1 // SPDX-License-Identifier: GPL-2.0-only
2 /* Kernel module to match L2TP header parameters. */
3 
4 /* (C) 2013      James Chapman <jchapman@katalix.com>
5  */
6 
7 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
8 #include <linux/module.h>
9 #include <linux/skbuff.h>
10 #include <linux/if_ether.h>
11 #include <net/ip.h>
12 #include <linux/ipv6.h>
13 #include <net/ipv6.h>
14 #include <net/udp.h>
15 #include <linux/l2tp.h>
16 
17 #include <linux/netfilter_ipv4.h>
18 #include <linux/netfilter_ipv6.h>
19 #include <linux/netfilter_ipv4/ip_tables.h>
20 #include <linux/netfilter_ipv6/ip6_tables.h>
21 #include <linux/netfilter/x_tables.h>
22 #include <linux/netfilter/xt_tcpudp.h>
23 #include <linux/netfilter/xt_l2tp.h>
24 
25 /* L2TP header masks */
26 #define L2TP_HDR_T_BIT	0x8000
27 #define L2TP_HDR_L_BIT	0x4000
28 #define L2TP_HDR_VER	0x000f
29 
30 MODULE_LICENSE("GPL");
31 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
32 MODULE_DESCRIPTION("Xtables: L2TP header match");
33 MODULE_ALIAS("ipt_l2tp");
34 MODULE_ALIAS("ip6t_l2tp");
35 
36 /* The L2TP fields that can be matched */
37 struct l2tp_data {
38 	u32 tid;
39 	u32 sid;
40 	u8 type;
41 	u8 version;
42 };
43 
44 union l2tp_val {
45 	__be16 val16[2];
46 	__be32 val32;
47 };
48 
l2tp_match(const struct xt_l2tp_info * info,struct l2tp_data * data)49 static bool l2tp_match(const struct xt_l2tp_info *info, struct l2tp_data *data)
50 {
51 	if ((info->flags & XT_L2TP_TYPE) && (info->type != data->type))
52 		return false;
53 
54 	if ((info->flags & XT_L2TP_VERSION) && (info->version != data->version))
55 		return false;
56 
57 	/* Check tid only for L2TPv3 control or any L2TPv2 packets */
58 	if ((info->flags & XT_L2TP_TID) &&
59 	    ((data->type == XT_L2TP_TYPE_CONTROL) || (data->version == 2)) &&
60 	    (info->tid != data->tid))
61 		return false;
62 
63 	/* Check sid only for L2TP data packets */
64 	if ((info->flags & XT_L2TP_SID) && (data->type == XT_L2TP_TYPE_DATA) &&
65 	    (info->sid != data->sid))
66 		return false;
67 
68 	return true;
69 }
70 
71 /* Parse L2TP header fields when UDP encapsulation is used. Handles
72  * L2TPv2 and L2TPv3. Note the L2TPv3 control and data packets have a
73  * different format. See
74  * RFC2661, Section 3.1, L2TPv2 Header Format
75  * RFC3931, Section 3.2.1, L2TPv3 Control Message Header
76  * RFC3931, Section 3.2.2, L2TPv3 Data Message Header
77  * RFC3931, Section 4.1.2.1, L2TPv3 Session Header over UDP
78  */
l2tp_udp_mt(const struct sk_buff * skb,struct xt_action_param * par,u16 thoff)79 static bool l2tp_udp_mt(const struct sk_buff *skb, struct xt_action_param *par, u16 thoff)
80 {
81 	const struct xt_l2tp_info *info = par->matchinfo;
82 	int uhlen = sizeof(struct udphdr);
83 	int offs = thoff + uhlen;
84 	union l2tp_val *lh;
85 	union l2tp_val lhbuf;
86 	u16 flags;
87 	struct l2tp_data data = { 0, };
88 
89 	if (par->fragoff != 0)
90 		return false;
91 
92 	/* Extract L2TP header fields. The flags in the first 16 bits
93 	 * tell us where the other fields are.
94 	 */
95 	lh = skb_header_pointer(skb, offs, 2, &lhbuf);
96 	if (lh == NULL)
97 		return false;
98 
99 	flags = ntohs(lh->val16[0]);
100 	if (flags & L2TP_HDR_T_BIT)
101 		data.type = XT_L2TP_TYPE_CONTROL;
102 	else
103 		data.type = XT_L2TP_TYPE_DATA;
104 	data.version = (u8) flags & L2TP_HDR_VER;
105 
106 	/* Now extract the L2TP tid/sid. These are in different places
107 	 * for L2TPv2 (rfc2661) and L2TPv3 (rfc3931). For L2TPv2, we
108 	 * must also check to see if the length field is present,
109 	 * since this affects the offsets into the packet of the
110 	 * tid/sid fields.
