[deliverable/linux.git] / net / bridge / netfilter / nf_tables_bridge.c

/*
 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
 * Copyright (c) 2013 Pablo Neira Ayuso <pablo@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Development of this code funded by Astaro AG (http://www.astaro.com/)
 */

#include <linux/init.h>
#include <linux/module.h>
#include <linux/netfilter_bridge.h>
#include <net/netfilter/nf_tables.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <net/netfilter/nf_tables_ipv4.h>
#include <net/netfilter/nf_tables_ipv6.h>

static unsigned int
nft_do_chain_bridge(void *priv,
		    struct sk_buff *skb,
		    const struct nf_hook_state *state)
{
	struct nft_pktinfo pkt;

	switch (eth_hdr(skb)->h_proto) {
	case htons(ETH_P_IP):
		nft_set_pktinfo_ipv4_validate(&pkt, skb, state);
		break;
	case htons(ETH_P_IPV6):
		nft_set_pktinfo_ipv6_validate(&pkt, skb, state);
		break;
	default:
		nft_set_pktinfo_unspec(&pkt, skb, state);
		break;
	}

	return nft_do_chain(&pkt, priv);
}

static struct nft_af_info nft_af_bridge __read_mostly = {
	.family		= NFPROTO_BRIDGE,
	.nhooks		= NF_BR_NUMHOOKS,
	.owner		= THIS_MODULE,
	.nops		= 1,
	.hooks		= {
		[NF_BR_PRE_ROUTING]	= nft_do_chain_bridge,
		[NF_BR_LOCAL_IN]	= nft_do_chain_bridge,
		[NF_BR_FORWARD]		= nft_do_chain_bridge,
		[NF_BR_LOCAL_OUT]	= nft_do_chain_bridge,
		[NF_BR_POST_ROUTING]	= nft_do_chain_bridge,
	},
};

static int nf_tables_bridge_init_net(struct net *net)
{
	net->nft.bridge = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);
	if (net->nft.bridge == NULL)
		return -ENOMEM;

	memcpy(net->nft.bridge, &nft_af_bridge, sizeof(nft_af_bridge));

	if (nft_register_afinfo(net, net->nft.bridge) < 0)
		goto err;

	return 0;
err:
	kfree(net->nft.bridge);
	return -ENOMEM;
}

static void nf_tables_bridge_exit_net(struct net *net)
{
	nft_unregister_afinfo(net, net->nft.bridge);
	kfree(net->nft.bridge);
}

static struct pernet_operations nf_tables_bridge_net_ops = {
	.init	= nf_tables_bridge_init_net,
	.exit	= nf_tables_bridge_exit_net,
};

static const struct nf_chain_type filter_bridge = {
	.name		= "filter",
	.type		= NFT_CHAIN_T_DEFAULT,
	.family		= NFPROTO_BRIDGE,
	.owner		= THIS_MODULE,
	.hook_mask	= (1 << NF_BR_PRE_ROUTING) |
			  (1 << NF_BR_LOCAL_IN) |
			  (1 << NF_BR_FORWARD) |
			  (1 << NF_BR_LOCAL_OUT) |
			  (1 << NF_BR_POST_ROUTING),
};

static void nf_br_saveroute(const struct sk_buff *skb,
			    struct nf_queue_entry *entry)
{
}

static int nf_br_reroute(struct net *net, struct sk_buff *skb,
			 const struct nf_queue_entry *entry)
{
	return 0;
}

static __sum16 nf_br_checksum(struct sk_buff *skb, unsigned int hook,
			      unsigned int dataoff, u_int8_t protocol)
{
	return 0;
}

static __sum16 nf_br_checksum_partial(struct sk_buff *skb, unsigned int hook,
				      unsigned int dataoff, unsigned int len,
				      u_int8_t protocol)
{
	return 0;
}

static int nf_br_route(struct net *net, struct dst_entry **dst,
		       struct flowi *fl, bool strict __always_unused)
{
	return 0;
}

static const struct nf_afinfo nf_br_afinfo = {
	.family                 = AF_BRIDGE,
	.checksum               = nf_br_checksum,
	.checksum_partial       = nf_br_checksum_partial,
	.route                  = nf_br_route,
	.saveroute              = nf_br_saveroute,
	.reroute                = nf_br_reroute,
	.route_key_size         = 0,
};

