~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/xt_l2tp.c

Version: ~ [ linux-5.4-rc7 ] ~ [ linux-5.3.11 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.84 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.154 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.201 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.201 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.77 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* Kernel module to match L2TP header parameters. */
  2 
  3 /* (C) 2013      James Chapman <jchapman@katalix.com>
  4  *
  5  * This program is free software; you can redistribute it and/or modify
  6  * it under the terms of the GNU General Public License version 2 as
  7  * published by the Free Software Foundation.
  8  */
  9 
 10 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 11 #include <linux/module.h>
 12 #include <linux/skbuff.h>
 13 #include <linux/if_ether.h>
 14 #include <net/ip.h>
 15 #include <linux/ipv6.h>
 16 #include <net/ipv6.h>
 17 #include <net/udp.h>
 18 #include <linux/l2tp.h>
 19 
 20 #include <linux/netfilter_ipv4.h>
 21 #include <linux/netfilter_ipv6.h>
 22 #include <linux/netfilter_ipv4/ip_tables.h>
 23 #include <linux/netfilter_ipv6/ip6_tables.h>
 24 #include <linux/netfilter/x_tables.h>
 25 #include <linux/netfilter/xt_tcpudp.h>
 26 #include <linux/netfilter/xt_l2tp.h>
 27 
 28 /* L2TP header masks */
 29 #define L2TP_HDR_T_BIT  0x8000
 30 #define L2TP_HDR_L_BIT  0x4000
 31 #define L2TP_HDR_VER    0x000f
 32 
 33 MODULE_LICENSE("GPL");
 34 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
 35 MODULE_DESCRIPTION("Xtables: L2TP header match");
 36 MODULE_ALIAS("ipt_l2tp");
 37 MODULE_ALIAS("ip6t_l2tp");
 38 
 39 /* The L2TP fields that can be matched */
 40 struct l2tp_data {
 41         u32 tid;
 42         u32 sid;
 43         u8 type;
 44         u8 version;
 45 };
 46 
 47 union l2tp_val {
 48         __be16 val16[2];
 49         __be32 val32;
 50 };
 51 
 52 static bool l2tp_match(const struct xt_l2tp_info *info, struct l2tp_data *data)
 53 {
 54         if ((info->flags & XT_L2TP_TYPE) && (info->type != data->type))
 55                 return false;
 56 
 57         if ((info->flags & XT_L2TP_VERSION) && (info->version != data->version))
 58                 return false;
 59 
 60         /* Check tid only for L2TPv3 control or any L2TPv2 packets */
 61         if ((info->flags & XT_L2TP_TID) &&
 62             ((data->type == XT_L2TP_TYPE_CONTROL) || (data->version == 2)) &&
 63             (info->tid != data->tid))
 64                 return false;
 65 
 66         /* Check sid only for L2TP data packets */
 67         if ((info->flags & XT_L2TP_SID) && (data->type == XT_L2TP_TYPE_DATA) &&
 68             (info->sid != data->sid))
 69                 return false;
 70 
 71         return true;
 72 }
 73 
 74 /* Parse L2TP header fields when UDP encapsulation is used. Handles
 75  * L2TPv2 and L2TPv3. Note the L2TPv3 control and data packets have a
 76  * different format. See
 77  * RFC2661, Section 3.1, L2TPv2 Header Format
 78  * RFC3931, Section 3.2.1, L2TPv3 Control Message Header
 79  * RFC3931, Section 3.2.2, L2TPv3 Data Message Header
 80  * RFC3931, Section 4.1.2.1, L2TPv3 Session Header over UDP
 81  */
 82 static bool l2tp_udp_mt(const struct sk_buff *skb, struct xt_action_param *par, u16 thoff)
 83 {
 84         const struct xt_l2tp_info *info = par->matchinfo;
 85         int uhlen = sizeof(struct udphdr);
 86         int offs = thoff + uhlen;
 87         union l2tp_val *lh;
 88         union l2tp_val lhbuf;
 89         u16 flags;
 90         struct l2tp_data data = { 0, };
 91 
 92         if (par->fragoff != 0)
 93                 return false;
 94 
 95         /* Extract L2TP header fields. The flags in the first 16 bits
 96          * tell us where the other fields are.
 97          */
 98         lh = skb_header_pointer(skb, offs, 2, &lhbuf);
 99         if (lh == NULL)
100                 return false;
101 
102         flags = ntohs(lh->val16[0]);
103         if (flags & L2TP_HDR_T_BIT)
104                 data.type = XT_L2TP_TYPE_CONTROL;
105         else
106                 data.type = XT_L2TP_TYPE_DATA;
107         data.version = (u8) flags & L2TP_HDR_VER;
108 
109         /* Now extract the L2TP tid/sid. These are in different places
110          * for L2TPv2 (rfc2661) and L2TPv3 (rfc3931). For L2TPv2, we
111          * must also check to see if the length field is present,
112          * since this affects the offsets into the packet of the
113          * tid/sid fields.
