[net-next-2.6.git] / net / ipv6 / netfilter / ip6t_rt.c

/* Kernel module to match ROUTING parameters. */

/* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/ipv6.h>
#include <linux/types.h>
#include <net/checksum.h>
#include <net/ipv6.h>

#include <asm/byteorder.h>

#include <linux/netfilter_ipv6/ip6_tables.h>
#include <linux/netfilter_ipv6/ip6t_rt.h>

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("IPv6 RT match");
MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");

#if 0
#define DEBUGP printk
#else
#define DEBUGP(format, args...)
#endif

/* Returns 1 if the id is matched by the range, 0 otherwise */
static inline int
segsleft_match(u_int32_t min, u_int32_t max, u_int32_t id, int invert)
{
	int r = 0;
	DEBUGP("rt segsleft_match:%c 0x%x <= 0x%x <= 0x%x",
	       invert ? '!' : ' ', min, id, max);
	r = (id >= min && id <= max) ^ invert;
	DEBUGP(" result %s\n", r ? "PASS" : "FAILED");
	return r;
}

static int
match(const struct sk_buff *skb,
      const struct net_device *in,
      const struct net_device *out,
      const struct xt_match *match,
      const void *matchinfo,
      int offset,
      unsigned int protoff,
      int *hotdrop)
{
	struct ipv6_rt_hdr _route, *rh;
	const struct ip6t_rt *rtinfo = matchinfo;
	unsigned int temp;
	unsigned int ptr;
	unsigned int hdrlen = 0;
	unsigned int ret = 0;
	struct in6_addr *ap, _addr;

	if (ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL) < 0)
		return 0;

	rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
	if (rh == NULL) {
		*hotdrop = 1;
		return 0;
	}

	hdrlen = ipv6_optlen(rh);
	if (skb->len - ptr < hdrlen) {
		/* Pcket smaller than its length field */
		return 0;
	}

	DEBUGP("IPv6 RT LEN %u %u ", hdrlen, rh->hdrlen);
	DEBUGP("TYPE %04X ", rh->type);
	DEBUGP("SGS_LEFT %u %02X\n", rh->segments_left, rh->segments_left);

	DEBUGP("IPv6 RT segsleft %02X ",
	       (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
			       rh->segments_left,
			       !!(rtinfo->invflags & IP6T_RT_INV_SGS))));
	DEBUGP("type %02X %02X %02X ",
	       rtinfo->rt_type, rh->type,
	       (!(rtinfo->flags & IP6T_RT_TYP) ||
		((rtinfo->rt_type == rh->type) ^
		 !!(rtinfo->invflags & IP6T_RT_INV_TYP))));
	DEBUGP("len %02X %04X %02X ",
	       rtinfo->hdrlen, hdrlen,
	       (!(rtinfo->flags & IP6T_RT_LEN) ||
		((rtinfo->hdrlen == hdrlen) ^
		 !!(rtinfo->invflags & IP6T_RT_INV_LEN))));
	DEBUGP("res %02X %02X %02X ",
	       (rtinfo->flags & IP6T_RT_RES),
	       ((struct rt0_hdr *)rh)->reserved,
	       !((rtinfo->flags & IP6T_RT_RES) &&
		 (((struct rt0_hdr *)rh)->reserved)));

	ret = (rh != NULL)
	      &&
	      (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
			      rh->segments_left,
			      !!(rtinfo->invflags & IP6T_RT_INV_SGS)))
	      &&
	      (!(rtinfo->flags & IP6T_RT_LEN) ||
	       ((rtinfo->hdrlen == hdrlen) ^
		!!(rtinfo->invflags & IP6T_RT_INV_LEN)))
	      &&
	      (!(rtinfo->flags & IP6T_RT_TYP) ||
	       ((rtinfo->rt_type == rh->type) ^
		!!(rtinfo->invflags & IP6T_RT_INV_TYP)));

	if (ret && (rtinfo->flags & IP6T_RT_RES)) {
		u_int32_t *rp, _reserved;
		rp = skb_header_pointer(skb,
					ptr + offsetof(struct rt0_hdr,
						       reserved),
					sizeof(_reserved),
					&_reserved);

		ret = (*rp == 0);
	}

	DEBUGP("#%d ", rtinfo->addrnr);
	if (!(rtinfo->flags & IP6T_RT_FST)) {
		return ret;
	} else if (rtinfo->flags & IP6T_RT_FST_NSTRICT) {
		DEBUGP("Not strict ");
		if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
			DEBUGP("There isn't enough space\n");
			return 0;
		} else {
			unsigned int i = 0;

