2 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
3 * Copyright (c) 2013 Pablo Neira Ayuso <pablo@netfilter.org>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Development of this code funded by Astaro AG (http://www.astaro.com/)
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/netfilter_bridge.h>
15 #include <net/netfilter/nf_tables.h>
16 #include <net/netfilter/nf_tables_bridge.h>
18 #include <linux/ipv6.h>
19 #include <net/netfilter/nf_tables_ipv4.h>
20 #include <net/netfilter/nf_tables_ipv6.h>
22 int nft_bridge_iphdr_validate(struct sk_buff *skb)
27 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
31 if (iph->ihl < 5 || iph->version != 4)
34 len = ntohs(iph->tot_len);
37 else if (len < (iph->ihl*4))
40 if (!pskb_may_pull(skb, iph->ihl*4))
45 EXPORT_SYMBOL_GPL(nft_bridge_iphdr_validate);
47 int nft_bridge_ip6hdr_validate(struct sk_buff *skb)
52 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
56 if (hdr->version != 6)
59 pkt_len = ntohs(hdr->payload_len);
60 if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
65 EXPORT_SYMBOL_GPL(nft_bridge_ip6hdr_validate);
67 static inline void nft_bridge_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
69 const struct nf_hook_state *state)
71 if (nft_bridge_iphdr_validate(skb))
72 nft_set_pktinfo_ipv4(pkt, skb, state);
74 nft_set_pktinfo(pkt, skb, state);
77 static inline void nft_bridge_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
79 const struct nf_hook_state *state)
81 #if IS_ENABLED(CONFIG_IPV6)
82 if (nft_bridge_ip6hdr_validate(skb) &&
83 nft_set_pktinfo_ipv6(pkt, skb, state) == 0)
86 nft_set_pktinfo(pkt, skb, state);
90 nft_do_chain_bridge(void *priv,
92 const struct nf_hook_state *state)
94 struct nft_pktinfo pkt;
96 switch (eth_hdr(skb)->h_proto) {
98 nft_bridge_set_pktinfo_ipv4(&pkt, skb, state);
100 case htons(ETH_P_IPV6):
101 nft_bridge_set_pktinfo_ipv6(&pkt, skb, state);
104 nft_set_pktinfo(&pkt, skb, state);
108 return nft_do_chain(&pkt, priv);
111 static struct nft_af_info nft_af_bridge __read_mostly = {
112 .family = NFPROTO_BRIDGE,
113 .nhooks = NF_BR_NUMHOOKS,
114 .owner = THIS_MODULE,
117 [NF_BR_PRE_ROUTING] = nft_do_chain_bridge,
118 [NF_BR_LOCAL_IN] = nft_do_chain_bridge,
119 [NF_BR_FORWARD] = nft_do_chain_bridge,
120 [NF_BR_LOCAL_OUT] = nft_do_chain_bridge,
121 [NF_BR_POST_ROUTING] = nft_do_chain_bridge,
125 static int nf_tables_bridge_init_net(struct net *net)
127 net->nft.bridge = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);
128 if (net->nft.bridge == NULL)
131 memcpy(net->nft.bridge, &nft_af_bridge, sizeof(nft_af_bridge));
133 if (nft_register_afinfo(net, net->nft.bridge) < 0)
138 kfree(net->nft.bridge);
142 static void nf_tables_bridge_exit_net(struct net *net)
144 nft_unregister_afinfo(net->nft.bridge);
145 kfree(net->nft.bridge);
148 static struct pernet_operations nf_tables_bridge_net_ops = {
149 .init = nf_tables_bridge_init_net,
150 .exit = nf_tables_bridge_exit_net,
153 static const struct nf_chain_type filter_bridge = {
155 .type = NFT_CHAIN_T_DEFAULT,
156 .family = NFPROTO_BRIDGE,
157 .owner = THIS_MODULE,
158 .hook_mask = (1 << NF_BR_PRE_ROUTING) |
159 (1 << NF_BR_LOCAL_IN) |
160 (1 << NF_BR_FORWARD) |
161 (1 << NF_BR_LOCAL_OUT) |
162 (1 << NF_BR_POST_ROUTING),
165 static int __init nf_tables_bridge_init(void)
169 nft_register_chain_type(&filter_bridge);
170 ret = register_pernet_subsys(&nf_tables_bridge_net_ops);
172 nft_unregister_chain_type(&filter_bridge);
177 static void __exit nf_tables_bridge_exit(void)
179 unregister_pernet_subsys(&nf_tables_bridge_net_ops);
180 nft_unregister_chain_type(&filter_bridge);
183 module_init(nf_tables_bridge_init);
184 module_exit(nf_tables_bridge_exit);
186 MODULE_LICENSE("GPL");
187 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
188 MODULE_ALIAS_NFT_FAMILY(AF_BRIDGE);