static int __init nf_tables_bridge_init(void)
{
	int ret;

	nf_register_afinfo(&nf_br_afinfo);
	ret = nft_register_chain_type(&filter_bridge);
	if (ret < 0)
		goto err1;

	ret = register_pernet_subsys(&nf_tables_bridge_net_ops);
	if (ret < 0)
		goto err2;

	return ret;

err2:
	nft_unregister_chain_type(&filter_bridge);
err1:
	nf_unregister_afinfo(&nf_br_afinfo);
	return ret;
}

static void __exit nf_tables_bridge_exit(void)
{
	unregister_pernet_subsys(&nf_tables_bridge_net_ops);
	nft_unregister_chain_type(&filter_bridge);
	nf_unregister_afinfo(&nf_br_afinfo);
}

module_init(nf_tables_bridge_init);
module_exit(nf_tables_bridge_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_ALIAS_NFT_FAMILY(AF_BRIDGE);
Commit	Line	Data
96518518 PM	1	/*
96518518 PM	2	* Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
46413825	3	* Copyright (c) 2013 Pablo Neira Ayuso <pablo@netfilter.org>
96518518 PM	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation.
	8	*
	9	* Development of this code funded by Astaro AG (http://www.astaro.com/)
	10	*/
	11
	12	#include <linux/init.h>
	13	#include <linux/module.h>
	14	#include <linux/netfilter_bridge.h>
	15	#include <net/netfilter/nf_tables.h>
68b0faa8 AN	16	#include <linux/ip.h>
68b0faa8 AN	17	#include <linux/ipv6.h>
1b63d4b9 AN	18	#include <net/netfilter/nf_tables_ipv4.h>
1b63d4b9 AN	19	#include <net/netfilter/nf_tables_ipv6.h>
68b0faa8	20
3b088c4b	21	static unsigned int
06198b34	22	nft_do_chain_bridge(void *priv,
3b088c4b	23	struct sk_buff *skb,
238e54c9	24	const struct nf_hook_state *state)
3b088c4b PM	25	{
	26	struct nft_pktinfo pkt;
	27
1b63d4b9 AN	28	switch (eth_hdr(skb)->h_proto) {
1b63d4b9 AN	29	case htons(ETH_P_IP):
10151d7b	30	nft_set_pktinfo_ipv4_validate(&pkt, skb, state);
1b63d4b9 AN	31	break;
1b63d4b9 AN	32	case htons(ETH_P_IPV6):
10151d7b	33	nft_set_pktinfo_ipv6_validate(&pkt, skb, state);
1b63d4b9 AN	34	break;
1b63d4b9 AN	35	default:
beac5afa	36	nft_set_pktinfo_unspec(&pkt, skb, state);
1b63d4b9 AN	37	break;
1b63d4b9 AN	38	}
3b088c4b	39
06198b34	40	return nft_do_chain(&pkt, priv);
3b088c4b PM	41	}
3b088c4b PM	42
96518518 PM	43	static struct nft_af_info nft_af_bridge __read_mostly = {
	44	.family = NFPROTO_BRIDGE,
	45	.nhooks = NF_BR_NUMHOOKS,
	46	.owner = THIS_MODULE,
115a60b1	47	.nops = 1,
3b088c4b	48	.hooks = {
36d2af59	49	[NF_BR_PRE_ROUTING] = nft_do_chain_bridge,
3b088c4b PM	50	[NF_BR_LOCAL_IN] = nft_do_chain_bridge,
	51	[NF_BR_FORWARD] = nft_do_chain_bridge,
	52	[NF_BR_LOCAL_OUT] = nft_do_chain_bridge,
36d2af59	53	[NF_BR_POST_ROUTING] = nft_do_chain_bridge,
3b088c4b	54	},
96518518 PM	55	};
96518518 PM	56
99633ab2 PNA	57	static int nf_tables_bridge_init_net(struct net *net)
	58	{
	59	net->nft.bridge = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);
	60	if (net->nft.bridge == NULL)
	61	return -ENOMEM;
	62
	63	memcpy(net->nft.bridge, &nft_af_bridge, sizeof(nft_af_bridge));
	64
	65	if (nft_register_afinfo(net, net->nft.bridge) < 0)
	66	goto err;
	67
	68	return 0;
