1 /* Kernel module to match FRAG parameters. */
2 #include <linux/module.h>
3 #include <linux/skbuff.h>
4 #include <linux/ipv6.h>
5 #include <linux/types.h>
6 #include <net/checksum.h>
7 #include <net/ipv6.h>
8 
9 #include <linux/netfilter_ipv6/ip6_tables.h>
10 #include <linux/netfilter_ipv6/ip6t_frag.h>
11 
12 EXPORT_NO_SYMBOLS;
13 MODULE_LICENSE("GPL");
14 MODULE_DESCRIPTION("IPv6 FRAG match");
15 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
16 
17 #if 0
18 #define DEBUGP printk
19 #else
20 #define DEBUGP(format, args...)
21 #endif
22 
23 #define IP6_MF	0x0001
24 
25 /* Returns 1 if the id is matched by the range, 0 otherwise */
26 static inline int
id_match(u_int32_t min,u_int32_t max,u_int32_t id,int invert)27 id_match(u_int32_t min, u_int32_t max, u_int32_t id, int invert)
28 {
29        int r=0;
30        DEBUGP("frag id_match:%c 0x%x <= 0x%x <= 0x%x",invert? '!':' ',
31               min,id,max);
32        r=(id >= min && id <= max) ^ invert;
33        DEBUGP(" result %s\n",r? "PASS" : "FAILED");
34        return r;
35 }
36 
37 static int
match(const struct sk_buff * skb,const struct net_device * in,const struct net_device * out,const void * matchinfo,int offset,const void * protohdr,u_int16_t datalen,int * hotdrop)38 match(const struct sk_buff *skb,
39       const struct net_device *in,
40       const struct net_device *out,
41       const void *matchinfo,
42       int offset,
43       const void *protohdr,
44       u_int16_t datalen,
45       int *hotdrop)
46 {
47        struct frag_hdr *frag = NULL;
48        const struct ip6t_frag *fraginfo = matchinfo;
49        unsigned int temp;
50        int len;
51        u8 nexthdr;
52        unsigned int ptr;
53        unsigned int hdrlen = 0;
54 
55        /* type of the 1st exthdr */
56        nexthdr = skb->nh.ipv6h->nexthdr;
57        /* pointer to the 1st exthdr */
58        ptr = sizeof(struct ipv6hdr);
59        /* available length */
60        len = skb->len - ptr;
61        temp = 0;
62 
63         while (ip6t_ext_hdr(nexthdr)) {
64                struct ipv6_opt_hdr *hdr;
65 
66               DEBUGP("ipv6_frag header iteration \n");
67 
68               /* Is there enough space for the next ext header? */
69                 if (len < (int)sizeof(struct ipv6_opt_hdr))
70                         return 0;
71               /* No more exthdr -> evaluate */
72                 if (nexthdr == NEXTHDR_NONE) {
73                      break;
74               }
75               /* ESP -> evaluate */
76                 if (nexthdr == NEXTHDR_ESP) {
77                      break;
78               }
79 
80               hdr=(struct ipv6_opt_hdr *)(skb->data+ptr);
81 
82               /* Calculate the header length */
83                 if (nexthdr == NEXTHDR_FRAGMENT) {
84                         hdrlen = 8;
85                 } else if (nexthdr == NEXTHDR_AUTH)
86                         hdrlen = (hdr->hdrlen+2)<<2;
87                 else
88                         hdrlen = ipv6_optlen(hdr);
89 
90               /* FRAG -> evaluate */
91                 if (nexthdr == NEXTHDR_FRAGMENT) {
92                      temp |= MASK_FRAGMENT;
93                      break;
94               }
95 
96 
97               /* set the flag */
98               switch (nexthdr){
99                      case NEXTHDR_HOP:
100                      case NEXTHDR_ROUTING:
101                      case NEXTHDR_FRAGMENT:
102                      case NEXTHDR_AUTH:
103                      case NEXTHDR_DEST:
104                             break;
105                      default:
106                             DEBUGP("ipv6_frag match: unknown nextheader %u\n",nexthdr);
107                             return 0;
108                             break;
109               }
110 
111                 nexthdr = hdr->nexthdr;
112                 len -= hdrlen;
113                 ptr += hdrlen;
114 		if ( ptr > skb->len ) {
