net/ipv6/netfilter/ip6t_dst.c

   1 /* Kernel module to match Hop-by-Hop and Destination parameters. */
   2 #include <linux/module.h>
   3 #include <linux/skbuff.h>
   4 #include <linux/ipv6.h>
   5 #include <linux/types.h>
   6 #include <net/checksum.h>
   7 #include <net/ipv6.h>
   8
   9 #include <asm/byteorder.h>
  10
  11 #include <linux/netfilter_ipv6/ip6_tables.h>
  12 #include <linux/netfilter_ipv6/ip6t_opts.h>
  13
  14 #define HOPBYHOP        0
  15
  16 EXPORT_NO_SYMBOLS;
  17 MODULE_LICENSE("GPL");
  18 #if HOPBYHOP
  19 MODULE_DESCRIPTION("IPv6 HbH match");
  20 #else
  21 MODULE_DESCRIPTION("IPv6 DST match");
  22 #endif
  23 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
  24
  25 #if 0
  26 #define DEBUGP printk
  27 #else
  28 #define DEBUGP(format, args...)
  29 #endif
  30
  31 /*
  32  * (Type & 0xC0) >> 6
  33  *      0       -> ignorable
  34  *      1       -> must drop the packet
  35  *      2       -> send ICMP PARM PROB regardless and drop packet
  36  *      3       -> Send ICMP if not a multicast address and drop packet
  37  *  (Type & 0x20) >> 5
  38  *      0       -> invariant
  39  *      1       -> can change the routing
  40  *  (Type & 0x1F) Type
  41  *      0       -> Pad1 (only 1 byte!)
  42  *      1       -> PadN LENGTH info (total length = length + 2)
  43  *      C0 | 2  -> JUMBO 4 x x x x ( xxxx > 64k )
  44  *      5       -> RTALERT 2 x x
  45  */
  46
  47 static int
  48 match(const struct sk_buff *skb,
  49       const struct net_device *in,
  50       const struct net_device *out,
  51       const void *matchinfo,
  52       int offset,
  53       const void *protohdr,
  54       u_int16_t datalen,
  55       int *hotdrop)
  56 {
  57        struct ipv6_opt_hdr *optsh = NULL;
  58        const struct ip6t_opts *optinfo = matchinfo;
  59        unsigned int temp;
  60        unsigned int len;
  61        u8 nexthdr;
  62        unsigned int ptr;
  63        unsigned int hdrlen = 0;
  64        unsigned int ret = 0;
  65        u8 *opttype = NULL;
  66        unsigned int optlen;
  67
  68        /* type of the 1st exthdr */
  69        nexthdr = skb->nh.ipv6h->nexthdr;
  70        /* pointer to the 1st exthdr */
  71        ptr = sizeof(struct ipv6hdr);
  72        /* available length */
  73        len = skb->len - ptr;
  74        temp = 0;
  75
  76         while (ip6t_ext_hdr(nexthdr)) {
  77                struct ipv6_opt_hdr *hdr;
  78
  79               DEBUGP("ipv6_opts header iteration \n");
  80
  81               /* Is there enough space for the next ext header? */
  82                 if (len < (int)sizeof(struct ipv6_opt_hdr))
  83                         return 0;
  84               /* No more exthdr -> evaluate */
  85                 if (nexthdr == NEXTHDR_NONE) {
  86                      break;
  87               }
  88               /* ESP -> evaluate */
  89                 if (nexthdr == NEXTHDR_ESP) {
  90                      break;
  91               }
  92
  93               hdr = (void *)(skb->data + ptr);
  94
  95               /* Calculate the header length */
  96                 if (nexthdr == NEXTHDR_FRAGMENT) {
  97                         hdrlen = 8;
  98                 } else if (nexthdr == NEXTHDR_AUTH)
  99                         hdrlen = (hdr->hdrlen+2)<<2;
 100                 else
 101                         hdrlen = ipv6_optlen(hdr);
 102
 103               /* OPTS -> evaluate */
 104 #if HOPBYHOP
 105                 if (nexthdr == NEXTHDR_HOP) {
 106                      temp |= MASK_HOPOPTS;
 107 #else
 108                 if (nexthdr == NEXTHDR_DEST) {
 109                      temp |= MASK_DSTOPTS;
 110 #endif
 111                      break;
 112               }
 113
 114
 115               /* set the flag */
 116               switch (nexthdr){
 117                      case NEXTHDR_HOP:
 118                      case NEXTHDR_ROUTING:
 119                      case NEXTHDR_FRAGMENT:
 120                      case NEXTHDR_AUTH:
 121                      case NEXTHDR_DEST:
 122                             break;
 123                      default:
 124                             DEBUGP("ipv6_opts match: unknown nextheader %u\n",nexthdr);
 125                             return 0;
 126                             break;
 127               }
 128
 129                 nexthdr = hdr->nexthdr;
 130                 len -= hdrlen;
 131                 ptr += hdrlen;
 132                 if ( ptr > skb->len ) {
 133                         DEBUGP("ipv6_opts: new pointer is too large! \n");
 134                         break;
 135                 }
 136         }
 137
 138        /* OPTIONS header not found */
 139 #if HOPBYHOP
 140        if ( temp != MASK_HOPOPTS ) return 0;
 141 #else
 142        if ( temp != MASK_DSTOPTS ) return 0;
 143 #endif
 144
 145        if (len < (int)sizeof(struct ipv6_opt_hdr)){
 146                *hotdrop = 1;
 147                 return 0;
 148        }
 149
 150        if (len < hdrlen){
 151                /* Packet smaller than it's length field */
 152                 return 0;
