net/bridge/br_netfilter_ipv6.c

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /*
0003  *  Handle firewalling
0004  *  Linux ethernet bridge
0005  *
0006  *  Authors:
0007  *  Lennert Buytenhek       <buytenh@gnu.org>
0008  *  Bart De Schuymer        <bdschuym@pandora.be>
0009  *
0010  *  Lennert dedicates this file to Kerstin Wurdinger.
0011  */
0012
0013 #include <linux/module.h>
0014 #include <linux/kernel.h>
0015 #include <linux/slab.h>
0016 #include <linux/ip.h>
0017 #include <linux/netdevice.h>
0018 #include <linux/skbuff.h>
0019 #include <linux/if_arp.h>
0020 #include <linux/if_ether.h>
0021 #include <linux/if_vlan.h>
0022 #include <linux/if_pppox.h>
0023 #include <linux/ppp_defs.h>
0024 #include <linux/netfilter_bridge.h>
0025 #include <linux/netfilter_ipv4.h>
0026 #include <linux/netfilter_ipv6.h>
0027 #include <linux/netfilter_arp.h>
0028 #include <linux/in_route.h>
0029 #include <linux/inetdevice.h>
0030
0031 #include <net/ip.h>
0032 #include <net/ipv6.h>
0033 #include <net/addrconf.h>
0034 #include <net/route.h>
0035 #include <net/netfilter/br_netfilter.h>
0036
0037 #include <linux/uaccess.h>
0038 #include "br_private.h"
0039 #ifdef CONFIG_SYSCTL
0040 #include <linux/sysctl.h>
0041 #endif
0042
0043 /* We only check the length. A bridge shouldn't do any hop-by-hop stuff
0044  * anyway
0045  */
0046 static int br_nf_check_hbh_len(struct sk_buff *skb)
0047 {
0048     unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
0049     u32 pkt_len;
0050     const unsigned char *nh = skb_network_header(skb);
0051     int off = raw - nh;
0052     int len = (raw[1] + 1) << 3;
0053
0054     if ((raw + len) - skb->data > skb_headlen(skb))
0055         goto bad;
0056
0057     off += 2;
0058     len -= 2;
0059
0060     while (len > 0) {
0061         int optlen = nh[off + 1] + 2;
0062
0063         switch (nh[off]) {
0064         case IPV6_TLV_PAD1:
0065             optlen = 1;
0066             break;
0067
0068         case IPV6_TLV_PADN:
0069             break;
0070
0071         case IPV6_TLV_JUMBO:
0072             if (nh[off + 1] != 4 || (off & 3) != 2)
0073                 goto bad;
0074             pkt_len = ntohl(*(__be32 *)(nh + off + 2));
0075             if (pkt_len <= IPV6_MAXPLEN ||
0076                 ipv6_hdr(skb)->payload_len)
0077                 goto bad;
0078             if (pkt_len > skb->len - sizeof(struct ipv6hdr))
0079                 goto bad;
0080             if (pskb_trim_rcsum(skb,
0081                         pkt_len + sizeof(struct ipv6hdr)))
0082                 goto bad;
0083             nh = skb_network_header(skb);
0084             break;
0085         default:
0086             if (optlen > len)
0087                 goto bad;
0088             break;
0089         }
0090         off += optlen;
0091         len -= optlen;
0092     }
0093     if (len == 0)
0094         return 0;
0095 bad:
0096     return -1;
0097 }
0098
0099 int br_validate_ipv6(struct net *net, struct sk_buff *skb)
0100 {
0101     const struct ipv6hdr *hdr;
0102     struct inet6_dev *idev = __in6_dev_get(skb->dev);
0103     u32 pkt_len;
0104     u8 ip6h_len = sizeof(struct ipv6hdr);
0105
0106     if (!pskb_may_pull(skb, ip6h_len))
0107         goto inhdr_error;
0108
0109     if (skb->len < ip6h_len)
0110         goto drop;
0111
0112     hdr = ipv6_hdr(skb);
0113
0114     if (hdr->version != 6)
0115         goto inhdr_error;
0116
0117     pkt_len = ntohs(hdr->payload_len);
0118
0119     if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
0120         if (pkt_len + ip6h_len > skb->len) {
0121             __IP6_INC_STATS(net, idev,
0122                     IPSTATS_MIB_INTRUNCATEDPKTS);
0123             goto drop;
0124         }
0125         if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
0126             __IP6_INC_STATS(net, idev,
0127                     IPSTATS_MIB_INDISCARDS);
0128             goto drop;
0129         }
0130         hdr = ipv6_hdr(skb);
