net/ipv6/netfilter/ip6t_frag.c

   1 /* Kernel module to match FRAG parameters. */
   2 #include <linux/module.h>
   3 #include <linux/skbuff.h>
   4 #include <linux/ipv6.h>
   5 #include <linux/types.h>
   6 #include <net/checksum.h>
   7 #include <net/ipv6.h>
   8
   9 #include <linux/netfilter_ipv6/ip6_tables.h>
  10 #include <linux/netfilter_ipv6/ip6t_frag.h>
  11
  12 EXPORT_NO_SYMBOLS;
  13 MODULE_LICENSE("GPL");
  14 MODULE_DESCRIPTION("IPv6 FRAG match");
  15 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
  16
  17 #if 0
  18 #define DEBUGP printk
  19 #else
  20 #define DEBUGP(format, args...)
  21 #endif
  22
  23 #define IP6_MF  0x0001
  24
  25 /* Returns 1 if the id is matched by the range, 0 otherwise */
  26 static inline int
  27 id_match(u_int32_t min, u_int32_t max, u_int32_t id, int invert)
  28 {
  29        int r=0;
  30        DEBUGP("frag id_match:%c 0x%x <= 0x%x <= 0x%x",invert? '!':' ',
  31               min,id,max);
  32        r=(id >= min && id <= max) ^ invert;
  33        DEBUGP(" result %s\n",r? "PASS" : "FAILED");
  34        return r;
  35 }
  36
  37 static int
  38 match(const struct sk_buff *skb,
  39       const struct net_device *in,
  40       const struct net_device *out,
  41       const void *matchinfo,
  42       int offset,
  43       const void *protohdr,
  44       u_int16_t datalen,
  45       int *hotdrop)
  46 {
  47        struct frag_hdr *frag = NULL;
  48        const struct ip6t_frag *fraginfo = matchinfo;
  49        unsigned int temp;
  50        int len;
  51        u8 nexthdr;
  52        unsigned int ptr;
  53        unsigned int hdrlen = 0;
  54
  55        /* type of the 1st exthdr */
  56        nexthdr = skb->nh.ipv6h->nexthdr;
  57        /* pointer to the 1st exthdr */
  58        ptr = sizeof(struct ipv6hdr);
  59        /* available length */
  60        len = skb->len - ptr;
  61        temp = 0;
  62
  63         while (ip6t_ext_hdr(nexthdr)) {
  64                struct ipv6_opt_hdr *hdr;
  65
  66               DEBUGP("ipv6_frag header iteration \n");
  67
  68               /* Is there enough space for the next ext header? */
  69                 if (len < (int)sizeof(struct ipv6_opt_hdr))
  70                         return 0;
  71               /* No more exthdr -> evaluate */
  72                 if (nexthdr == NEXTHDR_NONE) {
  73                      break;
  74               }
  75               /* ESP -> evaluate */
  76                 if (nexthdr == NEXTHDR_ESP) {
  77                      break;
  78               }
  79
  80               hdr=(struct ipv6_opt_hdr *)(skb->data+ptr);
  81
  82               /* Calculate the header length */
  83                 if (nexthdr == NEXTHDR_FRAGMENT) {
  84                         hdrlen = 8;
  85                 } else if (nexthdr == NEXTHDR_AUTH)
  86                         hdrlen = (hdr->hdrlen+2)<<2;
  87                 else
  88                         hdrlen = ipv6_optlen(hdr);
  89
  90               /* FRAG -> evaluate */
  91                 if (nexthdr == NEXTHDR_FRAGMENT) {
  92                      temp |= MASK_FRAGMENT;
  93                      break;
  94               }
  95
  96
  97               /* set the flag */
  98               switch (nexthdr){
  99                      case NEXTHDR_HOP:
 100                      case NEXTHDR_ROUTING:
 101                      case NEXTHDR_FRAGMENT:
 102                      case NEXTHDR_AUTH:
 103                      case NEXTHDR_DEST:
 104                             break;
 105                      default:
 106                             DEBUGP("ipv6_frag match: unknown nextheader %u\n",nexthdr);
 107                             return 0;
 108                             break;
 109               }
 110
 111                 nexthdr = hdr->nexthdr;
 112                 len -= hdrlen;
 113                 ptr += hdrlen;
 114                 if ( ptr > skb->len ) {
 115                         DEBUGP("ipv6_frag: new pointer too large! \n");
 116                         break;
 117                 }
 118         }
 119
 120        /* FRAG header not found */
