[deliverable/linux.git] / net / netfilter / xt_dccp.c

/*
 * iptables module for DCCP protocol header matching
 *
 * (C) 2005 by Harald Welte <laforge@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/spinlock.h>
#include <net/ip.h>
#include <linux/dccp.h>

#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_dccp.h>

#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("Match for DCCP protocol packets");
MODULE_ALIAS("ipt_dccp");

#define DCCHECK(cond, option, flag, invflag) (!((flag) & (option)) \
		                  || (!!((invflag) & (option)) ^ (cond)))

static unsigned char *dccp_optbuf;
static DEFINE_SPINLOCK(dccp_buflock);

static inline int
dccp_find_option(u_int8_t option,
		 const struct sk_buff *skb,
		 unsigned int protoff,
		 const struct dccp_hdr *dh,
		 int *hotdrop)
{
	/* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
	unsigned char *op;
	unsigned int optoff = __dccp_hdr_len(dh);
	unsigned int optlen = dh->dccph_doff*4 - __dccp_hdr_len(dh);
	unsigned int i;

	if (dh->dccph_doff * 4 < __dccp_hdr_len(dh)) {
		*hotdrop = 1;
		return 0;
	}

	if (!optlen)
		return 0;

	spin_lock_bh(&dccp_buflock);
	op = skb_header_pointer(skb, protoff + optoff, optlen, dccp_optbuf);
	if (op == NULL) {
		/* If we don't have the whole header, drop packet. */
		spin_unlock_bh(&dccp_buflock);
		*hotdrop = 1;
		return 0;
	}

	for (i = 0; i < optlen; ) {
		if (op[i] == option) {
			spin_unlock_bh(&dccp_buflock);
			return 1;
		}

		if (op[i] < 2) 
			i++;
		else 
			i += op[i+1]?:1;
	}

	spin_unlock_bh(&dccp_buflock);
	return 0;
}


static inline int
match_types(const struct dccp_hdr *dh, u_int16_t typemask)
{
	return (typemask & (1 << dh->dccph_type));
}

static inline int
match_option(u_int8_t option, const struct sk_buff *skb, unsigned int protoff,
	     const struct dccp_hdr *dh, int *hotdrop)
{
	return dccp_find_option(option, skb, protoff, dh, hotdrop);
}

static int
match(const struct sk_buff *skb,
      const struct net_device *in,
      const struct net_device *out,
      const struct xt_match *match,
      const void *matchinfo,
      int offset,
      unsigned int protoff,
      int *hotdrop)
{
	const struct xt_dccp_info *info = 
				(const struct xt_dccp_info *)matchinfo;
	struct dccp_hdr _dh, *dh;

	if (offset)
		return 0;
	
	dh = skb_header_pointer(skb, protoff, sizeof(_dh), &_dh);
	if (dh == NULL) {
		*hotdrop = 1;
		return 0;
       	}

	return  DCCHECK(((ntohs(dh->dccph_sport) >= info->spts[0]) 
			&& (ntohs(dh->dccph_sport) <= info->spts[1])), 
		   	XT_DCCP_SRC_PORTS, info->flags, info->invflags)
		&& DCCHECK(((ntohs(dh->dccph_dport) >= info->dpts[0]) 
			&& (ntohs(dh->dccph_dport) <= info->dpts[1])), 
			XT_DCCP_DEST_PORTS, info->flags, info->invflags)
		&& DCCHECK(match_types(dh, info->typemask),
			   XT_DCCP_TYPE, info->flags, info->invflags)
		&& DCCHECK(match_option(info->option, skb, protoff, dh,
					hotdrop),
			   XT_DCCP_OPTION, info->flags, info->invflags);
}

static int
checkentry(const char *tablename,
	   const void *inf,
	   const struct xt_match *match,
	   void *matchinfo,
	   unsigned int matchsize,
	   unsigned int hook_mask)
{
	const struct xt_dccp_info *info = matchinfo;

	return !(info->flags & ~XT_DCCP_VALID_FLAGS)
		&& !(info->invflags & ~XT_DCCP_VALID_FLAGS)
		&& !(info->invflags & ~info->flags);
}

static struct xt_match dccp_match = 
{ 
	.name 		= "dccp",
	.match		= match,
	.matchsize	= sizeof(struct xt_dccp_info),
	.proto		= IPPROTO_DCCP,
	.checkentry	= checkentry,
	.family		= AF_INET,
	.me 		= THIS_MODULE,
};
static struct xt_match dccp6_match = 
{ 
	.name 		= "dccp",
	.match		= match,
	.matchsize	= sizeof(struct xt_dccp_info),
	.proto		= IPPROTO_DCCP,
	.checkentry	= checkentry,
	.family		= AF_INET6,
	.me 		= THIS_MODULE,
};


static int __init init(void)
{
	int ret;

