Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 230ac490 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: bridge: split ipv6 code into separated file 



Resolve compilation breakage when CONFIG_IPV6 is not set by moving the IPv6
code into a separated br_netfilter_ipv6.c file.

Fixes: efb6de9b ("netfilter: bridge: forward IPv6 fragmented packets")
Reported-by: default avatarkbuild test robot <fengguang.wu@intel.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent c4e70a87

include/net/netfilter/br_netfilter.h

+60 −0
Original line number Diff line number Diff line 
#ifndef _BR_NETFILTER_H_

#define _BR_NETFILTER_H_



#include "../../../net/bridge/br_private.h"



static inline struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)

{

	skb->nf_bridge = kzalloc(sizeof(struct nf_bridge_info), GFP_ATOMIC);



	if (likely(skb->nf_bridge))

		atomic_set(&(skb->nf_bridge->use), 1);



	return skb->nf_bridge;

}



void nf_bridge_update_protocol(struct sk_buff *skb);



static inline struct nf_bridge_info *

nf_bridge_info_get(const struct sk_buff *skb)

{

	return skb->nf_bridge;

}



unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb);



static inline void nf_bridge_push_encap_header(struct sk_buff *skb)

{

	unsigned int len = nf_bridge_encap_header_len(skb);



	skb_push(skb, len);

	skb->network_header -= len;

}



int br_nf_pre_routing_finish_bridge(struct sock *sk, struct sk_buff *skb);



static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)

{

	struct net_bridge_port *port;



	port = br_port_get_rcu(dev);

	return port ? &port->br->fake_rtable : NULL;

}



struct net_device *setup_pre_routing(struct sk_buff *skb);

void br_netfilter_enable(void);



#if IS_ENABLED(CONFIG_IPV6)

int br_validate_ipv6(struct sk_buff *skb);

unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,

				    struct sk_buff *skb,

				    const struct nf_hook_state *state);

#else

static inline int br_validate_ipv6(struct sk_buff *skb)

{

	return -1;

}



static inline unsigned int

br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops, struct sk_buff *skb,

		       const struct nf_hook_state *state)

{

	return NF_DROP;

}

#endif



#endif /* _BR_NETFILTER_H_ */

net/bridge/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -13,6 +13,7 @@ bridge-$(CONFIG_SYSFS) += br_sysfs_if.o br_sysfs_br.o 
bridge-$(subst m,y,$(CONFIG_BRIDGE_NETFILTER)) += br_nf_core.o



br_netfilter-y := br_netfilter_hooks.o

br_netfilter-$(subst m,y,$(CONFIG_IPV6)) += br_netfilter_ipv6.o

obj-$(CONFIG_BRIDGE_NETFILTER) += br_netfilter.o



bridge-$(CONFIG_BRIDGE_IGMP_SNOOPING) += br_multicast.o br_mdb.o

net/bridge/br_netfilter_hooks.c

+9 −239
Original line number Diff line number Diff line
@@ -123,11 +123,6 @@ struct brnf_frag_data { 
static DEFINE_PER_CPU(struct brnf_frag_data, brnf_frag_data_storage);

#endif



static struct nf_bridge_info *nf_bridge_info_get(const struct sk_buff *skb)

{

	return skb->nf_bridge;

}



static void nf_bridge_info_free(struct sk_buff *skb)

{

	if (skb->nf_bridge) {
@@ -136,14 +131,6 @@ static void nf_bridge_info_free(struct sk_buff *skb) 
	}

}



static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)

{

	struct net_bridge_port *port;



	port = br_port_get_rcu(dev);

	return port ? &port->br->fake_rtable : NULL;

}



static inline struct net_device *bridge_parent(const struct net_device *dev)

{

	struct net_bridge_port *port;
@@ -152,15 +139,6 @@ static inline struct net_device *bridge_parent(const struct net_device *dev) 
	return port ? port->br->dev : NULL;

}



static inline struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)

{

	skb->nf_bridge = kzalloc(sizeof(struct nf_bridge_info), GFP_ATOMIC);

	if (likely(skb->nf_bridge))

		atomic_set(&(skb->nf_bridge->use), 1);



	return skb->nf_bridge;

