[mirror_ubuntu-artful-kernel.git] / net / ipv6 / netfilter / ip6t_rt.c

/* Kernel module to match ROUTING parameters. */

/* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/ipv6.h>
#include <linux/types.h>
#include <net/checksum.h>
#include <net/ipv6.h>

#include <asm/byteorder.h>

#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <linux/netfilter_ipv6/ip6t_rt.h>

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("IPv6 RT match");
MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");

#if 0
#define DEBUGP printk
#else
#define DEBUGP(format, args...)
#endif

/* Returns 1 if the id is matched by the range, 0 otherwise */
static inline int
segsleft_match(u_int32_t min, u_int32_t max, u_int32_t id, int invert)
{
	int r = 0;
	DEBUGP("rt segsleft_match:%c 0x%x <= 0x%x <= 0x%x",
	       invert ? '!' : ' ', min, id, max);
	r = (id >= min && id <= max) ^ invert;
	DEBUGP(" result %s\n", r ? "PASS" : "FAILED");
	return r;
}

static int
match(const struct sk_buff *skb,
      const struct net_device *in,
      const struct net_device *out,
      const struct xt_match *match,
      const void *matchinfo,
      int offset,
      unsigned int protoff,
      int *hotdrop)
{
	struct ipv6_rt_hdr _route, *rh;
	const struct ip6t_rt *rtinfo = matchinfo;
	unsigned int temp;
	unsigned int ptr;
	unsigned int hdrlen = 0;
	unsigned int ret = 0;
	struct in6_addr *ap, _addr;
	int err;

	err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL);
	if (err < 0) {
		if (err != -ENOENT)
			*hotdrop = 1;
		return 0;
	}

	rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
	if (rh == NULL) {
		*hotdrop = 1;
		return 0;
	}

	hdrlen = ipv6_optlen(rh);
	if (skb->len - ptr < hdrlen) {
		/* Pcket smaller than its length field */
		return 0;
	}

	DEBUGP("IPv6 RT LEN %u %u ", hdrlen, rh->hdrlen);
	DEBUGP("TYPE %04X ", rh->type);
	DEBUGP("SGS_LEFT %u %02X\n", rh->segments_left, rh->segments_left);

	DEBUGP("IPv6 RT segsleft %02X ",
	       (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
			       rh->segments_left,
			       !!(rtinfo->invflags & IP6T_RT_INV_SGS))));
	DEBUGP("type %02X %02X %02X ",
	       rtinfo->rt_type, rh->type,
	       (!(rtinfo->flags & IP6T_RT_TYP) ||
		((rtinfo->rt_type == rh->type) ^
		 !!(rtinfo->invflags & IP6T_RT_INV_TYP))));
	DEBUGP("len %02X %04X %02X ",
	       rtinfo->hdrlen, hdrlen,
	       (!(rtinfo->flags & IP6T_RT_LEN) ||
		((rtinfo->hdrlen == hdrlen) ^
		 !!(rtinfo->invflags & IP6T_RT_INV_LEN))));
	DEBUGP("res %02X %02X %02X ",
	       (rtinfo->flags & IP6T_RT_RES),
	       ((struct rt0_hdr *)rh)->reserved,
	       !((rtinfo->flags & IP6T_RT_RES) &&
		 (((struct rt0_hdr *)rh)->reserved)));

	ret = (rh != NULL)
	      &&
	      (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
			      rh->segments_left,
			      !!(rtinfo->invflags & IP6T_RT_INV_SGS)))
	      &&
	      (!(rtinfo->flags & IP6T_RT_LEN) ||
	       ((rtinfo->hdrlen == hdrlen) ^
		!!(rtinfo->invflags & IP6T_RT_INV_LEN)))
	      &&
	      (!(rtinfo->flags & IP6T_RT_TYP) ||
	       ((rtinfo->rt_type == rh->type) ^
		!!(rtinfo->invflags & IP6T_RT_INV_TYP)));

	if (ret && (rtinfo->flags & IP6T_RT_RES)) {
		u_int32_t *rp, _reserved;
		rp = skb_header_pointer(skb,
					ptr + offsetof(struct rt0_hdr,
						       reserved),
					sizeof(_reserved),
					&_reserved);

		ret = (*rp == 0);
	}

	DEBUGP("#%d ", rtinfo->addrnr);
	if (!(rtinfo->flags & IP6T_RT_FST)) {
		return ret;
	} else if (rtinfo->flags & IP6T_RT_FST_NSTRICT) {
		DEBUGP("Not strict ");
		if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
			DEBUGP("There isn't enough space\n");
			return 0;
		} else {
			unsigned int i = 0;

