]> git.karo-electronics.de Git - linux-beck.git/commitdiff
netfilter: bridge: split ipv6 code into separated file
authorPablo Neira Ayuso <pablo@netfilter.org>
Tue, 16 Jun 2015 12:07:03 +0000 (14:07 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Thu, 18 Jun 2015 19:14:21 +0000 (21:14 +0200)
Resolve compilation breakage when CONFIG_IPV6 is not set by moving the IPv6
code into a separated br_netfilter_ipv6.c file.

Fixes: efb6de9b4ba0 ("netfilter: bridge: forward IPv6 fragmented packets")
Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include/net/netfilter/br_netfilter.h
net/bridge/Makefile
net/bridge/br_netfilter_hooks.c
net/bridge/br_netfilter_ipv6.c [new file with mode: 0644]

index 2aa6048a55c1e099ee14caff579ac184e3643bc3..bab824bde92cabccb025a7de9030d033be1ffd7e 100644 (file)
@@ -1,6 +1,66 @@
 #ifndef _BR_NETFILTER_H_
 #define _BR_NETFILTER_H_
 
+#include "../../../net/bridge/br_private.h"
+
+static inline struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
+{
+       skb->nf_bridge = kzalloc(sizeof(struct nf_bridge_info), GFP_ATOMIC);
+
+       if (likely(skb->nf_bridge))
+               atomic_set(&(skb->nf_bridge->use), 1);
+
+       return skb->nf_bridge;
+}
+
+void nf_bridge_update_protocol(struct sk_buff *skb);
+
+static inline struct nf_bridge_info *
+nf_bridge_info_get(const struct sk_buff *skb)
+{
+       return skb->nf_bridge;
+}
+
+unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb);
+
+static inline void nf_bridge_push_encap_header(struct sk_buff *skb)
+{
+       unsigned int len = nf_bridge_encap_header_len(skb);
+
+       skb_push(skb, len);
+       skb->network_header -= len;
+}
+
+int br_nf_pre_routing_finish_bridge(struct sock *sk, struct sk_buff *skb);
+
+static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
+{
+       struct net_bridge_port *port;
+
+       port = br_port_get_rcu(dev);
+       return port ? &port->br->fake_rtable : NULL;
+}
+
+struct net_device *setup_pre_routing(struct sk_buff *skb);
 void br_netfilter_enable(void);
 
+#if IS_ENABLED(CONFIG_IPV6)
+int br_validate_ipv6(struct sk_buff *skb);
+unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,
+                                   struct sk_buff *skb,
+                                   const struct nf_hook_state *state);
+#else
+static inline int br_validate_ipv6(struct sk_buff *skb)
+{
+       return -1;
+}
+
+static inline unsigned int
+br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops, struct sk_buff *skb,
+                      const struct nf_hook_state *state)
+{
+       return NF_DROP;
+}
+#endif
+
 #endif /* _BR_NETFILTER_H_ */
index c52577ac718e8fd746f2821d6aba681b8b4eefdc..a1cda5d4718d98ddefbbfc6782bc37b296df3170 100644 (file)
@@ -13,6 +13,7 @@ bridge-$(CONFIG_SYSFS) += br_sysfs_if.o br_sysfs_br.o
 bridge-$(subst m,y,$(CONFIG_BRIDGE_NETFILTER)) += br_nf_core.o
 
 br_netfilter-y := br_netfilter_hooks.o
+br_netfilter-$(subst m,y,$(CONFIG_IPV6)) += br_netfilter_ipv6.o
 obj-$(CONFIG_BRIDGE_NETFILTER) += br_netfilter.o
 
 bridge-$(CONFIG_BRIDGE_IGMP_SNOOPING) += br_multicast.o br_mdb.o
index e4e5f2f29173f0fa6a50b815b9fad26febc9c5a7..d89f4fac0bc507cb3faea7782d9791d48a552fea 100644 (file)
@@ -123,11 +123,6 @@ struct brnf_frag_data {
 static DEFINE_PER_CPU(struct brnf_frag_data, brnf_frag_data_storage);
 #endif
 
-static struct nf_bridge_info *nf_bridge_info_get(const struct sk_buff *skb)
-{
-       return skb->nf_bridge;
-}
-
 static void nf_bridge_info_free(struct sk_buff *skb)
 {
        if (skb->nf_bridge) {
@@ -136,14 +131,6 @@ static void nf_bridge_info_free(struct sk_buff *skb)
        }
 }
 