			DEBUGP("#%d ", rtinfo->addrnr);
			for (temp = 0;
			     temp < (unsigned int)((hdrlen - 8) / 16);
			     temp++) {
				ap = skb_header_pointer(skb,
							ptr
							+ sizeof(struct rt0_hdr)
							+ temp * sizeof(_addr),
							sizeof(_addr),
							&_addr);

				BUG_ON(ap == NULL);

				if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {
					DEBUGP("i=%d temp=%d;\n", i, temp);
					i++;
				}
				if (i == rtinfo->addrnr)
					break;
			}
			DEBUGP("i=%d #%d\n", i, rtinfo->addrnr);
			if (i == rtinfo->addrnr)
				return ret;
			else
				return 0;
		}
	} else {
		DEBUGP("Strict ");
		if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
			DEBUGP("There isn't enough space\n");
			return 0;
		} else {
			DEBUGP("#%d ", rtinfo->addrnr);
			for (temp = 0; temp < rtinfo->addrnr; temp++) {
				ap = skb_header_pointer(skb,
							ptr
							+ sizeof(struct rt0_hdr)
							+ temp * sizeof(_addr),
							sizeof(_addr),
							&_addr);
				BUG_ON(ap == NULL);

				if (!ipv6_addr_equal(ap, &rtinfo->addrs[temp]))
					break;
			}
			DEBUGP("temp=%d #%d\n", temp, rtinfo->addrnr);
			if ((temp == rtinfo->addrnr) &&
			    (temp == (unsigned int)((hdrlen - 8) / 16)))
				return ret;
			else
				return 0;
		}
	}

	return 0;
}

/* Called when user tries to insert an entry of this type. */
static int
checkentry(const char *tablename,
	   const void *entry,
	   const struct xt_match *match,
	   void *matchinfo,
	   unsigned int hook_mask)
{
	const struct ip6t_rt *rtinfo = matchinfo;

	if (rtinfo->invflags & ~IP6T_RT_INV_MASK) {
		DEBUGP("ip6t_rt: unknown flags %X\n", rtinfo->invflags);
		return 0;
	}
	if ((rtinfo->flags & (IP6T_RT_RES | IP6T_RT_FST_MASK)) &&
	    (!(rtinfo->flags & IP6T_RT_TYP) ||
	     (rtinfo->rt_type != 0) ||
	     (rtinfo->invflags & IP6T_RT_INV_TYP))) {
		DEBUGP("`--rt-type 0' required before `--rt-0-*'");
		return 0;
	}

	return 1;
}

static struct ip6t_match rt_match = {
	.name		= "rt",
	.match		= match,
	.matchsize	= sizeof(struct ip6t_rt),
	.checkentry	= checkentry,
	.me		= THIS_MODULE,
};