111 	 */
112 	if (data.version == 3) {
113 		lh = skb_header_pointer(skb, offs + 4, 4, &lhbuf);
114 		if (lh == NULL)
115 			return false;
116 		if (data.type == XT_L2TP_TYPE_CONTROL)
117 			data.tid = ntohl(lh->val32);
118 		else
119 			data.sid = ntohl(lh->val32);
120 	} else if (data.version == 2) {
121 		if (flags & L2TP_HDR_L_BIT)
122 			offs += 2;
123 		lh = skb_header_pointer(skb, offs + 2, 4, &lhbuf);
124 		if (lh == NULL)
125 			return false;
126 		data.tid = (u32) ntohs(lh->val16[0]);
127 		data.sid = (u32) ntohs(lh->val16[1]);
128 	} else
129 		return false;
130 
131 	return l2tp_match(info, &data);
132 }
133 
134 /* Parse L2TP header fields for IP encapsulation (no UDP header).
135  * L2TPv3 data packets have a different form with IP encap. See
136  * RC3931, Section 4.1.1.1, L2TPv3 Session Header over IP.
137  * RC3931, Section 4.1.1.2, L2TPv3 Control and Data Traffic over IP.
138  */
l2tp_ip_mt(const struct sk_buff * skb,struct xt_action_param * par,u16 thoff)139 static bool l2tp_ip_mt(const struct sk_buff *skb, struct xt_action_param *par, u16 thoff)
140 {
141 	const struct xt_l2tp_info *info = par->matchinfo;
142 	union l2tp_val *lh;
143 	union l2tp_val lhbuf;
144 	struct l2tp_data data = { 0, };
145 
146 	/* For IP encap, the L2TP sid is the first 32-bits. */
147 	lh = skb_header_pointer(skb, thoff, sizeof(lhbuf), &lhbuf);
148 	if (lh == NULL)
149 		return false;
150 	if (lh->val32 == 0) {
151 		/* Must be a control packet. The L2TP tid is further
152 		 * into the packet.
153 		 */
154 		data.type = XT_L2TP_TYPE_CONTROL;
155 		lh = skb_header_pointer(skb, thoff + 8, sizeof(lhbuf),
156 					&lhbuf);
157 		if (lh == NULL)
158 			return false;
159 		data.tid = ntohl(lh->val32);
160 	} else {
161 		data.sid = ntohl(lh->val32);
162 		data.type = XT_L2TP_TYPE_DATA;
163 	}
164 
165 	data.version = 3;
166 
167 	return l2tp_match(info, &data);
168 }
169 
l2tp_mt4(const struct sk_buff * skb,struct xt_action_param * par)170 static bool l2tp_mt4(const struct sk_buff *skb, struct xt_action_param *par)
171 {
172 	struct iphdr *iph = ip_hdr(skb);
173 	u8 ipproto = iph->protocol;
174 
175 	/* l2tp_mt_check4 already restricts the transport protocol */
176 	switch (ipproto) {
177 	case IPPROTO_UDP:
178 		return l2tp_udp_mt(skb, par, par->thoff);
179 	case IPPROTO_L2TP:
180 		return l2tp_ip_mt(skb, par, par->thoff);
181 	}
182 
183 	return false;
184 }
185 
186 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
l2tp_mt6(const struct sk_buff * skb,struct xt_action_param * par)187 static bool l2tp_mt6(const struct sk_buff *skb, struct xt_action_param *par)
188 {
189 	unsigned int thoff = 0;
190 	unsigned short fragoff = 0;
191 	int ipproto;
192 
193 	ipproto = ipv6_find_hdr(skb, &thoff, -1, &fragoff, NULL);
194 	if (fragoff != 0)
195 		return false;
196 
197 	/* l2tp_mt_check6 already restricts the transport protocol */
198 	switch (ipproto) {
199 	case IPPROTO_UDP:
200 		return l2tp_udp_mt(skb, par, thoff);
201 	case IPPROTO_L2TP:
202 		return l2tp_ip_mt(skb, par, thoff);
203 	}
204 
205 	return false;
206 }
207 #endif
208 
l2tp_mt_check(const struct xt_mtchk_param * par)209 static int l2tp_mt_check(const struct xt_mtchk_param *par)
210 {
211 	const struct xt_l2tp_info *info = par->matchinfo;
212 
213 	/* Check for invalid flags */
214 	if (info->flags & ~(XT_L2TP_TID | XT_L2TP_SID | XT_L2TP_VERSION |
215 			    XT_L2TP_TYPE)) {
216 		pr_info_ratelimited("unknown flags: %x\n", info->flags);
217 		return -EINVAL;
218 	}
219 
220 	/* At least one of tid, sid or type=control must be specified */
221 	if ((!(info->flags & XT_L2TP_TID)) &&
222 	    (!(info->flags & XT_L2TP_SID)) &&
223 	    ((!(info->flags & XT_L2TP_TYPE)) ||
224 	     (info->type != XT_L2TP_TYPE_CONTROL))) {