-static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
-{
-       struct net_bridge_port *port;
-
-       port = br_port_get_rcu(dev);
-       return port ? &port->br->fake_rtable : NULL;
-}
-
 static inline struct net_device *bridge_parent(const struct net_device *dev)
 {
        struct net_bridge_port *port;
@@ -152,15 +139,6 @@ static inline struct net_device *bridge_parent(const struct net_device *dev)
        return port ? port->br->dev : NULL;
 }
 
-static inline struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
-{
-       skb->nf_bridge = kzalloc(sizeof(struct nf_bridge_info), GFP_ATOMIC);
-       if (likely(skb->nf_bridge))
-               atomic_set(&(skb->nf_bridge->use), 1);
-
-       return skb->nf_bridge;
-}
-
 static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
 {
        struct nf_bridge_info *nf_bridge = skb->nf_bridge;
@@ -178,7 +156,7 @@ static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
        return nf_bridge;
 }
 
-static unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb)
+unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb)
 {
        switch (skb->protocol) {
        case __cpu_to_be16(ETH_P_8021Q):
@@ -190,14 +168,6 @@ static unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb)
        }
 }
 
-static inline void nf_bridge_push_encap_header(struct sk_buff *skb)
-{
-       unsigned int len = nf_bridge_encap_header_len(skb);
-
-       skb_push(skb, len);
-       skb->network_header -= len;
-}
-
 static inline void nf_bridge_pull_encap_header(struct sk_buff *skb)
 {
        unsigned int len = nf_bridge_encap_header_len(skb);
@@ -267,112 +237,7 @@ drop:
        return -1;
 }
 
-/* We only check the length. A bridge shouldn't do any hop-by-hop stuff
- * anyway
- */
-static int check_hbh_len(struct sk_buff *skb)
-{
-       unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
-       u32 pkt_len;
-       const unsigned char *nh = skb_network_header(skb);
-       int off = raw - nh;
-       int len = (raw[1] + 1) << 3;
-
-       if ((raw + len) - skb->data > skb_headlen(skb))
-               goto bad;
-
-       off += 2;
-       len -= 2;
-
-       while (len > 0) {
-               int optlen = nh[off + 1] + 2;
-
-               switch (nh[off]) {
-               case IPV6_TLV_PAD1:
-                       optlen = 1;
-                       break;
-
-               case IPV6_TLV_PADN:
-                       break;
-
-               case IPV6_TLV_JUMBO:
-                       if (nh[off + 1] != 4 || (off & 3) != 2)
-                               goto bad;
-                       pkt_len = ntohl(*(__be32 *)(nh + off + 2));
-                       if (pkt_len <= IPV6_MAXPLEN ||
-                           ipv6_hdr(skb)->payload_len)
-                               goto bad;
-                       if (pkt_len > skb->len - sizeof(struct ipv6hdr))
-                               goto bad;
-                       if (pskb_trim_rcsum(skb,
-                                           pkt_len + sizeof(struct ipv6hdr)))
-                               goto bad;
-                       nh = skb_network_header(skb);
-                       break;
-               default:
-                       if (optlen > len)
-                               goto bad;
-                       break;
-               }
-               off += optlen;
-               len -= optlen;
-       }
-       if (len == 0)
-               return 0;
-bad:
-       return -1;
-}
-
-/* Equivalent to br_validate_ipv4 for IPv6 */
-static int br_validate_ipv6(struct sk_buff *skb)
-{
-       const struct ipv6hdr *hdr;
-       struct net_device *dev = skb->dev;
-       struct inet6_dev *idev = in6_dev_get(skb->dev);
-       u32 pkt_len;
-       u8 ip6h_len = sizeof(struct ipv6hdr);
-
-       if (!pskb_may_pull(skb, ip6h_len))
-               goto inhdr_error;
-
-       if (skb->len < ip6h_len)
-               goto drop;
-
-       hdr = ipv6_hdr(skb);
-
-       if (hdr->version != 6)
-               goto inhdr_error;
-
-       pkt_len = ntohs(hdr->payload_len);
-
-       if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
-               if (pkt_len + ip6h_len > skb->len) {
-                       IP6_INC_STATS_BH(dev_net(dev), idev,
-                                        IPSTATS_MIB_INTRUNCATEDPKTS);
-                       goto drop;
-               }
-               if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
-                       IP6_INC_STATS_BH(dev_net(dev), idev,
-                                        IPSTATS_MIB_INDISCARDS);
-                       goto drop;
-               }
-       }
-       if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb))
-               goto drop;
-
-       memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
-       /* No IP options in IPv6 header; however it should be
-        * checked if some next headers need special treatment
-        */
-       return 0;
-
-inhdr_error:
-       IP6_INC_STATS_BH(dev_net(dev), idev, IPSTATS_MIB_INHDRERRORS);
-drop:
-       return -1;
-}
-
-static void nf_bridge_update_protocol(struct sk_buff *skb)
+void nf_bridge_update_protocol(struct sk_buff *skb)
 {
        switch (skb->nf_bridge->orig_proto) {
        case BRNF_PROTO_8021Q:
@@ -391,7 +256,7 @@ static void nf_bridge_update_protocol(struct sk_buff *skb)
  * don't, we use the neighbour framework to find out. In both cases, we make
  * sure that br_handle_frame_finish() is called afterwards.
  */
-static int br_nf_pre_routing_finish_bridge(struct sock *sk, struct sk_buff *skb)
+int br_nf_pre_routing_finish_bridge(struct sock *sk, struct sk_buff *skb)
 {
        struct neighbour *neigh;
        struct dst_entry *dst;
@@ -431,77 +296,11 @@ free_skb:
        return 0;
 }
 
