net/bridge/br_netfilter.c

   1 /*
   2  *      Handle firewalling
   3  *      Linux ethernet bridge
   4  *
   5  *      Authors:
   6  *      Lennert Buytenhek               <buytenh@gnu.org>
   7  *      Bart De Schuymer (maintainer)   <bdschuym@pandora.be>
   8  *
   9  *      Changes:
  10  *      Apr 29 2003: physdev module support (bdschuym)
  11  *      Jun 19 2003: let arptables see bridged ARP traffic (bdschuym)
  12  *      Oct 06 2003: filter encapsulated IP/ARP VLAN traffic on untagged bridge
  13  *                   (bdschuym)
  14  *
  15  *      This program is free software; you can redistribute it and/or
  16  *      modify it under the terms of the GNU General Public License
  17  *      as published by the Free Software Foundation; either version
  18  *      2 of the License, or (at your option) any later version.
  19  *
  20  *      Lennert dedicates this file to Kerstin Wurdinger.
  21  */
  22
  23 #include <linux/module.h>
  24 #include <linux/kernel.h>
  25 #include <linux/ip.h>
  26 #include <linux/netdevice.h>
  27 #include <linux/skbuff.h>
  28 #include <linux/if_ether.h>
  29 #include <linux/if_vlan.h>
  30 #include <linux/netfilter_bridge.h>
  31 #include <linux/netfilter_ipv4.h>
  32 #include <linux/netfilter_arp.h>
  33 #include <linux/in_route.h>
  34 #include <net/ip.h>
  35 #include <asm/uaccess.h>
  36 #include <asm/checksum.h>
  37 #include "br_private.h"
  38 #ifdef CONFIG_SYSCTL
  39 #include <linux/sysctl.h>
  40 #endif
  41
  42
  43 #define skb_origaddr(skb)        (((struct bridge_skb_cb *) \
  44                                  (skb->nf_bridge->data))->daddr.ipv4)
  45 #define store_orig_dstaddr(skb)  (skb_origaddr(skb) = (skb)->nh.iph->daddr)
  46 #define dnat_took_place(skb)     (skb_origaddr(skb) != (skb)->nh.iph->daddr)
  47
  48 #define has_bridge_parent(device)       ((device)->br_port != NULL)
  49 #define bridge_parent(device)           ((device)->br_port->br->dev)
  50
  51 #ifdef CONFIG_SYSCTL
  52 static struct ctl_table_header *brnf_sysctl_header;
  53 static int brnf_call_iptables = 1;
  54 static int brnf_call_arptables = 1;
  55 static int brnf_filter_vlan_tagged = 1;
  56 #else
  57 #define brnf_filter_vlan_tagged 1
  58 #endif
  59
  60 #define IS_VLAN_IP (skb->protocol == __constant_htons(ETH_P_8021Q) &&    \
  61         hdr->h_vlan_encapsulated_proto == __constant_htons(ETH_P_IP) &&  \
  62         brnf_filter_vlan_tagged)
  63 #define IS_VLAN_ARP (skb->protocol == __constant_htons(ETH_P_8021Q) &&   \
  64         hdr->h_vlan_encapsulated_proto == __constant_htons(ETH_P_ARP) && \
  65         brnf_filter_vlan_tagged)
  66
  67 /* We need these fake structures to make netfilter happy --
  68  * lots of places assume that skb->dst != NULL, which isn't
  69  * all that unreasonable.
  70  *
  71  * Currently, we fill in the PMTU entry because netfilter
  72  * refragmentation needs it, and the rt_flags entry because
  73  * ipt_REJECT needs it.  Future netfilter modules might
  74  * require us to fill additional fields.
  75  */
  76 static struct net_device __fake_net_device = {
  77         .hard_header_len        = ETH_HLEN
  78 };
  79
  80 static struct rtable __fake_rtable = {
  81         .u = {
  82                 .dst = {
  83                         .__refcnt               = ATOMIC_INIT(1),
  84                         .dev                    = &__fake_net_device,
  85                         .path                   = &__fake_rtable.u.dst,
  86                         .metrics                = {[RTAX_MTU - 1] = 1500},
  87                 }
  88         },
  89         .rt_flags       = 0,
  90 };
  91
  92
  93 /* PF_BRIDGE/PRE_ROUTING *********************************************/
  94 static void __br_dnat_complain(void)
  95 {
  96         static unsigned long last_complaint;
  97
  98         if (jiffies - last_complaint >= 5 * HZ) {
  99                 printk(KERN_WARNING "Performing cross-bridge DNAT requires IP "
 100                         "forwarding to be enabled\n");
 101                 last_complaint = jiffies;
 102         }
 103 }
 104
 105
 106 /* This requires some explaining. If DNAT has taken place,
 107  * we will need to fix up the destination Ethernet address,
 108  * and this is a tricky process.
