)/POST_ROUTING until we have done the forwarding
880 * decision in the bridge code and have determined nf_bridge->physoutdev. */
881static unsigned int ip_sabotage_out(unsigned int hook, struct sk_buff **pskb,
789bc3e5
SH		 882 const struct net_device *in,
883 const struct net_device *out,
884 int (*okfn)(struct sk_buff *))
1da177e4
LT		 885{
886 struct sk_buff *skb = *pskb;
887
888 if ((out->hard_start_xmit == br_dev_xmit &&
789bc3e5 889 okfn != br_nf_forward_finish &&
2e2f7aef 890 okfn != br_nf_local_out_finish && okfn != br_nf_dev_queue_xmit)
1da177e4
LT		 891#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
892 || ((out->priv_flags & IFF_802_1Q_VLAN) &&
789bc3e5 893 VLAN_DEV_INFO(out)->real_dev->hard_start_xmit == br_dev_xmit)
1da177e4
LT		 894#endif
895 ) {
896 struct nf_bridge_info *nf_bridge;
897
898 if (!skb->nf_bridge) {
899#ifdef CONFIG_SYSCTL
900 /* This code is executed while in the IP(v6) stack,
901 the version should be 4 or 6. We can't use
902 skb->protocol because that isn't set on
903 PF_INET(6)/LOCAL_OUT. */
904 struct iphdr *ip = skb->nh.iph;
905
906 if (ip->version == 4 && !brnf_call_iptables)
907 return NF_ACCEPT;
908 else if (ip->version == 6 && !brnf_call_ip6tables)
909 return NF_ACCEPT;
10ea6ac8
PM		 910 else if (!brnf_deferred_hooks)
911 return NF_ACCEPT;
1da177e4
LT		 912#endif
913 if (hook == NF_IP_POST_ROUTING)
914 return NF_ACCEPT;
915 if (!nf_bridge_alloc(skb))
916 return NF_DROP;
917 }
918
919 nf_bridge = skb->nf_bridge;
920
921 /* This frame will arrive on PF_BRIDGE/LOCAL_OUT and we
922 * will need the indev then. For a brouter, the real indev
923 * can be a bridge port, so we make sure br_nf_local_out()
924 * doesn't use the bridge parent of the indev by using
925 * the BRNF_DONT_TAKE_PARENT mask. */
926 if (hook == NF_IP_FORWARD && nf_bridge->physindev == NULL) {
9666dae5 927 nf_bridge->mask |= BRNF_DONT_TAKE_PARENT;
1da177e4
LT		 928 nf_bridge->physindev = (struct net_device *)in;
929 }
930#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
931 /* the iptables outdev is br0.x, not br0 */
932 if (out->priv_flags & IFF_802_1Q_VLAN)
933 nf_bridge->netoutdev = (struct net_device *)out;
934#endif
935 return NF_STOP;
936 }
937
938 return NF_ACCEPT;
939}
940
941/* For br_nf_local_out we need (prio = NF_BR_PRI_FIRST), to insure that innocent
942 * PF_BRIDGE/NF_BR_LOCAL_OUT functions don't get bridged traffic as input.
943 * For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
944 * ip_refrag() can return NF_STOLEN. */
945static struct nf_hook_ops br_nf_ops[] = {
946 { .hook = br_nf_pre_routing,
947 .owner = THIS_MODULE,
948 .pf = PF_BRIDGE,
949 .hooknum = NF_BR_PRE_ROUTING,
950 .priority = NF_BR_PRI_BRNF, },
951 { .hook = br_nf_local_in,
952 .owner = THIS_MODULE,
953 .pf = PF_BRIDGE,
954 .hooknum = NF_BR_LOCAL_IN,
955 .priority = NF_BR_PRI_BRNF, },
956 { .hook = br_nf_forward_ip,
957 .owner = THIS_MODULE,
958 .pf = PF_BRIDGE,
959 .hooknum = NF_BR_FORWARD,
960 .priority = NF_BR_PRI_BRNF - 1, },
961 { .hook = br_nf_forward_arp,
962 .owner = THIS_MODULE,
963 .pf = PF_BRIDGE,
964 .hooknum = NF_BR_FORWARD,
965 .priority = NF_BR_PRI_BRNF, },
966 { .hook = br_nf_local_out,
967 .owner = THIS_MODULE,
968 .pf = PF_BRIDGE,
969 .hooknum = NF_BR_LOCAL_OUT,
970 .priority = NF_BR_PRI_FIRST, },
971 { .hook = br_nf_post_routing,
972 .owner = THIS_MODULE,
973 .pf = PF_BRIDGE,
974 .hooknum = NF_BR_POST_ROUTING,
975 .priority = NF_BR_PRI_LAST, },
976 { .hook = ip_sabotage_in,
977 .owner = THIS_MODULE,
978 .pf = PF_INET,
979 .hooknum = NF_IP_PRE_ROUTING,
980 .priority = NF_IP_PRI_FIRST, },
981 { .hook = ip_sabotage_in,
982 .owner = THIS_MODULE,
983 .pf = PF_INET6,
984 .hooknum = NF_IP6_PRE_ROUTING,
985 .priority = NF_IP6_PRI_FIRST, },
986 { .hook = ip_sabotage_out,
987 .owner = THIS_MODULE,
988 .pf = PF_INET,
