net/bridge/br_netfilter_ipv6.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Handle firewalling
   4  *      Linux ethernet bridge
   5  *
   6  *      Authors:
   7  *      Lennert Buytenhek               <buytenh@gnu.org>
   8  *      Bart De Schuymer                <bdschuym@pandora.be>
   9  *
  10  *      Lennert dedicates this file to Kerstin Wurdinger.
  11  */
  12
  13 #include <linux/module.h>
  14 #include <linux/kernel.h>
  15 #include <linux/slab.h>
  16 #include <linux/ip.h>
  17 #include <linux/netdevice.h>
  18 #include <linux/skbuff.h>
  19 #include <linux/if_arp.h>
  20 #include <linux/if_ether.h>
  21 #include <linux/if_vlan.h>
  22 #include <linux/if_pppox.h>
  23 #include <linux/ppp_defs.h>
  24 #include <linux/netfilter_bridge.h>
  25 #include <linux/netfilter_ipv4.h>
  26 #include <linux/netfilter_ipv6.h>
  27 #include <linux/netfilter_arp.h>
  28 #include <linux/in_route.h>
  29 #include <linux/inetdevice.h>
  30
  31 #include <net/ip.h>
  32 #include <net/ipv6.h>
  33 #include <net/addrconf.h>
  34 #include <net/route.h>
  35 #include <net/netfilter/br_netfilter.h>
  36
  37 #include <linux/uaccess.h>
  38 #include "br_private.h"
  39 #ifdef CONFIG_SYSCTL
  40 #include <linux/sysctl.h>
  41 #endif
  42
  43 /* We only check the length. A bridge shouldn't do any hop-by-hop stuff
  44  * anyway
  45  */
  46 static int br_nf_check_hbh_len(struct sk_buff *skb)
  47 {
  48         unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
  49         u32 pkt_len;
  50         const unsigned char *nh = skb_network_header(skb);
  51         int off = raw - nh;
  52         int len = (raw[1] + 1) << 3;
  53
  54         if ((raw + len) - skb->data > skb_headlen(skb))
  55                 goto bad;
  56
  57         off += 2;
  58         len -= 2;
  59
  60         while (len > 0) {
  61                 int optlen = nh[off + 1] + 2;
  62
  63                 switch (nh[off]) {
  64                 case IPV6_TLV_PAD1:
  65                         optlen = 1;
  66                         break;
  67
  68                 case IPV6_TLV_PADN:
  69                         break;
  70
  71                 case IPV6_TLV_JUMBO:
  72                         if (nh[off + 1] != 4 || (off & 3) != 2)
  73                                 goto bad;
  74                         pkt_len = ntohl(*(__be32 *)(nh + off + 2));
  75                         if (pkt_len <= IPV6_MAXPLEN ||
  76                             ipv6_hdr(skb)->payload_len)
  77                                 goto bad;
  78                         if (pkt_len > skb->len - sizeof(struct ipv6hdr))
  79                                 goto bad;
  80                         if (pskb_trim_rcsum(skb,
  81                                             pkt_len + sizeof(struct ipv6hdr)))
  82                                 goto bad;
  83                         nh = skb_network_header(skb);
  84                         break;
  85                 default:
  86                         if (optlen > len)
  87                                 goto bad;
  88                         break;
  89                 }
  90                 off += optlen;
  91                 len -= optlen;
  92         }
  93         if (len == 0)
  94                 return 0;
  95 bad:
  96         return -1;
  97 }
  98
  99 int br_validate_ipv6(struct net *net, struct sk_buff *skb)
 100 {
 101         const struct ipv6hdr *hdr;
 102         struct inet6_dev *idev = __in6_dev_get(skb->dev);
 103         u32 pkt_len;
 104         u8 ip6h_len = sizeof(struct ipv6hdr);
 105
 106         if (!pskb_may_pull(skb, ip6h_len))
 107                 goto inhdr_error;
 108
 109         if (skb->len < ip6h_len)
 110                 goto drop;
 111
 112         hdr = ipv6_hdr(skb);
 113
 114         if (hdr->version != 6)
 115                 goto inhdr_error;
 116
 117         pkt_len = ntohs(hdr->payload_len);
 118
 119         if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
 120                 if (pkt_len + ip6h_len > skb->len) {
 121                         __IP6_INC_STATS(net, idev,
 122                                         IPSTATS_MIB_INTRUNCATEDPKTS);
 123                         goto drop;
 124                 }
 125                 if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
 126                         __IP6_INC_STATS(net, idev,
 127                                         IPSTATS_MIB_INDISCARDS);
 128                         goto drop;