114          */
115         if (data.version == 3) {
116                 lh = skb_header_pointer(skb, offs + 4, 4, &lhbuf);
117                 if (lh == NULL)
118                         return false;
119                 if (data.type == XT_L2TP_TYPE_CONTROL)
120                         data.tid = ntohl(lh->val32);
121                 else
122                         data.sid = ntohl(lh->val32);
123         } else if (data.version == 2) {
124                 if (flags & L2TP_HDR_L_BIT)
125                         offs += 2;
126                 lh = skb_header_pointer(skb, offs + 2, 4, &lhbuf);
127                 if (lh == NULL)
128                         return false;
129                 data.tid = (u32) ntohs(lh->val16[0]);
130                 data.sid = (u32) ntohs(lh->val16[1]);
131         } else
132                 return false;
133 
134         return l2tp_match(info, &data);
135 }
136 
137 /* Parse L2TP header fields for IP encapsulation (no UDP header).
138  * L2TPv3 data packets have a different form with IP encap. See
139  * RC3931, Section 4.1.1.1, L2TPv3 Session Header over IP.
140  * RC3931, Section 4.1.1.2, L2TPv3 Control and Data Traffic over IP.
141  */
142 static bool l2tp_ip_mt(const struct sk_buff *skb, struct xt_action_param *par, u16 thoff)
143 {
144         const struct xt_l2tp_info *info = par->matchinfo;
145         union l2tp_val *lh;
146         union l2tp_val lhbuf;
147         struct l2tp_data data = { 0, };
148 
149         /* For IP encap, the L2TP sid is the first 32-bits. */
150         lh = skb_header_pointer(skb, thoff, sizeof(lhbuf), &lhbuf);
151         if (lh == NULL)
152                 return false;
153         if (lh->val32 == 0) {
154                 /* Must be a control packet. The L2TP tid is further
155                  * into the packet.
156                  */
157                 data.type = XT_L2TP_TYPE_CONTROL;
158                 lh = skb_header_pointer(skb, thoff + 8, sizeof(lhbuf),
159                                         &lhbuf);
160                 if (lh == NULL)
161                         return false;
162                 data.tid = ntohl(lh->val32);
163         } else {
164                 data.sid = ntohl(lh->val32);
165                 data.type = XT_L2TP_TYPE_DATA;
166         }
167 
168         data.version = 3;
169 
170         return l2tp_match(info, &data);
171 }
172 
173 static bool l2tp_mt4(const struct sk_buff *skb, struct xt_action_param *par)
174 {
175         struct iphdr *iph = ip_hdr(skb);
176         u8 ipproto = iph->protocol;
177 
178         /* l2tp_mt_check4 already restricts the transport protocol */
179         switch (ipproto) {
180         case IPPROTO_UDP:
181                 return l2tp_udp_mt(skb, par, par->thoff);
182         case IPPROTO_L2TP:
183                 return l2tp_ip_mt(skb, par, par->thoff);
184         }
185 
186         return false;
187 }
188 
189 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
190 static bool l2tp_mt6(const struct sk_buff *skb, struct xt_action_param *par)
191 {
192         unsigned int thoff = 0;
193         unsigned short fragoff = 0;
194         int ipproto;
195 
196         ipproto = ipv6_find_hdr(skb, &thoff, -1, &fragoff, NULL);
197         if (fragoff != 0)
198                 return false;
199 
200         /* l2tp_mt_check6 already restricts the transport protocol */
201         switch (ipproto) {
202         case IPPROTO_UDP:
203                 return l2tp_udp_mt(skb, par, thoff);
204         case IPPROTO_L2TP:
205                 return l2tp_ip_mt(skb, par, thoff);
206         }
207 
208         return false;
209 }
210 #endif
211 
212 static int l2tp_mt_check(const struct xt_mtchk_param *par)
213 {
214         const struct xt_l2tp_info *info = par->matchinfo;
215 
216         /* Check for invalid flags */
217         if (info->flags & ~(XT_L2TP_TID | XT_L2TP_SID | XT_L2TP_VERSION |
218                             XT_L2TP_TYPE)) {
219                 pr_info("unknown flags: %x\n", info->flags);
220                 return -EINVAL;
221         }
222 
223         /* At least one of tid, sid or type=control must be specified */
224         if ((!(info->flags & XT_L2TP_TID)) &&
225             (!(info->flags & XT_L2TP_SID)) &&
226             ((!(info->flags & XT_L2TP_TYPE)) ||
227              (info->type != XT_L2TP_TYPE_CONTROL))) {
228                 pr_info("invalid flags combination: %x\n", info->flags);
229                 return -EINVAL;
230         }
231 
