[deliverable/linux.git] / net / ipv6 / netfilter / ip6t_hbh.c

/* Kernel module to match Hop-by-Hop and Destination parameters. */

/* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/ipv6.h>
#include <linux/types.h>
#include <net/checksum.h>
#include <net/ipv6.h>

#include <asm/byteorder.h>

#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <linux/netfilter_ipv6/ip6t_opts.h>

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("IPv6 opts match");
MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
MODULE_ALIAS("ip6t_dst");

#if 0
#define DEBUGP printk
#else
#define DEBUGP(format, args...)
#endif

/*
 *  (Type & 0xC0) >> 6
 *	0	-> ignorable
 *	1	-> must drop the packet
 *	2	-> send ICMP PARM PROB regardless and drop packet
 *	3	-> Send ICMP if not a multicast address and drop packet
 *  (Type & 0x20) >> 5
 *	0	-> invariant
 *	1	-> can change the routing
 *  (Type & 0x1F) Type
 *	0	-> Pad1 (only 1 byte!)
 *	1	-> PadN LENGTH info (total length = length + 2)
 *	C0 | 2	-> JUMBO 4 x x x x ( xxxx > 64k )
 *	5	-> RTALERT 2 x x
 */

static int
match(const struct sk_buff *skb,
      const struct net_device *in,
      const struct net_device *out,
      const struct xt_match *match,
      const void *matchinfo,
      int offset,
      unsigned int protoff,
      int *hotdrop)
{
	struct ipv6_opt_hdr _optsh, *oh;
	const struct ip6t_opts *optinfo = matchinfo;
	unsigned int temp;
	unsigned int ptr;
	unsigned int hdrlen = 0;
	unsigned int ret = 0;
	u8 _opttype, *tp = NULL;
	u8 _optlen, *lp = NULL;
	unsigned int optlen;
	int err;

	err = ipv6_find_hdr(skb, &ptr, match->data, NULL);
	if (err < 0) {
		if (err != -ENOENT)
			*hotdrop = 1;
		return 0;
	}

	oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
	if (oh == NULL) {
		*hotdrop = 1;
		return 0;
	}

	hdrlen = ipv6_optlen(oh);
	if (skb->len - ptr < hdrlen) {
		/* Packet smaller than it's length field */
		return 0;
	}

	DEBUGP("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen);

	DEBUGP("len %02X %04X %02X ",
	       optinfo->hdrlen, hdrlen,
	       (!(optinfo->flags & IP6T_OPTS_LEN) ||
		((optinfo->hdrlen == hdrlen) ^
		 !!(optinfo->invflags & IP6T_OPTS_INV_LEN))));

	ret = (oh != NULL) &&
	      (!(optinfo->flags & IP6T_OPTS_LEN) ||
	       ((optinfo->hdrlen == hdrlen) ^
		!!(optinfo->invflags & IP6T_OPTS_INV_LEN)));

	ptr += 2;
	hdrlen -= 2;
	if (!(optinfo->flags & IP6T_OPTS_OPTS)) {
		return ret;
	} else if (optinfo->flags & IP6T_OPTS_NSTRICT) {
		DEBUGP("Not strict - not implemented");
	} else {
		DEBUGP("Strict ");
		DEBUGP("#%d ", optinfo->optsnr);
		for (temp = 0; temp < optinfo->optsnr; temp++) {
			/* type field exists ? */
			if (hdrlen < 1)
				break;
			tp = skb_header_pointer(skb, ptr, sizeof(_opttype),
						&_opttype);
			if (tp == NULL)
				break;

			/* Type check */
			if (*tp != (optinfo->opts[temp] & 0xFF00) >> 8) {
				DEBUGP("Tbad %02X %02X\n",
				       *tp,
				       (optinfo->opts[temp] & 0xFF00) >> 8);
				return 0;
			} else {
				DEBUGP("Tok ");
			}
			/* Length check */
			if (*tp) {
				u16 spec_len;

				/* length field exists ? */
				if (hdrlen < 2)
					break;
				lp = skb_header_pointer(skb, ptr + 1,
							sizeof(_optlen),
							&_optlen);
				if (lp == NULL)
					break;
				spec_len = optinfo->opts[temp] & 0x00FF;

				if (spec_len != 0x00FF && spec_len != *lp) {
					DEBUGP("Lbad %02X %04X\n", *lp,
					       spec_len);
					return 0;
				}
				DEBUGP("Lok ");
				optlen = *lp + 2;
			} else {
				DEBUGP("Pad1\n");
				optlen = 1;
			}