			DEBUGP("#%d ", rtinfo->addrnr);
			for (temp = 0;
			     temp < (unsigned int)((hdrlen - 8) / 16);
			     temp++) {
				ap = skb_header_pointer(skb,
							ptr
							+ sizeof(struct rt0_hdr)
							+ temp * sizeof(_addr),
							sizeof(_addr),
							&_addr);

				BUG_ON(ap == NULL);

				if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {
					DEBUGP("i=%d temp=%d;\n", i, temp);
					i++;
				}
				if (i == rtinfo->addrnr)
					break;
			}
			DEBUGP("i=%d #%d\n", i, rtinfo->addrnr);
			if (i == rtinfo->addrnr)
				return ret;
			else
				return 0;
		}
	} else {
		DEBUGP("Strict ");
		if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
			DEBUGP("There isn't enough space\n");
			return 0;
		} else {
			DEBUGP("#%d ", rtinfo->addrnr);
			for (temp = 0; temp < rtinfo->addrnr; temp++) {
				ap = skb_header_pointer(skb,
							ptr
							+ sizeof(struct rt0_hdr)
							+ temp * sizeof(_addr),
							sizeof(_addr),
							&_addr);
				BUG_ON(ap == NULL);

				if (!ipv6_addr_equal(ap, &rtinfo->addrs[temp]))
					break;
			}
			DEBUGP("temp=%d #%d\n", temp, rtinfo->addrnr);
			if ((temp == rtinfo->addrnr) &&
			    (temp == (unsigned int)((hdrlen - 8) / 16)))
				return ret;
			else
				return 0;
		}
	}

	return 0;
}

/* Called when user tries to insert an entry of this type. */
static int
checkentry(const char *tablename,
	   const void *entry,
	   const struct xt_match *match,
	   void *matchinfo,
	   unsigned int hook_mask)
{
	const struct ip6t_rt *rtinfo = matchinfo;

	if (rtinfo->invflags & ~IP6T_RT_INV_MASK) {
		DEBUGP("ip6t_rt: unknown flags %X\n", rtinfo->invflags);
		return 0;
	}
	if ((rtinfo->flags & (IP6T_RT_RES | IP6T_RT_FST_MASK)) &&
	    (!(rtinfo->flags & IP6T_RT_TYP) ||
	     (rtinfo->rt_type != 0) ||
	     (rtinfo->invflags & IP6T_RT_INV_TYP))) {
		DEBUGP("`--rt-type 0' required before `--rt-0-*'");
		return 0;
	}

	return 1;
}

static struct xt_match rt_match = {
	.name		= "rt",
	.family		= AF_INET6,
	.match		= match,
	.matchsize	= sizeof(struct ip6t_rt),
	.checkentry	= checkentry,
	.me		= THIS_MODULE,
};