0131     }
0132     if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb))
0133         goto drop;
0134
0135     memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
0136     /* No IP options in IPv6 header; however it should be
0137      * checked if some next headers need special treatment
0138      */
0139     return 0;
0140
0141 inhdr_error:
0142     __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
0143 drop:
0144     return -1;
0145 }
0146
0147 static inline bool
0148 br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
0149                  const struct nf_bridge_info *nf_bridge)
0150 {
0151     return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
0152               sizeof(ipv6_hdr(skb)->daddr)) != 0;
0153 }
0154
0155 /* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
0156  * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
0157  * for br_nf_pre_routing_finish(), same logic is used here but
0158  * equivalent IPv6 function ip6_route_input() called indirectly.
0159  */
0160 static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb)
0161 {
0162     struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
0163     struct rtable *rt;
0164     struct net_device *dev = skb->dev;
0165     const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
0166
0167     nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
0168
0169     if (nf_bridge->pkt_otherhost) {
0170         skb->pkt_type = PACKET_OTHERHOST;
0171         nf_bridge->pkt_otherhost = false;
0172     }
0173     nf_bridge->in_prerouting = 0;
0174     if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
0175         skb_dst_drop(skb);
0176         v6ops->route_input(skb);
0177
0178         if (skb_dst(skb)->error) {
0179             kfree_skb(skb);
0180             return 0;
0181         }
0182
0183         if (skb_dst(skb)->dev == dev) {
0184             skb->dev = nf_bridge->physindev;
0185             nf_bridge_update_protocol(skb);
0186             nf_bridge_push_encap_header(skb);
0187             br_nf_hook_thresh(NF_BR_PRE_ROUTING,
0188                       net, sk, skb, skb->dev, NULL,
0189                       br_nf_pre_routing_finish_bridge);
0190             return 0;
0191         }
0192         ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
0193         skb->pkt_type = PACKET_HOST;
0194     } else {
0195         rt = bridge_parent_rtable(nf_bridge->physindev);
0196         if (!rt) {
0197             kfree_skb(skb);
0198             return 0;
0199         }
0200         skb_dst_drop(skb);
0201         skb_dst_set_noref(skb, &rt->dst);
0202     }
0203
0204     skb->dev = nf_bridge->physindev;
0205     nf_bridge_update_protocol(skb);
0206     nf_bridge_push_encap_header(skb);
0207     br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb,
0208               skb->dev, NULL, br_handle_frame_finish);
0209
0210     return 0;
0211 }
0212
0213 /* Replicate the checks that IPv6 does on packet reception and pass the packet
0214  * to ip6tables.
0215  */
0216 unsigned int br_nf_pre_routing_ipv6(void *priv,
0217                     struct sk_buff *skb,
0218                     const struct nf_hook_state *state)
0219 {
0220     struct nf_bridge_info *nf_bridge;
0221
0222     if (br_validate_ipv6(state->net, skb))
0223         return NF_DROP;
0224
0225     nf_bridge = nf_bridge_alloc(skb);
0226     if (!nf_bridge)
0227         return NF_DROP;
0228     if (!setup_pre_routing(skb, state->net))
0229         return NF_DROP;
0230
0231     nf_bridge = nf_bridge_info_get(skb);
0232     nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
0233
0234     skb->protocol = htons(ETH_P_IPV6);
0235     skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);
0236
0237     NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
0238         skb->dev, NULL,
0239         br_nf_pre_routing_finish_ipv6);
0240
0241     return NF_STOLEN;
0242 }