			/* Step to the next */
			DEBUGP("len%04X \n", optlen);

			if ((ptr > skb->len - optlen || hdrlen < optlen) &&
			    (temp < optinfo->optsnr - 1)) {
				DEBUGP("new pointer is too large! \n");
				break;
			}
			ptr += optlen;
			hdrlen -= optlen;
		}
		if (temp == optinfo->optsnr)
			return ret;
		else
			return 0;
	}

	return 0;
}

/* Called when user tries to insert an entry of this type. */
static int
checkentry(const char *tablename,
	   const void *entry,
	   const struct xt_match *match,
	   void *matchinfo,
	   unsigned int hook_mask)
{
	const struct ip6t_opts *optsinfo = matchinfo;

	if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) {
		DEBUGP("ip6t_opts: unknown flags %X\n", optsinfo->invflags);
		return 0;
	}
	return 1;
}

static struct xt_match opts_match[] = {
	{
		.name		= "hbh",
		.family		= AF_INET6,
		.match		= match,
		.matchsize	= sizeof(struct ip6t_opts),
		.checkentry	= checkentry,
		.me		= THIS_MODULE,
		.data		= NEXTHDR_HOP,
	},
	{
		.name		= "dst",
		.family		= AF_INET6,
		.match		= match,
		.matchsize	= sizeof(struct ip6t_opts),
		.checkentry	= checkentry,
		.me		= THIS_MODULE,
		.data		= NEXTHDR_DEST,
	},
};

static int __init ip6t_hbh_init(void)
{
	return xt_register_matches(opts_match, ARRAY_SIZE(opts_match));
}

static void __exit ip6t_hbh_fini(void)
{
	xt_unregister_matches(opts_match, ARRAY_SIZE(opts_match));
}

