]>
Commit | Line | Data |
---|---|---|
74f77a6b JC |
1 | /* Kernel module to match L2TP header parameters. */ |
2 | ||
3 | /* (C) 2013 James Chapman <jchapman@katalix.com> | |
4 | * | |
5 | * This program is free software; you can redistribute it and/or modify | |
6 | * it under the terms of the GNU General Public License version 2 as | |
7 | * published by the Free Software Foundation. | |
8 | */ | |
9 | ||
10 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt | |
11 | #include <linux/module.h> | |
12 | #include <linux/skbuff.h> | |
13 | #include <linux/if_ether.h> | |
14 | #include <net/ip.h> | |
15 | #include <linux/ipv6.h> | |
16 | #include <net/ipv6.h> | |
17 | #include <net/udp.h> | |
18 | #include <linux/l2tp.h> | |
19 | ||
20 | #include <linux/netfilter_ipv4.h> | |
21 | #include <linux/netfilter_ipv6.h> | |
22 | #include <linux/netfilter_ipv4/ip_tables.h> | |
23 | #include <linux/netfilter_ipv6/ip6_tables.h> | |
24 | #include <linux/netfilter/x_tables.h> | |
25 | #include <linux/netfilter/xt_tcpudp.h> | |
26 | #include <linux/netfilter/xt_l2tp.h> | |
27 | ||
28 | /* L2TP header masks */ | |
29 | #define L2TP_HDR_T_BIT 0x8000 | |
30 | #define L2TP_HDR_L_BIT 0x4000 | |
31 | #define L2TP_HDR_VER 0x000f | |
32 | ||
33 | MODULE_LICENSE("GPL"); | |
34 | MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); | |
35 | MODULE_DESCRIPTION("Xtables: L2TP header match"); | |
36 | MODULE_ALIAS("ipt_l2tp"); | |
37 | MODULE_ALIAS("ip6t_l2tp"); | |
38 | ||
39 | /* The L2TP fields that can be matched */ | |
40 | struct l2tp_data { | |
41 | u32 tid; | |
42 | u32 sid; | |
43 | u8 type; | |
44 | u8 version; | |
45 | }; | |
46 | ||
47 | union l2tp_val { | |
48 | __be16 val16[2]; | |
49 | __be32 val32; | |
50 | }; | |
51 | ||
52 | static bool l2tp_match(const struct xt_l2tp_info *info, struct l2tp_data *data) | |
53 | { | |
54 | if ((info->flags & XT_L2TP_TYPE) && (info->type != data->type)) | |
55 | return false; | |
56 | ||
57 | if ((info->flags & XT_L2TP_VERSION) && (info->version != data->version)) | |
58 | return false; | |
59 | ||
60 | /* Check tid only for L2TPv3 control or any L2TPv2 packets */ | |
61 | if ((info->flags & XT_L2TP_TID) && | |
62 | ((data->type == XT_L2TP_TYPE_CONTROL) || (data->version == 2)) && | |
63 | (info->tid != data->tid)) | |
64 | return false; | |
65 | ||
66 | /* Check sid only for L2TP data packets */ | |
67 | if ((info->flags & XT_L2TP_SID) && (data->type == XT_L2TP_TYPE_DATA) && | |
68 | (info->sid != data->sid)) | |
69 | return false; | |
70 | ||
71 | return true; | |
72 | } | |
73 | ||
74 | /* Parse L2TP header fields when UDP encapsulation is used. Handles | |
75 | * L2TPv2 and L2TPv3. Note the L2TPv3 control and data packets have a | |
76 | * different format. See | |
77 | * RFC2661, Section 3.1, L2TPv2 Header Format | |
78 | * RFC3931, Section 3.2.1, L2TPv3 Control Message Header | |
79 | * RFC3931, Section 3.2.2, L2TPv3 Data Message Header | |
80 | * RFC3931, Section 4.1.2.1, L2TPv3 Session Header over UDP | |
81 | */ | |
