net/ipv6/netfilter/ip6t_esp.c

   1 /* Kernel module to match ESP parameters. */
   2 /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8
   9
  10 #include <linux/module.h>
  11 #include <linux/skbuff.h>
  12 #include <linux/ipv6.h>
  13 #include <linux/types.h>
  14 #include <net/checksum.h>
  15 #include <net/ipv6.h>
  16
  17 #include <linux/netfilter_ipv6/ip6_tables.h>
  18 #include <linux/netfilter_ipv6/ip6t_esp.h>
  19
  20 MODULE_LICENSE("GPL");
  21 MODULE_DESCRIPTION("IPv6 ESP match");
  22 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
  23
  24 #if 0
  25 #define DEBUGP printk
  26 #else
  27 #define DEBUGP(format, args...)
  28 #endif
  29
  30 /* Returns 1 if the spi is matched by the range, 0 otherwise */
  31 static inline int
  32 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, int invert)
  33 {
  34         int r=0;
  35         DEBUGP("esp spi_match:%c 0x%x <= 0x%x <= 0x%x",invert? '!':' ',
  36                min,spi,max);
  37         r=(spi >= min && spi <= max) ^ invert;
  38         DEBUGP(" result %s\n",r? "PASS\n" : "FAILED\n");
  39         return r;
  40 }
  41
  42 static int
  43 match(const struct sk_buff *skb,
  44       const struct net_device *in,
  45       const struct net_device *out,
  46       const void *matchinfo,
  47       int offset,
  48       unsigned int protoff,
  49       int *hotdrop)
  50 {
  51         struct ip_esp_hdr _esp, *eh = NULL;
  52         const struct ip6t_esp *espinfo = matchinfo;
  53         unsigned int temp;
  54         int len;
  55         u8 nexthdr;
  56         unsigned int ptr;
  57
  58         /* Make sure this isn't an evil packet */
  59         /*DEBUGP("ipv6_esp entered \n");*/
  60
  61         /* type of the 1st exthdr */
  62         nexthdr = skb->nh.ipv6h->nexthdr;
  63         /* pointer to the 1st exthdr */
  64         ptr = sizeof(struct ipv6hdr);
  65         /* available length */
  66         len = skb->len - ptr;
  67         temp = 0;
  68
  69         while (ip6t_ext_hdr(nexthdr)) {
  70                 struct ipv6_opt_hdr _hdr, *hp;
  71                 int hdrlen;
  72
  73                 DEBUGP("ipv6_esp header iteration \n");
  74
  75                 /* Is there enough space for the next ext header? */
  76                 if (len < sizeof(struct ipv6_opt_hdr))
  77                         return 0;
  78                 /* No more exthdr -> evaluate */
  79                 if (nexthdr == NEXTHDR_NONE)
  80                         break;
  81                 /* ESP -> evaluate */
  82                 if (nexthdr == NEXTHDR_ESP) {
  83                         temp |= MASK_ESP;
  84                         break;
  85                 }
  86
  87                 hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
  88                 BUG_ON(hp == NULL);
  89
  90                 /* Calculate the header length */
  91                 if (nexthdr == NEXTHDR_FRAGMENT)
  92                         hdrlen = 8;
  93                 else if (nexthdr == NEXTHDR_AUTH)
  94                         hdrlen = (hp->hdrlen+2)<<2;
  95                 else
  96                         hdrlen = ipv6_optlen(hp);
  97
  98                 /* set the flag */
  99                 switch (nexthdr) {
 100                 case NEXTHDR_HOP:
 101                 case NEXTHDR_ROUTING:
 102                 case NEXTHDR_FRAGMENT:
 103                 case NEXTHDR_AUTH:
 104                 case NEXTHDR_DEST:
 105                         break;
 106                 default:
 107                         DEBUGP("ipv6_esp match: unknown nextheader %u\n",nexthdr);
 108                         return 0;
 109                 }
 110
 111                 nexthdr = hp->nexthdr;
 112                 len -= hdrlen;
 113                 ptr += hdrlen;
 114                 if (ptr > skb->len) {
 115                         DEBUGP("ipv6_esp: new pointer too large! \n");
 116                         break;
 117                 }
 118         }
 119
 120         /* ESP header not found */
 121         if (temp != MASK_ESP)
 122                 return 0;
 123
 124         if (len < sizeof(struct ip_esp_hdr)) {
 125                 *hotdrop = 1;
 126                 return 0;
 127         }
 128
 129         eh = skb_header_pointer(skb, ptr, sizeof(_esp), &_esp);
 130         BUG_ON(eh == NULL);
 131
 132         DEBUGP("IPv6 ESP SPI %u %08X\n", ntohl(eh->spi), ntohl(eh->spi));
 133
 134         return (eh != NULL)
 135                 && spi_match(espinfo->spis[0], espinfo->spis[1],
 136                               ntohl(eh->spi),
 137                               !!(espinfo->invflags & IP6T_ESP_INV_SPI));
 138 }
 139
 140 /* Called when user tries to insert an entry of this type. */
 141 static int
 142 checkentry(const char *tablename,
 143            const struct ip6t_ip6 *ip,
 144            void *matchinfo,
 145            unsigned int matchinfosize,
 146            unsigned int hook_mask)
 147 {
 148         const struct ip6t_esp *espinfo = matchinfo;
 149
 150         if (matchinfosize != IP6T_ALIGN(sizeof(struct ip6t_esp))) {
 151                 DEBUGP("ip6t_esp: matchsize %u != %u\n",
 152                          matchinfosize, IP6T_ALIGN(sizeof(struct ip6t_esp)));
 153                 return 0;
 154         }
 155         if (espinfo->invflags & ~IP6T_ESP_INV_MASK) {
 156                 DEBUGP("ip6t_esp: unknown flags %X\n",
 157                          espinfo->invflags);
 158                 return 0;
 159         }
 160         return 1;
 161 }
 162
 163 static struct ip6t_match esp_match = {
 164         .name           = "esp",
 165         .match          = &match,
 166         .checkentry     = &checkentry,
 167         .me             = THIS_MODULE,
 168 };
 169
 170 static int __init init(void)
 171 {
 172         return ip6t_register_match(&esp_match);
 173 }
 174
 175 static void __exit cleanup(void)
 176 {
 177         ip6t_unregister_match(&esp_match);
 178 }
 179
 180 module_init(init);
 181 module_exit(cleanup);