]>
Commit | Line | Data |
---|---|---|
d2912cb1 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
1da177e4 LT |
2 | /* Kernel module to match Hop-by-Hop and Destination parameters. */ |
3 | ||
4 | /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu> | |
1da177e4 | 5 | */ |
ff67e4e4 | 6 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
1da177e4 LT |
7 | #include <linux/module.h> |
8 | #include <linux/skbuff.h> | |
9 | #include <linux/ipv6.h> | |
10 | #include <linux/types.h> | |
11 | #include <net/checksum.h> | |
12 | #include <net/ipv6.h> | |
13 | ||
14 | #include <asm/byteorder.h> | |
15 | ||
6709dbbb | 16 | #include <linux/netfilter/x_tables.h> |
1da177e4 LT |
17 | #include <linux/netfilter_ipv6/ip6_tables.h> |
18 | #include <linux/netfilter_ipv6/ip6t_opts.h> | |
19 | ||
1da177e4 | 20 | MODULE_LICENSE("GPL"); |
2ae15b64 | 21 | MODULE_DESCRIPTION("Xtables: IPv6 Hop-By-Hop and Destination Header match"); |
1da177e4 | 22 | MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>"); |
5fa2a760 | 23 | MODULE_ALIAS("ip6t_dst"); |
1da177e4 | 24 | |
1da177e4 | 25 | /* |
f0daaa65 YK |
26 | * (Type & 0xC0) >> 6 |
27 | * 0 -> ignorable | |
28 | * 1 -> must drop the packet | |
29 | * 2 -> send ICMP PARM PROB regardless and drop packet | |
30 | * 3 -> Send ICMP if not a multicast address and drop packet | |
1da177e4 | 31 | * (Type & 0x20) >> 5 |
f0daaa65 YK |
32 | * 0 -> invariant |
33 | * 1 -> can change the routing | |
1da177e4 | 34 | * (Type & 0x1F) Type |
f0daaa65 YK |
35 | * 0 -> Pad1 (only 1 byte!) |
36 | * 1 -> PadN LENGTH info (total length = length + 2) | |
37 | * C0 | 2 -> JUMBO 4 x x x x ( xxxx > 64k ) | |
38 | * 5 -> RTALERT 2 x x | |
1da177e4 LT |
39 | */ |
40 | ||
4f948db1 JE |
41 | static struct xt_match hbh_mt6_reg[] __read_mostly; |
42 | ||
1d93a9cb | 43 | static bool |
62fc8051 | 44 | hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par) |
1da177e4 | 45 | { |
a47362a2 JE |
46 | struct ipv6_opt_hdr _optsh; |
47 | const struct ipv6_opt_hdr *oh; | |
f7108a20 | 48 | const struct ip6t_opts *optinfo = par->matchinfo; |
f0daaa65 | 49 | unsigned int temp; |
84018f55 | 50 | unsigned int ptr = 0; |
f0daaa65 | 51 | unsigned int hdrlen = 0; |
1d93a9cb | 52 | bool ret = false; |
a47362a2 JE |
53 | u8 _opttype; |
54 | u8 _optlen; | |
55 | const u_int8_t *tp = NULL; | |
56 | const u_int8_t *lp = NULL; | |
f0daaa65 | 57 | unsigned int optlen; |
6d381634 | 58 | int err; |
f0daaa65 | 59 | |
4f948db1 JE |
60 | err = ipv6_find_hdr(skb, &ptr, |
61 | (par->match == &hbh_mt6_reg[0]) ? | |
84018f55 | 62 | NEXTHDR_HOP : NEXTHDR_DEST, NULL, NULL); |
6d381634 PM |
63 | if (err < 0) { |
64 | if (err != -ENOENT) | |
b4ba2611 | 65 | par->hotdrop = true; |
1d93a9cb | 66 | return false; |
6d381634 | 67 | } |
1da177e4 | 68 | |
f0daaa65 YK |
69 | oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh); |
70 | if (oh == NULL) { | |
b4ba2611 | 71 | par->hotdrop = true; |
1d93a9cb | 72 | return false; |
f0daaa65 YK |
73 | } |
74 | ||
75 | hdrlen = ipv6_optlen(oh); | |
76 | if (skb->len - ptr < hdrlen) { | |
77 | /* Packet smaller than it's length field */ | |
1d93a9cb | 78 | return false; |
f0daaa65 YK |
79 | } |
80 | ||
0d53778e | 81 | pr_debug("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen); |
f0daaa65 | 82 | |
0d53778e PM |
83 | pr_debug("len %02X %04X %02X ", |
84 | optinfo->hdrlen, hdrlen, | |
85 | (!(optinfo->flags & IP6T_OPTS_LEN) || | |
86 | ((optinfo->hdrlen == hdrlen) ^ | |
87 | !!(optinfo->invflags & IP6T_OPTS_INV_LEN)))); | |
f0daaa65 YK |
88 | |
89 | ret = (oh != NULL) && | |
90 | (!(optinfo->flags & IP6T_OPTS_LEN) || | |
91 | ((optinfo->hdrlen == hdrlen) ^ | |
92 | !!(optinfo->invflags & IP6T_OPTS_INV_LEN))); | |
93 | ||
94 | ptr += 2; | |
95 | hdrlen -= 2; | |
96 | if (!(optinfo->flags & IP6T_OPTS_OPTS)) { | |
97 | return ret; | |
1da177e4 | 98 | } else { |
0d53778e PM |
99 | pr_debug("Strict "); |