static int __init ip6t_rt_init(void)
{
	return xt_register_match(&rt_match);
}

static void __exit ip6t_rt_fini(void)
{
	xt_unregister_match(&rt_match);
}

module_init(ip6t_rt_init);
module_exit(ip6t_rt_fini);
Commit	Line	Data
1da177e4 LT	1	/* Kernel module to match ROUTING parameters. */
	2
	3	/* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation.
	8	*/
	9
	10	#include <linux/module.h>
	11	#include <linux/skbuff.h>
	12	#include <linux/ipv6.h>
	13	#include <linux/types.h>
	14	#include <net/checksum.h>
	15	#include <net/ipv6.h>
	16
	17	#include <asm/byteorder.h>
	18
6709dbbb	19	#include <linux/netfilter/x_tables.h>
1da177e4 LT	20	#include <linux/netfilter_ipv6/ip6_tables.h>
	21	#include <linux/netfilter_ipv6/ip6t_rt.h>
	22
	23	MODULE_LICENSE("GPL");
	24	MODULE_DESCRIPTION("IPv6 RT match");
	25	MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
	26
	27	#if 0
	28	#define DEBUGP printk
	29	#else
	30	#define DEBUGP(format, args...)
	31	#endif
	32
	33	/* Returns 1 if the id is matched by the range, 0 otherwise */
	34	static inline int
	35	segsleft_match(u_int32_t min, u_int32_t max, u_int32_t id, int invert)
	36	{
f0daaa65 YK	37	int r = 0;
	38	DEBUGP("rt segsleft_match:%c 0x%x <= 0x%x <= 0x%x",
	39	invert ? '!' : ' ', min, id, max);
	40	r = (id >= min && id <= max) ^ invert;
	41	DEBUGP(" result %s\n", r ? "PASS" : "FAILED");
	42	return r;
1da177e4 LT	43	}
	44
	45	static int
	46	match(const struct sk_buff *skb,
	47	const struct net_device *in,
	48	const struct net_device *out,
c4986734	49	const struct xt_match *match,
1da177e4 LT	50	const void *matchinfo,
	51	int offset,
	52	unsigned int protoff,
	53	int *hotdrop)
	54	{
f0daaa65 YK	55	struct ipv6_rt_hdr _route, *rh;
	56	const struct ip6t_rt *rtinfo = matchinfo;
	57	unsigned int temp;
	58	unsigned int ptr;
	59	unsigned int hdrlen = 0;
	60	unsigned int ret = 0;
	61	struct in6_addr *ap, _addr;
6d381634	62	int err;
1da177e4	63
6d381634 PM	64	err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL);
	65	if (err < 0) {
	66	if (err != -ENOENT)
	67	*hotdrop = 1;
e674d0f3	68	return 0;
6d381634	69	}
1da177e4	70
f0daaa65 YK	71	rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
	72	if (rh == NULL) {
	73	*hotdrop = 1;
	74	return 0;
	75	}
	76
	77	hdrlen = ipv6_optlen(rh);
	78	if (skb->len - ptr < hdrlen) {
	79	/* Pcket smaller than its length field */
	80	return 0;
	81	}
	82
	83	DEBUGP("IPv6 RT LEN %u %u ", hdrlen, rh->hdrlen);
	84	DEBUGP("TYPE %04X ", rh->type);
	85	DEBUGP("SGS_LEFT %u %02X\n", rh->segments_left, rh->segments_left);
	86
	87	DEBUGP("IPv6 RT segsleft %02X ",
	88	(segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
	89	rh->segments_left,
	90	!!(rtinfo->invflags & IP6T_RT_INV_SGS))));
	91	DEBUGP("type %02X %02X %02X ",
	92	rtinfo->rt_type, rh->type,
	93	(!(rtinfo->flags & IP6T_RT_TYP) \|\|
	94	((rtinfo->rt_type == rh->type) ^
	95	!!(rtinfo->invflags & IP6T_RT_INV_TYP))));
	96	DEBUGP("len %02X %04X %02X ",
	97	rtinfo->hdrlen, hdrlen,
	98	(!(rtinfo->flags & IP6T_RT_LEN) \|\|
	99	((rtinfo->hdrlen == hdrlen) ^
	100	!!(rtinfo->invflags & IP6T_RT_INV_LEN))));
	101	DEBUGP("res %02X %02X %02X ",
	102	(rtinfo->flags & IP6T_RT_RES),
	103	((struct rt0_hdr *)rh)->reserved,
	104	!((rtinfo->flags & IP6T_RT_RES) &&
	105	(((struct rt0_hdr *)rh)->reserved)));
	106
	107	ret = (rh != NULL)
	108	&&
	109	(segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
	110	rh->segments_left,
	111	!!(rtinfo->invflags & IP6T_RT_INV_SGS)))
	112	&&
	113	(!(rtinfo->flags & IP6T_RT_LEN) \|\|
	114	((rtinfo->hdrlen == hdrlen) ^
	115	!!(rtinfo->invflags & IP6T_RT_INV_LEN)))
	116	&&
	117	(!(rtinfo->flags & IP6T_RT_TYP) \|\|
	118	((rtinfo->rt_type == rh->type) ^
	119	!!(rtinfo->invflags & IP6T_RT_INV_TYP)));
1da177e4 LT	120
