2 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
3 * Copyright (c) 2013 Pablo Neira Ayuso <pablo@netfilter.org>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Development of this code funded by Astaro AG (http://www.astaro.com/)
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/netfilter_bridge.h>
15 #include <net/netfilter/nf_tables.h>
16 #include <net/netfilter/nf_tables_bridge.h>
18 #include <linux/ipv6.h>
19 #include <net/netfilter/nf_tables_ipv4.h>
20 #include <net/netfilter/nf_tables_ipv6.h>
22 int nft_bridge_iphdr_validate(struct sk_buff *skb)
27 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
31 if (iph->ihl < 5 || iph->version != 4)
34 len = ntohs(iph->tot_len);
37 else if (len < (iph->ihl*4))
40 if (!pskb_may_pull(skb, iph->ihl*4))
45 EXPORT_SYMBOL_GPL(nft_bridge_iphdr_validate);
47 int nft_bridge_ip6hdr_validate(struct sk_buff *skb)
52 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
56 if (hdr->version != 6)
59 pkt_len = ntohs(hdr->payload_len);
60 if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
65 EXPORT_SYMBOL_GPL(nft_bridge_ip6hdr_validate);
67 static inline void nft_bridge_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
68 const struct nf_hook_ops *ops,
70 const struct nf_hook_state *state)
72 if (nft_bridge_iphdr_validate(skb))
73 nft_set_pktinfo_ipv4(pkt, ops, skb, state);
75 nft_set_pktinfo(pkt, ops, skb, state);
78 static inline void nft_bridge_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
79 const struct nf_hook_ops *ops,
81 const struct nf_hook_state *state)
83 #if IS_ENABLED(CONFIG_IPV6)
84 if (nft_bridge_ip6hdr_validate(skb) &&
85 nft_set_pktinfo_ipv6(pkt, ops, skb, state) == 0)
88 nft_set_pktinfo(pkt, ops, skb, state);
92 nft_do_chain_bridge(const struct nf_hook_ops *ops,
94 const struct nf_hook_state *state)
96 struct nft_pktinfo pkt;
98 switch (eth_hdr(skb)->h_proto) {
100 nft_bridge_set_pktinfo_ipv4(&pkt, ops, skb, state);
102 case htons(ETH_P_IPV6):
103 nft_bridge_set_pktinfo_ipv6(&pkt, ops, skb, state);
106 nft_set_pktinfo(&pkt, ops, skb, state);
110 return nft_do_chain(&pkt, ops);
113 static struct nft_af_info nft_af_bridge __read_mostly = {
114 .family = NFPROTO_BRIDGE,
115 .nhooks = NF_BR_NUMHOOKS,
116 .owner = THIS_MODULE,
119 [NF_BR_PRE_ROUTING] = nft_do_chain_bridge,
120 [NF_BR_LOCAL_IN] = nft_do_chain_bridge,
121 [NF_BR_FORWARD] = nft_do_chain_bridge,
122 [NF_BR_LOCAL_OUT] = nft_do_chain_bridge,
123 [NF_BR_POST_ROUTING] = nft_do_chain_bridge,
127 static int nf_tables_bridge_init_net(struct net *net)
129 net->nft.bridge = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);
130 if (net->nft.bridge == NULL)
133 memcpy(net->nft.bridge, &nft_af_bridge, sizeof(nft_af_bridge));
135 if (nft_register_afinfo(net, net->nft.bridge) < 0)
140 kfree(net->nft.bridge);
144 static void nf_tables_bridge_exit_net(struct net *net)
146 nft_unregister_afinfo(net->nft.bridge);
147 kfree(net->nft.bridge);
150 static struct pernet_operations nf_tables_bridge_net_ops = {
151 .init = nf_tables_bridge_init_net,
152 .exit = nf_tables_bridge_exit_net,
155 static const struct nf_chain_type filter_bridge = {
157 .type = NFT_CHAIN_T_DEFAULT,
158 .family = NFPROTO_BRIDGE,
159 .owner = THIS_MODULE,
160 .hook_mask = (1 << NF_BR_PRE_ROUTING) |
161 (1 << NF_BR_LOCAL_IN) |
162 (1 << NF_BR_FORWARD) |
163 (1 << NF_BR_LOCAL_OUT) |
164 (1 << NF_BR_POST_ROUTING),
167 static int __init nf_tables_bridge_init(void)
171 nft_register_chain_type(&filter_bridge);
172 ret = register_pernet_subsys(&nf_tables_bridge_net_ops);
174 nft_unregister_chain_type(&filter_bridge);
179 static void __exit nf_tables_bridge_exit(void)
181 unregister_pernet_subsys(&nf_tables_bridge_net_ops);
182 nft_unregister_chain_type(&filter_bridge);
185 module_init(nf_tables_bridge_init);
186 module_exit(nf_tables_bridge_exit);
188 MODULE_LICENSE("GPL");
189 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
190 MODULE_ALIAS_NFT_FAMILY(AF_BRIDGE);