net/ipv6/netfilter/ip6t_frag.c

   1 /* Kernel module to match FRAG parameters. */
   2
   3 /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  */
   9
  10 #include <linux/module.h>
  11 #include <linux/skbuff.h>
  12 #include <linux/ipv6.h>
  13 #include <linux/types.h>
  14 #include <net/checksum.h>
  15 #include <net/ipv6.h>
  16
  17 #include <linux/netfilter_ipv6/ip6_tables.h>
  18 #include <linux/netfilter_ipv6/ip6t_frag.h>
  19
  20 MODULE_LICENSE("GPL");
  21 MODULE_DESCRIPTION("IPv6 FRAG match");
  22 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
  23
  24 #if 0
  25 #define DEBUGP printk
  26 #else
  27 #define DEBUGP(format, args...)
  28 #endif
  29
  30 /* Returns 1 if the id is matched by the range, 0 otherwise */
  31 static inline int
  32 id_match(u_int32_t min, u_int32_t max, u_int32_t id, int invert)
  33 {
  34        int r=0;
  35        DEBUGP("frag id_match:%c 0x%x <= 0x%x <= 0x%x",invert? '!':' ',
  36               min,id,max);
  37        r=(id >= min && id <= max) ^ invert;
  38        DEBUGP(" result %s\n",r? "PASS" : "FAILED");
  39        return r;
  40 }
  41
  42 static int
  43 match(const struct sk_buff *skb,
  44       const struct net_device *in,
  45       const struct net_device *out,
  46       const void *matchinfo,
  47       int offset,
  48       unsigned int protoff,
  49       int *hotdrop)
  50 {
  51        struct frag_hdr _frag, *fh = NULL;
  52        const struct ip6t_frag *fraginfo = matchinfo;
  53        unsigned int temp;
  54        int len;
  55        u8 nexthdr;
  56        unsigned int ptr;
  57        unsigned int hdrlen = 0;
  58
  59        /* type of the 1st exthdr */
  60        nexthdr = skb->nh.ipv6h->nexthdr;
  61        /* pointer to the 1st exthdr */
  62        ptr = sizeof(struct ipv6hdr);
  63        /* available length */
  64        len = skb->len - ptr;
  65        temp = 0;
  66
  67         while (ip6t_ext_hdr(nexthdr)) {
  68                struct ipv6_opt_hdr _hdr, *hp;
  69
  70               DEBUGP("ipv6_frag header iteration \n");
  71
  72               /* Is there enough space for the next ext header? */
  73                 if (len < (int)sizeof(struct ipv6_opt_hdr))
  74                         return 0;
  75               /* No more exthdr -> evaluate */
  76                 if (nexthdr == NEXTHDR_NONE) {
  77                      break;
  78               }
  79               /* ESP -> evaluate */
  80                 if (nexthdr == NEXTHDR_ESP) {
  81                      break;
  82               }
  83
  84               hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
  85               BUG_ON(hp == NULL);
  86
  87               /* Calculate the header length */
  88                 if (nexthdr == NEXTHDR_FRAGMENT) {
  89                         hdrlen = 8;
  90                 } else if (nexthdr == NEXTHDR_AUTH)
  91                         hdrlen = (hp->hdrlen+2)<<2;
  92                 else
  93                         hdrlen = ipv6_optlen(hp);
  94
  95               /* FRAG -> evaluate */
  96                 if (nexthdr == NEXTHDR_FRAGMENT) {
  97                      temp |= MASK_FRAGMENT;
  98                      break;
  99               }
 100
 101
 102               /* set the flag */
 103               switch (nexthdr){
 104                      case NEXTHDR_HOP:
 105                      case NEXTHDR_ROUTING:
 106                      case NEXTHDR_FRAGMENT:
 107                      case NEXTHDR_AUTH:
 108                      case NEXTHDR_DEST:
 109                             break;
 110                      default:
 111                             DEBUGP("ipv6_frag match: unknown nextheader %u\n",nexthdr);
 112                             return 0;
 113                             break;
 114               }
 115
 116                 nexthdr = hp->nexthdr;
 117                 len -= hdrlen;
 118                 ptr += hdrlen;
 119                 if ( ptr > skb->len ) {
 120                         DEBUGP("ipv6_frag: new pointer too large! \n");
 121                         break;
 122                 }
 123         }
 124
 125        /* FRAG header not found */
 126        if ( temp != MASK_FRAGMENT ) return 0;