static int __init ip6t_rt_init(void)
{
	return ip6t_register_match(&rt_match);
}

static void __exit ip6t_rt_fini(void)
{
	ip6t_unregister_match(&rt_match);
}

module_init(ip6t_rt_init);
module_exit(ip6t_rt_fini);
Commit	Line	Data
1da177e4 LT	1	/* Kernel module to match ROUTING parameters. */
	2
	3	/* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation.
	8	*/
	9
	10	#include <linux/module.h>
	11	#include <linux/skbuff.h>
	12	#include <linux/ipv6.h>
	13	#include <linux/types.h>
	14	#include <net/checksum.h>
	15	#include <net/ipv6.h>
	16
	17	#include <asm/byteorder.h>
	18
	19	#include <linux/netfilter_ipv6/ip6_tables.h>
	20	#include <linux/netfilter_ipv6/ip6t_rt.h>
	21
	22	MODULE_LICENSE("GPL");
	23	MODULE_DESCRIPTION("IPv6 RT match");
	24	MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
	25
	26	#if 0
	27	#define DEBUGP printk
	28	#else
	29	#define DEBUGP(format, args...)
	30	#endif
	31
	32	/* Returns 1 if the id is matched by the range, 0 otherwise */
	33	static inline int
	34	segsleft_match(u_int32_t min, u_int32_t max, u_int32_t id, int invert)
	35	{
f0daaa65 YK	36	int r = 0;
	37	DEBUGP("rt segsleft_match:%c 0x%x <= 0x%x <= 0x%x",
	38	invert ? '!' : ' ', min, id, max);
	39	r = (id >= min && id <= max) ^ invert;
	40	DEBUGP(" result %s\n", r ? "PASS" : "FAILED");
	41	return r;
1da177e4 LT	42	}
	43
	44	static int
	45	match(const struct sk_buff *skb,
	46	const struct net_device *in,
	47	const struct net_device *out,
c4986734	48	const struct xt_match *match,
1da177e4 LT	49	const void *matchinfo,
	50	int offset,
	51	unsigned int protoff,
	52	int *hotdrop)
	53	{
f0daaa65 YK	54	struct ipv6_rt_hdr _route, *rh;
	55	const struct ip6t_rt *rtinfo = matchinfo;
	56	unsigned int temp;
	57	unsigned int ptr;
	58	unsigned int hdrlen = 0;
	59	unsigned int ret = 0;
	60	struct in6_addr *ap, _addr;
1da177e4	61
b777e0ce	62	if (ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL) < 0)
e674d0f3	63	return 0;
1da177e4	64
f0daaa65 YK	65	rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
	66	if (rh == NULL) {
	67	*hotdrop = 1;
	68	return 0;
	69	}
	70
	71	hdrlen = ipv6_optlen(rh);
	72	if (skb->len - ptr < hdrlen) {
	73	/* Pcket smaller than its length field */
	74	return 0;
	75	}
	76
	77	DEBUGP("IPv6 RT LEN %u %u ", hdrlen, rh->hdrlen);
	78	DEBUGP("TYPE %04X ", rh->type);
	79	DEBUGP("SGS_LEFT %u %02X\n", rh->segments_left, rh->segments_left);
	80
	81	DEBUGP("IPv6 RT segsleft %02X ",
	82	(segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
	83	rh->segments_left,
	84	!!(rtinfo->invflags & IP6T_RT_INV_SGS))));
	85	DEBUGP("type %02X %02X %02X ",
	86	rtinfo->rt_type, rh->type,
	87	(!(rtinfo->flags & IP6T_RT_TYP) \|\|
	88	((rtinfo->rt_type == rh->type) ^
	89	!!(rtinfo->invflags & IP6T_RT_INV_TYP))));
	90	DEBUGP("len %02X %04X %02X ",
	91	rtinfo->hdrlen, hdrlen,
	92	(!(rtinfo->flags & IP6T_RT_LEN) \|\|
	93	((rtinfo->hdrlen == hdrlen) ^
	94	!!(rtinfo->invflags & IP6T_RT_INV_LEN))));
	95	DEBUGP("res %02X %02X %02X ",
	96	(rtinfo->flags & IP6T_RT_RES),
	97	((struct rt0_hdr *)rh)->reserved,
	98	!((rtinfo->flags & IP6T_RT_RES) &&
	99	(((struct rt0_hdr *)rh)->reserved)));
	100
	101	ret = (rh != NULL)
	102	&&
	103	(segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
	104	rh->segments_left,
	105	!!(rtinfo->invflags & IP6T_RT_INV_SGS)))
	106	&&
	107	(!(rtinfo->flags & IP6T_RT_LEN) \|\|
	108	((rtinfo->hdrlen == hdrlen) ^
	109	!!(rtinfo->invflags & IP6T_RT_INV_LEN)))
	110	&&
	111	(!(rtinfo->flags & IP6T_RT_TYP) \|\|
	112	((rtinfo->rt_type == rh->type) ^
	113	!!(rtinfo->invflags & IP6T_RT_INV_TYP)));
1da177e4 LT	114
1da177e4 LT	115	if (ret && (rtinfo->flags & IP6T_RT_RES)) {
