1 /* Kernel module to match Hop-by-Hop and Destination parameters. */
2 #include <linux/module.h>
3 #include <linux/skbuff.h>
4 #include <linux/ipv6.h>
5 #include <linux/types.h>
6 #include <net/checksum.h>
7 #include <net/ipv6.h>
8 
9 #include <asm/byteorder.h>
10 
11 #include <linux/netfilter_ipv6/ip6_tables.h>
12 #include <linux/netfilter_ipv6/ip6t_opts.h>
13 
14 #define HOPBYHOP	0
15 
16 EXPORT_NO_SYMBOLS;
17 MODULE_LICENSE("GPL");
18 #if HOPBYHOP
19 MODULE_DESCRIPTION("IPv6 HbH match");
20 #else
21 MODULE_DESCRIPTION("IPv6 DST match");
22 #endif
23 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
24 
25 #if 0
26 #define DEBUGP printk
27 #else
28 #define DEBUGP(format, args...)
29 #endif
30 
31 /*
32  * (Type & 0xC0) >> 6
33  * 	0	-> ignorable
34  * 	1	-> must drop the packet
35  * 	2	-> send ICMP PARM PROB regardless and drop packet
36  * 	3	-> Send ICMP if not a multicast address and drop packet
37  *  (Type & 0x20) >> 5
38  *  	0	-> invariant
39  *  	1	-> can change the routing
40  *  (Type & 0x1F) Type
41  *      0	-> Pad1 (only 1 byte!)
42  *      1	-> PadN LENGTH info (total length = length + 2)
43  *      C0 | 2	-> JUMBO 4 x x x x ( xxxx > 64k )
44  *      5	-> RTALERT 2 x x
45  */
46 
47 static int
match(const struct sk_buff * skb,const struct net_device * in,const struct net_device * out,const void * matchinfo,int offset,const void * protohdr,u_int16_t datalen,int * hotdrop)48 match(const struct sk_buff *skb,
49       const struct net_device *in,
50       const struct net_device *out,
51       const void *matchinfo,
52       int offset,
53       const void *protohdr,
54       u_int16_t datalen,
55       int *hotdrop)
56 {
57        struct ipv6_opt_hdr *optsh = NULL;
58        const struct ip6t_opts *optinfo = matchinfo;
59        unsigned int temp;
60        unsigned int len;
61        u8 nexthdr;
62        unsigned int ptr;
63        unsigned int hdrlen = 0;
64        unsigned int ret = 0;
65        u8 *opttype = NULL;
66        unsigned int optlen;
67 
68        /* type of the 1st exthdr */
69        nexthdr = skb->nh.ipv6h->nexthdr;
70        /* pointer to the 1st exthdr */
71        ptr = sizeof(struct ipv6hdr);
72        /* available length */
73        len = skb->len - ptr;
74        temp = 0;
75 
76         while (ip6t_ext_hdr(nexthdr)) {
77                struct ipv6_opt_hdr *hdr;
78 
79               DEBUGP("ipv6_opts header iteration \n");
80 
81               /* Is there enough space for the next ext header? */
82                 if (len < (int)sizeof(struct ipv6_opt_hdr))
83                         return 0;
84               /* No more exthdr -> evaluate */
85                 if (nexthdr == NEXTHDR_NONE) {
86                      break;
87               }
88               /* ESP -> evaluate */
89                 if (nexthdr == NEXTHDR_ESP) {
90                      break;
91               }
92 
93 	      hdr = (void *)(skb->data + ptr);
94 
95               /* Calculate the header length */
96                 if (nexthdr == NEXTHDR_FRAGMENT) {
97                         hdrlen = 8;
98                 } else if (nexthdr == NEXTHDR_AUTH)
99                         hdrlen = (hdr->hdrlen+2)<<2;
100                 else
101                         hdrlen = ipv6_optlen(hdr);
102 
103               /* OPTS -> evaluate */
104 #if HOPBYHOP
105                 if (nexthdr == NEXTHDR_HOP) {
106                      temp |= MASK_HOPOPTS;
107 #else
108                 if (nexthdr == NEXTHDR_DEST) {
109                      temp |= MASK_DSTOPTS;
110 #endif
111                      break;
112               }
113 
114 
115               /* set the flag */
116               switch (nexthdr){
117                      case NEXTHDR_HOP:
118                      case NEXTHDR_ROUTING:
119                      case NEXTHDR_FRAGMENT:
120                      case NEXTHDR_AUTH:
121                      case NEXTHDR_DEST:
122                             break;
123                      default:
124                             DEBUGP("ipv6_opts match: unknown nextheader %u\n",nexthdr);
125                             return 0;
126                             break;
127               }
128 
129                 nexthdr = hdr->nexthdr;
130                 len -= hdrlen;
131                 ptr += hdrlen;