 127
 128        if (len < sizeof(struct frag_hdr)){
 129                *hotdrop = 1;
 130                 return 0;
 131        }
 132
 133        fh = skb_header_pointer(skb, ptr, sizeof(_frag), &_frag);
 134        BUG_ON(fh == NULL);
 135
 136        DEBUGP("INFO %04X ", fh->frag_off);
 137        DEBUGP("OFFSET %04X ", ntohs(fh->frag_off) & ~0x7);
 138        DEBUGP("RES %02X %04X", fh->reserved, ntohs(fh->frag_off) & 0x6);
 139        DEBUGP("MF %04X ", fh->frag_off & htons(IP6_MF));
 140        DEBUGP("ID %u %08X\n", ntohl(fh->identification),
 141               ntohl(fh->identification));
 142
 143        DEBUGP("IPv6 FRAG id %02X ",
 144                 (id_match(fraginfo->ids[0], fraginfo->ids[1],
 145                            ntohl(fh->identification),
 146                            !!(fraginfo->invflags & IP6T_FRAG_INV_IDS))));
 147        DEBUGP("res %02X %02X%04X %02X ",
 148                 (fraginfo->flags & IP6T_FRAG_RES), fh->reserved,
 149                 ntohs(fh->frag_off) & 0x6,
 150                 !((fraginfo->flags & IP6T_FRAG_RES)
 151                         && (fh->reserved || (ntohs(fh->frag_off) & 0x06))));
 152        DEBUGP("first %02X %02X %02X ",
 153                 (fraginfo->flags & IP6T_FRAG_FST),
 154                 ntohs(fh->frag_off) & ~0x7,
 155                 !((fraginfo->flags & IP6T_FRAG_FST)
 156                         && (ntohs(fh->frag_off) & ~0x7)));
 157        DEBUGP("mf %02X %02X %02X ",
 158                 (fraginfo->flags & IP6T_FRAG_MF),
 159                 ntohs(fh->frag_off) & IP6_MF,
 160                 !((fraginfo->flags & IP6T_FRAG_MF)
 161                         && !((ntohs(fh->frag_off) & IP6_MF))));
 162        DEBUGP("last %02X %02X %02X\n",
 163                 (fraginfo->flags & IP6T_FRAG_NMF),
 164                 ntohs(fh->frag_off) & IP6_MF,
 165                 !((fraginfo->flags & IP6T_FRAG_NMF)
 166                         && (ntohs(fh->frag_off) & IP6_MF)));
 167
 168        return (fh != NULL)
 169                 &&
 170                 (id_match(fraginfo->ids[0], fraginfo->ids[1],
 171                           ntohl(fh->identification),
 172                            !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)))
 173                 &&
 174                 !((fraginfo->flags & IP6T_FRAG_RES)
 175                         && (fh->reserved || (ntohs(fh->frag_off) & 0x6)))
 176                 &&
 177                 !((fraginfo->flags & IP6T_FRAG_FST)
 178                         && (ntohs(fh->frag_off) & ~0x7))
 179                 &&
 180                 !((fraginfo->flags & IP6T_FRAG_MF)
 181                         && !(ntohs(fh->frag_off) & IP6_MF))
 182                 &&
 183                 !((fraginfo->flags & IP6T_FRAG_NMF)
 184                         && (ntohs(fh->frag_off) & IP6_MF));
 185 }
 186
 187 /* Called when user tries to insert an entry of this type. */
 188 static int
 189 checkentry(const char *tablename,
 190           const struct ip6t_ip6 *ip,
 191           void *matchinfo,
 192           unsigned int matchinfosize,
 193           unsigned int hook_mask)
 194 {
 195        const struct ip6t_frag *fraginfo = matchinfo;
 196
 197        if (matchinfosize != IP6T_ALIGN(sizeof(struct ip6t_frag))) {
 198               DEBUGP("ip6t_frag: matchsize %u != %u\n",
 199                       matchinfosize, IP6T_ALIGN(sizeof(struct ip6t_frag)));
 200               return 0;
 201        }
 202        if (fraginfo->invflags & ~IP6T_FRAG_INV_MASK) {
 203               DEBUGP("ip6t_frag: unknown flags %X\n",
 204                       fraginfo->invflags);
 205               return 0;
 206        }
 207
 208        return 1;
 209 }
 210
 211 static struct ip6t_match frag_match = {
 212         .name           = "frag",
 213         .match          = &match,
 214         .checkentry     = &checkentry,
 215         .me             = THIS_MODULE,
 216 };
 217
 218 static int __init init(void)
 219 {
 220        return ip6t_register_match(&frag_match);
 221 }
 222
 223 static void __exit cleanup(void)
 224 {
 225        ip6t_unregister_match(&frag_match);
 226 }
 227
 228 module_init(init);
 229 module_exit(cleanup);