 109  *
 110  * There are two cases to consider:
 111  * 1. The packet was DNAT'ed to a device in the same bridge
 112  *    port group as it was received on. We can still bridge
 113  *    the packet.
 114  * 2. The packet was DNAT'ed to a different device, either
 115  *    a non-bridged device or another bridge port group.
 116  *    The packet will need to be routed.
 117  *
 118  * The correct way of distinguishing between these two cases is to
 119  * call ip_route_input() and to look at skb->dst->dev, which is
 120  * changed to the destination device if ip_route_input() succeeds.
 121  *
 122  * Let us first consider the case that ip_route_input() succeeds:
 123  *
 124  * If skb->dst->dev equals the logical bridge device the packet
 125  * came in on, we can consider this bridging. We then call
 126  * skb->dst->output() which will make the packet enter br_nf_local_out()
 127  * not much later. In that function it is assured that the iptables
 128  * FORWARD chain is traversed for the packet.
 129  *
 130  * Otherwise, the packet is considered to be routed and we just
 131  * change the destination MAC address so that the packet will
 132  * later be passed up to the IP stack to be routed.
 133  *
 134  * Let us now consider the case that ip_route_input() fails:
 135  *
 136  * After a "echo '0' > /proc/sys/net/ipv4/ip_forward" ip_route_input()
 137  * will fail, while __ip_route_output_key() will return success. The source
 138  * address for __ip_route_output_key() is set to zero, so __ip_route_output_key
 139  * thinks we're handling a locally generated packet and won't care
 140  * if IP forwarding is allowed. We send a warning message to the users's
 141  * log telling her to put IP forwarding on.
 142  *
 143  * ip_route_input() will also fail if there is no route available.
 144  * In that case we just drop the packet.
 145  *
 146  * --Lennert, 20020411
 147  * --Bart, 20020416 (updated)
 148  * --Bart, 20021007 (updated)
 149  */
 150
 151 static int br_nf_pre_routing_finish_bridge(struct sk_buff *skb)
 152 {
 153 #ifdef CONFIG_NETFILTER_DEBUG
 154         skb->nf_debug |= (1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_FORWARD);
 155 #endif
 156
 157         if (skb->pkt_type == PACKET_OTHERHOST) {
 158                 skb->pkt_type = PACKET_HOST;
 159                 skb->nf_bridge->mask |= BRNF_PKT_TYPE;
 160         }
 161         skb->nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
 162
 163         skb->dev = bridge_parent(skb->dev);
 164         if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
 165                 skb_pull(skb, VLAN_HLEN);
 166                 skb->nh.raw += VLAN_HLEN;
 167         }
 168         skb->dst->output(&skb);
 169         return 0;
 170 }
 171
 172 static int br_nf_pre_routing_finish(struct sk_buff *skb)
 173 {
 174         struct net_device *dev = skb->dev;
 175         struct iphdr *iph = skb->nh.iph;
 176         struct nf_bridge_info *nf_bridge = skb->nf_bridge;
 177
 178 #ifdef CONFIG_NETFILTER_DEBUG
 179         skb->nf_debug ^= (1 << NF_BR_PRE_ROUTING);
 180 #endif
 181
 182         if (nf_bridge->mask & BRNF_PKT_TYPE) {
 183                 skb->pkt_type = PACKET_OTHERHOST;
 184                 nf_bridge->mask ^= BRNF_PKT_TYPE;
 185         }
 186         nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
 187
 188         if (dnat_took_place(skb)) {
 189                 if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos,
 190                     dev)) {
 191                         struct rtable *rt;
 192                         struct flowi fl = { .nl_u =
 193                         { .ip4_u = { .daddr = iph->daddr, .saddr = 0 ,
 194                                      .tos = RT_TOS(iph->tos)} }, .proto = 0};
 195
 196                         if (!ip_route_output_key(&rt, &fl)) {
 197                                 /* Bridged-and-DNAT'ed traffic doesn't
 198                                  * require ip_forwarding.
