net/ipv6/netfilter/ip6t_hbh.c

   1 /* Kernel module to match Hop-by-Hop and Destination parameters. */
   2 #include <linux/module.h>
   3 #include <linux/skbuff.h>
   4 #include <linux/ipv6.h>
   5 #include <linux/types.h>
   6 #include <net/checksum.h>
   7 #include <net/ipv6.h>
   8
   9 #include <asm/byteorder.h>
  10
  11 #include <linux/netfilter_ipv6/ip6_tables.h>
  12 #include <linux/netfilter_ipv6/ip6t_opts.h>
  13
  14 #define HOPBYHOP        1
  15
  16 EXPORT_NO_SYMBOLS;
  17 MODULE_LICENSE("GPL");
  18 #if HOPBYHOP
  19 MODULE_DESCRIPTION("IPv6 HbH match");
  20 #else
  21 MODULE_DESCRIPTION("IPv6 DST match");
  22 #endif
  23 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
  24
  25 #if 0
  26 #define DEBUGP printk
  27 #else
  28 #define DEBUGP(format, args...)
  29 #endif
  30
  31 /*
  32  * (Type & 0xC0) >> 6
  33  *      0       -> ignorable
  34  *      1       -> must drop the packet
  35  *      2       -> send ICMP PARM PROB regardless and drop packet
  36  *      3       -> Send ICMP if not a multicast address and drop packet
  37  *  (Type & 0x20) >> 5
  38  *      0       -> invariant
  39  *      1       -> can change the routing
  40  *  (Type & 0x1F) Type
  41  *      0       -> Pad1 (only 1 byte!)
  42  *      1       -> PadN LENGTH info (total length = length + 2)
  43  *      C0 | 2  -> JUMBO 4 x x x x ( xxxx > 64k )
  44  *      5       -> RTALERT 2 x x
  45  */
  46
  47 static int
  48 match(const struct sk_buff *skb,
  49       const struct net_device *in,
  50       const struct net_device *out,
  51       const void *matchinfo,
  52       int offset,
  53       const void *protohdr,
  54       u_int16_t datalen,
  55       int *hotdrop)
  56 {
  57        struct ipv6_opt_hdr *optsh = NULL;
  58        const struct ip6t_opts *optinfo = matchinfo;
  59        unsigned int temp;
  60        unsigned int len;
  61        u8 nexthdr;
  62        unsigned int ptr;
  63        unsigned int hdrlen = 0;
  64        unsigned int ret = 0;
  65        u8 *opttype = NULL;
  66        unsigned int optlen;
  67
  68        /* type of the 1st exthdr */
  69        nexthdr = skb->nh.ipv6h->nexthdr;
  70        /* pointer to the 1st exthdr */
  71        ptr = sizeof(struct ipv6hdr);
  72        /* available length */
  73        len = skb->len - ptr;
  74        temp = 0;
  75
  76         while (ip6t_ext_hdr(nexthdr)) {
  77                struct ipv6_opt_hdr *hdr;
  78
  79               DEBUGP("ipv6_opts header iteration \n");
  80
  81               /* Is there enough space for the next ext header? */
  82                 if (len < (int)sizeof(struct ipv6_opt_hdr))
  83                         return 0;
  84               /* No more exthdr -> evaluate */
  85                 if (nexthdr == NEXTHDR_NONE) {
  86                      break;
  87               }
  88               /* ESP -> evaluate */
  89                 if (nexthdr == NEXTHDR_ESP) {
  90                      break;
  91               }
  92
  93               hdr = (void *)(skb->data + ptr);
  94
  95               /* Calculate the header length */
  96                 if (nexthdr == NEXTHDR_FRAGMENT) {
  97                         hdrlen = 8;
  98                 } else if (nexthdr == NEXTHDR_AUTH)
  99                         hdrlen = (hdr->hdrlen+2)<<2;
 100                 else
 101                         hdrlen = ipv6_optlen(hdr);
 102
 103               /* OPTS -> evaluate */
 104 #if HOPBYHOP
 105                 if (nexthdr == NEXTHDR_HOP) {
 106                      temp |= MASK_HOPOPTS;
 107 #else
 108                 if (nexthdr == NEXTHDR_DEST) {
 109                      temp |= MASK_DSTOPTS;
 110 #endif
 111                      break;
 112               }
 113
 114
 115               /* set the flag */
 116               switch (nexthdr){
 117                      case NEXTHDR_HOP:
 118                      case NEXTHDR_ROUTING:
 119                      case NEXTHDR_FRAGMENT:
 120                      case NEXTHDR_AUTH:
 121                      case NEXTHDR_DEST:
 122                             break;
 123                      default:
 124                             DEBUGP("ipv6_opts match: unknown nextheader %u\n",nexthdr);
 125                             return 0;
 126                             break;
 127               }
 128
 129                 nexthdr = hdr->nexthdr;
 130                 len -= hdrlen;
 131                 ptr += hdrlen;
 132                 if ( ptr > skb->len ) {
 133                         DEBUGP("ipv6_opts: new pointer is too large! \n");
 134                         break;
 135                 }
 136         }
 137
 138        /* OPTIONS header not found */
 139 #if HOPBYHOP
 140        if ( temp != MASK_HOPOPTS ) return 0;
 141 #else
 142        if ( temp != MASK_DSTOPTS ) return 0;
 143 #endif
 144
 145        if (len < (int)sizeof(struct ipv6_opt_hdr)){
 146                *hotdrop = 1;
 147                 return 0;
 148        }
 149
 150        if (len < hdrlen){
 151                /* Packet smaller than it's length field */