115 			DEBUGP("ipv6_frag: new pointer too large! \n");
116 			break;
117 		}
118         }
119 
120        /* FRAG header not found */
121        if ( temp != MASK_FRAGMENT ) return 0;
122 
123        if (len < sizeof(struct frag_hdr)){
124 	       *hotdrop = 1;
125        		return 0;
126        }
127 
128        frag = (struct frag_hdr *) (skb->data + ptr);
129 
130        DEBUGP("INFO %04X ", frag->frag_off);
131        DEBUGP("OFFSET %04X ", ntohs(frag->frag_off) & ~0x7);
132        DEBUGP("RES %02X %04X", frag->reserved, ntohs(frag->frag_off) & 0x6);
133        DEBUGP("MF %04X ", frag->frag_off & htons(IP6_MF));
134        DEBUGP("ID %u %08X\n", ntohl(frag->identification),
135 	      ntohl(frag->identification));
136 
137        DEBUGP("IPv6 FRAG id %02X ",
138        		(id_match(fraginfo->ids[0], fraginfo->ids[1],
139                            ntohl(frag->identification),
140                            !!(fraginfo->invflags & IP6T_FRAG_INV_IDS))));
141        DEBUGP("res %02X %02X%04X %02X ",
142        		(fraginfo->flags & IP6T_FRAG_RES), frag->reserved,
143 		ntohs(frag->frag_off) & 0x6,
144        		!((fraginfo->flags & IP6T_FRAG_RES)
145 			&& (frag->reserved || (ntohs(frag->frag_off) & 0x6))));
146        DEBUGP("first %02X %02X %02X ",
147        		(fraginfo->flags & IP6T_FRAG_FST),
148 		ntohs(frag->frag_off) & ~0x7,
149        		!((fraginfo->flags & IP6T_FRAG_FST)
150 			&& (ntohs(frag->frag_off) & ~0x7)));
151        DEBUGP("mf %02X %02X %02X ",
152        		(fraginfo->flags & IP6T_FRAG_MF),
153 		ntohs(frag->frag_off) & IP6_MF,
154        		!((fraginfo->flags & IP6T_FRAG_MF)
155 			&& !((ntohs(frag->frag_off) & IP6_MF))));
156        DEBUGP("last %02X %02X %02X\n",
157        		(fraginfo->flags & IP6T_FRAG_NMF),
158 		ntohs(frag->frag_off) & IP6_MF,
159        		!((fraginfo->flags & IP6T_FRAG_NMF)
160 			&& (ntohs(frag->frag_off) & IP6_MF)));
161 
162        return (frag != NULL)
163        		&&
164        		(id_match(fraginfo->ids[0], fraginfo->ids[1],
165 			  ntohl(frag->identification),
166                            !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)))
167 		&&
168 		!((fraginfo->flags & IP6T_FRAG_RES)
169 			&& (frag->reserved || (ntohs(frag->frag_off) & 0x6)))
170 		&&
171 		!((fraginfo->flags & IP6T_FRAG_FST)
172 			&& (ntohs(frag->frag_off) & ~0x7))
173 		&&
174 		!((fraginfo->flags & IP6T_FRAG_MF)
175 			&& !(ntohs(frag->frag_off) & IP6_MF))
176 		&&
177 		!((fraginfo->flags & IP6T_FRAG_NMF)
178 			&& (ntohs(frag->frag_off) & IP6_MF));
179 }
180 
181 /* Called when user tries to insert an entry of this type. */
182 static int
checkentry(const char * tablename,const struct ip6t_ip6 * ip,void * matchinfo,unsigned int matchinfosize,unsigned int hook_mask)183 checkentry(const char *tablename,
184           const struct ip6t_ip6 *ip,
185           void *matchinfo,
186           unsigned int matchinfosize,
187           unsigned int hook_mask)
188 {
189        const struct ip6t_frag *fraginfo = matchinfo;
190 
191        if (matchinfosize != IP6T_ALIGN(sizeof(struct ip6t_frag))) {
192               DEBUGP("ip6t_frag: matchsize %u != %u\n",
193                       matchinfosize, IP6T_ALIGN(sizeof(struct ip6t_frag)));
194               return 0;
195        }
196        if (fraginfo->invflags & ~IP6T_FRAG_INV_MASK) {
197               DEBUGP("ip6t_frag: unknown flags %X\n",
198                       fraginfo->invflags);
199               return 0;
200        }
201 
202        return 1;
203 }
204 
205 static struct ip6t_match frag_match
206 = { { NULL, NULL }, "frag", &match, &checkentry, NULL, THIS_MODULE };
207 
init(void)208 static int __init init(void)
209 {
210        return ip6t_register_match(&frag_match);
211 }
212 
cleanup(void)213 static void __exit cleanup(void)
214 {
215        ip6t_unregister_match(&frag_match);
216 }
217 
218 module_init(init);
219 module_exit(cleanup);
220