~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv6/netfilter/ip6t_rt.c

Version: ~ [ linux-5.16-rc3 ] ~ [ linux-5.15.5 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.82 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.162 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.218 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.256 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.291 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.293 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* Kernel module to match ROUTING parameters. */
  2 
  3 /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
  4  *
  5  * This program is free software; you can redistribute it and/or modify
  6  * it under the terms of the GNU General Public License version 2 as
  7  * published by the Free Software Foundation.
  8  */
  9 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 10 #include <linux/module.h>
 11 #include <linux/skbuff.h>
 12 #include <linux/ipv6.h>
 13 #include <linux/types.h>
 14 #include <net/checksum.h>
 15 #include <net/ipv6.h>
 16 
 17 #include <asm/byteorder.h>
 18 
 19 #include <linux/netfilter/x_tables.h>
 20 #include <linux/netfilter_ipv6/ip6_tables.h>
 21 #include <linux/netfilter_ipv6/ip6t_rt.h>
 22 
 23 MODULE_LICENSE("GPL");
 24 MODULE_DESCRIPTION("Xtables: IPv6 Routing Header match");
 25 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 26 
 27 /* Returns 1 if the id is matched by the range, 0 otherwise */
 28 static inline bool
 29 segsleft_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert)
 30 {
 31         bool r;
 32         pr_debug("segsleft_match:%c 0x%x <= 0x%x <= 0x%x\n",
 33                  invert ? '!' : ' ', min, id, max);
 34         r = (id >= min && id <= max) ^ invert;
 35         pr_debug(" result %s\n", r ? "PASS" : "FAILED");
 36         return r;
 37 }
 38 
 39 static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 40 {
 41         struct ipv6_rt_hdr _route;
 42         const struct ipv6_rt_hdr *rh;
 43         const struct ip6t_rt *rtinfo = par->matchinfo;
 44         unsigned int temp;
 45         unsigned int ptr = 0;
 46         unsigned int hdrlen = 0;
 47         bool ret = false;
 48         struct in6_addr _addr;
 49         const struct in6_addr *ap;
 50         int err;
 51 
 52         err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL, NULL);
 53         if (err < 0) {
 54                 if (err != -ENOENT)
 55                         par->hotdrop = true;
 56                 return false;
 57         }
 58 
 59         rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
 60         if (rh == NULL) {
 61                 par->hotdrop = true;
 62                 return false;
 63         }
 64 
 65         hdrlen = ipv6_optlen(rh);
 66         if (skb->len - ptr < hdrlen) {
 67                 /* Pcket smaller than its length field */
 68                 return false;
 69         }
 70 
 71         pr_debug("IPv6 RT LEN %u %u ", hdrlen, rh->hdrlen);
 72         pr_debug("TYPE %04X ", rh->type);
 73         pr_debug("SGS_LEFT %u %02X\n", rh->segments_left, rh->segments_left);
 74 
 75         pr_debug("IPv6 RT segsleft %02X ",
 76                  segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
 77                                 rh->segments_left,
 78                                 !!(rtinfo->invflags & IP6T_RT_INV_SGS)));
 79         pr_debug("type %02X %02X %02X ",
 80                  rtinfo->rt_type, rh->type,
 81                  (!(rtinfo->flags & IP6T_RT_TYP) ||
 82                   ((rtinfo->rt_type == rh->type) ^
 83                    !!(rtinfo->invflags & IP6T_RT_INV_TYP))));
 84         pr_debug("len %02X %04X %02X ",
 85                  rtinfo->hdrlen, hdrlen,
 86                  !(rtinfo->flags & IP6T_RT_LEN) ||
 87                   ((rtinfo->hdrlen == hdrlen) ^
 88                    !!(rtinfo->invflags & IP6T_RT_INV_LEN)));
 89         pr_debug("res %02X %02X %02X ",
 90                  rtinfo->flags & IP6T_RT_RES,
 91                  ((const struct rt0_hdr *)rh)->reserved,
 92                  !((rtinfo->flags & IP6T_RT_RES) &&
 93                    (((const struct rt0_hdr *)rh)->reserved)));
 94 
 95         ret = (rh != NULL) &&
 96               (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
 97                               rh->segments_left,
 98                               !!(rtinfo->invflags & IP6T_RT_INV_SGS))) &&
 99               (!(rtinfo->flags & IP6T_RT_LEN) ||
100                ((rtinfo->hdrlen == hdrlen) ^
101                 !!(rtinfo->invflags & IP6T_RT_INV_LEN))) &&
102               (!(rtinfo->flags & IP6T_RT_TYP) ||
103                ((rtinfo->rt_type == rh->type) ^
104                 !!(rtinfo->invflags & IP6T_RT_INV_TYP)));
105 
106         if (ret && (rtinfo->flags & IP6T_RT_RES)) {
107                 const u_int32_t *rp;
108                 u_int32_t _reserved;
109                 rp = skb_header_pointer(skb,
110                                         ptr + offsetof(struct rt0_hdr,