989 .hooknum = NF_IP_FORWARD,
990 .priority = NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD, },
991 { .hook = ip_sabotage_out,
992 .owner = THIS_MODULE,
993 .pf = PF_INET6,
994 .hooknum = NF_IP6_FORWARD,
995 .priority = NF_IP6_PRI_BRIDGE_SABOTAGE_FORWARD, },
996 { .hook = ip_sabotage_out,
997 .owner = THIS_MODULE,
998 .pf = PF_INET,
999 .hooknum = NF_IP_LOCAL_OUT,
1000 .priority = NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT, },
1001 { .hook = ip_sabotage_out,
1002 .owner = THIS_MODULE,
1003 .pf = PF_INET6,
1004 .hooknum = NF_IP6_LOCAL_OUT,
1005 .priority = NF_IP6_PRI_BRIDGE_SABOTAGE_LOCAL_OUT, },
1006 { .hook = ip_sabotage_out,
1007 .owner = THIS_MODULE,
1008 .pf = PF_INET,
1009 .hooknum = NF_IP_POST_ROUTING,
1010 .priority = NF_IP_PRI_FIRST, },
1011 { .hook = ip_sabotage_out,
1012 .owner = THIS_MODULE,
1013 .pf = PF_INET6,
1014 .hooknum = NF_IP6_POST_ROUTING,
1015 .priority = NF_IP6_PRI_FIRST, },
1016};
1017
1018#ifdef CONFIG_SYSCTL
1019static
789bc3e5
SH		 1020int brnf_sysctl_call_tables(ctl_table * ctl, int write, struct file *filp,
1021 void __user * buffer, size_t * lenp, loff_t * ppos)
1da177e4
LT		 1022{
1023 int ret;
1024
1025 ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
1026
1027 if (write && *(int *)(ctl->data))
1028 *(int *)(ctl->data) = 1;
1029 return ret;
1030}
1031
1032static ctl_table brnf_table[] = {
1033 {
1034 .ctl_name = NET_BRIDGE_NF_CALL_ARPTABLES,
1035 .procname = "bridge-nf-call-arptables",
1036 .data = &brnf_call_arptables,
1037 .maxlen = sizeof(int),
1038 .mode = 0644,
1039 .proc_handler = &brnf_sysctl_call_tables,
1040 },
1041 {
1042 .ctl_name = NET_BRIDGE_NF_CALL_IPTABLES,
1043 .procname = "bridge-nf-call-iptables",
1044 .data = &brnf_call_iptables,
1045 .maxlen = sizeof(int),
1046 .mode = 0644,
1047 .proc_handler = &brnf_sysctl_call_tables,
1048 },
1049 {
1050 .ctl_name = NET_BRIDGE_NF_CALL_IP6TABLES,
1051 .procname = "bridge-nf-call-ip6tables",
1052 .data = &brnf_call_ip6tables,
1053 .maxlen = sizeof(int),
1054 .mode = 0644,
1055 .proc_handler = &brnf_sysctl_call_tables,
1056 },
1057 {
1058 .ctl_name = NET_BRIDGE_NF_FILTER_VLAN_TAGGED,
1059 .procname = "bridge-nf-filter-vlan-tagged",
1060 .data = &brnf_filter_vlan_tagged,
1061 .maxlen = sizeof(int),
1062 .mode = 0644,
1063 .proc_handler = &brnf_sysctl_call_tables,
1064 },
1065 { .ctl_name = 0 }
1066};
1067
1068static ctl_table brnf_bridge_table[] = {
1069 {
1070 .ctl_name = NET_BRIDGE,
1071 .procname = "bridge",
1072 .mode = 0555,
1073 .child = brnf_table,
1074 },
1075 { .ctl_name = 0 }
1076};
1077
1078static ctl_table brnf_net_table[] = {
1079 {
1080 .ctl_name = CTL_NET,
1081 .procname = "net",
1082 .mode = 0555,
1083 .child = brnf_bridge_table,
1084 },
1085 { .ctl_name = 0 }
1086};
1087#endif
1088
1089int br_netfilter_init(void)
1090{
1091 int i;
1092
1093 for (i = 0; i < ARRAY_SIZE(br_nf_ops); i++) {
1094 int ret;
1095
1096 if ((ret = nf_register_hook(&br_nf_ops[i])) >= 0)
1097 continue;
1098
1099 while (i--)
1100 nf_unregister_hook(&br_nf_ops[i]);
1101
1102 return ret;
1103 }
1104
1105#ifdef CONFIG_SYSCTL
1106 brnf_sysctl_header = register_sysctl_table(brnf_net_table, 0);
1107 if (brnf_sysctl_header == NULL) {
789bc3e5
SH		 1108 printk(KERN_WARNING
1109 "br_netfilter: can't register to sysctl.\n");
1da177e4
LT		 1110 for (i = 0; i < ARRAY_SIZE(br_nf_ops); i++)
1111 nf_unregister_hook(&br_nf_ops[i]);
1112 return -EFAULT;
1113 }
1114#endif
1115
1116 printk(KERN_NOTICE "Bridge firewalling registered\n");
1117
1118 return 0;
1119}
1120
1121void br_netfilter_fini(void)
1122{
1123 int i;
1124
1125 for (i = ARRAY_SIZE(br_nf_ops) - 1; i >= 0; i--)
1126 nf_unregister_hook(&br_nf_ops[i]);
1127#ifdef CONFIG_SYSCTL
1128 unregister_sysctl_table(brnf_sysctl_header);
1129#endif
1130}
Clone of davem's net-next-2.6 tree