 152                 return 0;
 153        }
 154
 155        optsh = (void *)(skb->data + ptr);
 156
 157        DEBUGP("IPv6 OPTS LEN %u %u ", hdrlen, optsh->hdrlen);
 158
 159        DEBUGP("len %02X %04X %02X ",
 160                 optinfo->hdrlen, hdrlen,
 161                 (!(optinfo->flags & IP6T_OPTS_LEN) ||
 162                            ((optinfo->hdrlen == hdrlen) ^
 163                            !!(optinfo->invflags & IP6T_OPTS_INV_LEN))));
 164
 165        ret = (optsh != NULL)
 166                 &&
 167                 (!(optinfo->flags & IP6T_OPTS_LEN) ||
 168                            ((optinfo->hdrlen == hdrlen) ^
 169                            !!(optinfo->invflags & IP6T_OPTS_INV_LEN)));
 170
 171        ptr += 2;
 172        hdrlen -= 2;
 173        if ( !(optinfo->flags & IP6T_OPTS_OPTS) ){
 174                return ret;
 175         } else if (optinfo->flags & IP6T_OPTS_NSTRICT) {
 176                 DEBUGP("Not strict - not implemented");
 177         } else {
 178                 DEBUGP("Strict ");
 179                 DEBUGP("#%d ",optinfo->optsnr);
 180                 for(temp=0; temp<optinfo->optsnr; temp++){
 181                         /* type field exists ? */
 182                         if (ptr > skb->len - 1 || hdrlen < 1)
 183                                 break;
 184                         opttype = (void *)(skb->data + ptr);
 185
 186                         /* Type check */
 187                         if (*opttype != (optinfo->opts[temp] & 0xFF00)>>8){
 188                                 DEBUGP("Tbad %02X %02X\n",
 189                                        *opttype,
 190                                        (optinfo->opts[temp] & 0xFF00)>>8);
 191                                 return 0;
 192                         } else {
 193                                 DEBUGP("Tok ");
 194                         }
 195                         /* Length check */
 196                         if (*opttype) {
 197                                 u16 spec_len;
 198
 199                                 /* length field exists ? */
 200                                 if (ptr > skb->len - 2 || hdrlen < 2)
 201                                         break;
 202                                 optlen = *((u8 *)(skb->data + ptr + 1));
 203                                 spec_len = optinfo->opts[temp] & 0x00FF;
 204
 205                                 if (spec_len != 0x00FF && spec_len != optlen) {
 206                                         DEBUGP("Lbad %02X %04X\n", optlen,
 207                                                spec_len);
 208                                         return 0;
 209                                 }
 210                                 DEBUGP("Lok ");
 211                                 optlen += 2;
 212                         } else {
 213                                 DEBUGP("Pad1\n");
 214                                 optlen = 1;
 215                         }
 216
 217                         /* Step to the next */
 218                         DEBUGP("len%04X \n", optlen);
 219
 220                         if ((ptr > skb->len - optlen || hdrlen < optlen) &&
 221                             (temp < optinfo->optsnr - 1)) {
 222                                 DEBUGP("new pointer is too large! \n");
 223                                 break;
 224                         }
 225                         ptr += optlen;
 226                         hdrlen -= optlen;
 227                 }
 228                 if (temp == optinfo->optsnr)
 229                         return ret;
 230                 else return 0;
 231         }
 232
 233         return 0;
 234 }
 235
 236 /* Called when user tries to insert an entry of this type. */
 237 static int
 238 checkentry(const char *tablename,
 239           const struct ip6t_ip6 *ip,
 240           void *matchinfo,
 241           unsigned int matchinfosize,
 242           unsigned int hook_mask)
 243 {
 244        const struct ip6t_opts *optsinfo = matchinfo;
 245
 246        if (matchinfosize != IP6T_ALIGN(sizeof(struct ip6t_opts))) {
 247               DEBUGP("ip6t_opts: matchsize %u != %u\n",
 248                       matchinfosize, IP6T_ALIGN(sizeof(struct ip6t_opts)));
 249               return 0;
 250        }
 251        if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) {
 252               DEBUGP("ip6t_opts: unknown flags %X\n",
 253                       optsinfo->invflags);
 254               return 0;
 255        }
 256
 257        return 1;
 258 }
 259
 260 static struct ip6t_match opts_match
 261 #if HOPBYHOP
 262 = { { NULL, NULL }, "hbh", &match, &checkentry, NULL, THIS_MODULE };
 263 #else
 264 = { { NULL, NULL }, "dst", &match, &checkentry, NULL, THIS_MODULE };
 265 #endif
 266
 267 static int __init init(void)
 268 {
 269        return ip6t_register_match(&opts_match);
 270 }
 271
 272 static void __exit cleanup(void)
 273 {
 274        ip6t_unregister_match(&opts_match);
 275 }
 276
 277 module_init(init);
 278 module_exit(cleanup);