232         /* If version 2 is specified, check that incompatible params
233          * are not supplied
234          */
235         if (info->flags & XT_L2TP_VERSION) {
236                 if ((info->version < 2) || (info->version > 3)) {
237                         pr_info("wrong L2TP version: %u\n", info->version);
238                         return -EINVAL;
239                 }
240 
241                 if (info->version == 2) {
242                         if ((info->flags & XT_L2TP_TID) &&
243                             (info->tid > 0xffff)) {
244                                 pr_info("v2 tid > 0xffff: %u\n", info->tid);
245                                 return -EINVAL;
246                         }
247                         if ((info->flags & XT_L2TP_SID) &&
248                             (info->sid > 0xffff)) {
249                                 pr_info("v2 sid > 0xffff: %u\n", info->sid);
250                                 return -EINVAL;
251                         }
252                 }
253         }
254 
255         return 0;
256 }
257 
258 static int l2tp_mt_check4(const struct xt_mtchk_param *par)
259 {
260         const struct xt_l2tp_info *info = par->matchinfo;
261         const struct ipt_entry *e = par->entryinfo;
262         const struct ipt_ip *ip = &e->ip;
263         int ret;
264 
265         ret = l2tp_mt_check(par);
266         if (ret != 0)
267                 return ret;
268 
269         if ((ip->proto != IPPROTO_UDP) &&
270             (ip->proto != IPPROTO_L2TP)) {
271                 pr_info("missing protocol rule (udp|l2tpip)\n");
272                 return -EINVAL;
273         }
274 
275         if ((ip->proto == IPPROTO_L2TP) &&
276             (info->version == 2)) {
277                 pr_info("v2 doesn't support IP mode\n");
278                 return -EINVAL;
279         }
280 
281         return 0;
282 }
283 
284 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
285 static int l2tp_mt_check6(const struct xt_mtchk_param *par)
286 {
287         const struct xt_l2tp_info *info = par->matchinfo;
288         const struct ip6t_entry *e = par->entryinfo;
289         const struct ip6t_ip6 *ip = &e->ipv6;
290         int ret;
291 
292         ret = l2tp_mt_check(par);
293         if (ret != 0)
294                 return ret;
295 
296         if ((ip->proto != IPPROTO_UDP) &&
297             (ip->proto != IPPROTO_L2TP)) {
298                 pr_info("missing protocol rule (udp|l2tpip)\n");
299                 return -EINVAL;
300         }
301 
302         if ((ip->proto == IPPROTO_L2TP) &&
303             (info->version == 2)) {
304                 pr_info("v2 doesn't support IP mode\n");
305                 return -EINVAL;
306         }
307 
308         return 0;
309 }
310 #endif
311 
312 static struct xt_match l2tp_mt_reg[] __read_mostly = {
313         {
314                 .name      = "l2tp",
315                 .revision  = 0,
316                 .family    = NFPROTO_IPV4,
317                 .match     = l2tp_mt4,
318                 .matchsize = XT_ALIGN(sizeof(struct xt_l2tp_info)),
319                 .checkentry = l2tp_mt_check4,
320                 .hooks     = ((1 << NF_INET_PRE_ROUTING) |
321                               (1 << NF_INET_LOCAL_IN) |
322                               (1 << NF_INET_LOCAL_OUT) |
323                               (1 << NF_INET_FORWARD)),
324                 .me        = THIS_MODULE,
325         },
326 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
327         {
328                 .name      = "l2tp",
329                 .revision  = 0,
330                 .family    = NFPROTO_IPV6,
331                 .match     = l2tp_mt6,
332                 .matchsize = XT_ALIGN(sizeof(struct xt_l2tp_info)),
333                 .checkentry = l2tp_mt_check6,
334                 .hooks     = ((1 << NF_INET_PRE_ROUTING) |
335                               (1 << NF_INET_LOCAL_IN) |
336                               (1 << NF_INET_LOCAL_OUT) |
337                               (1 << NF_INET_FORWARD)),
338                 .me        = THIS_MODULE,
339         },
340 #endif
341 };
342 
343 static int __init l2tp_mt_init(void)
344 {
345         return xt_register_matches(&l2tp_mt_reg[0], ARRAY_SIZE(l2tp_mt_reg));
346 }
347 
348 static void __exit l2tp_mt_exit(void)
349 {
350         xt_unregister_matches(&l2tp_mt_reg[0], ARRAY_SIZE(l2tp_mt_reg));
351 }
352 
353 module_init(l2tp_mt_init);
354 module_exit(l2tp_mt_exit);
355 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp