SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/ipv6/netfilter/ip6t_hbh.c

   1 /* Kernel module to match Hop-by-Hop and Destination parameters. */
   2
   3 /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  */
   9
  10 #include <linux/module.h>
  11 #include <linux/skbuff.h>
  12 #include <linux/ipv6.h>
  13 #include <linux/types.h>
  14 #include <net/checksum.h>
  15 #include <net/ipv6.h>
  16
  17 #include <asm/byteorder.h>
  18
  19 #include <linux/netfilter/x_tables.h>
  20 #include <linux/netfilter_ipv6/ip6_tables.h>
  21 #include <linux/netfilter_ipv6/ip6t_opts.h>
  22
  23 MODULE_LICENSE("GPL");
  24 MODULE_DESCRIPTION("IPv6 opts match");
  25 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
  26 MODULE_ALIAS("ip6t_dst");
  27
  28 #if 0
  29 #define DEBUGP printk
  30 #else
  31 #define DEBUGP(format, args...)
  32 #endif
  33
  34 /*
  35  *  (Type & 0xC0) >> 6
  36  *      0       -> ignorable
  37  *      1       -> must drop the packet
  38  *      2       -> send ICMP PARM PROB regardless and drop packet
  39  *      3       -> Send ICMP if not a multicast address and drop packet
  40  *  (Type & 0x20) >> 5
  41  *      0       -> invariant
  42  *      1       -> can change the routing
  43  *  (Type & 0x1F) Type
  44  *      0       -> Pad1 (only 1 byte!)
  45  *      1       -> PadN LENGTH info (total length = length + 2)
  46  *      C0 | 2  -> JUMBO 4 x x x x ( xxxx > 64k )
  47  *      5       -> RTALERT 2 x x
  48  */
  49
  50 static int
  51 match(const struct sk_buff *skb,
  52       const struct net_device *in,
  53       const struct net_device *out,
  54       const struct xt_match *match,
  55       const void *matchinfo,
  56       int offset,
  57       unsigned int protoff,
  58       int *hotdrop)
  59 {
  60         struct ipv6_opt_hdr _optsh, *oh;
  61         const struct ip6t_opts *optinfo = matchinfo;
  62         unsigned int temp;
  63         unsigned int ptr;
  64         unsigned int hdrlen = 0;
  65         unsigned int ret = 0;
  66         u8 _opttype, *tp = NULL;
  67         u8 _optlen, *lp = NULL;
  68         unsigned int optlen;
  69         int err;
  70
  71         err = ipv6_find_hdr(skb, &ptr, match->data, NULL);
  72         if (err < 0) {
  73                 if (err != -ENOENT)
  74                         *hotdrop = 1;
  75                 return 0;
  76         }
  77
  78         oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
  79         if (oh == NULL) {
  80                 *hotdrop = 1;
  81                 return 0;
  82         }
  83
  84         hdrlen = ipv6_optlen(oh);
  85         if (skb->len - ptr < hdrlen) {
  86                 /* Packet smaller than it's length field */
  87                 return 0;
  88         }
  89
  90         DEBUGP("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen);
  91
  92         DEBUGP("len %02X %04X %02X ",
  93                optinfo->hdrlen, hdrlen,
  94                (!(optinfo->flags & IP6T_OPTS_LEN) ||
  95                 ((optinfo->hdrlen == hdrlen) ^
  96                  !!(optinfo->invflags & IP6T_OPTS_INV_LEN))));
  97
  98         ret = (oh != NULL) &&
  99               (!(optinfo->flags & IP6T_OPTS_LEN) ||
 100                ((optinfo->hdrlen == hdrlen) ^
 101                 !!(optinfo->invflags & IP6T_OPTS_INV_LEN)));
 102
 103         ptr += 2;
 104         hdrlen -= 2;
 105         if (!(optinfo->flags & IP6T_OPTS_OPTS)) {
 106                 return ret;
 107         } else if (optinfo->flags & IP6T_OPTS_NSTRICT) {
 108                 DEBUGP("Not strict - not implemented");
 109         } else {
 110                 DEBUGP("Strict ");
 111                 DEBUGP("#%d ", optinfo->optsnr);
 112                 for (temp = 0; temp < optinfo->optsnr; temp++) {
 113                         /* type field exists ? */
 114                         if (hdrlen < 1)
 115                                 break;
 116                         tp = skb_header_pointer(skb, ptr, sizeof(_opttype),
 117                                                 &_opttype);
 118                         if (tp == NULL)
 119                                 break;
 120
 121                         /* Type check */