 199                                  */
 200                                 if (((struct dst_entry *)rt)->dev == dev) {
 201                                         skb->dst = (struct dst_entry *)rt;
 202                                         goto bridged_dnat;
 203                                 }
 204                                 __br_dnat_complain();
 205                                 dst_release((struct dst_entry *)rt);
 206                         }
 207                         kfree_skb(skb);
 208                         return 0;
 209                 } else {
 210                         if (skb->dst->dev == dev) {
 211 bridged_dnat:
 212                                 /* Tell br_nf_local_out this is a
 213                                  * bridged frame
 214                                  */
 215                                 nf_bridge->mask |= BRNF_BRIDGED_DNAT;
 216                                 skb->dev = nf_bridge->physindev;
 217                                 if (skb->protocol ==
 218                                     __constant_htons(ETH_P_8021Q)) {
 219                                         skb_push(skb, VLAN_HLEN);
 220                                         skb->nh.raw -= VLAN_HLEN;
 221                                 }
 222                                 NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING,
 223                                                skb, skb->dev, NULL,
 224                                                br_nf_pre_routing_finish_bridge,
 225                                                1);
 226                                 return 0;
 227                         }
 228                         memcpy(skb->mac.ethernet->h_dest, dev->dev_addr,
 229                                ETH_ALEN);
 230                         skb->pkt_type = PACKET_HOST;
 231                 }
 232         } else {
 233                 skb->dst = (struct dst_entry *)&__fake_rtable;
 234                 dst_hold(skb->dst);
 235         }
 236
 237         skb->dev = nf_bridge->physindev;
 238         if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
 239                 skb_push(skb, VLAN_HLEN);
 240                 skb->nh.raw -= VLAN_HLEN;
 241         }
 242         NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
 243                        br_handle_frame_finish, 1);
 244
 245         return 0;
 246 }
 247
 248 /* Replicate the checks that IPv4 does on packet reception.
 249  * Set skb->dev to the bridge device (i.e. parent of the
 250  * receiving device) to make netfilter happy, the REDIRECT
 251  * target in particular.  Save the original destination IP
 252  * address to be able to detect DNAT afterwards.
 253  */
 254 static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
 255    const struct net_device *in, const struct net_device *out,
 256    int (*okfn)(struct sk_buff *))
 257 {
 258         struct iphdr *iph;
 259         __u32 len;
 260         struct sk_buff *skb = *pskb;
 261         struct nf_bridge_info *nf_bridge;
 262
 263 #ifdef CONFIG_SYSCTL
 264         if (!brnf_call_iptables)
 265                 return NF_ACCEPT;
 266 #endif
 267
 268         if (skb->protocol != __constant_htons(ETH_P_IP)) {
 269                 struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)
 270                                           ((*pskb)->mac.ethernet);
 271
 272                 if (!IS_VLAN_IP)
 273                         return NF_ACCEPT;
 274                 if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
 275                         goto out;
 276                 skb_pull(*pskb, VLAN_HLEN);
 277                 (*pskb)->nh.raw += VLAN_HLEN;
 278         } else if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
 279                 goto out;
 280
 281         if (!pskb_may_pull(skb, sizeof(struct iphdr)))
 282                 goto inhdr_error;
 283
 284         iph = skb->nh.iph;
 285         if (iph->ihl < 5 || iph->version != 4)
 286                 goto inhdr_error;
 287
 288         if (!pskb_may_pull(skb, 4*iph->ihl))
 289                 goto inhdr_error;
 290
 291         iph = skb->nh.iph;
 292         if (ip_fast_csum((__u8 *)iph, iph->ihl) != 0)
 293                 goto inhdr_error;
 294
 295         len = ntohs(iph->tot_len);
 296         if (skb->len < len || len < 4*iph->ihl)
 297                 goto inhdr_error;
 298
 299         if (skb->len > len) {
 300                 __pskb_trim(skb, len);
 301                 if (skb->ip_summed == CHECKSUM_HW)
 302                         skb->ip_summed = CHECKSUM_NONE;
 303         }
 304
 305 #ifdef CONFIG_NETFILTER_DEBUG
 306         skb->nf_debug ^= (1 << NF_IP_PRE_ROUTING);
 307 #endif
 308         if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
 309                 return NF_DROP;
 310
 311         if (skb->pkt_type == PACKET_OTHERHOST) {
 312                 skb->pkt_type = PACKET_HOST;
 313                 nf_bridge->mask |= BRNF_PKT_TYPE;
 314         }
 315
 316         nf_bridge->mask |= BRNF_NF_BRIDGE_PREROUTING;
 317         nf_bridge->physindev = skb->dev;
 318         skb->dev = bridge_parent(skb->dev);
 319         store_orig_dstaddr(skb);
 320
 321         NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL,
 322                 br_nf_pre_routing_finish);
 323
 324         return NF_STOLEN;
 325
 326 inhdr_error:
 327 //      IP_INC_STATS_BH(IpInHdrErrors);
 328 out:
 329         return NF_DROP;
 330 }
 331
 332
 333 /* PF_BRIDGE/LOCAL_IN ************************************************/
 334 /* The packet is locally destined, which requires a real
 335  * dst_entry, so detach the fake one.  On the way up, the
 336  * packet would pass through PRE_ROUTING again (which already
 337  * took place when the packet entered the bridge), but we
 338  * register an IPv4 PRE_ROUTING 'sabotage' hook that will
 339  * prevent this from happening.