82 | static bool l2tp_udp_mt(const struct sk_buff *skb, struct xt_action_param *par, u16 thoff) | |
83 | { | |
84 | const struct xt_l2tp_info *info = par->matchinfo; | |
85 | int uhlen = sizeof(struct udphdr); | |
86 | int offs = thoff + uhlen; | |
87 | union l2tp_val *lh; | |
88 | union l2tp_val lhbuf; | |
89 | u16 flags; | |
90 | struct l2tp_data data = { 0, }; | |
91 | ||
92 | if (par->fragoff != 0) | |
93 | return false; | |
94 | ||
95 | /* Extract L2TP header fields. The flags in the first 16 bits | |
96 | * tell us where the other fields are. | |
97 | */ | |
98 | lh = skb_header_pointer(skb, offs, 2, &lhbuf); | |
99 | if (lh == NULL) | |
100 | return false; | |
101 | ||
102 | flags = ntohs(lh->val16[0]); | |
103 | if (flags & L2TP_HDR_T_BIT) | |
104 | data.type = XT_L2TP_TYPE_CONTROL; | |
105 | else | |
106 | data.type = XT_L2TP_TYPE_DATA; | |
107 | data.version = (u8) flags & L2TP_HDR_VER; | |
108 | ||
109 | /* Now extract the L2TP tid/sid. These are in different places | |
110 | * for L2TPv2 (rfc2661) and L2TPv3 (rfc3931). For L2TPv2, we | |
111 | * must also check to see if the length field is present, | |
112 | * since this affects the offsets into the packet of the | |
113 | * tid/sid fields. | |
114 | */ | |
115 | if (data.version == 3) { | |
116 | lh = skb_header_pointer(skb, offs + 4, 4, &lhbuf); | |
117 | if (lh == NULL) | |
118 | return false; | |
119 | if (data.type == XT_L2TP_TYPE_CONTROL) | |
120 | data.tid = ntohl(lh->val32); | |
121 | else | |
122 | data.sid = ntohl(lh->val32); | |
123 | } else if (data.version == 2) { | |
124 | if (flags & L2TP_HDR_L_BIT) | |
125 | offs += 2; | |
126 | lh = skb_header_pointer(skb, offs + 2, 4, &lhbuf); | |
127 | if (lh == NULL) | |
128 | return false; | |
129 | data.tid = (u32) ntohs(lh->val16[0]); | |
130 | data.sid = (u32) ntohs(lh->val16[1]); | |
131 | } else | |
132 | return false; | |
133 | ||
134 | return l2tp_match(info, &data); | |
135 | } | |
136 | ||
137 | /* Parse L2TP header fields for IP encapsulation (no UDP header). | |
138 | * L2TPv3 data packets have a different form with IP encap. See | |
139 | * RC3931, Section 4.1.1.1, L2TPv3 Session Header over IP. | |
140 | * RC3931, Section 4.1.1.2, L2TPv3 Control and Data Traffic over IP. | |
141 | */ | |
142 | static bool l2tp_ip_mt(const struct sk_buff *skb, struct xt_action_param *par, u16 thoff) | |
143 | { | |
144 | const struct xt_l2tp_info *info = par->matchinfo; | |
145 | union l2tp_val *lh; | |
146 | union l2tp_val lhbuf; | |
147 | struct l2tp_data data = { 0, }; | |
148 | ||
149 | /* For IP encap, the L2TP sid is the first 32-bits. */ | |
150 | lh = skb_header_pointer(skb, thoff, sizeof(lhbuf), &lhbuf); | |
151 | if (lh == NULL) | |
152 | return false; | |
153 | if (lh->val32 == 0) { | |
154 | /* Must be a control packet. The L2TP tid is further | |
155 | * into the packet. | |
156 | */ | |
157 | data.type = XT_L2TP_TYPE_CONTROL; | |
158 | lh = skb_header_pointer(skb, thoff + 8, sizeof(lhbuf), | |
159 | &lhbuf); | |
160 | if (lh == NULL) | |
161 | return false; | |
162 | data.tid = ntohl(lh->val32); | |