	/* doff is 8 bits, so the maximum option size is (4*256).  Don't put
	 * this in BSS since DaveM is worried about locked TLB's for kernel
	 * BSS. */
	dccp_optbuf = kmalloc(256 * 4, GFP_KERNEL);
	if (!dccp_optbuf)
		return -ENOMEM;
	ret = xt_register_match(&dccp_match);
	if (ret)
		goto out_kfree;
	ret = xt_register_match(&dccp6_match);
	if (ret)
		goto out_unreg;

	return ret;

out_unreg:
	xt_unregister_match(&dccp_match);
out_kfree:
	kfree(dccp_optbuf);

	return ret;
}

static void __exit fini(void)
{
	xt_unregister_match(&dccp6_match);
	xt_unregister_match(&dccp_match);
	kfree(dccp_optbuf);
}

module_init(init);
module_exit(fini);
Commit	Line	Data
1d3de414 HW	1	/*
	2	* iptables module for DCCP protocol header matching
	3	*
	4	* (C) 2005 by Harald Welte <laforge@netfilter.org>
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*/
	10
	11	#include <linux/module.h>
	12	#include <linux/skbuff.h>
	13	#include <linux/spinlock.h>
	14	#include <net/ip.h>
	15	#include <linux/dccp.h>
	16
2e4e6a17 HW	17	#include <linux/netfilter/x_tables.h>
	18	#include <linux/netfilter/xt_dccp.h>
	19
1d3de414	20	#include <linux/netfilter_ipv4/ip_tables.h>
2e4e6a17 HW	21	#include <linux/netfilter_ipv6/ip6_tables.h>
	22
	23	MODULE_LICENSE("GPL");
	24	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
	25	MODULE_DESCRIPTION("Match for DCCP protocol packets");
	26	MODULE_ALIAS("ipt_dccp");
1d3de414 HW	27
	28	#define DCCHECK(cond, option, flag, invflag) (!((flag) & (option)) \
	29	\|\| (!!((invflag) & (option)) ^ (cond)))
	30
	31	static unsigned char *dccp_optbuf;
	32	static DEFINE_SPINLOCK(dccp_buflock);
	33
	34	static inline int
	35	dccp_find_option(u_int8_t option,
	36	const struct sk_buff *skb,
2e4e6a17	37	unsigned int protoff,
1d3de414 HW	38	const struct dccp_hdr *dh,
	39	int *hotdrop)
	40	{
	41	/* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
	42	unsigned char *op;
	43	unsigned int optoff = __dccp_hdr_len(dh);
	44	unsigned int optlen = dh->dccph_doff*4 - __dccp_hdr_len(dh);
	45	unsigned int i;
	46
	47	if (dh->dccph_doff * 4 < __dccp_hdr_len(dh)) {
	48	*hotdrop = 1;
	49	return 0;
	50	}
	51
	52	if (!optlen)
	53	return 0;
	54
	55	spin_lock_bh(&dccp_buflock);
2e4e6a17	56	op = skb_header_pointer(skb, protoff + optoff, optlen, dccp_optbuf);
1d3de414 HW	57	if (op == NULL) {
	58	/* If we don't have the whole header, drop packet. */
	59	spin_unlock_bh(&dccp_buflock);
	60	*hotdrop = 1;
	61	return 0;
	62	}
	63
	64	for (i = 0; i < optlen; ) {
	65	if (op[i] == option) {
	66	spin_unlock_bh(&dccp_buflock);
	67	return 1;
	68	}
	69
	70	if (op[i] < 2)
	71	i++;
	72	else
	73	i += op[i+1]?:1;
	74	}
	75
	76	spin_unlock_bh(&dccp_buflock);
	77	return 0;
	78	}
	79
	80
	81	static inline int
	82	match_types(const struct dccp_hdr *dh, u_int16_t typemask)
	83	{
	84	return (typemask & (1 << dh->dccph_type));
	85	}
	86
	87	static inline int
2e4e6a17	88	match_option(u_int8_t option, const struct sk_buff *skb, unsigned int protoff,
1d3de414 HW	89	const struct dccp_hdr dh, int hotdrop)
1d3de414 HW	90	{
2e4e6a17	91	return dccp_find_option(option, skb, protoff, dh, hotdrop);
1d3de414 HW	92	}
	93
	94	static int
	95	match(const struct sk_buff *skb,
	96	const struct net_device *in,
	97	const struct net_device *out,