 340  */
 341 static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff **pskb,
 342    const struct net_device *in, const struct net_device *out,
 343    int (*okfn)(struct sk_buff *))
 344 {
 345         struct sk_buff *skb = *pskb;
 346
 347         if (skb->dst == (struct dst_entry *)&__fake_rtable) {
 348                 dst_release(skb->dst);
 349                 skb->dst = NULL;
 350         }
 351
 352         return NF_ACCEPT;
 353 }
 354
 355
 356 /* PF_BRIDGE/FORWARD *************************************************/
 357 static int br_nf_forward_finish(struct sk_buff *skb)
 358 {
 359         struct nf_bridge_info *nf_bridge = skb->nf_bridge;
 360         struct net_device *in;
 361         struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)(skb->mac.ethernet);
 362
 363 #ifdef CONFIG_NETFILTER_DEBUG
 364         skb->nf_debug ^= (1 << NF_BR_FORWARD);
 365 #endif
 366
 367         if (skb->protocol == __constant_htons(ETH_P_IP) || IS_VLAN_IP) {
 368                 in = nf_bridge->physindev;
 369                 if (nf_bridge->mask & BRNF_PKT_TYPE) {
 370                         skb->pkt_type = PACKET_OTHERHOST;
 371                         nf_bridge->mask ^= BRNF_PKT_TYPE;
 372                 }
 373         } else {
 374                 in = *((struct net_device **)(skb->cb));
 375         }
 376         if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
 377                 skb_push(skb, VLAN_HLEN);
 378                 skb->nh.raw -= VLAN_HLEN;
 379         }
 380         NF_HOOK_THRESH(PF_BRIDGE, NF_BR_FORWARD, skb, in,
 381                         skb->dev, br_forward_finish, 1);
 382         return 0;
 383 }
 384
 385 /* This is the 'purely bridged' case.  For IP, we pass the packet to
 386  * netfilter with indev and outdev set to the bridge device,
 387  * but we are still able to filter on the 'real' indev/outdev
 388  * because of the ipt_physdev.c module. For ARP, indev and outdev are the
 389  * bridge ports.
 390  */
 391 static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff **pskb,
 392    const struct net_device *in, const struct net_device *out,
 393    int (*okfn)(struct sk_buff *))
 394 {
 395         struct sk_buff *skb = *pskb;
 396         struct nf_bridge_info *nf_bridge;
 397         struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)(skb->mac.ethernet);
 398
 399 #ifdef CONFIG_SYSCTL
 400         if (!skb->nf_bridge)
 401                 return NF_ACCEPT;
 402 #endif
 403
 404         if (skb->protocol != __constant_htons(ETH_P_IP)) {
 405                 if (!IS_VLAN_IP)
 406                         return NF_ACCEPT;
 407                 skb_pull(*pskb, VLAN_HLEN);
 408                 (*pskb)->nh.raw += VLAN_HLEN;
 409         }
 410
 411 #ifdef CONFIG_NETFILTER_DEBUG
 412         skb->nf_debug ^= (1 << NF_BR_FORWARD);
 413 #endif
 414         nf_bridge = skb->nf_bridge;
 415         if (skb->pkt_type == PACKET_OTHERHOST) {
 416                 skb->pkt_type = PACKET_HOST;
 417                 nf_bridge->mask |= BRNF_PKT_TYPE;
 418         }
 419
 420         /* The physdev module checks on this */
 421         nf_bridge->mask |= BRNF_BRIDGED;
 422         nf_bridge->physoutdev = skb->dev;
 423
 424         NF_HOOK(PF_INET, NF_IP_FORWARD, skb, bridge_parent(in),
 425                 bridge_parent(out), br_nf_forward_finish);
 426
 427         return NF_STOLEN;
 428 }
 429
 430 static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff **pskb,
 431    const struct net_device *in, const struct net_device *out,
 432    int (*okfn)(struct sk_buff *))
 433 {
 434         struct sk_buff *skb = *pskb;
 435         struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)(skb->mac.ethernet);
 436         struct net_device **d = (struct net_device **)(skb->cb);
 437
 438 #ifdef CONFIG_SYSCTL
 439         if (!brnf_call_arptables)
 440                 return NF_ACCEPT;
 441 #endif
 442
 443         if (skb->protocol != __constant_htons(ETH_P_ARP)) {
 444                 if (!IS_VLAN_ARP)
 445                         return NF_ACCEPT;
 446                 skb_pull(*pskb, VLAN_HLEN);
 447                 (*pskb)->nh.raw += VLAN_HLEN;
 448         }
 449
 450 #ifdef CONFIG_NETFILTER_DEBUG
 451         skb->nf_debug ^= (1 << NF_BR_FORWARD);
 452 #endif
 453
 454         if (skb->nh.arph->ar_pln != 4) {
 455                 if (IS_VLAN_ARP) {
 456                         skb_push(*pskb, VLAN_HLEN);
 457                         (*pskb)->nh.raw -= VLAN_HLEN;
 458                 }
 459                 return NF_ACCEPT;
 460         }
 461         *d = (struct net_device *)in;
 462         NF_HOOK(NF_ARP, NF_ARP_FORWARD, skb, (struct net_device *)in,
 463                 (struct net_device *)out, br_nf_forward_finish);
 464
 465         return NF_STOLEN;
 466 }
 467
 468
 469 /* PF_BRIDGE/LOCAL_OUT ***********************************************/
 470 static int br_nf_local_out_finish(struct sk_buff *skb)
 471 {
 472 #ifdef CONFIG_NETFILTER_DEBUG
 473         skb->nf_debug &= ~(1 << NF_BR_LOCAL_OUT);
 474 #endif
 475         if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
 476                 skb_push(skb, VLAN_HLEN);
 477                 skb->nh.raw -= VLAN_HLEN;
 478         }
 479
 480         NF_HOOK_THRESH(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
 481                         br_forward_finish, NF_BR_PRI_FIRST + 1);
 482
 483         return 0;
 484 }
 485
 486
 487 /* This function sees both locally originated IP packets and forwarded
 488  * IP packets (in both cases the destination device is a bridge
 489  * device). It also sees bridged-and-DNAT'ed packets.