 122                         if (*tp != (optinfo->opts[temp] & 0xFF00) >> 8) {
 123                                 DEBUGP("Tbad %02X %02X\n",
 124                                        *tp,
 125                                        (optinfo->opts[temp] & 0xFF00) >> 8);
 126                                 return 0;
 127                         } else {
 128                                 DEBUGP("Tok ");
 129                         }
 130                         /* Length check */
 131                         if (*tp) {
 132                                 u16 spec_len;
 133
 134                                 /* length field exists ? */
 135                                 if (hdrlen < 2)
 136                                         break;
 137                                 lp = skb_header_pointer(skb, ptr + 1,
 138                                                         sizeof(_optlen),
 139                                                         &_optlen);
 140                                 if (lp == NULL)
 141                                         break;
 142                                 spec_len = optinfo->opts[temp] & 0x00FF;
 143
 144                                 if (spec_len != 0x00FF && spec_len != *lp) {
 145                                         DEBUGP("Lbad %02X %04X\n", *lp,
 146                                                spec_len);
 147                                         return 0;
 148                                 }
 149                                 DEBUGP("Lok ");
 150                                 optlen = *lp + 2;
 151                         } else {
 152                                 DEBUGP("Pad1\n");
 153                                 optlen = 1;
 154                         }
 155
 156                         /* Step to the next */
 157                         DEBUGP("len%04X \n", optlen);
 158
 159                         if ((ptr > skb->len - optlen || hdrlen < optlen) &&
 160                             (temp < optinfo->optsnr - 1)) {
 161                                 DEBUGP("new pointer is too large! \n");
 162                                 break;
 163                         }
 164                         ptr += optlen;
 165                         hdrlen -= optlen;
 166                 }
 167                 if (temp == optinfo->optsnr)
 168                         return ret;
 169                 else
 170                         return 0;
 171         }
 172
 173         return 0;
 174 }
 175
 176 /* Called when user tries to insert an entry of this type. */
 177 static int
 178 checkentry(const char *tablename,
 179            const void *entry,
 180            const struct xt_match *match,
 181            void *matchinfo,
 182            unsigned int hook_mask)
 183 {
 184         const struct ip6t_opts *optsinfo = matchinfo;
 185
 186         if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) {
 187                 DEBUGP("ip6t_opts: unknown flags %X\n", optsinfo->invflags);
 188                 return 0;
 189         }
 190         return 1;
 191 }
 192
 193 static struct xt_match opts_match[] = {
 194         {
 195                 .name           = "hbh",
 196                 .family         = AF_INET6,
 197                 .match          = match,
 198                 .matchsize      = sizeof(struct ip6t_opts),
 199                 .checkentry     = checkentry,
 200                 .me             = THIS_MODULE,
 201                 .data           = NEXTHDR_HOP,
 202         },
 203         {
 204                 .name           = "dst",
 205                 .family         = AF_INET6,
 206                 .match          = match,
 207                 .matchsize      = sizeof(struct ip6t_opts),
 208                 .checkentry     = checkentry,
 209                 .me             = THIS_MODULE,
 210                 .data           = NEXTHDR_DEST,
 211         },
 212 };
 213
 214 static int __init ip6t_hbh_init(void)
 215 {
 216         return xt_register_matches(opts_match, ARRAY_SIZE(opts_match));
 217 }
 218
 219 static void __exit ip6t_hbh_fini(void)
 220 {
 221         xt_unregister_matches(opts_match, ARRAY_SIZE(opts_match));
 222 }
 223
 224 module_init(ip6t_hbh_init);
 225 module_exit(ip6t_hbh_fini);