2 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
3 * Copyright (c) 2013 Pablo Neira Ayuso <pablo@netfilter.org>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Development of this code funded by Astaro AG (http://www.astaro.com/)
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/netfilter_bridge.h>
15 #include <net/netfilter/nf_tables.h>
16 #include <net/netfilter/nf_tables_bridge.h>
18 #include <linux/ipv6.h>
19 #include <net/netfilter/nf_tables_ipv4.h>
20 #include <net/netfilter/nf_tables_ipv6.h>
22 int nft_bridge_iphdr_validate(struct sk_buff *skb)
27 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
31 if (iph->ihl < 5 || iph->version != 4)
34 len = ntohs(iph->tot_len);
37 else if (len < (iph->ihl*4))
40 if (!pskb_may_pull(skb, iph->ihl*4))
45 EXPORT_SYMBOL_GPL(nft_bridge_iphdr_validate);
47 int nft_bridge_ip6hdr_validate(struct sk_buff *skb)
52 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
56 if (hdr->version != 6)
59 pkt_len = ntohs(hdr->payload_len);
60 if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
65 EXPORT_SYMBOL_GPL(nft_bridge_ip6hdr_validate);
67 static inline void nft_bridge_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
68 const struct nf_hook_ops *ops,
70 const struct net_device *in,
71 const struct net_device *out)
73 if (nft_bridge_iphdr_validate(skb))
74 nft_set_pktinfo_ipv4(pkt, ops, skb, in, out);
76 nft_set_pktinfo(pkt, ops, skb, in, out);
79 static inline void nft_bridge_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
80 const struct nf_hook_ops *ops,
82 const struct net_device *in,
83 const struct net_device *out)
85 #if IS_ENABLED(CONFIG_IPV6)
86 if (nft_bridge_ip6hdr_validate(skb) &&
87 nft_set_pktinfo_ipv6(pkt, ops, skb, in, out) == 0)
90 nft_set_pktinfo(pkt, ops, skb, in, out);
94 nft_do_chain_bridge(const struct nf_hook_ops *ops,
96 const struct net_device *in,
97 const struct net_device *out,
98 int (*okfn)(struct sk_buff *))
100 struct nft_pktinfo pkt;
102 switch (eth_hdr(skb)->h_proto) {
103 case htons(ETH_P_IP):
104 nft_bridge_set_pktinfo_ipv4(&pkt, ops, skb, in, out);
106 case htons(ETH_P_IPV6):
107 nft_bridge_set_pktinfo_ipv6(&pkt, ops, skb, in, out);
110 nft_set_pktinfo(&pkt, ops, skb, in, out);
114 return nft_do_chain(&pkt, ops);
117 static struct nft_af_info nft_af_bridge __read_mostly = {
118 .family = NFPROTO_BRIDGE,
119 .nhooks = NF_BR_NUMHOOKS,
120 .owner = THIS_MODULE,
123 [NF_BR_PRE_ROUTING] = nft_do_chain_bridge,
124 [NF_BR_LOCAL_IN] = nft_do_chain_bridge,
125 [NF_BR_FORWARD] = nft_do_chain_bridge,
126 [NF_BR_LOCAL_OUT] = nft_do_chain_bridge,
127 [NF_BR_POST_ROUTING] = nft_do_chain_bridge,
131 static int nf_tables_bridge_init_net(struct net *net)
133 net->nft.bridge = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);
134 if (net->nft.bridge == NULL)
137 memcpy(net->nft.bridge, &nft_af_bridge, sizeof(nft_af_bridge));
139 if (nft_register_afinfo(net, net->nft.bridge) < 0)
144 kfree(net->nft.bridge);
148 static void nf_tables_bridge_exit_net(struct net *net)
150 nft_unregister_afinfo(net->nft.bridge);
151 kfree(net->nft.bridge);
154 static struct pernet_operations nf_tables_bridge_net_ops = {
155 .init = nf_tables_bridge_init_net,
156 .exit = nf_tables_bridge_exit_net,
159 static const struct nf_chain_type filter_bridge = {
161 .type = NFT_CHAIN_T_DEFAULT,
162 .family = NFPROTO_BRIDGE,
163 .owner = THIS_MODULE,
164 .hook_mask = (1 << NF_BR_PRE_ROUTING) |
165 (1 << NF_BR_LOCAL_IN) |
166 (1 << NF_BR_FORWARD) |
167 (1 << NF_BR_LOCAL_OUT) |
168 (1 << NF_BR_POST_ROUTING),
171 static int __init nf_tables_bridge_init(void)
175 nft_register_chain_type(&filter_bridge);
176 ret = register_pernet_subsys(&nf_tables_bridge_net_ops);
178 nft_unregister_chain_type(&filter_bridge);
183 static void __exit nf_tables_bridge_exit(void)
185 unregister_pernet_subsys(&nf_tables_bridge_net_ops);
186 nft_unregister_chain_type(&filter_bridge);
189 module_init(nf_tables_bridge_init);
190 module_exit(nf_tables_bridge_exit);
192 MODULE_LICENSE("GPL");
193 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
194 MODULE_ALIAS_NFT_FAMILY(AF_BRIDGE);