 490  * To be able to filter on the physical bridge devices (with the ipt_physdev.c
 491  * module), we steal packets destined to a bridge device away from the
 492  * PF_INET/FORWARD and PF_INET/OUTPUT hook functions, and give them back later,
 493  * when we have determined the real output device. This is done in here.
 494  *
 495  * If (nf_bridge->mask & BRNF_BRIDGED_DNAT) then the packet is bridged
 496  * and we fake the PF_BRIDGE/FORWARD hook. The function br_nf_forward()
 497  * will then fake the PF_INET/FORWARD hook. br_nf_local_out() has priority
 498  * NF_BR_PRI_FIRST, so no relevant PF_BRIDGE/INPUT functions have been nor
 499  * will be executed.
 500  * Otherwise, if nf_bridge->physindev is NULL, the bridge-nf code never touched
 501  * this packet before, and so the packet was locally originated. We fake
 502  * the PF_INET/LOCAL_OUT hook.
 503  * Finally, if nf_bridge->physindev isn't NULL, then the packet was IP routed,
 504  * so we fake the PF_INET/FORWARD hook. ipv4_sabotage_out() makes sure
 505  * even routed packets that didn't arrive on a bridge interface have their
 506  * nf_bridge->physindev set.
 507  */
 508
 509 static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff **pskb,
 510    const struct net_device *in, const struct net_device *out,
 511    int (*_okfn)(struct sk_buff *))
 512 {
 513         int (*okfn)(struct sk_buff *skb);
 514         struct net_device *realindev;
 515         struct sk_buff *skb = *pskb;
 516         struct nf_bridge_info *nf_bridge;
 517         struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)(skb->mac.ethernet);
 518
 519 #ifdef CONFIG_SYSCTL
 520         if (!skb->nf_bridge)
 521                 return NF_ACCEPT;
 522 #endif
 523
 524         if (skb->protocol != __constant_htons(ETH_P_IP) && !IS_VLAN_IP)
 525                 return NF_ACCEPT;
 526
 527         /* Sometimes we get packets with NULL ->dst here (for example,
 528          * running a dhcp client daemon triggers this).
 529          */
 530         if (skb->dst == NULL)
 531                 return NF_ACCEPT;
 532
 533         nf_bridge = skb->nf_bridge;
 534         nf_bridge->physoutdev = skb->dev;
 535         realindev = nf_bridge->physindev;
 536
 537         /* Bridged, take PF_BRIDGE/FORWARD.
 538          * (see big note in front of br_nf_pre_routing_finish)
 539          */
 540         if (nf_bridge->mask & BRNF_BRIDGED_DNAT) {
 541                 okfn = br_forward_finish;
 542
 543                 if (nf_bridge->mask & BRNF_PKT_TYPE) {
 544                         skb->pkt_type = PACKET_OTHERHOST;
 545                         nf_bridge->mask ^= BRNF_PKT_TYPE;
 546                 }
 547                 if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
 548                         skb_push(skb, VLAN_HLEN);
 549                         skb->nh.raw -= VLAN_HLEN;
 550                 }
 551
 552                 NF_HOOK(PF_BRIDGE, NF_BR_FORWARD, skb, realindev,
 553                         skb->dev, okfn);
 554         } else {
 555                 struct net_device *realoutdev = bridge_parent(skb->dev);
 556
 557 #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
 558                 /* iptables should match -o br0.x */
 559                 if (nf_bridge->netoutdev)
 560                         realoutdev = nf_bridge->netoutdev;
 561 #endif
 562                 okfn = br_nf_local_out_finish;
 563                 if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
 564                         skb_pull(skb, VLAN_HLEN);
 565                         (*pskb)->nh.raw += VLAN_HLEN;
 566                 }
 567                 /* IP forwarded traffic has a physindev, locally
 568                  * generated traffic hasn't.