 129                 }
 130                 hdr = ipv6_hdr(skb);
 131         }
 132         if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb))
 133                 goto drop;
 134
 135         memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
 136         /* No IP options in IPv6 header; however it should be
 137          * checked if some next headers need special treatment
 138          */
 139         return 0;
 140
 141 inhdr_error:
 142         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 143 drop:
 144         return -1;
 145 }
 146
 147 static inline bool
 148 br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
 149                              const struct nf_bridge_info *nf_bridge)
 150 {
 151         return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
 152                       sizeof(ipv6_hdr(skb)->daddr)) != 0;
 153 }
 154
 155 /* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
 156  * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
 157  * for br_nf_pre_routing_finish(), same logic is used here but
 158  * equivalent IPv6 function ip6_route_input() called indirectly.
 159  */
 160 static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb)
 161 {
 162         struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
 163         struct rtable *rt;
 164         struct net_device *dev = skb->dev;
 165         const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
 166
 167         nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
 168
 169         if (nf_bridge->pkt_otherhost) {
 170                 skb->pkt_type = PACKET_OTHERHOST;
 171                 nf_bridge->pkt_otherhost = false;
 172         }
 173         nf_bridge->in_prerouting = 0;
 174         if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
 175                 skb_dst_drop(skb);
 176                 v6ops->route_input(skb);
 177
 178                 if (skb_dst(skb)->error) {
 179                         kfree_skb(skb);
 180                         return 0;
 181                 }
 182
 183                 if (skb_dst(skb)->dev == dev) {
 184                         skb->dev = nf_bridge->physindev;
 185                         nf_bridge_update_protocol(skb);
 186                         nf_bridge_push_encap_header(skb);
 187                         br_nf_hook_thresh(NF_BR_PRE_ROUTING,
 188                                           net, sk, skb, skb->dev, NULL,
 189                                           br_nf_pre_routing_finish_bridge);
 190                         return 0;
 191                 }
 192                 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
 193                 skb->pkt_type = PACKET_HOST;
 194         } else {
 195                 rt = bridge_parent_rtable(nf_bridge->physindev);
 196                 if (!rt) {
 197                         kfree_skb(skb);
 198                         return 0;
 199                 }
 200                 skb_dst_set_noref(skb, &rt->dst);
 201         }
 202
 203         skb->dev = nf_bridge->physindev;
 204         nf_bridge_update_protocol(skb);
 205         nf_bridge_push_encap_header(skb);
 206         br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb,
 207                           skb->dev, NULL, br_handle_frame_finish);
 208
 209         return 0;
 210 }
 211
 212 /* Replicate the checks that IPv6 does on packet reception and pass the packet
 213  * to ip6tables.
 214  */
 215 unsigned int br_nf_pre_routing_ipv6(void *priv,
 216                                     struct sk_buff *skb,
 217                                     const struct nf_hook_state *state)
 218 {
 219         struct nf_bridge_info *nf_bridge;
 220
 221         if (br_validate_ipv6(state->net, skb))
 222                 return NF_DROP;
 223
 224         nf_bridge = nf_bridge_alloc(skb);
 225         if (!nf_bridge)
 226                 return NF_DROP;
 227         if (!setup_pre_routing(skb, state->net))
 228                 return NF_DROP;
 229
 230         nf_bridge = nf_bridge_info_get(skb);
 231         nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
 232
 233         skb->protocol = htons(ETH_P_IPV6);
 234         skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);
 235
 236         NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
 237                 skb->dev, NULL,
 238                 br_nf_pre_routing_finish_ipv6);
 239
 240         return NF_STOLEN;
 241 }