]>
Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* Kernel module to match Hop-by-Hop and Destination parameters. */ |
2 | ||
3 | /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu> | |
4 | * | |
5 | * This program is free software; you can redistribute it and/or modify | |
6 | * it under the terms of the GNU General Public License version 2 as | |
7 | * published by the Free Software Foundation. | |
8 | */ | |
9 | ||
10 | #include <linux/module.h> | |
11 | #include <linux/skbuff.h> | |
12 | #include <linux/ipv6.h> | |
13 | #include <linux/types.h> | |
14 | #include <net/checksum.h> | |
15 | #include <net/ipv6.h> | |
16 | ||
17 | #include <asm/byteorder.h> | |
18 | ||
6709dbbb | 19 | #include <linux/netfilter/x_tables.h> |
1da177e4 LT |
20 | #include <linux/netfilter_ipv6/ip6_tables.h> |
21 | #include <linux/netfilter_ipv6/ip6t_opts.h> | |
22 | ||
1da177e4 | 23 | MODULE_LICENSE("GPL"); |
2ae15b64 | 24 | MODULE_DESCRIPTION("Xtables: IPv6 Hop-By-Hop and Destination Header match"); |
1da177e4 | 25 | MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>"); |
5fa2a760 | 26 | MODULE_ALIAS("ip6t_dst"); |
1da177e4 | 27 | |
1da177e4 | 28 | /* |
f0daaa65 YK |
29 | * (Type & 0xC0) >> 6 |
30 | * 0 -> ignorable | |
31 | * 1 -> must drop the packet | |
32 | * 2 -> send ICMP PARM PROB regardless and drop packet | |
33 | * 3 -> Send ICMP if not a multicast address and drop packet | |
1da177e4 | 34 | * (Type & 0x20) >> 5 |
f0daaa65 YK |
35 | * 0 -> invariant |
36 | * 1 -> can change the routing | |
1da177e4 | 37 | * (Type & 0x1F) Type |
f0daaa65 YK |
38 | * 0 -> Pad1 (only 1 byte!) |
39 | * 1 -> PadN LENGTH info (total length = length + 2) | |
40 | * C0 | 2 -> JUMBO 4 x x x x ( xxxx > 64k ) | |
41 | * 5 -> RTALERT 2 x x | |
1da177e4 LT |
42 | */ |
43 | ||
1d93a9cb | 44 | static bool |
d3c5ee6d JE |
45 | hbh_mt6(const struct sk_buff *skb, const struct net_device *in, |
46 | const struct net_device *out, const struct xt_match *match, | |
47 | const void *matchinfo, int offset, unsigned int protoff, | |
48 | bool *hotdrop) | |
1da177e4 | 49 | { |
a47362a2 JE |
50 | struct ipv6_opt_hdr _optsh; |
51 | const struct ipv6_opt_hdr *oh; | |
f0daaa65 YK |
52 | const struct ip6t_opts *optinfo = matchinfo; |
53 | unsigned int temp; | |
54 | unsigned int ptr; | |
55 | unsigned int hdrlen = 0; | |
1d93a9cb | 56 | bool ret = false; |
a47362a2 JE |
57 | u8 _opttype; |
58 | u8 _optlen; | |
59 | const u_int8_t *tp = NULL; | |
60 | const u_int8_t *lp = NULL; | |
f0daaa65 | 61 | unsigned int optlen; |
6d381634 | 62 | int err; |
f0daaa65 | 63 | |
6d381634 PM |
64 | err = ipv6_find_hdr(skb, &ptr, match->data, NULL); |
65 | if (err < 0) { | |
66 | if (err != -ENOENT) | |
cff533ac | 67 | *hotdrop = true; |
1d93a9cb | 68 | return false; |
6d381634 | 69 | } |
1da177e4 | 70 | |
f0daaa65 YK |
71 | oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh); |
72 | if (oh == NULL) { | |
cff533ac | 73 | *hotdrop = true; |
1d93a9cb | 74 | return false; |
f0daaa65 YK |
75 | } |
76 | ||
77 | hdrlen = ipv6_optlen(oh); | |
78 | if (skb->len - ptr < hdrlen) { | |
79 | /* Packet smaller than it's length field */ | |
1d93a9cb | 80 | return false; |
f0daaa65 YK |
81 | } |
82 | ||
0d53778e | 83 | pr_debug("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen); |
f0daaa65 | 84 | |
0d53778e PM |
85 | pr_debug("len %02X %04X %02X ", |
86 | optinfo->hdrlen, hdrlen, | |
87 | (!(optinfo->flags & IP6T_OPTS_LEN) || | |
88 | ((optinfo->hdrlen == hdrlen) ^ | |
89 | !!(optinfo->invflags & IP6T_OPTS_INV_LEN)))); | |
f0daaa65 YK |
90 | |
91 | ret = (oh != NULL) && | |
92 | (!(optinfo->flags & IP6T_OPTS_LEN) || | |
93 | ((optinfo->hdrlen == hdrlen) ^ | |
94 | !!(optinfo->invflags & IP6T_OPTS_INV_LEN))); | |
95 | ||
96 | ptr += 2; | |
97 | hdrlen -= 2; | |
98 | if (!(optinfo->flags & IP6T_OPTS_OPTS)) { | |
99 | return ret; | |
1da177e4 | 100 | } else { |
0d53778e PM |
101 | pr_debug("Strict "); |
102 | pr_debug("#%d ", optinfo->optsnr); | |