163 | } else { | |
164 | data.sid = ntohl(lh->val32); | |
165 | data.type = XT_L2TP_TYPE_DATA; | |
166 | } | |
167 | ||
168 | data.version = 3; | |
169 | ||
170 | return l2tp_match(info, &data); | |
171 | } | |
172 | ||
173 | static bool l2tp_mt4(const struct sk_buff *skb, struct xt_action_param *par) | |
174 | { | |
175 | struct iphdr *iph = ip_hdr(skb); | |
176 | u8 ipproto = iph->protocol; | |
177 | ||
178 | /* l2tp_mt_check4 already restricts the transport protocol */ | |
179 | switch (ipproto) { | |
180 | case IPPROTO_UDP: | |
181 | return l2tp_udp_mt(skb, par, par->thoff); | |
182 | case IPPROTO_L2TP: | |
183 | return l2tp_ip_mt(skb, par, par->thoff); | |
184 | } | |
185 | ||
186 | return false; | |
187 | } | |
188 | ||
189 | #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) | |
190 | static bool l2tp_mt6(const struct sk_buff *skb, struct xt_action_param *par) | |
191 | { | |
192 | unsigned int thoff = 0; | |
193 | unsigned short fragoff = 0; | |
194 | int ipproto; | |
195 | ||
196 | ipproto = ipv6_find_hdr(skb, &thoff, -1, &fragoff, NULL); | |
197 | if (fragoff != 0) | |
198 | return false; | |
199 | ||
200 | /* l2tp_mt_check6 already restricts the transport protocol */ | |
201 | switch (ipproto) { | |
202 | case IPPROTO_UDP: | |
203 | return l2tp_udp_mt(skb, par, thoff); | |
204 | case IPPROTO_L2TP: | |
205 | return l2tp_ip_mt(skb, par, thoff); | |
206 | } | |
207 | ||
208 | return false; | |
209 | } | |
210 | #endif | |
211 | ||
212 | static int l2tp_mt_check(const struct xt_mtchk_param *par) | |
213 | { | |
214 | const struct xt_l2tp_info *info = par->matchinfo; | |
215 | ||
216 | /* Check for invalid flags */ | |
217 | if (info->flags & ~(XT_L2TP_TID | XT_L2TP_SID | XT_L2TP_VERSION | | |
218 | XT_L2TP_TYPE)) { | |
219 | pr_info("unknown flags: %x\n", info->flags); | |
220 | return -EINVAL; | |
221 | } | |
222 | ||
223 | /* At least one of tid, sid or type=control must be specified */ | |
224 | if ((!(info->flags & XT_L2TP_TID)) && | |
225 | (!(info->flags & XT_L2TP_SID)) && | |
226 | ((!(info->flags & XT_L2TP_TYPE)) || | |
227 | (info->type != XT_L2TP_TYPE_CONTROL))) { | |
228 | pr_info("invalid flags combination: %x\n", info->flags); | |
229 | return -EINVAL; | |
230 | } | |
231 | ||
232 | /* If version 2 is specified, check that incompatible params | |
233 | * are not supplied | |
234 | */ | |
235 | if (info->flags & XT_L2TP_VERSION) { | |
236 | if ((info->version < 2) || (info->version > 3)) { | |
237 | pr_info("wrong L2TP version: %u\n", info->version); | |
238 | return -EINVAL; | |
239 | } | |
240 | ||
241 | if (info->version == 2) { | |
242 | if ((info->flags & XT_L2TP_TID) && | |
243 | (info->tid > 0xffff)) { | |
244 | pr_info("v2 tid > 0xffff: %u\n", info->tid); | |
245 | return -EINVAL; | |
246 | } | |
247 | if ((info->flags & XT_L2TP_SID) && | |
248 | (info->sid > 0xffff)) { | |
249 | pr_info("v2 sid > 0xffff: %u\n", info->sid); | |
250 | return -EINVAL; | |
251 | } | |
252 | } | |
253 | } | |
254 | ||
255 | return 0; | |
256 | } | |
257 | ||
