netfilter: x_tables: use NFPROTO_* in extensions
[linux-2.6.git] / net / ipv6 / netfilter / ip6t_rt.c
1 /* Kernel module to match ROUTING parameters. */
2
3 /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License version 2 as
7  * published by the Free Software Foundation.
8  */
9
10 #include <linux/module.h>
11 #include <linux/skbuff.h>
12 #include <linux/ipv6.h>
13 #include <linux/types.h>
14 #include <net/checksum.h>
15 #include <net/ipv6.h>
16
17 #include <asm/byteorder.h>
18
19 #include <linux/netfilter/x_tables.h>
20 #include <linux/netfilter_ipv6/ip6_tables.h>
21 #include <linux/netfilter_ipv6/ip6t_rt.h>
22
23 MODULE_LICENSE("GPL");
24 MODULE_DESCRIPTION("Xtables: IPv6 Routing Header match");
25 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
26
27 /* Returns 1 if the id is matched by the range, 0 otherwise */
28 static inline bool
29 segsleft_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert)
30 {
31         bool r;
32         pr_debug("rt segsleft_match:%c 0x%x <= 0x%x <= 0x%x",
33                  invert ? '!' : ' ', min, id, max);
34         r = (id >= min && id <= max) ^ invert;
35         pr_debug(" result %s\n", r ? "PASS" : "FAILED");
36         return r;
37 }
38
39 static bool
40 rt_mt6(const struct sk_buff *skb, const struct net_device *in,
41        const struct net_device *out, const struct xt_match *match,
42        const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
43 {
44         struct ipv6_rt_hdr _route;
45         const struct ipv6_rt_hdr *rh;
46         const struct ip6t_rt *rtinfo = matchinfo;
47         unsigned int temp;
48         unsigned int ptr;
49         unsigned int hdrlen = 0;
50         bool ret = false;
51         struct in6_addr _addr;
52         const struct in6_addr *ap;
53         int err;
54
55         err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL);
56         if (err < 0) {
57                 if (err != -ENOENT)
58                         *hotdrop = true;
59                 return false;
60         }
61
62         rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
63         if (rh == NULL) {
64                 *hotdrop = true;
65                 return false;
66         }
67
68         hdrlen = ipv6_optlen(rh);
69         if (skb->len - ptr < hdrlen) {
70                 /* Pcket smaller than its length field */
71                 return false;
72         }
73
74         pr_debug("IPv6 RT LEN %u %u ", hdrlen, rh->hdrlen);
75         pr_debug("TYPE %04X ", rh->type);
76         pr_debug("SGS_LEFT %u %02X\n", rh->segments_left, rh->segments_left);
77
78         pr_debug("IPv6 RT segsleft %02X ",
79                  segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
80                                 rh->segments_left,
81                                 !!(rtinfo->invflags & IP6T_RT_INV_SGS)));
82         pr_debug("type %02X %02X %02X ",
83                  rtinfo->rt_type, rh->type,
84                  (!(rtinfo->flags & IP6T_RT_TYP) ||
85                   ((rtinfo->rt_type == rh->type) ^
86                    !!(rtinfo->invflags & IP6T_RT_INV_TYP))));
87         pr_debug("len %02X %04X %02X ",
88                  rtinfo->hdrlen, hdrlen,
89                  !(rtinfo->flags & IP6T_RT_LEN) ||
90                   ((rtinfo->hdrlen == hdrlen) ^
91                    !!(rtinfo->invflags & IP6T_RT_INV_LEN)));
92         pr_debug("res %02X %02X %02X ",
93                  rtinfo->flags & IP6T_RT_RES,
94                  ((const struct rt0_hdr *)rh)->reserved,
95                  !((rtinfo->flags & IP6T_RT_RES) &&
96                    (((const struct rt0_hdr *)rh)->reserved)));
97
98         ret = (rh != NULL)
99               &&
100               (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
101                               rh->segments_left,
102                               !!(rtinfo->invflags & IP6T_RT_INV_SGS)))
103               &&
104               (!(rtinfo->flags & IP6T_RT_LEN) ||
105                ((rtinfo->hdrlen == hdrlen) ^
106                 !!(rtinfo->invflags & IP6T_RT_INV_LEN)))
107               &&
108               (!(rtinfo->flags & IP6T_RT_TYP) ||
109                ((rtinfo->rt_type == rh->type) ^
110                 !!(rtinfo->invflags & IP6T_RT_INV_TYP)));
111
112         if (ret && (rtinfo->flags & IP6T_RT_RES)) {
113                 const u_int32_t *rp;
114                 u_int32_t _reserved;
115                 rp = skb_header_pointer(skb,
116                                         ptr + offsetof(struct rt0_hdr,
117                                                        reserved),
118                                         sizeof(_reserved),
119                                         &_reserved);
120
121                 ret = (*rp == 0);
122         }
123
124         pr_debug("#%d ", rtinfo->addrnr);