module_init(ip6t_hbh_init);
module_exit(ip6t_hbh_fini);
Commit	Line	Data
1da177e4 LT	1	/* Kernel module to match Hop-by-Hop and Destination parameters. */
	2
	3	/* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation.
	8	*/
	9
	10	#include <linux/module.h>
	11	#include <linux/skbuff.h>
	12	#include <linux/ipv6.h>
	13	#include <linux/types.h>
	14	#include <net/checksum.h>
	15	#include <net/ipv6.h>
	16
	17	#include <asm/byteorder.h>
	18
6709dbbb	19	#include <linux/netfilter/x_tables.h>
1da177e4 LT	20	#include <linux/netfilter_ipv6/ip6_tables.h>
	21	#include <linux/netfilter_ipv6/ip6t_opts.h>
	22
1da177e4	23	MODULE_LICENSE("GPL");
5fa2a760	24	MODULE_DESCRIPTION("IPv6 opts match");
1da177e4	25	MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
5fa2a760	26	MODULE_ALIAS("ip6t_dst");
1da177e4 LT	27
	28	#if 0
	29	#define DEBUGP printk
	30	#else
	31	#define DEBUGP(format, args...)
	32	#endif
	33
	34	/*
f0daaa65 YK	35	* (Type & 0xC0) >> 6
	36	* 0 -> ignorable
	37	* 1 -> must drop the packet
	38	* 2 -> send ICMP PARM PROB regardless and drop packet
	39	* 3 -> Send ICMP if not a multicast address and drop packet
1da177e4	40	* (Type & 0x20) >> 5
f0daaa65 YK	41	* 0 -> invariant
f0daaa65 YK	42	* 1 -> can change the routing
1da177e4	43	* (Type & 0x1F) Type
f0daaa65 YK	44	* 0 -> Pad1 (only 1 byte!)
	45	* 1 -> PadN LENGTH info (total length = length + 2)
	46	* C0 \| 2 -> JUMBO 4 x x x x ( xxxx > 64k )
	47	* 5 -> RTALERT 2 x x
1da177e4 LT	48	*/
	49
	50	static int
	51	match(const struct sk_buff *skb,
	52	const struct net_device *in,
	53	const struct net_device *out,
c4986734	54	const struct xt_match *match,
1da177e4 LT	55	const void *matchinfo,
	56	int offset,
	57	unsigned int protoff,
	58	int *hotdrop)
	59	{
f0daaa65 YK	60	struct ipv6_opt_hdr _optsh, *oh;
	61	const struct ip6t_opts *optinfo = matchinfo;
	62	unsigned int temp;
	63	unsigned int ptr;
	64	unsigned int hdrlen = 0;
	65	unsigned int ret = 0;
	66	u8 _opttype, *tp = NULL;
	67	u8 _optlen, *lp = NULL;
	68	unsigned int optlen;
6d381634	69	int err;
f0daaa65	70
6d381634 PM	71	err = ipv6_find_hdr(skb, &ptr, match->data, NULL);
	72	if (err < 0) {
	73	if (err != -ENOENT)
	74	*hotdrop = 1;
e674d0f3	75	return 0;
6d381634	76	}
1da177e4	77
f0daaa65 YK	78	oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
	79	if (oh == NULL) {
	80	*hotdrop = 1;
	81	return 0;
	82	}
	83
	84	hdrlen = ipv6_optlen(oh);
	85	if (skb->len - ptr < hdrlen) {
	86	/* Packet smaller than it's length field */
	87	return 0;
	88	}
	89
	90	DEBUGP("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen);
	91
	92	DEBUGP("len %02X %04X %02X ",
	93	optinfo->hdrlen, hdrlen,
	94	(!(optinfo->flags & IP6T_OPTS_LEN) \|\|
	95	((optinfo->hdrlen == hdrlen) ^
	96	!!(optinfo->invflags & IP6T_OPTS_INV_LEN))));
	97
	98	ret = (oh != NULL) &&
	99	(!(optinfo->flags & IP6T_OPTS_LEN) \|\|
	100	((optinfo->hdrlen == hdrlen) ^
	101	!!(optinfo->invflags & IP6T_OPTS_INV_LEN)));
	102
	103	ptr += 2;
	104	hdrlen -= 2;
	105	if (!(optinfo->flags & IP6T_OPTS_OPTS)) {
	106	return ret;
1da177e4 LT	107	} else if (optinfo->flags & IP6T_OPTS_NSTRICT) {
	108	DEBUGP("Not strict - not implemented");
	109	} else {
	110	DEBUGP("Strict ");
f0daaa65 YK	111	DEBUGP("#%d ", optinfo->optsnr);
f0daaa65 YK	112	for (temp = 0; temp < optinfo->optsnr; temp++) {
1da177e4 LT	113	/* type field exists ? */
	114	if (hdrlen < 1)
	115	break;
	116	tp = skb_header_pointer(skb, ptr, sizeof(_opttype),
	117	&_opttype);
	118	if (tp == NULL)
	119	break;
	120
	121	/* Type check */
f0daaa65	122	if (*tp != (optinfo->opts[temp] & 0xFF00) >> 8) {
1da177e4 LT	123	DEBUGP("Tbad %02X %02X\n",
1da177e4 LT	124	*tp,
f0daaa65	125	(optinfo->opts[temp] & 0xFF00) >> 8);
1da177e4 LT	126	return 0;
	127	} else {
	128	DEBUGP("Tok ");
	129	}
	130	/* Length check */
	131	if (*tp) {
	132	u16 spec_len;
	133
	134	/* length field exists ? */
	135	if (hdrlen < 2)
	136	break;
	137	lp = skb_header_pointer(skb, ptr + 1,
	138	sizeof(_optlen),
	139	&_optlen);
	140	if (lp == NULL)
	141	break;
	142	spec_len = optinfo->opts[temp] & 0x00FF;
	143
	144	if (spec_len != 0x00FF && spec_len != *lp) {
	145	DEBUGP("Lbad %02X %04X\n", *lp,
	146	spec_len);
	147	return 0;
	148	}
	149	DEBUGP("Lok ");
	150	optlen = *lp + 2;
	151	} else {
	152	DEBUGP("Pad1\n");
	153	optlen = 1;
	154	}
	155
	156	/* Step to the next */
	157	DEBUGP("len%04X \n", optlen);
	158
	159	if ((ptr > skb->len - optlen \|\| hdrlen < optlen) &&
	160	(temp < optinfo->optsnr - 1)) {
	161	DEBUGP("new pointer is too large! \n");
	162	break;
	163	}
	164	ptr += optlen;
	165	hdrlen -= optlen;
	166	}
	167	if (temp == optinfo->optsnr)
	168	return ret;
f0daaa65 YK	169	else
f0daaa65 YK	170	return 0;
1da177e4 LT	171	}
	172
	173	return 0;
	174	}
	175
	176	/* Called when user tries to insert an entry of this type. */
	177	static int
	178	checkentry(const char *tablename,
f0daaa65	179	const void *entry,
c4986734	180	const struct xt_match *match,
f0daaa65	181	void *matchinfo,
f0daaa65	182	unsigned int hook_mask)
1da177e4	183	{
f0daaa65 YK	184	const struct ip6t_opts *optsinfo = matchinfo;
f0daaa65 YK	185
f0daaa65 YK	186	if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) {
	187	DEBUGP("ip6t_opts: unknown flags %X\n", optsinfo->invflags);
	188	return 0;
	189	}
f0daaa65	190	return 1;
1da177e4 LT	191	}
1da177e4 LT	192
5fa2a760 PM	193	static struct xt_match opts_match[] = {
	194	{
	195	.name = "hbh",
	196	.family = AF_INET6,
	197	.match = match,
	198	.matchsize = sizeof(struct ip6t_opts),
	199	.checkentry = checkentry,
	200	.me = THIS_MODULE,
	201	.data = NEXTHDR_HOP,
	202	},
	203	{
	204	.name = "dst",
	205	.family = AF_INET6,
	206	.match = match,
	207	.matchsize = sizeof(struct ip6t_opts),
	208	.checkentry = checkentry,
	209	.me = THIS_MODULE,
	210	.data = NEXTHDR_DEST,
	211	},
1da177e4 LT	212	};
1da177e4 LT	213
65b4b4e8	214	static int __init ip6t_hbh_init(void)
1da177e4	215	{
5fa2a760	216	return xt_register_matches(opts_match, ARRAY_SIZE(opts_match));
1da177e4 LT	217	}
1da177e4 LT	218
65b4b4e8	219	static void __exit ip6t_hbh_fini(void)
1da177e4	220	{
5fa2a760	221	xt_unregister_matches(opts_match, ARRAY_SIZE(opts_match));
1da177e4 LT	222	}
1da177e4 LT	223
65b4b4e8 AM	224	module_init(ip6t_hbh_init);
65b4b4e8 AM	225	module_exit(ip6t_hbh_fini);