258 | static int l2tp_mt_check4(const struct xt_mtchk_param *par) | |
259 | { | |
260 | const struct xt_l2tp_info *info = par->matchinfo; | |
261 | const struct ipt_entry *e = par->entryinfo; | |
262 | const struct ipt_ip *ip = &e->ip; | |
263 | int ret; | |
264 | ||
265 | ret = l2tp_mt_check(par); | |
266 | if (ret != 0) | |
267 | return ret; | |
268 | ||
269 | if ((ip->proto != IPPROTO_UDP) && | |
270 | (ip->proto != IPPROTO_L2TP)) { | |
271 | pr_info("missing protocol rule (udp|l2tpip)\n"); | |
272 | return -EINVAL; | |
273 | } | |
274 | ||
275 | if ((ip->proto == IPPROTO_L2TP) && | |
276 | (info->version == 2)) { | |
277 | pr_info("v2 doesn't support IP mode\n"); | |
278 | return -EINVAL; | |
279 | } | |
280 | ||
281 | return 0; | |
282 | } | |
283 | ||
284 | #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) | |
285 | static int l2tp_mt_check6(const struct xt_mtchk_param *par) | |
286 | { | |
287 | const struct xt_l2tp_info *info = par->matchinfo; | |
288 | const struct ip6t_entry *e = par->entryinfo; | |
289 | const struct ip6t_ip6 *ip = &e->ipv6; | |
290 | int ret; | |
291 | ||
292 | ret = l2tp_mt_check(par); | |
293 | if (ret != 0) | |
294 | return ret; | |
295 | ||
296 | if ((ip->proto != IPPROTO_UDP) && | |
297 | (ip->proto != IPPROTO_L2TP)) { | |
298 | pr_info("missing protocol rule (udp|l2tpip)\n"); | |
299 | return -EINVAL; | |
300 | } | |
301 | ||
302 | if ((ip->proto == IPPROTO_L2TP) && | |
303 | (info->version == 2)) { | |
304 | pr_info("v2 doesn't support IP mode\n"); | |
305 | return -EINVAL; | |
306 | } | |
307 | ||
308 | return 0; | |
309 | } | |
310 | #endif | |
311 | ||
312 | static struct xt_match l2tp_mt_reg[] __read_mostly = { | |
313 | { | |
314 | .name = "l2tp", | |
315 | .revision = 0, | |
316 | .family = NFPROTO_IPV4, | |
317 | .match = l2tp_mt4, | |
318 | .matchsize = XT_ALIGN(sizeof(struct xt_l2tp_info)), | |
319 | .checkentry = l2tp_mt_check4, | |
320 | .hooks = ((1 << NF_INET_PRE_ROUTING) | | |
321 | (1 << NF_INET_LOCAL_IN) | | |
322 | (1 << NF_INET_LOCAL_OUT) | | |
323 | (1 << NF_INET_FORWARD)), | |
324 | .me = THIS_MODULE, | |
325 | }, | |
326 | #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) | |
327 | { | |
328 | .name = "l2tp", | |
329 | .revision = 0, | |
330 | .family = NFPROTO_IPV6, | |
331 | .match = l2tp_mt6, | |
332 | .matchsize = XT_ALIGN(sizeof(struct xt_l2tp_info)), | |
333 | .checkentry = l2tp_mt_check6, | |
334 | .hooks = ((1 << NF_INET_PRE_ROUTING) | | |
335 | (1 << NF_INET_LOCAL_IN) | | |
336 | (1 << NF_INET_LOCAL_OUT) | | |
337 | (1 << NF_INET_FORWARD)), | |
338 | .me = THIS_MODULE, | |
339 | }, | |
340 | #endif | |
341 | }; | |
342 | ||
343 | static int __init l2tp_mt_init(void) | |
344 | { | |
345 | return xt_register_matches(&l2tp_mt_reg[0], ARRAY_SIZE(l2tp_mt_reg)); | |
346 | } | |
347 | ||
348 | static void __exit l2tp_mt_exit(void) | |
349 | { | |
350 | xt_unregister_matches(&l2tp_mt_reg[0], ARRAY_SIZE(l2tp_mt_reg)); | |
351 | } | |
352 | ||
353 | module_init(l2tp_mt_init); | |
354 | module_exit(l2tp_mt_exit); |