132 		if ( ptr > skb->len ) {
133 			DEBUGP("ipv6_opts: new pointer is too large! \n");
134 			break;
135 		}
136         }
137 
138        /* OPTIONS header not found */
139 #if HOPBYHOP
140        if ( temp != MASK_HOPOPTS ) return 0;
141 #else
142        if ( temp != MASK_DSTOPTS ) return 0;
143 #endif
144 
145        if (len < (int)sizeof(struct ipv6_opt_hdr)){
146 	       *hotdrop = 1;
147        		return 0;
148        }
149 
150        if (len < hdrlen){
151 	       /* Packet smaller than it's length field */
152        		return 0;
153        }
154 
155        optsh = (void *)(skb->data + ptr);
156 
157        DEBUGP("IPv6 OPTS LEN %u %u ", hdrlen, optsh->hdrlen);
158 
159        DEBUGP("len %02X %04X %02X ",
160        		optinfo->hdrlen, hdrlen,
161        		(!(optinfo->flags & IP6T_OPTS_LEN) ||
162                            ((optinfo->hdrlen == hdrlen) ^
163                            !!(optinfo->invflags & IP6T_OPTS_INV_LEN))));
164 
165        ret = (optsh != NULL)
166        		&&
167 	      	(!(optinfo->flags & IP6T_OPTS_LEN) ||
168                            ((optinfo->hdrlen == hdrlen) ^
169                            !!(optinfo->invflags & IP6T_OPTS_INV_LEN)));
170 
171        ptr += 2;
172        hdrlen -= 2;
173        if ( !(optinfo->flags & IP6T_OPTS_OPTS) ){
174 	       return ret;
175 	} else {
176 		DEBUGP("Strict ");
177 		DEBUGP("#%d ",optinfo->optsnr);
178 		for(temp=0; temp<optinfo->optsnr; temp++){
179 			/* type field exists ? */
180 			if (ptr > skb->len - 1 || hdrlen < 1)
181 				break;
182 			opttype = (void *)(skb->data + ptr);
183 
184 			/* Type check */
185 			if (*opttype != (optinfo->opts[temp] & 0xFF00)>>8){
186 				DEBUGP("Tbad %02X %02X\n",
187 				       *opttype,
188 				       (optinfo->opts[temp] & 0xFF00)>>8);
189 				return 0;
190 			} else {
191 				DEBUGP("Tok ");
192 			}
193 			/* Length check */
194 			if (*opttype) {
195 				u16 spec_len;
196 
197 				/* length field exists ? */
198 				if (ptr > skb->len - 2 || hdrlen < 2)
199 					break;
200 				optlen = *((u8 *)(skb->data + ptr + 1));
201 				spec_len = optinfo->opts[temp] & 0x00FF;
202 
203 				if (spec_len != 0x00FF && spec_len != optlen) {
204 					DEBUGP("Lbad %02X %04X\n", optlen,
205 					       spec_len);
206 					return 0;
207 				}
208 				DEBUGP("Lok ");
209 				optlen += 2;
210 			} else {
211 				DEBUGP("Pad1\n");
212 				optlen = 1;
213 			}
214 
215 			/* Step to the next */
216 			DEBUGP("len%04X \n", optlen);
217 
218 			if ((ptr > skb->len - optlen || hdrlen < optlen) &&
219 			    (temp < optinfo->optsnr - 1)) {
220 				DEBUGP("new pointer is too large! \n");
221 				break;
222 			}
223 			ptr += optlen;
224 			hdrlen -= optlen;
225 		}
226 		if (temp == optinfo->optsnr)
227 			return ret;
228 		else return 0;
229 	}
230 
231 	return 0;
232 }
233 
234 /* Called when user tries to insert an entry of this type. */
235 static int
236 checkentry(const char *tablename,
237           const struct ip6t_ip6 *ip,
238           void *matchinfo,
239           unsigned int matchinfosize,
240           unsigned int hook_mask)
241 {
242        const struct ip6t_opts *optsinfo = matchinfo;
243 
244        if (matchinfosize != IP6T_ALIGN(sizeof(struct ip6t_opts))) {
245               DEBUGP("ip6t_opts: matchsize %u != %u\n",
246                       matchinfosize, IP6T_ALIGN(sizeof(struct ip6t_opts)));
247               return 0;
248        }
249        if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) {
250               DEBUGP("ip6t_opts: unknown flags %X\n",
251                       optsinfo->invflags);
252               return 0;
253        }
254        if (optsinfo->flags & IP6T_OPTS_NSTRICT) {
255 	       DEBUGP("ip6t_opts: Not strict - not implemented");
256 	       return 0;
257        }
258 
259        return 1;
260 }
261 
262 static struct ip6t_match opts_match
263 #if HOPBYHOP
264 = { { NULL, NULL }, "hbh", &match, &checkentry, NULL, THIS_MODULE };
265 #else
266 = { { NULL, NULL }, "dst", &match, &checkentry, NULL, THIS_MODULE };
267 #endif
268 
269 static int __init init(void)
270 {
271        return ip6t_register_match(&opts_match);
272 }
273 
274 static void __exit cleanup(void)
275 {
276        ip6t_unregister_match(&opts_match);
277 }
278 
279 module_init(init);
280 module_exit(cleanup);
281