1 // SPDX-License-Identifier: GPL-2.0-or-later
4 * Linux ethernet bridge
7 * Lennert Buytenhek <buytenh@gnu.org>
8 * Bart De Schuymer <bdschuym@pandora.be>
10 * Lennert dedicates this file to Kerstin Wurdinger.
13 #include <linux/module.h>
14 #include <linux/kernel.h>
15 #include <linux/slab.h>
17 #include <linux/netdevice.h>
18 #include <linux/skbuff.h>
19 #include <linux/if_arp.h>
20 #include <linux/if_ether.h>
21 #include <linux/if_vlan.h>
22 #include <linux/if_pppox.h>
23 #include <linux/ppp_defs.h>
24 #include <linux/netfilter_bridge.h>
25 #include <linux/netfilter_ipv4.h>
26 #include <linux/netfilter_ipv6.h>
27 #include <linux/netfilter_arp.h>
28 #include <linux/in_route.h>
29 #include <linux/inetdevice.h>
33 #include <net/addrconf.h>
34 #include <net/route.h>
35 #include <net/netfilter/br_netfilter.h>
37 #include <linux/uaccess.h>
38 #include "br_private.h"
40 #include <linux/sysctl.h>
43 int br_validate_ipv6(struct net *net, struct sk_buff *skb)
45 const struct ipv6hdr *hdr;
46 struct inet6_dev *idev = __in6_dev_get(skb->dev);
48 u8 ip6h_len = sizeof(struct ipv6hdr);
50 if (!pskb_may_pull(skb, ip6h_len))
53 if (skb->len < ip6h_len)
58 if (hdr->version != 6)
61 pkt_len = ntohs(hdr->payload_len);
62 if (hdr->nexthdr == NEXTHDR_HOP && nf_ip6_check_hbh_len(skb, &pkt_len))
65 if (pkt_len + ip6h_len > skb->len) {
66 __IP6_INC_STATS(net, idev,
67 IPSTATS_MIB_INTRUNCATEDPKTS);
70 if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
71 __IP6_INC_STATS(net, idev,
72 IPSTATS_MIB_INDISCARDS);
76 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
77 /* No IP options in IPv6 header; however it should be
78 * checked if some next headers need special treatment
83 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
89 br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
90 const struct nf_bridge_info *nf_bridge)
92 return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
93 sizeof(ipv6_hdr(skb)->daddr)) != 0;
96 /* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
97 * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
98 * for br_nf_pre_routing_finish(), same logic is used here but
99 * equivalent IPv6 function ip6_route_input() called indirectly.
101 static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb)
103 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
105 struct net_device *dev = skb->dev;
106 const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
108 nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
110 if (nf_bridge->pkt_otherhost) {
111 skb->pkt_type = PACKET_OTHERHOST;
112 nf_bridge->pkt_otherhost = false;
114 nf_bridge->in_prerouting = 0;
115 if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
117 v6ops->route_input(skb);
119 if (skb_dst(skb)->error) {
124 if (skb_dst(skb)->dev == dev) {
125 skb->dev = nf_bridge->physindev;
126 nf_bridge_update_protocol(skb);
127 nf_bridge_push_encap_header(skb);
128 br_nf_hook_thresh(NF_BR_PRE_ROUTING,
129 net, sk, skb, skb->dev, NULL,
130 br_nf_pre_routing_finish_bridge);
133 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
134 skb->pkt_type = PACKET_HOST;
136 rt = bridge_parent_rtable(nf_bridge->physindev);
142 skb_dst_set_noref(skb, &rt->dst);
145 skb->dev = nf_bridge->physindev;
146 nf_bridge_update_protocol(skb);
147 nf_bridge_push_encap_header(skb);
148 br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb,
149 skb->dev, NULL, br_handle_frame_finish);
154 /* Replicate the checks that IPv6 does on packet reception and pass the packet
157 unsigned int br_nf_pre_routing_ipv6(void *priv,
159 const struct nf_hook_state *state)
161 struct nf_bridge_info *nf_bridge;
163 if (br_validate_ipv6(state->net, skb))
166 nf_bridge = nf_bridge_alloc(skb);
169 if (!setup_pre_routing(skb, state->net))
172 nf_bridge = nf_bridge_info_get(skb);
173 nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
175 skb->protocol = htons(ETH_P_IPV6);
176 skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);
178 NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
180 br_nf_pre_routing_finish_ipv6);