125         if (!(rtinfo->flags & IP6T_RT_FST)) {
126                 return ret;
127         } else if (rtinfo->flags & IP6T_RT_FST_NSTRICT) {
128                 pr_debug("Not strict ");
129                 if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
130                         pr_debug("There isn't enough space\n");
131                         return false;
132                 } else {
133                         unsigned int i = 0;
134
135                         pr_debug("#%d ", rtinfo->addrnr);
136                         for (temp = 0;
137                              temp < (unsigned int)((hdrlen - 8) / 16);
138                              temp++) {
139                                 ap = skb_header_pointer(skb,
140                                                         ptr
141                                                         + sizeof(struct rt0_hdr)
142                                                         + temp * sizeof(_addr),
143                                                         sizeof(_addr),
144                                                         &_addr);
145
146                                 BUG_ON(ap == NULL);
147
148                                 if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {
149                                         pr_debug("i=%d temp=%d;\n", i, temp);
150                                         i++;
151                                 }
152                                 if (i == rtinfo->addrnr)
153                                         break;
154                         }
155                         pr_debug("i=%d #%d\n", i, rtinfo->addrnr);
156                         if (i == rtinfo->addrnr)
157                                 return ret;
158                         else
159                                 return false;
160                 }
161         } else {
162                 pr_debug("Strict ");
163                 if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
164                         pr_debug("There isn't enough space\n");
165                         return false;
166                 } else {
167                         pr_debug("#%d ", rtinfo->addrnr);
168                         for (temp = 0; temp < rtinfo->addrnr; temp++) {
169                                 ap = skb_header_pointer(skb,
170                                                         ptr
171                                                         + sizeof(struct rt0_hdr)
172                                                         + temp * sizeof(_addr),
173                                                         sizeof(_addr),
174                                                         &_addr);
175                                 BUG_ON(ap == NULL);
176
177                                 if (!ipv6_addr_equal(ap, &rtinfo->addrs[temp]))
178                                         break;
179                         }
180                         pr_debug("temp=%d #%d\n", temp, rtinfo->addrnr);
181                         if (temp == rtinfo->addrnr &&
182                             temp == (unsigned int)((hdrlen - 8) / 16))
183                                 return ret;
184                         else
185                                 return false;
186                 }
187         }
188
189         return false;
190 }
191
192 /* Called when user tries to insert an entry of this type. */
193 static bool
194 rt_mt6_check(const char *tablename, const void *entry,
195              const struct xt_match *match, void *matchinfo,
196              unsigned int hook_mask)
197 {
198         const struct ip6t_rt *rtinfo = matchinfo;
199
200         if (rtinfo->invflags & ~IP6T_RT_INV_MASK) {
201                 pr_debug("ip6t_rt: unknown flags %X\n", rtinfo->invflags);
202                 return false;
203         }
204         if ((rtinfo->flags & (IP6T_RT_RES | IP6T_RT_FST_MASK)) &&
205             (!(rtinfo->flags & IP6T_RT_TYP) ||
206              (rtinfo->rt_type != 0) ||
207              (rtinfo->invflags & IP6T_RT_INV_TYP))) {
208                 pr_debug("`--rt-type 0' required before `--rt-0-*'");
209                 return false;
210         }
211
212         return true;
213 }
214
215 static struct xt_match rt_mt6_reg __read_mostly = {
216         .name           = "rt",
217         .family         = NFPROTO_IPV6,
218         .match          = rt_mt6,
219         .matchsize      = sizeof(struct ip6t_rt),
220         .checkentry     = rt_mt6_check,
221         .me             = THIS_MODULE,
222 };
223
224 static int __init rt_mt6_init(void)
225 {
226         return xt_register_match(&rt_mt6_reg);
227 }
228
229 static void __exit rt_mt6_exit(void)
230 {
231         xt_unregister_match(&rt_mt6_reg);
232 }
233
234 module_init(rt_mt6_init);
235 module_exit(rt_mt6_exit);