111                                                        reserved),
112                                         sizeof(_reserved),
113                                         &_reserved);
114 
115                 ret = (*rp == 0);
116         }
117 
118         pr_debug("#%d ", rtinfo->addrnr);
119         if (!(rtinfo->flags & IP6T_RT_FST)) {
120                 return ret;
121         } else if (rtinfo->flags & IP6T_RT_FST_NSTRICT) {
122                 pr_debug("Not strict ");
123                 if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
124                         pr_debug("There isn't enough space\n");
125                         return false;
126                 } else {
127                         unsigned int i = 0;
128 
129                         pr_debug("#%d ", rtinfo->addrnr);
130                         for (temp = 0;
131                              temp < (unsigned int)((hdrlen - 8) / 16);
132                              temp++) {
133                                 ap = skb_header_pointer(skb,
134                                                         ptr
135                                                         + sizeof(struct rt0_hdr)
136                                                         + temp * sizeof(_addr),
137                                                         sizeof(_addr),
138                                                         &_addr);
139 
140                                 BUG_ON(ap == NULL);
141 
142                                 if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {
143                                         pr_debug("i=%d temp=%d;\n", i, temp);
144                                         i++;
145                                 }
146                                 if (i == rtinfo->addrnr)
147                                         break;
148                         }
149                         pr_debug("i=%d #%d\n", i, rtinfo->addrnr);
150                         if (i == rtinfo->addrnr)
151                                 return ret;
152                         else
153                                 return false;
154                 }
155         } else {
156                 pr_debug("Strict ");
157                 if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
158                         pr_debug("There isn't enough space\n");
159                         return false;
160                 } else {
161                         pr_debug("#%d ", rtinfo->addrnr);
162                         for (temp = 0; temp < rtinfo->addrnr; temp++) {
163                                 ap = skb_header_pointer(skb,
164                                                         ptr
165                                                         + sizeof(struct rt0_hdr)
166                                                         + temp * sizeof(_addr),
167                                                         sizeof(_addr),
168                                                         &_addr);
169                                 BUG_ON(ap == NULL);
170 
171                                 if (!ipv6_addr_equal(ap, &rtinfo->addrs[temp]))
172                                         break;
173                         }
174                         pr_debug("temp=%d #%d\n", temp, rtinfo->addrnr);
175                         if (temp == rtinfo->addrnr &&
176                             temp == (unsigned int)((hdrlen - 8) / 16))
177                                 return ret;
178                         else
179                                 return false;
180                 }
181         }
182 
183         return false;
184 }
185 
186 static int rt_mt6_check(const struct xt_mtchk_param *par)
187 {
188         const struct ip6t_rt *rtinfo = par->matchinfo;
189 
190         if (rtinfo->invflags & ~IP6T_RT_INV_MASK) {
191                 pr_debug("unknown flags %X\n", rtinfo->invflags);
192                 return -EINVAL;
193         }
194         if ((rtinfo->flags & (IP6T_RT_RES | IP6T_RT_FST_MASK)) &&
195             (!(rtinfo->flags & IP6T_RT_TYP) ||
196              (rtinfo->rt_type != 0) ||
197              (rtinfo->invflags & IP6T_RT_INV_TYP))) {
198                 pr_debug("`--rt-type 0' required before `--rt-0-*'");
199                 return -EINVAL;
200         }
201 
202         return 0;
203 }
204 
205 static struct xt_match rt_mt6_reg __read_mostly = {
206         .name           = "rt",
207         .family         = NFPROTO_IPV6,
208         .match          = rt_mt6,
209         .matchsize      = sizeof(struct ip6t_rt),
210         .checkentry     = rt_mt6_check,
211         .me             = THIS_MODULE,
212 };
213 
214 static int __init rt_mt6_init(void)
215 {
216         return xt_register_match(&rt_mt6_reg);
217 }
218 
219 static void __exit rt_mt6_exit(void)
220 {
221         xt_unregister_match(&rt_mt6_reg);
222 }
223 
224 module_init(rt_mt6_init);
225 module_exit(rt_mt6_exit);
226 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp