[mirror_ubuntu-artful-kernel.git] / net / netfilter / xt_dccp.c

/*
 * iptables module for DCCP protocol header matching
 *
 * (C) 2005 by Harald Welte <laforge@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/spinlock.h>
#include <net/ip.h>
#include <linux/dccp.h>

#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_dccp.h>

#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("Match for DCCP protocol packets");
MODULE_ALIAS("ipt_dccp");

#define DCCHECK(cond, option, flag, invflag) (!((flag) & (option)) \
		                  || (!!((invflag) & (option)) ^ (cond)))

static unsigned char *dccp_optbuf;
static DEFINE_SPINLOCK(dccp_buflock);

static inline int
dccp_find_option(u_int8_t option,
		 const struct sk_buff *skb,
		 unsigned int protoff,
		 const struct dccp_hdr *dh,
		 int *hotdrop)
{
	/* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
	unsigned char *op;
	unsigned int optoff = __dccp_hdr_len(dh);
	unsigned int optlen = dh->dccph_doff*4 - __dccp_hdr_len(dh);
	unsigned int i;

	if (dh->dccph_doff * 4 < __dccp_hdr_len(dh)) {
		*hotdrop = 1;
		return 0;
	}

	if (!optlen)
		return 0;

	spin_lock_bh(&dccp_buflock);
	op = skb_header_pointer(skb, protoff + optoff, optlen, dccp_optbuf);
	if (op == NULL) {
		/* If we don't have the whole header, drop packet. */
		spin_unlock_bh(&dccp_buflock);
		*hotdrop = 1;
		return 0;
	}

	for (i = 0; i < optlen; ) {
		if (op[i] == option) {
			spin_unlock_bh(&dccp_buflock);
			return 1;
		}

		if (op[i] < 2) 
			i++;
		else 
			i += op[i+1]?:1;
	}

	spin_unlock_bh(&dccp_buflock);
	return 0;
}


static inline int
match_types(const struct dccp_hdr *dh, u_int16_t typemask)
{
	return (typemask & (1 << dh->dccph_type));
}

static inline int
match_option(u_int8_t option, const struct sk_buff *skb, unsigned int protoff,
	     const struct dccp_hdr *dh, int *hotdrop)
{
	return dccp_find_option(option, skb, protoff, dh, hotdrop);
}

static int
match(const struct sk_buff *skb,
      const struct net_device *in,
      const struct net_device *out,
      const struct xt_match *match,
      const void *matchinfo,
      int offset,
      unsigned int protoff,
      int *hotdrop)
{
	const struct xt_dccp_info *info = matchinfo;
	struct dccp_hdr _dh, *dh;

	if (offset)
		return 0;
	
	dh = skb_header_pointer(skb, protoff, sizeof(_dh), &_dh);
	if (dh == NULL) {
		*hotdrop = 1;
		return 0;
       	}

	return  DCCHECK(((ntohs(dh->dccph_sport) >= info->spts[0]) 
			&& (ntohs(dh->dccph_sport) <= info->spts[1])), 
		   	XT_DCCP_SRC_PORTS, info->flags, info->invflags)
		&& DCCHECK(((ntohs(dh->dccph_dport) >= info->dpts[0]) 
			&& (ntohs(dh->dccph_dport) <= info->dpts[1])), 
			XT_DCCP_DEST_PORTS, info->flags, info->invflags)
		&& DCCHECK(match_types(dh, info->typemask),
			   XT_DCCP_TYPE, info->flags, info->invflags)
		&& DCCHECK(match_option(info->option, skb, protoff, dh,
					hotdrop),
			   XT_DCCP_OPTION, info->flags, info->invflags);
}

static int
checkentry(const char *tablename,
	   const void *inf,
	   const struct xt_match *match,
	   void *matchinfo,
	   unsigned int hook_mask)
{
	const struct xt_dccp_info *info = matchinfo;

	return !(info->flags & ~XT_DCCP_VALID_FLAGS)
		&& !(info->invflags & ~XT_DCCP_VALID_FLAGS)
		&& !(info->invflags & ~info->flags);
}

static struct xt_match xt_dccp_match[] = {
	{
		.name 		= "dccp",
		.family		= AF_INET,
		.checkentry	= checkentry,
		.match		= match,
		.matchsize	= sizeof(struct xt_dccp_info),
		.proto		= IPPROTO_DCCP,
		.me 		= THIS_MODULE,
	},
	{
		.name 		= "dccp",
		.family		= AF_INET6,
		.checkentry	= checkentry,
		.match		= match,
		.matchsize	= sizeof(struct xt_dccp_info),
		.proto		= IPPROTO_DCCP,
		.me 		= THIS_MODULE,
	},
};

static int __init xt_dccp_init(void)
{
	int ret;

	/* doff is 8 bits, so the maximum option size is (4*256).  Don't put
	 * this in BSS since DaveM is worried about locked TLB's for kernel
	 * BSS. */
	dccp_optbuf = kmalloc(256 * 4, GFP_KERNEL);
	if (!dccp_optbuf)
		return -ENOMEM;
	ret = xt_register_matches(xt_dccp_match, ARRAY_SIZE(xt_dccp_match));
	if (ret)
		goto out_kfree;
	return ret;

out_kfree:
	kfree(dccp_optbuf);
	return ret;
}

static void __exit xt_dccp_fini(void)
{
	xt_unregister_matches(xt_dccp_match, ARRAY_SIZE(xt_dccp_match));
	kfree(dccp_optbuf);
}

module_init(xt_dccp_init);
module_exit(xt_dccp_fini);
Commit	Line	Data
1d3de414 HW	1	/*
	2	* iptables module for DCCP protocol header matching
	3	*
	4	* (C) 2005 by Harald Welte <laforge@netfilter.org>
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*/
	10
	11	#include <linux/module.h>
	12	#include <linux/skbuff.h>
	13	#include <linux/spinlock.h>
	14	#include <net/ip.h>
	15	#include <linux/dccp.h>
	16
2e4e6a17 HW	17	#include <linux/netfilter/x_tables.h>
	18	#include <linux/netfilter/xt_dccp.h>
	19
1d3de414	20	#include <linux/netfilter_ipv4/ip_tables.h>
2e4e6a17 HW	21	#include <linux/netfilter_ipv6/ip6_tables.h>
	22
	23	MODULE_LICENSE("GPL");
	24	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
	25	MODULE_DESCRIPTION("Match for DCCP protocol packets");
	26	MODULE_ALIAS("ipt_dccp");
1d3de414 HW	27
	28	#define DCCHECK(cond, option, flag, invflag) (!((flag) & (option)) \
	29	\|\| (!!((invflag) & (option)) ^ (cond)))
	30
	31	static unsigned char *dccp_optbuf;
	32	static DEFINE_SPINLOCK(dccp_buflock);
	33
	34	static inline int
	35	dccp_find_option(u_int8_t option,
	36	const struct sk_buff *skb,
2e4e6a17	37	unsigned int protoff,
1d3de414 HW	38	const struct dccp_hdr *dh,
	39	int *hotdrop)
	40	{
	41	/* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
	42	unsigned char *op;
	43	unsigned int optoff = __dccp_hdr_len(dh);
	44	unsigned int optlen = dh->dccph_doff*4 - __dccp_hdr_len(dh);
	45	unsigned int i;
	46
	47	if (dh->dccph_doff * 4 < __dccp_hdr_len(dh)) {
	48	*hotdrop = 1;
	49	return 0;
	50	}
	51
	52	if (!optlen)
	53	return 0;
	54
	55	spin_lock_bh(&dccp_buflock);
2e4e6a17	56	op = skb_header_pointer(skb, protoff + optoff, optlen, dccp_optbuf);
1d3de414 HW	57	if (op == NULL) {
	58	/* If we don't have the whole header, drop packet. */
	59	spin_unlock_bh(&dccp_buflock);
	60	*hotdrop = 1;
	61	return 0;
	62	}
	63
	64	for (i = 0; i < optlen; ) {
	65	if (op[i] == option) {
	66	spin_unlock_bh(&dccp_buflock);
	67	return 1;
	68	}
	69
	70	if (op[i] < 2)
	71	i++;
	72	else
	73	i += op[i+1]?:1;
	74	}
	75
	76	spin_unlock_bh(&dccp_buflock);
	77	return 0;
	78	}
	79
	80
	81	static inline int
	82	match_types(const struct dccp_hdr *dh, u_int16_t typemask)
	83	{
	84	return (typemask & (1 << dh->dccph_type));
	85	}
	86
	87	static inline int
2e4e6a17	88	match_option(u_int8_t option, const struct sk_buff *skb, unsigned int protoff,
1d3de414 HW	89	const struct dccp_hdr dh, int hotdrop)
1d3de414 HW	90	{
2e4e6a17	91	return dccp_find_option(option, skb, protoff, dh, hotdrop);
1d3de414 HW	92	}
	93
	94	static int
	95	match(const struct sk_buff *skb,