}



static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)

{

	struct nf_bridge_info *nf_bridge = skb->nf_bridge;
@@ -178,7 +156,7 @@ static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb) 
	return nf_bridge;

}



static unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb)

unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb)

{

	switch (skb->protocol) {

	case __cpu_to_be16(ETH_P_8021Q):
@@ -190,14 +168,6 @@ static unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb) 
	}

}



static inline void nf_bridge_push_encap_header(struct sk_buff *skb)

{

	unsigned int len = nf_bridge_encap_header_len(skb);



	skb_push(skb, len);

	skb->network_header -= len;

}



static inline void nf_bridge_pull_encap_header(struct sk_buff *skb)

{

	unsigned int len = nf_bridge_encap_header_len(skb);
@@ -267,112 +237,7 @@ static int br_validate_ipv4(struct sk_buff *skb) 
	return -1;

}



/* We only check the length. A bridge shouldn't do any hop-by-hop stuff

 * anyway

 */

static int check_hbh_len(struct sk_buff *skb)

{

	unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);

	u32 pkt_len;

	const unsigned char *nh = skb_network_header(skb);

	int off = raw - nh;

	int len = (raw[1] + 1) << 3;



	if ((raw + len) - skb->data > skb_headlen(skb))

		goto bad;



	off += 2;

	len -= 2;



	while (len > 0) {

		int optlen = nh[off + 1] + 2;



		switch (nh[off]) {

		case IPV6_TLV_PAD1:

			optlen = 1;

			break;



		case IPV6_TLV_PADN:

			break;



		case IPV6_TLV_JUMBO:

			if (nh[off + 1] != 4 || (off & 3) != 2)

				goto bad;

			pkt_len = ntohl(*(__be32 *)(nh + off + 2));

			if (pkt_len <= IPV6_MAXPLEN ||

			    ipv6_hdr(skb)->payload_len)

				goto bad;

			if (pkt_len > skb->len - sizeof(struct ipv6hdr))

				goto bad;

			if (pskb_trim_rcsum(skb,

					    pkt_len + sizeof(struct ipv6hdr)))

				goto bad;

			nh = skb_network_header(skb);

			break;

		default:

			if (optlen > len)

				goto bad;

			break;

		}

		off += optlen;

		len -= optlen;

	}

	if (len == 0)

		return 0;

bad:

	return -1;

}



/* Equivalent to br_validate_ipv4 for IPv6 */

static int br_validate_ipv6(struct sk_buff *skb)

{

	const struct ipv6hdr *hdr;

	struct net_device *dev = skb->dev;

	struct inet6_dev *idev = in6_dev_get(skb->dev);

	u32 pkt_len;

	u8 ip6h_len = sizeof(struct ipv6hdr);



	if (!pskb_may_pull(skb, ip6h_len))

		goto inhdr_error;



	if (skb->len < ip6h_len)

		goto drop;



	hdr = ipv6_hdr(skb);



	if (hdr->version != 6)

		goto inhdr_error;



	pkt_len = ntohs(hdr->payload_len);



	if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {

		if (pkt_len + ip6h_len > skb->len) {

			IP6_INC_STATS_BH(dev_net(dev), idev,

					 IPSTATS_MIB_INTRUNCATEDPKTS);

			goto drop;

		}

		if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {

			IP6_INC_STATS_BH(dev_net(dev), idev,

					 IPSTATS_MIB_INDISCARDS);

			goto drop;

		}

	}

	if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb))

		goto drop;



	memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));

	/* No IP options in IPv6 header; however it should be

	 * checked if some next headers need special treatment

	 */

	return 0;



inhdr_error:

	IP6_INC_STATS_BH(dev_net(dev), idev, IPSTATS_MIB_INHDRERRORS);

drop:

	return -1;

}



static void nf_bridge_update_protocol(struct sk_buff *skb)

void nf_bridge_update_protocol(struct sk_buff *skb)

{

	switch (skb->nf_bridge->orig_proto) {

	case BRNF_PROTO_8021Q:
@@ -391,7 +256,7 @@ static void nf_bridge_update_protocol(struct sk_buff *skb) 
 * don't, we use the neighbour framework to find out. In both cases, we make

 * sure that br_handle_frame_finish() is called afterwards.