 153        }
 154
 155        optsh = (void *)(skb->data + ptr);
 156
 157        DEBUGP("IPv6 OPTS LEN %u %u ", hdrlen, optsh->hdrlen);
 158
 159        DEBUGP("len %02X %04X %02X ",
 160                 optinfo->hdrlen, hdrlen,
 161                 (!(optinfo->flags & IP6T_OPTS_LEN) ||
 162                            ((optinfo->hdrlen == hdrlen) ^
 163                            !!(optinfo->invflags & IP6T_OPTS_INV_LEN))));
 164
 165        ret = (optsh != NULL)
 166                 &&
 167                 (!(optinfo->flags & IP6T_OPTS_LEN) ||
 168                            ((optinfo->hdrlen == hdrlen) ^
 169                            !!(optinfo->invflags & IP6T_OPTS_INV_LEN)));
 170
 171        ptr += 2;
 172        hdrlen -= 2;
 173        if ( !(optinfo->flags & IP6T_OPTS_OPTS) ){
 174                return ret;
 175         } else {
 176                 DEBUGP("Strict ");
 177                 DEBUGP("#%d ",optinfo->optsnr);
 178                 for(temp=0; temp<optinfo->optsnr; temp++){
 179                         /* type field exists ? */
 180                         if (ptr > skb->len - 1 || hdrlen < 1)
 181                                 break;
 182                         opttype = (void *)(skb->data + ptr);
 183
 184                         /* Type check */
 185                         if (*opttype != (optinfo->opts[temp] & 0xFF00)>>8){
 186                                 DEBUGP("Tbad %02X %02X\n",
 187                                        *opttype,
 188                                        (optinfo->opts[temp] & 0xFF00)>>8);
 189                                 return 0;
 190                         } else {
 191                                 DEBUGP("Tok ");
 192                         }
 193                         /* Length check */
 194                         if (*opttype) {
 195                                 u16 spec_len;
 196
 197                                 /* length field exists ? */
 198                                 if (ptr > skb->len - 2 || hdrlen < 2)
 199                                         break;
 200                                 optlen = *((u8 *)(skb->data + ptr + 1));
 201                                 spec_len = optinfo->opts[temp] & 0x00FF;
 202
 203                                 if (spec_len != 0x00FF && spec_len != optlen) {
 204                                         DEBUGP("Lbad %02X %04X\n", optlen,
 205                                                spec_len);
 206                                         return 0;
 207                                 }
 208                                 DEBUGP("Lok ");
 209                                 optlen += 2;
 210                         } else {
 211                                 DEBUGP("Pad1\n");
 212                                 optlen = 1;
 213                         }
 214
 215                         /* Step to the next */
 216                         DEBUGP("len%04X \n", optlen);
 217
 218                         if ((ptr > skb->len - optlen || hdrlen < optlen) &&
 219                             (temp < optinfo->optsnr - 1)) {
 220                                 DEBUGP("new pointer is too large! \n");
 221                                 break;
 222                         }
 223                         ptr += optlen;
 224                         hdrlen -= optlen;
 225                 }
 226                 if (temp == optinfo->optsnr)
 227                         return ret;
 228                 else return 0;
 229         }
 230
 231         return 0;
 232 }
 233
 234 /* Called when user tries to insert an entry of this type. */
 235 static int
 236 checkentry(const char *tablename,
 237           const struct ip6t_ip6 *ip,
 238           void *matchinfo,
 239           unsigned int matchinfosize,
 240           unsigned int hook_mask)
 241 {
 242        const struct ip6t_opts *optsinfo = matchinfo;
 243
 244        if (matchinfosize != IP6T_ALIGN(sizeof(struct ip6t_opts))) {
 245               DEBUGP("ip6t_opts: matchsize %u != %u\n",
 246                       matchinfosize, IP6T_ALIGN(sizeof(struct ip6t_opts)));
 247               return 0;
 248        }
 249        if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) {
 250               DEBUGP("ip6t_opts: unknown flags %X\n",
 251                       optsinfo->invflags);
 252               return 0;
 253        }
 254        if (optsinfo->flags & IP6T_OPTS_NSTRICT) {
 255                DEBUGP("ip6t_opts: Not strict - not implemented");
 256                return 0;
 257        }
 258
 259        return 1;
 260 }
 261
 262 static struct ip6t_match opts_match
 263 #if HOPBYHOP
 264 = { { NULL, NULL }, "hbh", &match, &checkentry, NULL, THIS_MODULE };
 265 #else
 266 = { { NULL, NULL }, "dst", &match, &checkentry, NULL, THIS_MODULE };
 267 #endif
 268
 269 static int __init init(void)
 270 {
 271        return ip6t_register_match(&opts_match);
 272 }
 273
 274 static void __exit cleanup(void)
 275 {
 276        ip6t_unregister_match(&opts_match);
 277 }
 278
 279 module_init(init);
 280 module_exit(cleanup);