	96	const struct net_device *in,
	97	const struct net_device *out,
c4986734	98	const struct xt_match *match,
1d3de414 HW	99	const void *matchinfo,
1d3de414 HW	100	int offset,
2e4e6a17	101	unsigned int protoff,
1d3de414 HW	102	int *hotdrop)
1d3de414 HW	103	{
3e72b2fe	104	const struct xt_dccp_info *info = matchinfo;
1d3de414 HW	105	struct dccp_hdr _dh, *dh;
	106
	107	if (offset)
	108	return 0;
	109
2e4e6a17	110	dh = skb_header_pointer(skb, protoff, sizeof(_dh), &_dh);
1d3de414 HW	111	if (dh == NULL) {
	112	*hotdrop = 1;
	113	return 0;
	114	}
	115
	116	return DCCHECK(((ntohs(dh->dccph_sport) >= info->spts[0])
	117	&& (ntohs(dh->dccph_sport) <= info->spts[1])),
2e4e6a17	118	XT_DCCP_SRC_PORTS, info->flags, info->invflags)
1d3de414 HW	119	&& DCCHECK(((ntohs(dh->dccph_dport) >= info->dpts[0])
1d3de414 HW	120	&& (ntohs(dh->dccph_dport) <= info->dpts[1])),
2e4e6a17	121	XT_DCCP_DEST_PORTS, info->flags, info->invflags)
1d3de414	122	&& DCCHECK(match_types(dh, info->typemask),
2e4e6a17 HW	123	XT_DCCP_TYPE, info->flags, info->invflags)
	124	&& DCCHECK(match_option(info->option, skb, protoff, dh,
	125	hotdrop),
	126	XT_DCCP_OPTION, info->flags, info->invflags);
1d3de414 HW	127	}
	128
	129	static int
	130	checkentry(const char *tablename,
2e4e6a17	131	const void *inf,
c4986734	132	const struct xt_match *match,
1d3de414	133	void *matchinfo,
1d3de414 HW	134	unsigned int hook_mask)
1d3de414 HW	135	{
5d04bff0	136	const struct xt_dccp_info *info = matchinfo;
1d3de414	137
5d04bff0	138	return !(info->flags & ~XT_DCCP_VALID_FLAGS)
2e4e6a17 HW	139	&& !(info->invflags & ~XT_DCCP_VALID_FLAGS)
	140	&& !(info->invflags & ~info->flags);
	141	}
	142
4470bbc7 PM	143	static struct xt_match xt_dccp_match[] = {
	144	{
	145	.name = "dccp",
	146	.family = AF_INET,
	147	.checkentry = checkentry,
	148	.match = match,
	149	.matchsize = sizeof(struct xt_dccp_info),
	150	.proto = IPPROTO_DCCP,
	151	.me = THIS_MODULE,
	152	},
	153	{
	154	.name = "dccp",
	155	.family = AF_INET6,
	156	.checkentry = checkentry,
	157	.match = match,
	158	.matchsize = sizeof(struct xt_dccp_info),
	159	.proto = IPPROTO_DCCP,
	160	.me = THIS_MODULE,
	161	},
1d3de414 HW	162	};
1d3de414 HW	163
65b4b4e8	164	static int __init xt_dccp_init(void)
1d3de414 HW	165	{
	166	int ret;
	167
	168	/* doff is 8 bits, so the maximum option size is (4*256). Don't put
	169	* this in BSS since DaveM is worried about locked TLB's for kernel
	170	* BSS. */
	171	dccp_optbuf = kmalloc(256 * 4, GFP_KERNEL);
	172	if (!dccp_optbuf)
	173	return -ENOMEM;
4470bbc7	174	ret = xt_register_matches(xt_dccp_match, ARRAY_SIZE(xt_dccp_match));
1d3de414	175	if (ret)
2e4e6a17	176	goto out_kfree;
2e4e6a17 HW	177	return ret;
2e4e6a17 HW	178
2e4e6a17 HW	179	out_kfree:
2e4e6a17 HW	180	kfree(dccp_optbuf);
1d3de414 HW	181	return ret;
	182	}
	183
65b4b4e8	184	static void __exit xt_dccp_fini(void)
1d3de414	185	{
4470bbc7	186	xt_unregister_matches(xt_dccp_match, ARRAY_SIZE(xt_dccp_match));
1d3de414 HW	187	kfree(dccp_optbuf);
	188	}
	189
65b4b4e8 AM	190	module_init(xt_dccp_init);
65b4b4e8 AM	191	module_exit(xt_dccp_fini);