f0daaa65 | 103 | for (temp = 0; temp < optinfo->optsnr; temp++) { |
1da177e4 LT |
104 | /* type field exists ? */ |
105 | if (hdrlen < 1) | |
106 | break; | |
107 | tp = skb_header_pointer(skb, ptr, sizeof(_opttype), | |
108 | &_opttype); | |
109 | if (tp == NULL) | |
110 | break; | |
111 | ||
112 | /* Type check */ | |
f0daaa65 | 113 | if (*tp != (optinfo->opts[temp] & 0xFF00) >> 8) { |
0d53778e PM |
114 | pr_debug("Tbad %02X %02X\n", *tp, |
115 | (optinfo->opts[temp] & 0xFF00) >> 8); | |
1d93a9cb | 116 | return false; |
1da177e4 | 117 | } else { |
0d53778e | 118 | pr_debug("Tok "); |
1da177e4 LT |
119 | } |
120 | /* Length check */ | |
121 | if (*tp) { | |
122 | u16 spec_len; | |
123 | ||
124 | /* length field exists ? */ | |
125 | if (hdrlen < 2) | |
126 | break; | |
127 | lp = skb_header_pointer(skb, ptr + 1, | |
128 | sizeof(_optlen), | |
129 | &_optlen); | |
130 | if (lp == NULL) | |
131 | break; | |
132 | spec_len = optinfo->opts[temp] & 0x00FF; | |
133 | ||
134 | if (spec_len != 0x00FF && spec_len != *lp) { | |
0d53778e PM |
135 | pr_debug("Lbad %02X %04X\n", *lp, |
136 | spec_len); | |
1d93a9cb | 137 | return false; |
1da177e4 | 138 | } |
0d53778e | 139 | pr_debug("Lok "); |
1da177e4 LT |
140 | optlen = *lp + 2; |
141 | } else { | |
0d53778e | 142 | pr_debug("Pad1\n"); |
1da177e4 LT |
143 | optlen = 1; |
144 | } | |
145 | ||
146 | /* Step to the next */ | |
0d53778e | 147 | pr_debug("len%04X \n", optlen); |
1da177e4 LT |
148 | |
149 | if ((ptr > skb->len - optlen || hdrlen < optlen) && | |
7c4e36bc | 150 | temp < optinfo->optsnr - 1) { |
0d53778e | 151 | pr_debug("new pointer is too large! \n"); |
1da177e4 LT |
152 | break; |
153 | } | |
154 | ptr += optlen; | |
155 | hdrlen -= optlen; | |
156 | } | |
157 | if (temp == optinfo->optsnr) | |
158 | return ret; | |
f0daaa65 | 159 | else |
1d93a9cb | 160 | return false; |
1da177e4 LT |
161 | } |
162 | ||
1d93a9cb | 163 | return false; |
1da177e4 LT |
164 | } |
165 | ||
166 | /* Called when user tries to insert an entry of this type. */ | |
ccb79bdc | 167 | static bool |
d3c5ee6d JE |
168 | hbh_mt6_check(const char *tablename, const void *entry, |
169 | const struct xt_match *match, void *matchinfo, | |
170 | unsigned int hook_mask) | |
1da177e4 | 171 | { |
f0daaa65 YK |
172 | const struct ip6t_opts *optsinfo = matchinfo; |
173 | ||
f0daaa65 | 174 | if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) { |
0d53778e | 175 | pr_debug("ip6t_opts: unknown flags %X\n", optsinfo->invflags); |
ccb79bdc | 176 | return false; |
f0daaa65 | 177 | } |
8ca31ce5 YK |
178 | |
179 | if (optsinfo->flags & IP6T_OPTS_NSTRICT) { | |
180 | pr_debug("ip6t_opts: Not strict - not implemented"); | |
181 | return false; | |
182 | } | |
183 | ||
ccb79bdc | 184 | return true; |
1da177e4 LT |
185 | } |
186 | ||
d3c5ee6d | 187 | static struct xt_match hbh_mt6_reg[] __read_mostly = { |
5fa2a760 PM |
188 | { |
189 | .name = "hbh", | |
ee999d8b | 190 | .family = NFPROTO_IPV6, |
d3c5ee6d | 191 | .match = hbh_mt6, |
5fa2a760 | 192 | .matchsize = sizeof(struct ip6t_opts), |
d3c5ee6d | 193 | .checkentry = hbh_mt6_check, |
5fa2a760 PM |
194 | .me = THIS_MODULE, |
195 | .data = NEXTHDR_HOP, | |
196 | }, | |
197 | { | |
198 | .name = "dst", | |
ee999d8b | 199 | .family = NFPROTO_IPV6, |
d3c5ee6d | 200 | .match = hbh_mt6, |
5fa2a760 | 201 | .matchsize = sizeof(struct ip6t_opts), |
d3c5ee6d | 202 | .checkentry = hbh_mt6_check, |
5fa2a760 PM |
203 | .me = THIS_MODULE, |
204 | .data = NEXTHDR_DEST, | |
205 | }, | |
1da177e4 LT |
206 | }; |
207 | ||
d3c5ee6d | 208 | static int __init hbh_mt6_init(void) |
1da177e4 | 209 | { |
d3c5ee6d | 210 | return xt_register_matches(hbh_mt6_reg, ARRAY_SIZE(hbh_mt6_reg)); |
1da177e4 LT |
211 | } |
212 | ||
d3c5ee6d | 213 | static void __exit hbh_mt6_exit(void) |
1da177e4 | 214 | { |
d3c5ee6d | 215 | xt_unregister_matches(hbh_mt6_reg, ARRAY_SIZE(hbh_mt6_reg)); |
1da177e4 LT |
216 | } |
217 | ||
d3c5ee6d JE |
218 | module_init(hbh_mt6_init); |
219 | module_exit(hbh_mt6_exit); |