	69	err:
	70	kfree(net->nft.bridge);
	71	return -ENOMEM;
	72	}
	73
	74	static void nf_tables_bridge_exit_net(struct net *net)
	75	{
df05ef87	76	nft_unregister_afinfo(net, net->nft.bridge);
99633ab2 PNA	77	kfree(net->nft.bridge);
	78	}
	79
	80	static struct pernet_operations nf_tables_bridge_net_ops = {
	81	.init = nf_tables_bridge_init_net,
	82	.exit = nf_tables_bridge_exit_net,
	83	};
	84
2a37d755	85	static const struct nf_chain_type filter_bridge = {
46413825 PNA	86	.name = "filter",
46413825 PNA	87	.type = NFT_CHAIN_T_DEFAULT,
fa2c1de0 PM	88	.family = NFPROTO_BRIDGE,
fa2c1de0 PM	89	.owner = THIS_MODULE,
4d87716c PNA	90	.hook_mask = (1 << NF_BR_PRE_ROUTING) \|
4d87716c PNA	91	(1 << NF_BR_LOCAL_IN) \|
46413825	92	(1 << NF_BR_FORWARD) \|
4d87716c PNA	93	(1 << NF_BR_LOCAL_OUT) \|
4d87716c PNA	94	(1 << NF_BR_POST_ROUTING),
46413825 PNA	95	};
46413825 PNA	96
ac286344 SB	97	static void nf_br_saveroute(const struct sk_buff *skb,
	98	struct nf_queue_entry *entry)
	99	{
	100	}
	101
	102	static int nf_br_reroute(struct net net, struct sk_buff skb,
	103	const struct nf_queue_entry *entry)
	104	{
	105	return 0;
	106	}
	107
	108	static __sum16 nf_br_checksum(struct sk_buff *skb, unsigned int hook,
	109	unsigned int dataoff, u_int8_t protocol)
	110	{
	111	return 0;
	112	}
	113
	114	static __sum16 nf_br_checksum_partial(struct sk_buff *skb, unsigned int hook,
	115	unsigned int dataoff, unsigned int len,
	116	u_int8_t protocol)
	117	{
	118	return 0;
	119	}
	120
	121	static int nf_br_route(struct net net, struct dst_entry *dst,
	122	struct flowi *fl, bool strict __always_unused)
	123	{
	124	return 0;
	125	}
	126
	127	static const struct nf_afinfo nf_br_afinfo = {
	128	.family = AF_BRIDGE,
	129	.checksum = nf_br_checksum,
	130	.checksum_partial = nf_br_checksum_partial,
	131	.route = nf_br_route,
	132	.saveroute = nf_br_saveroute,
	133	.reroute = nf_br_reroute,
	134	.route_key_size = 0,
	135	};
	136
96518518 PM	137	static int __init nf_tables_bridge_init(void)
96518518 PM	138	{
46413825 PNA	139	int ret;
46413825 PNA	140
ac286344	141	nf_register_afinfo(&nf_br_afinfo);
23d07508 GF	142	ret = nft_register_chain_type(&filter_bridge);
	143	if (ret < 0)
	144	goto err1;
	145
46413825	146	ret = register_pernet_subsys(&nf_tables_bridge_net_ops);
23d07508 GF	147	if (ret < 0)
	148	goto err2;
	149
	150	return ret;
	151
	152	err2:
	153	nft_unregister_chain_type(&filter_bridge);
	154	err1:
	155	nf_unregister_afinfo(&nf_br_afinfo);
46413825	156	return ret;
96518518 PM	157	}
	158
	159	static void __exit nf_tables_bridge_exit(void)
	160	{
46413825 PNA	161	unregister_pernet_subsys(&nf_tables_bridge_net_ops);
46413825 PNA	162	nft_unregister_chain_type(&filter_bridge);
ac286344	163	nf_unregister_afinfo(&nf_br_afinfo);
96518518 PM	164	}
	165
	166	module_init(nf_tables_bridge_init);
	167	module_exit(nf_tables_bridge_exit);
	168
	169	MODULE_LICENSE("GPL");
	170	MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
	171	MODULE_ALIAS_NFT_FAMILY(AF_BRIDGE);