1da177e4 LT	121	if (ret && (rtinfo->flags & IP6T_RT_RES)) {
e6df439b BH	122	u_int32_t *rp, _reserved;
e6df439b BH	123	rp = skb_header_pointer(skb,
f0daaa65 YK	124	ptr + offsetof(struct rt0_hdr,
	125	reserved),
	126	sizeof(_reserved),
	127	&_reserved);
1da177e4	128
e6df439b	129	ret = (*rp == 0);
1da177e4 LT	130	}
1da177e4 LT	131
f0daaa65 YK	132	DEBUGP("#%d ", rtinfo->addrnr);
	133	if (!(rtinfo->flags & IP6T_RT_FST)) {
	134	return ret;
1da177e4 LT	135	} else if (rtinfo->flags & IP6T_RT_FST_NSTRICT) {
1da177e4 LT	136	DEBUGP("Not strict ");
f0daaa65	137	if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
1da177e4 LT	138	DEBUGP("There isn't enough space\n");
	139	return 0;
	140	} else {
	141	unsigned int i = 0;
	142
f0daaa65 YK	143	DEBUGP("#%d ", rtinfo->addrnr);
	144	for (temp = 0;
	145	temp < (unsigned int)((hdrlen - 8) / 16);
	146	temp++) {
1da177e4 LT	147	ap = skb_header_pointer(skb,
	148	ptr
	149	+ sizeof(struct rt0_hdr)
	150	+ temp * sizeof(_addr),
	151	sizeof(_addr),
	152	&_addr);
	153
	154	BUG_ON(ap == NULL);
	155
	156	if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {
f0daaa65	157	DEBUGP("i=%d temp=%d;\n", i, temp);
1da177e4 LT	158	i++;
1da177e4 LT	159	}
f0daaa65 YK	160	if (i == rtinfo->addrnr)
f0daaa65 YK	161	break;
1da177e4 LT	162	}
	163	DEBUGP("i=%d #%d\n", i, rtinfo->addrnr);
	164	if (i == rtinfo->addrnr)
	165	return ret;
f0daaa65 YK	166	else
f0daaa65 YK	167	return 0;
1da177e4 LT	168	}
	169	} else {
	170	DEBUGP("Strict ");
f0daaa65	171	if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
1da177e4 LT	172	DEBUGP("There isn't enough space\n");
	173	return 0;
	174	} else {
f0daaa65 YK	175	DEBUGP("#%d ", rtinfo->addrnr);
f0daaa65 YK	176	for (temp = 0; temp < rtinfo->addrnr; temp++) {
1da177e4 LT	177	ap = skb_header_pointer(skb,
	178	ptr
	179	+ sizeof(struct rt0_hdr)
	180	+ temp * sizeof(_addr),
	181	sizeof(_addr),
	182	&_addr);
	183	BUG_ON(ap == NULL);
	184
	185	if (!ipv6_addr_equal(ap, &rtinfo->addrs[temp]))
	186	break;
	187	}
	188	DEBUGP("temp=%d #%d\n", temp, rtinfo->addrnr);
f0daaa65 YK	189	if ((temp == rtinfo->addrnr) &&
f0daaa65 YK	190	(temp == (unsigned int)((hdrlen - 8) / 16)))
1da177e4	191	return ret;
f0daaa65 YK	192	else
f0daaa65 YK	193	return 0;
1da177e4 LT	194	}
	195	}
	196
	197	return 0;
	198	}
	199
	200	/* Called when user tries to insert an entry of this type. */
	201	static int
	202	checkentry(const char *tablename,
f0daaa65	203	const void *entry,
c4986734	204	const struct xt_match *match,
f0daaa65	205	void *matchinfo,
f0daaa65	206	unsigned int hook_mask)
1da177e4	207	{
f0daaa65 YK	208	const struct ip6t_rt *rtinfo = matchinfo;
f0daaa65 YK	209
f0daaa65 YK	210	if (rtinfo->invflags & ~IP6T_RT_INV_MASK) {
	211	DEBUGP("ip6t_rt: unknown flags %X\n", rtinfo->invflags);
	212	return 0;
	213	}
	214	if ((rtinfo->flags & (IP6T_RT_RES \| IP6T_RT_FST_MASK)) &&
	215	(!(rtinfo->flags & IP6T_RT_TYP) \|\|
	216	(rtinfo->rt_type != 0) \|\|
	217	(rtinfo->invflags & IP6T_RT_INV_TYP))) {
	218	DEBUGP("`--rt-type 0' required before `--rt-0-*'");
	219	return 0;
	220	}
	221
	222	return 1;
1da177e4 LT	223	}
1da177e4 LT	224
6709dbbb	225	static struct xt_match rt_match = {
1da177e4	226	.name = "rt",
6709dbbb	227	.family = AF_INET6,
7f939713 PM	228	.match = match,
	229	.matchsize = sizeof(struct ip6t_rt),
	230	.checkentry = checkentry,
1da177e4 LT	231	.me = THIS_MODULE,
	232	};
	233
65b4b4e8	234	static int __init ip6t_rt_init(void)
1da177e4	235	{
6709dbbb	236	return xt_register_match(&rt_match);
1da177e4 LT	237	}
1da177e4 LT	238
65b4b4e8	239	static void __exit ip6t_rt_fini(void)
1da177e4	240	{
6709dbbb	241	xt_unregister_match(&rt_match);
1da177e4 LT	242	}
1da177e4 LT	243
65b4b4e8 AM	244	module_init(ip6t_rt_init);
65b4b4e8 AM	245	module_exit(ip6t_rt_fini);