 */

static int br_nf_pre_routing_finish_bridge(struct sock *sk, struct sk_buff *skb)

int br_nf_pre_routing_finish_bridge(struct sock *sk, struct sk_buff *skb)

{

	struct neighbour *neigh;

	struct dst_entry *dst;
@@ -431,77 +296,11 @@ static int br_nf_pre_routing_finish_bridge(struct sock *sk, struct sk_buff *skb) 
	return 0;

}



static bool daddr_was_changed(const struct sk_buff *skb,

static inline bool

br_nf_ipv4_daddr_was_changed(const struct sk_buff *skb,

			     const struct nf_bridge_info *nf_bridge)

{

	switch (skb->protocol) {

	case htons(ETH_P_IP):

	return ip_hdr(skb)->daddr != nf_bridge->ipv4_daddr;

	case htons(ETH_P_IPV6):

		return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,

			      sizeof(ipv6_hdr(skb)->daddr)) != 0;

	default:

		return false;

	}

}



/* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables

 * PREROUTING and continue the bridge PRE_ROUTING hook. See comment

 * for br_nf_pre_routing_finish(), same logic is used here but

 * equivalent IPv6 function ip6_route_input() called indirectly.

 */

static int br_nf_pre_routing_finish_ipv6(struct sock *sk, struct sk_buff *skb)

{

	struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);

	struct rtable *rt;

	struct net_device *dev = skb->dev;

	const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();



	nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;



	if (nf_bridge->pkt_otherhost) {

		skb->pkt_type = PACKET_OTHERHOST;

		nf_bridge->pkt_otherhost = false;

	}

	nf_bridge->mask &= ~BRNF_NF_BRIDGE_PREROUTING;

	if (daddr_was_changed(skb, nf_bridge)) {

		skb_dst_drop(skb);

		v6ops->route_input(skb);



		if (skb_dst(skb)->error) {

			kfree_skb(skb);

			return 0;

		}



		if (skb_dst(skb)->dev == dev) {

			skb->dev = nf_bridge->physindev;

			nf_bridge_update_protocol(skb);

			nf_bridge_push_encap_header(skb);

			NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING,

				       sk, skb, skb->dev, NULL,

				       br_nf_pre_routing_finish_bridge,

				       1);

			return 0;

		}

		ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);

		skb->pkt_type = PACKET_HOST;

	} else {

		rt = bridge_parent_rtable(nf_bridge->physindev);

		if (!rt) {

			kfree_skb(skb);

			return 0;

		}

		skb_dst_set_noref(skb, &rt->dst);

	}



	skb->dev = nf_bridge->physindev;

	nf_bridge_update_protocol(skb);

	nf_bridge_push_encap_header(skb);

	NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, sk, skb,

		       skb->dev, NULL,

		       br_handle_frame_finish, 1);



	return 0;

}



/* This requires some explaining. If DNAT has taken place,
@@ -558,7 +357,7 @@ static int br_nf_pre_routing_finish(struct sock *sk, struct sk_buff *skb) 
		nf_bridge->pkt_otherhost = false;

	}

	nf_bridge->mask &= ~BRNF_NF_BRIDGE_PREROUTING;

	if (daddr_was_changed(skb, nf_bridge)) {

	if (br_nf_ipv4_daddr_was_changed(skb, nf_bridge)) {

		if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {

			struct in_device *in_dev = __in_dev_get_rcu(dev);
@@ -636,7 +435,7 @@ static struct net_device *brnf_get_logical_dev(struct sk_buff *skb, const struct 
}



/* Some common code for IPv4/IPv6 */

static struct net_device *setup_pre_routing(struct sk_buff *skb)

struct net_device *setup_pre_routing(struct sk_buff *skb)

{

	struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
@@ -659,35 +458,6 @@ static struct net_device *setup_pre_routing(struct sk_buff *skb) 
	return skb->dev;

}



/* Replicate the checks that IPv6 does on packet reception and pass the packet

 * to ip6tables.