100 | pr_debug("#%d ", optinfo->optsnr); | |
f0daaa65 | 101 | for (temp = 0; temp < optinfo->optsnr; temp++) { |
1da177e4 LT |
102 | /* type field exists ? */ |
103 | if (hdrlen < 1) | |
104 | break; | |
105 | tp = skb_header_pointer(skb, ptr, sizeof(_opttype), | |
106 | &_opttype); | |
107 | if (tp == NULL) | |
108 | break; | |
109 | ||
110 | /* Type check */ | |
f0daaa65 | 111 | if (*tp != (optinfo->opts[temp] & 0xFF00) >> 8) { |
0d53778e PM |
112 | pr_debug("Tbad %02X %02X\n", *tp, |
113 | (optinfo->opts[temp] & 0xFF00) >> 8); | |
1d93a9cb | 114 | return false; |
1da177e4 | 115 | } else { |
0d53778e | 116 | pr_debug("Tok "); |
1da177e4 LT |
117 | } |
118 | /* Length check */ | |
119 | if (*tp) { | |
120 | u16 spec_len; | |
121 | ||
122 | /* length field exists ? */ | |
123 | if (hdrlen < 2) | |
124 | break; | |
125 | lp = skb_header_pointer(skb, ptr + 1, | |
126 | sizeof(_optlen), | |
127 | &_optlen); | |
128 | if (lp == NULL) | |
129 | break; | |
130 | spec_len = optinfo->opts[temp] & 0x00FF; | |
131 | ||
132 | if (spec_len != 0x00FF && spec_len != *lp) { | |
0d53778e PM |
133 | pr_debug("Lbad %02X %04X\n", *lp, |
134 | spec_len); | |
1d93a9cb | 135 | return false; |
1da177e4 | 136 | } |
0d53778e | 137 | pr_debug("Lok "); |
1da177e4 LT |
138 | optlen = *lp + 2; |
139 | } else { | |
0d53778e | 140 | pr_debug("Pad1\n"); |
1da177e4 LT |
141 | optlen = 1; |
142 | } | |
143 | ||
144 | /* Step to the next */ | |
b1383380 | 145 | pr_debug("len%04X\n", optlen); |
1da177e4 LT |
146 | |
147 | if ((ptr > skb->len - optlen || hdrlen < optlen) && | |
7c4e36bc | 148 | temp < optinfo->optsnr - 1) { |
b1383380 | 149 | pr_debug("new pointer is too large!\n"); |
1da177e4 LT |
150 | break; |
151 | } | |
152 | ptr += optlen; | |
153 | hdrlen -= optlen; | |
154 | } | |
155 | if (temp == optinfo->optsnr) | |
156 | return ret; | |
f0daaa65 | 157 | else |
1d93a9cb | 158 | return false; |
1da177e4 LT |
159 | } |
160 | ||
1d93a9cb | 161 | return false; |
1da177e4 LT |
162 | } |
163 | ||
b0f38452 | 164 | static int hbh_mt6_check(const struct xt_mtchk_param *par) |
1da177e4 | 165 | { |
9b4fce7a | 166 | const struct ip6t_opts *optsinfo = par->matchinfo; |
f0daaa65 | 167 | |
f0daaa65 | 168 | if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) { |
ff67e4e4 | 169 | pr_debug("unknown flags %X\n", optsinfo->invflags); |
bd414ee6 | 170 | return -EINVAL; |
f0daaa65 | 171 | } |
8ca31ce5 YK |
172 | |
173 | if (optsinfo->flags & IP6T_OPTS_NSTRICT) { | |
ff67e4e4 | 174 | pr_debug("Not strict - not implemented"); |
bd414ee6 | 175 | return -EINVAL; |
8ca31ce5 YK |
176 | } |
177 | ||
bd414ee6 | 178 | return 0; |
1da177e4 LT |
179 | } |
180 | ||
d3c5ee6d | 181 | static struct xt_match hbh_mt6_reg[] __read_mostly = { |
5fa2a760 | 182 | { |
4f948db1 | 183 | /* Note, hbh_mt6 relies on the order of hbh_mt6_reg */ |
5fa2a760 | 184 | .name = "hbh", |
ee999d8b | 185 | .family = NFPROTO_IPV6, |
d3c5ee6d | 186 | .match = hbh_mt6, |
5fa2a760 | 187 | .matchsize = sizeof(struct ip6t_opts), |
d3c5ee6d | 188 | .checkentry = hbh_mt6_check, |
5fa2a760 | 189 | .me = THIS_MODULE, |
5fa2a760 PM |
190 | }, |
191 | { | |
192 | .name = "dst", | |
ee999d8b | 193 | .family = NFPROTO_IPV6, |
d3c5ee6d | 194 | .match = hbh_mt6, |
5fa2a760 | 195 | .matchsize = sizeof(struct ip6t_opts), |
d3c5ee6d | 196 | .checkentry = hbh_mt6_check, |
5fa2a760 | 197 | .me = THIS_MODULE, |
5fa2a760 | 198 | }, |
1da177e4 LT |
199 | }; |
200 | ||
d3c5ee6d | 201 | static int __init hbh_mt6_init(void) |
1da177e4 | 202 | { |
d3c5ee6d | 203 | return xt_register_matches(hbh_mt6_reg, ARRAY_SIZE(hbh_mt6_reg)); |
1da177e4 LT |
204 | } |
205 | ||
d3c5ee6d | 206 | static void __exit hbh_mt6_exit(void) |
1da177e4 | 207 | { |
d3c5ee6d | 208 | xt_unregister_matches(hbh_mt6_reg, ARRAY_SIZE(hbh_mt6_reg)); |
1da177e4 LT |
209 | } |
210 | ||
d3c5ee6d JE |
211 | module_init(hbh_mt6_init); |
212 | module_exit(hbh_mt6_exit); |