-static bool daddr_was_changed(const struct sk_buff *skb,
-                             const struct nf_bridge_info *nf_bridge)
+static inline bool
+br_nf_ipv4_daddr_was_changed(const struct sk_buff *skb,
+                            const struct nf_bridge_info *nf_bridge)
 {
-       switch (skb->protocol) {
-       case htons(ETH_P_IP):
-               return ip_hdr(skb)->daddr != nf_bridge->ipv4_daddr;
-       case htons(ETH_P_IPV6):
-               return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
-                             sizeof(ipv6_hdr(skb)->daddr)) != 0;
-       default:
-               return false;
-       }
-}
-
-/* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
- * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
- * for br_nf_pre_routing_finish(), same logic is used here but
- * equivalent IPv6 function ip6_route_input() called indirectly.
- */
-static int br_nf_pre_routing_finish_ipv6(struct sock *sk, struct sk_buff *skb)
-{
-       struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
-       struct rtable *rt;
-       struct net_device *dev = skb->dev;
-       const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
-
-       nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
-
-       if (nf_bridge->pkt_otherhost) {
-               skb->pkt_type = PACKET_OTHERHOST;
-               nf_bridge->pkt_otherhost = false;
-       }
-       nf_bridge->mask &= ~BRNF_NF_BRIDGE_PREROUTING;
-       if (daddr_was_changed(skb, nf_bridge)) {
-               skb_dst_drop(skb);
-               v6ops->route_input(skb);
-
-               if (skb_dst(skb)->error) {
-                       kfree_skb(skb);
-                       return 0;
-               }
-
-               if (skb_dst(skb)->dev == dev) {
-                       skb->dev = nf_bridge->physindev;
-                       nf_bridge_update_protocol(skb);
-                       nf_bridge_push_encap_header(skb);
-                       NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING,
-                                      sk, skb, skb->dev, NULL,
-                                      br_nf_pre_routing_finish_bridge,
-                                      1);
-                       return 0;
-               }
-               ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
-               skb->pkt_type = PACKET_HOST;
-       } else {
-               rt = bridge_parent_rtable(nf_bridge->physindev);
-               if (!rt) {
-                       kfree_skb(skb);
-                       return 0;
-               }
-               skb_dst_set_noref(skb, &rt->dst);
-       }
-
-       skb->dev = nf_bridge->physindev;
-       nf_bridge_update_protocol(skb);
-       nf_bridge_push_encap_header(skb);
-       NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, sk, skb,
-                      skb->dev, NULL,
-                      br_handle_frame_finish, 1);
-
-       return 0;
+       return ip_hdr(skb)->daddr != nf_bridge->ipv4_daddr;
 }
 
 /* This requires some explaining. If DNAT has taken place,
@@ -558,7 +357,7 @@ static int br_nf_pre_routing_finish(struct sock *sk, struct sk_buff *skb)
                nf_bridge->pkt_otherhost = false;
        }
        nf_bridge->mask &= ~BRNF_NF_BRIDGE_PREROUTING;
-       if (daddr_was_changed(skb, nf_bridge)) {
+       if (br_nf_ipv4_daddr_was_changed(skb, nf_bridge)) {
                if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
                        struct in_device *in_dev = __in_dev_get_rcu(dev);
 
@@ -636,7 +435,7 @@ static struct net_device *brnf_get_logical_dev(struct sk_buff *skb, const struct
 }
 