 */

static unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,

					   struct sk_buff *skb,

					   const struct nf_hook_state *state)

{

	struct nf_bridge_info *nf_bridge;



	if (br_validate_ipv6(skb))

		return NF_DROP;



	nf_bridge_put(skb->nf_bridge);

	if (!nf_bridge_alloc(skb))

		return NF_DROP;

	if (!setup_pre_routing(skb))

		return NF_DROP;



	nf_bridge = nf_bridge_info_get(skb);

	nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;



	skb->protocol = htons(ETH_P_IPV6);

	NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->sk, skb,

		skb->dev, NULL,

		br_nf_pre_routing_finish_ipv6);



	return NF_STOLEN;

}



/* Direct IPv6 traffic to br_nf_pre_routing_ipv6.

 * Replicate the checks that IPv4 does on packet reception.

 * Set skb->dev to the bridge device (i.e. parent of the

net/bridge/br_netfilter_ipv6.c

0 → 100644
+245 −0
Original line number Diff line number Diff line 
/*

 *	Handle firewalling

 *	Linux ethernet bridge

 *

 *	Authors:

 *	Lennert Buytenhek		<buytenh@gnu.org>

 *	Bart De Schuymer		<bdschuym@pandora.be>

 *

 *	This program is free software; you can redistribute it and/or

 *	modify it under the terms of the GNU General Public License

 *	as published by the Free Software Foundation; either version

 *	2 of the License, or (at your option) any later version.

 *

 *	Lennert dedicates this file to Kerstin Wurdinger.

 */



#include <linux/module.h>

#include <linux/kernel.h>

#include <linux/slab.h>

#include <linux/ip.h>

#include <linux/netdevice.h>

#include <linux/skbuff.h>

#include <linux/if_arp.h>

#include <linux/if_ether.h>

#include <linux/if_vlan.h>

#include <linux/if_pppox.h>

#include <linux/ppp_defs.h>

#include <linux/netfilter_bridge.h>

#include <linux/netfilter_ipv4.h>

#include <linux/netfilter_ipv6.h>

#include <linux/netfilter_arp.h>

#include <linux/in_route.h>

#include <linux/inetdevice.h>



#include <net/ip.h>

#include <net/ipv6.h>

#include <net/addrconf.h>

#include <net/route.h>

#include <net/netfilter/br_netfilter.h>



#include <asm/uaccess.h>

#include "br_private.h"

#ifdef CONFIG_SYSCTL

#include <linux/sysctl.h>

#endif



/* We only check the length. A bridge shouldn't do any hop-by-hop stuff

 * anyway

 */

static int br_nf_check_hbh_len(struct sk_buff *skb)

{

	unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);

	u32 pkt_len;

	const unsigned char *nh = skb_network_header(skb);

	int off = raw - nh;

	int len = (raw[1] + 1) << 3;



	if ((raw + len) - skb->data > skb_headlen(skb))

		goto bad;



	off += 2;

	len -= 2;



	while (len > 0) {

		int optlen = nh[off + 1] + 2;



		switch (nh[off]) {

		case IPV6_TLV_PAD1:

			optlen = 1;

			break;



		case IPV6_TLV_PADN:

			break;



		case IPV6_TLV_JUMBO:

			if (nh[off + 1] != 4 || (off & 3) != 2)

				goto bad;

			pkt_len = ntohl(*(__be32 *)(nh + off + 2));

			if (pkt_len <= IPV6_MAXPLEN ||

			    ipv6_hdr(skb)->payload_len)

				goto bad;

			if (pkt_len > skb->len - sizeof(struct ipv6hdr))

				goto bad;

			if (pskb_trim_rcsum(skb,

					    pkt_len + sizeof(struct ipv6hdr)))

				goto bad;

			nh = skb_network_header(skb);

			break;

		default:

			if (optlen > len)

				goto bad;

			break;

		}

		off += optlen;

		len -= optlen;

	}

	if (len == 0)

		return 0;

bad:

	return -1;