 569                  */
 570                 if (realindev != NULL) {
 571                         if (((nf_bridge->mask & BRNF_DONT_TAKE_PARENT) == 0) &&
 572                             has_bridge_parent(realindev))
 573                                 realindev = bridge_parent(realindev);
 574                         NF_HOOK_THRESH(PF_INET, NF_IP_FORWARD, skb, realindev,
 575                                        realoutdev, okfn,
 576                                        NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD + 1);
 577                 } else {
 578 #ifdef CONFIG_NETFILTER_DEBUG
 579                         skb->nf_debug ^= (1 << NF_IP_LOCAL_OUT);
 580 #endif
 581
 582                         NF_HOOK_THRESH(PF_INET, NF_IP_LOCAL_OUT, skb, realindev,
 583                                        realoutdev, okfn,
 584                                        NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT + 1);
 585                 }
 586         }
 587
 588         return NF_STOLEN;
 589 }
 590
 591
 592 /* PF_BRIDGE/POST_ROUTING ********************************************/
 593 static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
 594    const struct net_device *in, const struct net_device *out,
 595    int (*okfn)(struct sk_buff *))
 596 {
 597         struct sk_buff *skb = *pskb;
 598         struct nf_bridge_info *nf_bridge = (*pskb)->nf_bridge;
 599         struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)(skb->mac.ethernet);
 600         struct net_device *realoutdev = bridge_parent(skb->dev);
 601
 602 #ifdef CONFIG_NETFILTER_DEBUG
 603         /* Be very paranoid. This probably won't happen anymore, but let's
 604          * keep the check just to be sure... */
 605         if (skb->mac.raw < skb->head || skb->mac.raw + ETH_HLEN > skb->data) {
 606                 printk(KERN_CRIT "br_netfilter: Argh!! br_nf_post_routing: "
 607                                  "bad mac.raw pointer.");
 608                 goto print_error;
 609         }
 610 #endif
 611
 612 #ifdef CONFIG_SYSCTL
 613         if (!nf_bridge)
 614                 return NF_ACCEPT;
 615 #endif
 616
 617         if (skb->protocol != __constant_htons(ETH_P_IP) && !IS_VLAN_IP)
 618                 return NF_ACCEPT;
 619
 620 #ifdef CONFIG_NETFILTER_DEBUG
 621         /* Sometimes we get packets with NULL ->dst here (for example,
 622          * running a dhcp client daemon triggers this). This should now
 623          * be fixed, but let's keep the check around.
 624          */
 625         if (skb->dst == NULL) {
 626                 printk(KERN_CRIT "br_netfilter: skb->dst == NULL.");
 627                 goto print_error;
 628         }
 629
 630         skb->nf_debug ^= (1 << NF_IP_POST_ROUTING);
 631 #endif
 632
 633         /* We assume any code from br_dev_queue_push_xmit onwards doesn't care
 634          * about the value of skb->pkt_type.
 635          */
 636         if (skb->pkt_type == PACKET_OTHERHOST) {
 637                 skb->pkt_type = PACKET_HOST;
 638                 nf_bridge->mask |= BRNF_PKT_TYPE;
 639         }
 640
 641         if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
 642                 skb_pull(skb, VLAN_HLEN);
 643                 skb->nh.raw += VLAN_HLEN;
 644         }
 645
 646         nf_bridge_save_header(skb);
 647
 648 #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
 649         if (nf_bridge->netoutdev)
 650                 realoutdev = nf_bridge->netoutdev;
 651 #endif
 652         NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL,
 653                 realoutdev, br_dev_queue_push_xmit);
 654
 655         return NF_STOLEN;
 656
 657 #ifdef CONFIG_NETFILTER_DEBUG
 658 print_error:
 659         if (skb->dev != NULL) {
 660                 printk("[%s]", skb->dev->name);
 661                 if (has_bridge_parent(skb->dev))
 662                         printk("[%s]", bridge_parent(skb->dev)->name);
 663         }
 664         printk(" head:%p, raw:%p, data:%p\n", skb->head, skb->mac.raw,
 665                                               skb->data);
 666         return NF_ACCEPT;
 667 #endif
 668 }
 669
 670
 671 /* IPv4/SABOTAGE *****************************************************/
 672
 673 /* Don't hand locally destined packets to PF_INET/PRE_ROUTING
 674  * for the second time.
