Merge branch 'for-3.19/drivers' of git://git.kernel.dk/linux-block

[cascardo/linux.git] / net / bridge / netfilter / nf_tables_bridge.c

diff --git a/net/bridge/netfilter/nf_tables_bridge.c b/net/bridge/netfilter/nf_tables_bridge.c
index 074c557..19473a9 100644 (file)
--- a/net/bridge/netfilter/nf_tables_bridge.c
+++ b/net/bridge/netfilter/nf_tables_bridge.c
@@ -13,6 +13,82 @@
 #include <linux/module.h>
 #include <linux/netfilter_bridge.h>
 #include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables_bridge.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <net/netfilter/nf_tables_ipv4.h>
+#include <net/netfilter/nf_tables_ipv6.h>
+
+int nft_bridge_iphdr_validate(struct sk_buff *skb)
+{
+       struct iphdr *iph;
+       u32 len;
+
+       if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+               return 0;
+
+       iph = ip_hdr(skb);
+       if (iph->ihl < 5 || iph->version != 4)
+               return 0;
+
+       len = ntohs(iph->tot_len);
+       if (skb->len < len)
+               return 0;
+       else if (len < (iph->ihl*4))
+               return 0;
+
+       if (!pskb_may_pull(skb, iph->ihl*4))
+               return 0;
+
+       return 1;
+}
+EXPORT_SYMBOL_GPL(nft_bridge_iphdr_validate);
+
+int nft_bridge_ip6hdr_validate(struct sk_buff *skb)
+{
+       struct ipv6hdr *hdr;
+       u32 pkt_len;
+
+       if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
+               return 0;
+
+       hdr = ipv6_hdr(skb);
+       if (hdr->version != 6)
+               return 0;
+
+       pkt_len = ntohs(hdr->payload_len);
+       if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
+               return 0;
+
+       return 1;
+}
+EXPORT_SYMBOL_GPL(nft_bridge_ip6hdr_validate);
+
+static inline void nft_bridge_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
+                                              const struct nf_hook_ops *ops,
+                                              struct sk_buff *skb,
+                                              const struct net_device *in,
+                                              const struct net_device *out)
+{
+       if (nft_bridge_iphdr_validate(skb))
+               nft_set_pktinfo_ipv4(pkt, ops, skb, in, out);
+       else
+               nft_set_pktinfo(pkt, ops, skb, in, out);
+}
+
+static inline void nft_bridge_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
+                                             const struct nf_hook_ops *ops,
+                                             struct sk_buff *skb,
+                                             const struct net_device *in,
+                                             const struct net_device *out)
+{
+#if IS_ENABLED(CONFIG_IPV6)
+       if (nft_bridge_ip6hdr_validate(skb) &&
+           nft_set_pktinfo_ipv6(pkt, ops, skb, in, out) == 0)
+               return;
+#endif
+       nft_set_pktinfo(pkt, ops, skb, in, out);
+}
 
 static unsigned int
 nft_do_chain_bridge(const struct nf_hook_ops *ops,
@@ -23,7 +99,17 @@ nft_do_chain_bridge(const struct nf_hook_ops *ops,
 {
        struct nft_pktinfo pkt;
 
-       nft_set_pktinfo(&pkt, ops, skb, in, out);
+       switch (eth_hdr(skb)->h_proto) {
+       case htons(ETH_P_IP):
+               nft_bridge_set_pktinfo_ipv4(&pkt, ops, skb, in, out);
+               break;
+       case htons(ETH_P_IPV6):
+               nft_bridge_set_pktinfo_ipv6(&pkt, ops, skb, in, out);
+               break;
+       default:
+               nft_set_pktinfo(&pkt, ops, skb, in, out);
+               break;
+       }
 
        return nft_do_chain(&pkt, ops);
 }