 121        if ( temp != MASK_FRAGMENT ) return 0;
 122
 123        if (len < sizeof(struct frag_hdr)){
 124                *hotdrop = 1;
 125                 return 0;
 126        }
 127
 128        frag = (struct frag_hdr *) (skb->data + ptr);
 129
 130        DEBUGP("INFO %04X ", frag->frag_off);
 131        DEBUGP("OFFSET %04X ", ntohs(frag->frag_off) & ~0x7);
 132        DEBUGP("RES %02X %04X", frag->reserved, ntohs(frag->frag_off) & 0x6);
 133        DEBUGP("MF %04X ", frag->frag_off & htons(IP6_MF));
 134        DEBUGP("ID %u %08X\n", ntohl(frag->identification),
 135               ntohl(frag->identification));
 136
 137        DEBUGP("IPv6 FRAG id %02X ",
 138                 (id_match(fraginfo->ids[0], fraginfo->ids[1],
 139                            ntohl(frag->identification),
 140                            !!(fraginfo->invflags & IP6T_FRAG_INV_IDS))));
 141        DEBUGP("res %02X %02X%04X %02X ",
 142                 (fraginfo->flags & IP6T_FRAG_RES), frag->reserved,
 143                 ntohs(frag->frag_off) & 0x6,
 144                 !((fraginfo->flags & IP6T_FRAG_RES)
 145                         && (frag->reserved || (ntohs(frag->frag_off) & 0x6))));
 146        DEBUGP("first %02X %02X %02X ",
 147                 (fraginfo->flags & IP6T_FRAG_FST),
 148                 ntohs(frag->frag_off) & ~0x7,
 149                 !((fraginfo->flags & IP6T_FRAG_FST)
 150                         && (ntohs(frag->frag_off) & ~0x7)));
 151        DEBUGP("mf %02X %02X %02X ",
 152                 (fraginfo->flags & IP6T_FRAG_MF),
 153                 ntohs(frag->frag_off) & IP6_MF,
 154                 !((fraginfo->flags & IP6T_FRAG_MF)
 155                         && !((ntohs(frag->frag_off) & IP6_MF))));
 156        DEBUGP("last %02X %02X %02X\n",
 157                 (fraginfo->flags & IP6T_FRAG_NMF),
 158                 ntohs(frag->frag_off) & IP6_MF,
 159                 !((fraginfo->flags & IP6T_FRAG_NMF)
 160                         && (ntohs(frag->frag_off) & IP6_MF)));
 161
 162        return (frag != NULL)
 163                 &&
 164                 (id_match(fraginfo->ids[0], fraginfo->ids[1],
 165                           ntohl(frag->identification),
 166                            !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)))
 167                 &&
 168                 !((fraginfo->flags & IP6T_FRAG_RES)
 169                         && (frag->reserved || (ntohs(frag->frag_off) & 0x6)))
 170                 &&
 171                 !((fraginfo->flags & IP6T_FRAG_FST)
 172                         && (ntohs(frag->frag_off) & ~0x7))
 173                 &&
 174                 !((fraginfo->flags & IP6T_FRAG_MF)
 175                         && !(ntohs(frag->frag_off) & IP6_MF))
 176                 &&
 177                 !((fraginfo->flags & IP6T_FRAG_NMF)
 178                         && (ntohs(frag->frag_off) & IP6_MF));
 179 }
 180
 181 /* Called when user tries to insert an entry of this type. */
 182 static int
 183 checkentry(const char *tablename,
 184           const struct ip6t_ip6 *ip,
 185           void *matchinfo,
 186           unsigned int matchinfosize,
 187           unsigned int hook_mask)
 188 {
 189        const struct ip6t_frag *fraginfo = matchinfo;
 190
 191        if (matchinfosize != IP6T_ALIGN(sizeof(struct ip6t_frag))) {
 192               DEBUGP("ip6t_frag: matchsize %u != %u\n",
 193                       matchinfosize, IP6T_ALIGN(sizeof(struct ip6t_frag)));
 194               return 0;
 195        }
 196        if (fraginfo->invflags & ~IP6T_FRAG_INV_MASK) {
 197               DEBUGP("ip6t_frag: unknown flags %X\n",
 198                       fraginfo->invflags);
 199               return 0;
 200        }
 201
 202        return 1;
 203 }
 204
 205 static struct ip6t_match frag_match
 206 = { { NULL, NULL }, "frag", &match, &checkentry, NULL, THIS_MODULE };
 207
 208 static int __init init(void)
 209 {
 210        return ip6t_register_match(&frag_match);
 211 }
 212
 213 static void __exit cleanup(void)
 214 {
 215        ip6t_unregister_match(&frag_match);
 216 }
 217
 218 module_init(init);
 219 module_exit(cleanup);