 675  */
 676 static unsigned int ipv4_sabotage_in(unsigned int hook, struct sk_buff **pskb,
 677    const struct net_device *in, const struct net_device *out,
 678    int (*okfn)(struct sk_buff *))
 679 {
 680         if ((*pskb)->nf_bridge &&
 681             !((*pskb)->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)) {
 682                 okfn(*pskb);
 683                 return NF_STOLEN;
 684         }
 685
 686         return NF_ACCEPT;
 687 }
 688
 689 /* Postpone execution of PF_INET/FORWARD, PF_INET/LOCAL_OUT
 690  * and PF_INET/POST_ROUTING until we have done the forwarding
 691  * decision in the bridge code and have determined skb->physoutdev.
 692  */
 693 static unsigned int ipv4_sabotage_out(unsigned int hook, struct sk_buff **pskb,
 694    const struct net_device *in, const struct net_device *out,
 695    int (*okfn)(struct sk_buff *))
 696 {
 697         struct sk_buff *skb = *pskb;
 698
 699 #ifdef CONFIG_SYSCTL
 700         if (!brnf_call_iptables && !skb->nf_bridge)
 701                 return NF_ACCEPT;
 702 #endif
 703
 704         if ((out->hard_start_xmit == br_dev_xmit &&
 705             okfn != br_nf_forward_finish &&
 706             okfn != br_nf_local_out_finish &&
 707             okfn != br_dev_queue_push_xmit)
 708 #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
 709             || ((out->priv_flags & IFF_802_1Q_VLAN) &&
 710             VLAN_DEV_INFO(out)->real_dev->hard_start_xmit == br_dev_xmit)
 711 #endif
 712             ) {
 713                 struct nf_bridge_info *nf_bridge;
 714
 715                 if (!skb->nf_bridge && !nf_bridge_alloc(skb))
 716                         return NF_DROP;
 717
 718                 nf_bridge = skb->nf_bridge;
 719
 720                 /* This frame will arrive on PF_BRIDGE/LOCAL_OUT and we
 721                  * will need the indev then. For a brouter, the real indev
 722                  * can be a bridge port, so we make sure br_nf_local_out()
 723                  * doesn't use the bridge parent of the indev by using
 724                  * the BRNF_DONT_TAKE_PARENT mask.
 725                  */
 726                 if (hook == NF_IP_FORWARD && nf_bridge->physindev == NULL) {
 727                         nf_bridge->mask &= BRNF_DONT_TAKE_PARENT;
 728                         nf_bridge->physindev = (struct net_device *)in;
 729                 }
 730 #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
 731                 /* the iptables outdev is br0.x, not br0 */
 732                 if (out->priv_flags & IFF_802_1Q_VLAN)
 733                         nf_bridge->netoutdev = (struct net_device *)out;
 734 #endif
 735                 okfn(skb);
 736                 return NF_STOLEN;
 737         }
 738
 739         return NF_ACCEPT;
 740 }
 741
 742 /* For br_nf_local_out we need (prio = NF_BR_PRI_FIRST), to insure that innocent
 743  * PF_BRIDGE/NF_BR_LOCAL_OUT functions don't get bridged traffic as input.
 744  * For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
 745  * ip_refrag() can return NF_STOLEN.
 746  */
 747 static struct nf_hook_ops br_nf_ops[] = {
 748         { .hook = br_nf_pre_routing,
 749           .owner = THIS_MODULE,
 750           .pf = PF_BRIDGE,
 751           .hooknum = NF_BR_PRE_ROUTING,
 752           .priority = NF_BR_PRI_BRNF, },
 753         { .hook = br_nf_local_in,
 754           .owner = THIS_MODULE,
 755           .pf = PF_BRIDGE,
 756           .hooknum = NF_BR_LOCAL_IN,
 757           .priority = NF_BR_PRI_BRNF, },
 758         { .hook = br_nf_forward_ip,
 759           .owner = THIS_MODULE,
 760           .pf = PF_BRIDGE,
 761           .hooknum = NF_BR_FORWARD,
 762           .priority = NF_BR_PRI_BRNF - 1, },
 763         { .hook = br_nf_forward_arp,
 764           .owner = THIS_MODULE,
 765           .pf = PF_BRIDGE,
 766           .hooknum = NF_BR_FORWARD,
 767           .priority = NF_BR_PRI_BRNF, },
 768         { .hook = br_nf_local_out,
 769           .owner = THIS_MODULE,
 770           .pf = PF_BRIDGE,
 771           .hooknum = NF_BR_LOCAL_OUT,
 772           .priority = NF_BR_PRI_FIRST, },
 773         { .hook = br_nf_post_routing,
 774           .owner = THIS_MODULE,
 775           .pf = PF_BRIDGE,
 776           .hooknum = NF_BR_POST_ROUTING,
 777           .priority = NF_BR_PRI_LAST, },
 778         { .hook = ipv4_sabotage_in,
 779           .owner = THIS_MODULE,
