[linux-2.6-block.git] / net / ipv6 / netfilter / ip6t_mh.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Copyright (C)2006 USAGI/WIDE Project
 *
 * Author:
 *	Masahide NAKAMURA @USAGI <masahide.nakamura.cz@hitachi.com>
 *
 * Based on net/netfilter/xt_tcpudp.c
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/types.h>
#include <linux/module.h>
#include <net/ip.h>
#include <linux/ipv6.h>
#include <net/ipv6.h>
#include <net/mip6.h>

#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_ipv6/ip6t_mh.h>

MODULE_DESCRIPTION("Xtables: IPv6 Mobility Header match");
MODULE_LICENSE("GPL");

/* Returns 1 if the type is matched by the range, 0 otherwise */
static inline bool
type_match(u_int8_t min, u_int8_t max, u_int8_t type, bool invert)
{
	return (type >= min && type <= max) ^ invert;
}

static bool mh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
{
	struct ip6_mh _mh;
	const struct ip6_mh *mh;
	const struct ip6t_mh *mhinfo = par->matchinfo;

	/* Must not be a fragment. */
	if (par->fragoff != 0)
		return false;

	mh = skb_header_pointer(skb, par->thoff, sizeof(_mh), &_mh);
	if (mh == NULL) {
		/* We've been asked to examine this packet, and we
		   can't.  Hence, no choice but to drop. */
		pr_debug("Dropping evil MH tinygram.\n");
		par->hotdrop = true;
		return false;
	}

	if (mh->ip6mh_proto != IPPROTO_NONE) {
		pr_debug("Dropping invalid MH Payload Proto: %u\n",
			 mh->ip6mh_proto);
		par->hotdrop = true;
		return false;
	}

	return type_match(mhinfo->types[0], mhinfo->types[1], mh->ip6mh_type,
			  !!(mhinfo->invflags & IP6T_MH_INV_TYPE));
}

static int mh_mt6_check(const struct xt_mtchk_param *par)
{
	const struct ip6t_mh *mhinfo = par->matchinfo;

	/* Must specify no unknown invflags */
	return (mhinfo->invflags & ~IP6T_MH_INV_MASK) ? -EINVAL : 0;
}

static struct xt_match mh_mt6_reg __read_mostly = {
	.name		= "mh",
	.family		= NFPROTO_IPV6,
	.checkentry	= mh_mt6_check,
	.match		= mh_mt6,
	.matchsize	= sizeof(struct ip6t_mh),
	.proto		= IPPROTO_MH,
	.me		= THIS_MODULE,
};

static int __init mh_mt6_init(void)
{
	return xt_register_match(&mh_mt6_reg);
}

static void __exit mh_mt6_exit(void)
{
	xt_unregister_match(&mh_mt6_reg);
}

module_init(mh_mt6_init);
module_exit(mh_mt6_exit);
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
a0ca215a MN	2	/*
	3	* Copyright (C)2006 USAGI/WIDE Project
	4	*
a0ca215a MN	5	* Author:
	6	* Masahide NAKAMURA @USAGI <masahide.nakamura.cz@hitachi.com>
	7	*
	8	* Based on net/netfilter/xt_tcpudp.c
a0ca215a	9	*/
be91fd5e	10	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
a0ca215a MN	11	#include <linux/types.h>
	12	#include <linux/module.h>
	13	#include <net/ip.h>
	14	#include <linux/ipv6.h>
	15	#include <net/ipv6.h>
	16	#include <net/mip6.h>
	17
	18	#include <linux/netfilter/x_tables.h>
	19	#include <linux/netfilter_ipv6/ip6t_mh.h>
	20
2ae15b64	21	MODULE_DESCRIPTION("Xtables: IPv6 Mobility Header match");
a0ca215a MN	22	MODULE_LICENSE("GPL");
a0ca215a MN	23
a0ca215a	24	/* Returns 1 if the type is matched by the range, 0 otherwise */
1d93a9cb JE	25	static inline bool
1d93a9cb JE	26	type_match(u_int8_t min, u_int8_t max, u_int8_t type, bool invert)
a0ca215a	27	{
1d93a9cb	28	return (type >= min && type <= max) ^ invert;
a0ca215a MN	29	}
a0ca215a MN	30
62fc8051	31	static bool mh_mt6(const struct sk_buff skb, struct xt_action_param par)
a0ca215a	32	{
a47362a2 JE	33	struct ip6_mh _mh;
a47362a2 JE	34	const struct ip6_mh *mh;
f7108a20	35	const struct ip6t_mh *mhinfo = par->matchinfo;
a0ca215a MN	36
a0ca215a MN	37	/* Must not be a fragment. */
f7108a20	38	if (par->fragoff != 0)
1d93a9cb	39	return false;
a0ca215a	40
f7108a20	41	mh = skb_header_pointer(skb, par->thoff, sizeof(_mh), &_mh);
a0ca215a MN	42	if (mh == NULL) {
	43	/* We've been asked to examine this packet, and we
	44	can't. Hence, no choice but to drop. */
be91fd5e	45	pr_debug("Dropping evil MH tinygram.\n");
b4ba2611	46	par->hotdrop = true;
1d93a9cb	47	return false;
a0ca215a MN	48	}
a0ca215a MN	49
138939e0	50	if (mh->ip6mh_proto != IPPROTO_NONE) {
be91fd5e	51	pr_debug("Dropping invalid MH Payload Proto: %u\n",
138939e0	52	mh->ip6mh_proto);
b4ba2611	53	par->hotdrop = true;
1d93a9cb	54	return false;
138939e0 MN	55	}
138939e0 MN	56
a0ca215a MN	57	return type_match(mhinfo->types[0], mhinfo->types[1], mh->ip6mh_type,
	58	!!(mhinfo->invflags & IP6T_MH_INV_TYPE));
	59	}
	60
b0f38452	61	static int mh_mt6_check(const struct xt_mtchk_param *par)
a0ca215a	62	{
9b4fce7a	63	const struct ip6t_mh *mhinfo = par->matchinfo;
a0ca215a MN	64
a0ca215a MN	65	/* Must specify no unknown invflags */
bd414ee6	66	return (mhinfo->invflags & ~IP6T_MH_INV_MASK) ? -EINVAL : 0;
a0ca215a MN	67	}
a0ca215a MN	68
d3c5ee6d	69	static struct xt_match mh_mt6_reg __read_mostly = {
a0ca215a	70	.name = "mh",
ee999d8b	71	.family = NFPROTO_IPV6,
d3c5ee6d JE	72	.checkentry = mh_mt6_check,
d3c5ee6d JE	73	.match = mh_mt6,
a0ca215a MN	74	.matchsize = sizeof(struct ip6t_mh),
	75	.proto = IPPROTO_MH,
	76	.me = THIS_MODULE,
	77	};
	78
d3c5ee6d	79	static int __init mh_mt6_init(void)
a0ca215a	80	{
d3c5ee6d	81	return xt_register_match(&mh_mt6_reg);
a0ca215a MN	82	}
a0ca215a MN	83
d3c5ee6d	84	static void __exit mh_mt6_exit(void)
a0ca215a	85	{
d3c5ee6d	86	xt_unregister_match(&mh_mt6_reg);
a0ca215a MN	87	}
a0ca215a MN	88
d3c5ee6d JE	89	module_init(mh_mt6_init);
d3c5ee6d JE	90	module_exit(mh_mt6_exit);