 /* Some common code for IPv4/IPv6 */
-static struct net_device *setup_pre_routing(struct sk_buff *skb)
+struct net_device *setup_pre_routing(struct sk_buff *skb)
 {
        struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
 
@@ -659,35 +458,6 @@ static struct net_device *setup_pre_routing(struct sk_buff *skb)
        return skb->dev;
 }
 
-/* Replicate the checks that IPv6 does on packet reception and pass the packet
- * to ip6tables.
- */
-static unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,
-                                          struct sk_buff *skb,
-                                          const struct nf_hook_state *state)
-{
-       struct nf_bridge_info *nf_bridge;
-
-       if (br_validate_ipv6(skb))
-               return NF_DROP;
-
-       nf_bridge_put(skb->nf_bridge);
-       if (!nf_bridge_alloc(skb))
-               return NF_DROP;
-       if (!setup_pre_routing(skb))
-               return NF_DROP;
-
-       nf_bridge = nf_bridge_info_get(skb);
-       nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
-
-       skb->protocol = htons(ETH_P_IPV6);
-       NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->sk, skb,
-               skb->dev, NULL,
-               br_nf_pre_routing_finish_ipv6);
-
-       return NF_STOLEN;
-}
-
 /* Direct IPv6 traffic to br_nf_pre_routing_ipv6.
  * Replicate the checks that IPv4 does on packet reception.
  * Set skb->dev to the bridge device (i.e. parent of the
diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c
new file mode 100644 (file)
index 0000000..6d12d26
--- /dev/null
@@ -0,0 +1,245 @@
+/*
+ *     Handle firewalling
+ *     Linux ethernet bridge
+ *
+ *     Authors:
+ *     Lennert Buytenhek               <buytenh@gnu.org>
+ *     Bart De Schuymer                <bdschuym@pandora.be>
+ *
+ *     This program is free software; you can redistribute it and/or
+ *     modify it under the terms of the GNU General Public License
+ *     as published by the Free Software Foundation; either version
+ *     2 of the License, or (at your option) any later version.
+ *
+ *     Lennert dedicates this file to Kerstin Wurdinger.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/ip.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/if_ether.h>
+#include <linux/if_vlan.h>
+#include <linux/if_pppox.h>
+#include <linux/ppp_defs.h>
+#include <linux/netfilter_bridge.h>
+#include <linux/netfilter_ipv4.h>
+#include <linux/netfilter_ipv6.h>
+#include <linux/netfilter_arp.h>
+#include <linux/in_route.h>
+#include <linux/inetdevice.h>
+
+#include <net/ip.h>
+#include <net/ipv6.h>
+#include <net/addrconf.h>
+#include <net/route.h>
+#include <net/netfilter/br_netfilter.h>
+
+#include <asm/uaccess.h>
+#include "br_private.h"
+#ifdef CONFIG_SYSCTL
+#include <linux/sysctl.h>
+#endif
+
+/* We only check the length. A bridge shouldn't do any hop-by-hop stuff
+ * anyway
+ */
+static int br_nf_check_hbh_len(struct sk_buff *skb)
+{
+       unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
+       u32 pkt_len;
+       const unsigned char *nh = skb_network_header(skb);
+       int off = raw - nh;
+       int len = (raw[1] + 1) << 3;
+
+       if ((raw + len) - skb->data > skb_headlen(skb))
+               goto bad;
+
+       off += 2;
+       len -= 2;
+
+       while (len > 0) {
+               int optlen = nh[off + 1] + 2;
+
+               switch (nh[off]) {
+               case IPV6_TLV_PAD1:
+                       optlen = 1;
+                       break;
+
+               case IPV6_TLV_PADN:
+                       break;
+
+               case IPV6_TLV_JUMBO:
+                       if (nh[off + 1] != 4 || (off & 3) != 2)
+                               goto bad;
+                       pkt_len = ntohl(*(__be32 *)(nh + off + 2));
+                       if (pkt_len <= IPV6_MAXPLEN ||
+                           ipv6_hdr(skb)->payload_len)
+                               goto bad;
+                       if (pkt_len > skb->len - sizeof(struct ipv6hdr))
+                               goto bad;
+                       if (pskb_trim_rcsum(skb,
+                                           pkt_len + sizeof(struct ipv6hdr)))
+                               goto bad;
+                       nh = skb_network_header(skb);
+                       break;
+               default:
+                       if (optlen > len)
+                               goto bad;
+                       break;
+               }
+               off += optlen;
+               len -= optlen;
+       }
+       if (len == 0)
+               return 0;
+bad:
+       return -1;
+}
+
+int br_validate_ipv6(struct sk_buff *skb)
+{
+       const struct ipv6hdr *hdr;
+       struct net_device *dev = skb->dev;
+       struct inet6_dev *idev = in6_dev_get(skb->dev);
+       u32 pkt_len;