e6df439b BH	116	u_int32_t *rp, _reserved;
e6df439b BH	117	rp = skb_header_pointer(skb,
f0daaa65 YK	118	ptr + offsetof(struct rt0_hdr,
	119	reserved),
	120	sizeof(_reserved),
	121	&_reserved);
1da177e4	122
e6df439b	123	ret = (*rp == 0);
1da177e4 LT	124	}
1da177e4 LT	125
f0daaa65 YK	126	DEBUGP("#%d ", rtinfo->addrnr);
	127	if (!(rtinfo->flags & IP6T_RT_FST)) {
	128	return ret;
1da177e4 LT	129	} else if (rtinfo->flags & IP6T_RT_FST_NSTRICT) {
1da177e4 LT	130	DEBUGP("Not strict ");
f0daaa65	131	if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
1da177e4 LT	132	DEBUGP("There isn't enough space\n");
	133	return 0;
	134	} else {
	135	unsigned int i = 0;
	136
f0daaa65 YK	137	DEBUGP("#%d ", rtinfo->addrnr);
	138	for (temp = 0;
	139	temp < (unsigned int)((hdrlen - 8) / 16);
	140	temp++) {
1da177e4 LT	141	ap = skb_header_pointer(skb,
	142	ptr
	143	+ sizeof(struct rt0_hdr)
	144	+ temp * sizeof(_addr),
	145	sizeof(_addr),
	146	&_addr);
	147
	148	BUG_ON(ap == NULL);
	149
	150	if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {
f0daaa65	151	DEBUGP("i=%d temp=%d;\n", i, temp);
1da177e4 LT	152	i++;
1da177e4 LT	153	}
f0daaa65 YK	154	if (i == rtinfo->addrnr)
f0daaa65 YK	155	break;
1da177e4 LT	156	}
	157	DEBUGP("i=%d #%d\n", i, rtinfo->addrnr);
	158	if (i == rtinfo->addrnr)
	159	return ret;
f0daaa65 YK	160	else
f0daaa65 YK	161	return 0;
1da177e4 LT	162	}
	163	} else {
	164	DEBUGP("Strict ");
f0daaa65	165	if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
1da177e4 LT	166	DEBUGP("There isn't enough space\n");
	167	return 0;
	168	} else {
f0daaa65 YK	169	DEBUGP("#%d ", rtinfo->addrnr);
f0daaa65 YK	170	for (temp = 0; temp < rtinfo->addrnr; temp++) {
1da177e4 LT	171	ap = skb_header_pointer(skb,
	172	ptr
	173	+ sizeof(struct rt0_hdr)
	174	+ temp * sizeof(_addr),
	175	sizeof(_addr),
	176	&_addr);
	177	BUG_ON(ap == NULL);
	178
	179	if (!ipv6_addr_equal(ap, &rtinfo->addrs[temp]))
	180	break;
	181	}
	182	DEBUGP("temp=%d #%d\n", temp, rtinfo->addrnr);
f0daaa65 YK	183	if ((temp == rtinfo->addrnr) &&
f0daaa65 YK	184	(temp == (unsigned int)((hdrlen - 8) / 16)))
1da177e4	185	return ret;
f0daaa65 YK	186	else
f0daaa65 YK	187	return 0;
1da177e4 LT	188	}
	189	}
	190
	191	return 0;
	192	}
	193
	194	/* Called when user tries to insert an entry of this type. */
	195	static int
	196	checkentry(const char *tablename,
f0daaa65	197	const void *entry,
c4986734	198	const struct xt_match *match,
f0daaa65	199	void *matchinfo,
f0daaa65	200	unsigned int hook_mask)
1da177e4	201	{
f0daaa65 YK	202	const struct ip6t_rt *rtinfo = matchinfo;
f0daaa65 YK	203
f0daaa65 YK	204	if (rtinfo->invflags & ~IP6T_RT_INV_MASK) {
	205	DEBUGP("ip6t_rt: unknown flags %X\n", rtinfo->invflags);
	206	return 0;
	207	}
	208	if ((rtinfo->flags & (IP6T_RT_RES \| IP6T_RT_FST_MASK)) &&
	209	(!(rtinfo->flags & IP6T_RT_TYP) \|\|
	210	(rtinfo->rt_type != 0) \|\|
	211	(rtinfo->invflags & IP6T_RT_INV_TYP))) {
	212	DEBUGP("`--rt-type 0' required before `--rt-0-*'");
	213	return 0;
	214	}
	215
	216	return 1;
1da177e4 LT	217	}
	218
	219	static struct ip6t_match rt_match = {
	220	.name = "rt",
7f939713 PM	221	.match = match,
	222	.matchsize = sizeof(struct ip6t_rt),
	223	.checkentry = checkentry,
1da177e4 LT	224	.me = THIS_MODULE,
	225	};
	226
65b4b4e8	227	static int __init ip6t_rt_init(void)
1da177e4	228	{
f0daaa65	229	return ip6t_register_match(&rt_match);
1da177e4 LT	230	}
1da177e4 LT	231
65b4b4e8	232	static void __exit ip6t_rt_fini(void)
1da177e4	233	{
f0daaa65	234	ip6t_unregister_match(&rt_match);
1da177e4 LT	235	}
1da177e4 LT	236
65b4b4e8 AM	237	module_init(ip6t_rt_init);
65b4b4e8 AM	238	module_exit(ip6t_rt_fini);