225 		pr_info_ratelimited("invalid flags combination: %x\n",
226 				    info->flags);
227 		return -EINVAL;
228 	}
229 
230 	/* If version 2 is specified, check that incompatible params
231 	 * are not supplied
232 	 */
233 	if (info->flags & XT_L2TP_VERSION) {
234 		if ((info->version < 2) || (info->version > 3)) {
235 			pr_info_ratelimited("wrong L2TP version: %u\n",
236 					    info->version);
237 			return -EINVAL;
238 		}
239 
240 		if (info->version == 2) {
241 			if ((info->flags & XT_L2TP_TID) &&
242 			    (info->tid > 0xffff)) {
243 				pr_info_ratelimited("v2 tid > 0xffff: %u\n",
244 						    info->tid);
245 				return -EINVAL;
246 			}
247 			if ((info->flags & XT_L2TP_SID) &&
248 			    (info->sid > 0xffff)) {
249 				pr_info_ratelimited("v2 sid > 0xffff: %u\n",
250 						    info->sid);
251 				return -EINVAL;
252 			}
253 		}
254 	}
255 
256 	return 0;
257 }
258 
l2tp_mt_check4(const struct xt_mtchk_param * par)259 static int l2tp_mt_check4(const struct xt_mtchk_param *par)
260 {
261 	const struct xt_l2tp_info *info = par->matchinfo;
262 	const struct ipt_entry *e = par->entryinfo;
263 	const struct ipt_ip *ip = &e->ip;
264 	int ret;
265 
266 	ret = l2tp_mt_check(par);
267 	if (ret != 0)
268 		return ret;
269 
270 	if ((ip->proto != IPPROTO_UDP) &&
271 	    (ip->proto != IPPROTO_L2TP)) {
272 		pr_info_ratelimited("missing protocol rule (udp|l2tpip)\n");
273 		return -EINVAL;
274 	}
275 
276 	if ((ip->proto == IPPROTO_L2TP) &&
277 	    (info->version == 2)) {
278 		pr_info_ratelimited("v2 doesn't support IP mode\n");
279 		return -EINVAL;
280 	}
281 
282 	return 0;
283 }
284 
285 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
l2tp_mt_check6(const struct xt_mtchk_param * par)286 static int l2tp_mt_check6(const struct xt_mtchk_param *par)
287 {
288 	const struct xt_l2tp_info *info = par->matchinfo;
289 	const struct ip6t_entry *e = par->entryinfo;
290 	const struct ip6t_ip6 *ip = &e->ipv6;
291 	int ret;
292 
293 	ret = l2tp_mt_check(par);
294 	if (ret != 0)
295 		return ret;
296 
297 	if ((ip->proto != IPPROTO_UDP) &&
298 	    (ip->proto != IPPROTO_L2TP)) {
299 		pr_info_ratelimited("missing protocol rule (udp|l2tpip)\n");
300 		return -EINVAL;
301 	}
302 
303 	if ((ip->proto == IPPROTO_L2TP) &&
304 	    (info->version == 2)) {
305 		pr_info_ratelimited("v2 doesn't support IP mode\n");
306 		return -EINVAL;
307 	}
308 
309 	return 0;
310 }
311 #endif
312 
313 static struct xt_match l2tp_mt_reg[] __read_mostly = {
314 	{
315 		.name      = "l2tp",
316 		.revision  = 0,
317 		.family    = NFPROTO_IPV4,
318 		.match     = l2tp_mt4,
319 		.matchsize = XT_ALIGN(sizeof(struct xt_l2tp_info)),
320 		.checkentry = l2tp_mt_check4,
321 		.hooks     = ((1 << NF_INET_PRE_ROUTING) |
322 			      (1 << NF_INET_LOCAL_IN) |
323 			      (1 << NF_INET_LOCAL_OUT) |
324 			      (1 << NF_INET_FORWARD)),
325 		.me        = THIS_MODULE,
326 	},
327 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
328 	{
329 		.name      = "l2tp",
330 		.revision  = 0,
331 		.family    = NFPROTO_IPV6,
332 		.match     = l2tp_mt6,
333 		.matchsize = XT_ALIGN(sizeof(struct xt_l2tp_info)),
334 		.checkentry = l2tp_mt_check6,
335 		.hooks     = ((1 << NF_INET_PRE_ROUTING) |
336 			      (1 << NF_INET_LOCAL_IN) |
337 			      (1 << NF_INET_LOCAL_OUT) |
338 			      (1 << NF_INET_FORWARD)),
339 		.me        = THIS_MODULE,
340 	},
341 #endif
342 };
343 
l2tp_mt_init(void)344 static int __init l2tp_mt_init(void)
345 {
346 	return xt_register_matches(&l2tp_mt_reg[0], ARRAY_SIZE(l2tp_mt_reg));
347 }
348 
l2tp_mt_exit(void)349 static void __exit l2tp_mt_exit(void)
350 {
351 	xt_unregister_matches(&l2tp_mt_reg[0], ARRAY_SIZE(l2tp_mt_reg));
352 }
353 
354 module_init(l2tp_mt_init);
355 module_exit(l2tp_mt_exit);
356