+       u8 ip6h_len = sizeof(struct ipv6hdr);
+
+       if (!pskb_may_pull(skb, ip6h_len))
+               goto inhdr_error;
+
+       if (skb->len < ip6h_len)
+               goto drop;
+
+       hdr = ipv6_hdr(skb);
+
+       if (hdr->version != 6)
+               goto inhdr_error;
+
+       pkt_len = ntohs(hdr->payload_len);
+
+       if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
+               if (pkt_len + ip6h_len > skb->len) {
+                       IP6_INC_STATS_BH(dev_net(dev), idev,
+                                        IPSTATS_MIB_INTRUNCATEDPKTS);
+                       goto drop;
+               }
+               if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
+                       IP6_INC_STATS_BH(dev_net(dev), idev,
+                                        IPSTATS_MIB_INDISCARDS);
+                       goto drop;
+               }
+       }
+       if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb))
+               goto drop;
+
+       memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
+       /* No IP options in IPv6 header; however it should be
+        * checked if some next headers need special treatment
+        */
+       return 0;
+
+inhdr_error:
+       IP6_INC_STATS_BH(dev_net(dev), idev, IPSTATS_MIB_INHDRERRORS);
+drop:
+       return -1;
+}
+
+static inline bool
+br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
+                            const struct nf_bridge_info *nf_bridge)
+{
+       return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
+                     sizeof(ipv6_hdr(skb)->daddr)) != 0;
+}
+
+/* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
+ * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
+ * for br_nf_pre_routing_finish(), same logic is used here but
+ * equivalent IPv6 function ip6_route_input() called indirectly.
+ */
+static int br_nf_pre_routing_finish_ipv6(struct sock *sk, struct sk_buff *skb)
+{
+       struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
+       struct rtable *rt;
+       struct net_device *dev = skb->dev;
+       const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
+
+       nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
+
+       if (nf_bridge->pkt_otherhost) {
+               skb->pkt_type = PACKET_OTHERHOST;
+               nf_bridge->pkt_otherhost = false;
+       }
+       nf_bridge->mask &= ~BRNF_NF_BRIDGE_PREROUTING;
+       if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
+               skb_dst_drop(skb);
+               v6ops->route_input(skb);
+
+               if (skb_dst(skb)->error) {
+                       kfree_skb(skb);
+                       return 0;
+               }
+
+               if (skb_dst(skb)->dev == dev) {
+                       skb->dev = nf_bridge->physindev;
+                       nf_bridge_update_protocol(skb);
+                       nf_bridge_push_encap_header(skb);
+                       NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING,
+                                      sk, skb, skb->dev, NULL,
+                                      br_nf_pre_routing_finish_bridge,
+                                      1);
+                       return 0;
+               }
+               ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
+               skb->pkt_type = PACKET_HOST;
+       } else {
+               rt = bridge_parent_rtable(nf_bridge->physindev);
+               if (!rt) {
+                       kfree_skb(skb);
+                       return 0;
+               }
+               skb_dst_set_noref(skb, &rt->dst);
+       }
+
+       skb->dev = nf_bridge->physindev;
+       nf_bridge_update_protocol(skb);
+       nf_bridge_push_encap_header(skb);
+       NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, sk, skb,
+                      skb->dev, NULL,
+                      br_handle_frame_finish, 1);
+
+       return 0;
+}
+
+/* Replicate the checks that IPv6 does on packet reception and pass the packet
+ * to ip6tables.
+ */
+unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,
+                                   struct sk_buff *skb,
+                                   const struct nf_hook_state *state)
+{
+       struct nf_bridge_info *nf_bridge;
+
+       if (br_validate_ipv6(skb))
+               return NF_DROP;
+
+       nf_bridge_put(skb->nf_bridge);
+       if (!nf_bridge_alloc(skb))
+               return NF_DROP;
+       if (!setup_pre_routing(skb))
+               return NF_DROP;
+
+       nf_bridge = nf_bridge_info_get(skb);
+       nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
+
+       skb->protocol = htons(ETH_P_IPV6);
+       NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->sk, skb,
+               skb->dev, NULL,
+               br_nf_pre_routing_finish_ipv6);
+
+       return NF_STOLEN;
+}