 780           .pf = PF_INET,
 781           .hooknum = NF_IP_PRE_ROUTING,
 782           .priority = NF_IP_PRI_FIRST, },
 783         { .hook = ipv4_sabotage_out,
 784           .owner = THIS_MODULE,
 785           .pf = PF_INET,
 786           .hooknum = NF_IP_FORWARD,
 787           .priority = NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD, },
 788         { .hook = ipv4_sabotage_out,
 789           .owner = THIS_MODULE,
 790           .pf = PF_INET,
 791           .hooknum = NF_IP_LOCAL_OUT,
 792           .priority = NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT, },
 793         { .hook = ipv4_sabotage_out,
 794           .owner = THIS_MODULE,
 795           .pf = PF_INET,
 796           .hooknum = NF_IP_POST_ROUTING,
 797           .priority = NF_IP_PRI_FIRST, },
 798 };
 799
 800 #ifdef CONFIG_SYSCTL
 801 static
 802 int brnf_sysctl_call_tables(ctl_table *ctl, int write, struct file * filp,
 803                         void __user *buffer, size_t *lenp)
 804 {
 805         int ret;
 806
 807         ret = proc_dointvec(ctl, write, filp, buffer, lenp);
 808
 809         if (write && *(int *)(ctl->data))
 810                 *(int *)(ctl->data) = 1;
 811         return ret;
 812 }
 813
 814 static ctl_table brnf_table[] = {
 815         {
 816                 .ctl_name       = NET_BRIDGE_NF_CALL_ARPTABLES,
 817                 .procname       = "bridge-nf-call-arptables",
 818                 .data           = &brnf_call_arptables,
 819                 .maxlen         = sizeof(int),
 820                 .mode           = 0644,
 821                 .proc_handler   = &brnf_sysctl_call_tables,
 822         },
 823         {
 824                 .ctl_name       = NET_BRIDGE_NF_CALL_IPTABLES,
 825                 .procname       = "bridge-nf-call-iptables",
 826                 .data           = &brnf_call_iptables,
 827                 .maxlen         = sizeof(int),
 828                 .mode           = 0644,
 829                 .proc_handler   = &brnf_sysctl_call_tables,
 830         },
 831         {
 832                 .ctl_name       = NET_BRIDGE_NF_FILTER_VLAN_TAGGED,
 833                 .procname       = "bridge-nf-filter-vlan-tagged",
 834                 .data           = &brnf_filter_vlan_tagged,
 835                 .maxlen         = sizeof(int),
 836                 .mode           = 0644,
 837                 .proc_handler   = &brnf_sysctl_call_tables,
 838         },
 839         { .ctl_name = 0 }
 840 };
 841
 842 static ctl_table brnf_bridge_table[] = {
 843         {
 844                 .ctl_name       = NET_BRIDGE,
 845                 .procname       = "bridge",
 846                 .mode           = 0555,
 847                 .child          = brnf_table,
 848         },
 849         { .ctl_name = 0 }
 850 };
 851
 852 static ctl_table brnf_net_table[] = {
 853         {
 854                 .ctl_name       = CTL_NET,
 855                 .procname       = "net",
 856                 .mode           = 0555,
 857                 .child          = brnf_bridge_table,
 858         },
 859         { .ctl_name = 0 }
 860 };
 861 #endif
 862
 863 int br_netfilter_init(void)
 864 {
 865         int i;
 866
 867         for (i = 0; i < ARRAY_SIZE(br_nf_ops); i++) {
 868                 int ret;
 869
 870                 if ((ret = nf_register_hook(&br_nf_ops[i])) >= 0)
 871                         continue;
 872
 873                 while (i--)
 874                         nf_unregister_hook(&br_nf_ops[i]);
 875
 876                 return ret;
 877         }
 878
 879 #ifdef CONFIG_SYSCTL
 880         brnf_sysctl_header = register_sysctl_table(brnf_net_table, 0);
 881         if (brnf_sysctl_header == NULL) {
 882                 printk(KERN_WARNING "br_netfilter: can't register to sysctl.\n");
 883                 for (i = 0; i < ARRAY_SIZE(br_nf_ops); i++)
 884                         nf_unregister_hook(&br_nf_ops[i]);
 885                 return -EFAULT;
 886         }
 887 #endif
 888
 889         printk(KERN_NOTICE "Bridge firewalling registered\n");
 890
 891         return 0;
 892 }
 893
 894 void br_netfilter_fini(void)
 895 {
 896         int i;
 897
 898         for (i = ARRAY_SIZE(br_nf_ops) - 1; i >= 0; i--)
 899                 nf_unregister_hook(&br_nf_ops[i]);
 900 #ifdef CONFIG_SYSCTL
 901         unregister_sysctl_table(brnf_sysctl_header);
 902 #endif
 903 }