}



int br_validate_ipv6(struct sk_buff *skb)

{

	const struct ipv6hdr *hdr;

	struct net_device *dev = skb->dev;

	struct inet6_dev *idev = in6_dev_get(skb->dev);

	u32 pkt_len;

	u8 ip6h_len = sizeof(struct ipv6hdr);



	if (!pskb_may_pull(skb, ip6h_len))

		goto inhdr_error;



	if (skb->len < ip6h_len)

		goto drop;



	hdr = ipv6_hdr(skb);



	if (hdr->version != 6)

		goto inhdr_error;



	pkt_len = ntohs(hdr->payload_len);



	if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {

		if (pkt_len + ip6h_len > skb->len) {

			IP6_INC_STATS_BH(dev_net(dev), idev,

					 IPSTATS_MIB_INTRUNCATEDPKTS);

			goto drop;

		}

		if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {

			IP6_INC_STATS_BH(dev_net(dev), idev,

					 IPSTATS_MIB_INDISCARDS);

			goto drop;

		}

	}

	if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb))

		goto drop;



	memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));

	/* No IP options in IPv6 header; however it should be

	 * checked if some next headers need special treatment

	 */

	return 0;



inhdr_error:

	IP6_INC_STATS_BH(dev_net(dev), idev, IPSTATS_MIB_INHDRERRORS);

drop:

	return -1;

}



static inline bool

br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,

			     const struct nf_bridge_info *nf_bridge)

{

	return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,

		      sizeof(ipv6_hdr(skb)->daddr)) != 0;

}



/* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables

 * PREROUTING and continue the bridge PRE_ROUTING hook. See comment

 * for br_nf_pre_routing_finish(), same logic is used here but

 * equivalent IPv6 function ip6_route_input() called indirectly.

 */

static int br_nf_pre_routing_finish_ipv6(struct sock *sk, struct sk_buff *skb)

{

	struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);

	struct rtable *rt;

	struct net_device *dev = skb->dev;

	const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();



	nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;



	if (nf_bridge->pkt_otherhost) {

		skb->pkt_type = PACKET_OTHERHOST;

		nf_bridge->pkt_otherhost = false;

	}

	nf_bridge->mask &= ~BRNF_NF_BRIDGE_PREROUTING;

	if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {

		skb_dst_drop(skb);

		v6ops->route_input(skb);



		if (skb_dst(skb)->error) {

			kfree_skb(skb);

			return 0;

		}



		if (skb_dst(skb)->dev == dev) {

			skb->dev = nf_bridge->physindev;

			nf_bridge_update_protocol(skb);

			nf_bridge_push_encap_header(skb);

			NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING,

				       sk, skb, skb->dev, NULL,

				       br_nf_pre_routing_finish_bridge,

				       1);

			return 0;

		}

		ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);

		skb->pkt_type = PACKET_HOST;

	} else {

		rt = bridge_parent_rtable(nf_bridge->physindev);

		if (!rt) {

			kfree_skb(skb);

			return 0;

		}

		skb_dst_set_noref(skb, &rt->dst);

	}



	skb->dev = nf_bridge->physindev;

	nf_bridge_update_protocol(skb);

	nf_bridge_push_encap_header(skb);

	NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, sk, skb,

		       skb->dev, NULL,

		       br_handle_frame_finish, 1);



	return 0;

}



/* Replicate the checks that IPv6 does on packet reception and pass the packet

 * to ip6tables.

 */

unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,

				    struct sk_buff *skb,

				    const struct nf_hook_state *state)

{

	struct nf_bridge_info *nf_bridge;



	if (br_validate_ipv6(skb))

		return NF_DROP;



	nf_bridge_put(skb->nf_bridge);

	if (!nf_bridge_alloc(skb))

		return NF_DROP;

	if (!setup_pre_routing(skb))

		return NF_DROP;



	nf_bridge = nf_bridge_info_get(skb);

	nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;



	skb->protocol = htons(ETH_P_IPV6);

	NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->sk, skb,

		skb->dev, NULL,

		br_nf_pre_routing_finish_ipv6);



	return NF_STOLEN;

}