c4986734	98	const struct xt_match *match,
1d3de414 HW	99	const void *matchinfo,
1d3de414 HW	100	int offset,
2e4e6a17	101	unsigned int protoff,
1d3de414 HW	102	int *hotdrop)
1d3de414 HW	103	{
2e4e6a17 HW	104	const struct xt_dccp_info *info =
2e4e6a17 HW	105	(const struct xt_dccp_info *)matchinfo;
1d3de414 HW	106	struct dccp_hdr _dh, *dh;
	107
	108	if (offset)
	109	return 0;
	110
2e4e6a17	111	dh = skb_header_pointer(skb, protoff, sizeof(_dh), &_dh);
1d3de414 HW	112	if (dh == NULL) {
	113	*hotdrop = 1;
	114	return 0;
	115	}
	116
	117	return DCCHECK(((ntohs(dh->dccph_sport) >= info->spts[0])
	118	&& (ntohs(dh->dccph_sport) <= info->spts[1])),
2e4e6a17	119	XT_DCCP_SRC_PORTS, info->flags, info->invflags)
1d3de414 HW	120	&& DCCHECK(((ntohs(dh->dccph_dport) >= info->dpts[0])
1d3de414 HW	121	&& (ntohs(dh->dccph_dport) <= info->dpts[1])),
2e4e6a17	122	XT_DCCP_DEST_PORTS, info->flags, info->invflags)
1d3de414	123	&& DCCHECK(match_types(dh, info->typemask),
2e4e6a17 HW	124	XT_DCCP_TYPE, info->flags, info->invflags)
	125	&& DCCHECK(match_option(info->option, skb, protoff, dh,
	126	hotdrop),
	127	XT_DCCP_OPTION, info->flags, info->invflags);
1d3de414 HW	128	}
	129
	130	static int
	131	checkentry(const char *tablename,
2e4e6a17	132	const void *inf,
c4986734	133	const struct xt_match *match,
1d3de414 HW	134	void *matchinfo,
	135	unsigned int matchsize,
	136	unsigned int hook_mask)
	137	{
5d04bff0	138	const struct xt_dccp_info *info = matchinfo;
1d3de414	139
5d04bff0	140	return !(info->flags & ~XT_DCCP_VALID_FLAGS)
2e4e6a17 HW	141	&& !(info->invflags & ~XT_DCCP_VALID_FLAGS)
	142	&& !(info->invflags & ~info->flags);
	143	}
	144
2e4e6a17	145	static struct xt_match dccp_match =
1d3de414 HW	146	{
1d3de414 HW	147	.name = "dccp",
5d04bff0 PM	148	.match = match,
	149	.matchsize = sizeof(struct xt_dccp_info),
	150	.proto = IPPROTO_DCCP,
	151	.checkentry = checkentry,
a45049c5	152	.family = AF_INET,
1d3de414 HW	153	.me = THIS_MODULE,
1d3de414 HW	154	};
2e4e6a17 HW	155	static struct xt_match dccp6_match =
	156	{
	157	.name = "dccp",
5d04bff0 PM	158	.match = match,
	159	.matchsize = sizeof(struct xt_dccp_info),
	160	.proto = IPPROTO_DCCP,
	161	.checkentry = checkentry,
a45049c5	162	.family = AF_INET6,
2e4e6a17 HW	163	.me = THIS_MODULE,
	164	};
	165
1d3de414 HW	166
	167	static int __init init(void)
	168	{
	169	int ret;
	170
	171	/* doff is 8 bits, so the maximum option size is (4*256). Don't put
	172	* this in BSS since DaveM is worried about locked TLB's for kernel
	173	* BSS. */
	174	dccp_optbuf = kmalloc(256 * 4, GFP_KERNEL);
	175	if (!dccp_optbuf)
	176	return -ENOMEM;
a45049c5	177	ret = xt_register_match(&dccp_match);
1d3de414	178	if (ret)
2e4e6a17	179	goto out_kfree;
a45049c5	180	ret = xt_register_match(&dccp6_match);
2e4e6a17 HW	181	if (ret)
	182	goto out_unreg;
	183
	184	return ret;
	185
	186	out_unreg:
a45049c5	187	xt_unregister_match(&dccp_match);
2e4e6a17 HW	188	out_kfree:
2e4e6a17 HW	189	kfree(dccp_optbuf);
1d3de414 HW	190
	191	return ret;
	192	}
	193
	194	static void __exit fini(void)
	195	{
a45049c5 PNA	196	xt_unregister_match(&dccp6_match);
a45049c5 PNA	197	xt_unregister_match(&dccp_match);
1d3de414 HW	198	kfree(dccp_optbuf);
	199	}
	200
	201	module_init(init);
	202	module_exit(fini);