1 /* 2 * INET An implementation of the TCP/IP protocol suite for the LINUX 3 * operating system. INET is implemented using the BSD Socket 4 * interface as the means of communication with the user level. 5 * 6 * The options processing module for ip.c 7 * 8 * Authors: A.N.Kuznetsov 9 * 10 */ 11 12 #define pr_fmt(fmt) "IPv4: " fmt 13 14 #include <linux/capability.h> 15 #include <linux/module.h> 16 #include <linux/slab.h> 17 #include <linux/types.h> 18 #include <linux/uaccess.h> 19 #include <asm/unaligned.h> 20 #include <linux/skbuff.h> 21 #include <linux/ip.h> 22 #include <linux/icmp.h> 23 #include <linux/netdevice.h> 24 #include <linux/rtnetlink.h> 25 #include <net/sock.h> 26 #include <net/ip.h> 27 #include <net/icmp.h> 28 #include <net/route.h> 29 #include <net/cipso_ipv4.h> 30 #include <net/ip_fib.h> 31 32 /* 33 * Write options to IP header, record destination address to 34 * source route option, address of outgoing interface 35 * (we should already know it, so that this function is allowed be 36 * called only after routing decision) and timestamp, 37 * if we originate this datagram. 38 * 39 * daddr is real destination address, next hop is recorded in IP header. 40 * saddr is address of outgoing interface. 41 */ 42 43 void ip_options_build(struct sk_buff *skb, struct ip_options *opt, 44 __be32 daddr, struct rtable *rt, int is_frag) 45 { 46 unsigned char *iph = skb_network_header(skb); 47 48 memcpy(&(IPCB(skb)->opt), opt, sizeof(struct ip_options)); 49 memcpy(iph+sizeof(struct iphdr), opt->__data, opt->optlen); 50 opt = &(IPCB(skb)->opt); 51 52 if (opt->srr) 53 memcpy(iph+opt->srr+iph[opt->srr+1]-4, &daddr, 4); 54 55 if (!is_frag) { 56 if (opt->rr_needaddr) 57 ip_rt_get_source(iph+opt->rr+iph[opt->rr+2]-5, skb, rt); 58 if (opt->ts_needaddr) 59 ip_rt_get_source(iph+opt->ts+iph[opt->ts+2]-9, skb, rt); 60 if (opt->ts_needtime) { 61 __be32 midtime; 62 63 midtime = inet_current_timestamp(); 64 memcpy(iph+opt->ts+iph[opt->ts+2]-5, &midtime, 4); 65 } 66 return; 67 } 68 if (opt->rr) { 69 memset(iph+opt->rr, IPOPT_NOP, iph[opt->rr+1]); 70 opt->rr = 0; 71 opt->rr_needaddr = 0; 72 } 73 if (opt->ts) { 74 memset(iph+opt->ts, IPOPT_NOP, iph[opt->ts+1]); 75 opt->ts = 0; 76 opt->ts_needaddr = opt->ts_needtime = 0; 77 } 78 } 79 80 /* 81 * Provided (sopt, skb) points to received options, 82 * build in dopt compiled option set appropriate for answering. 83 * i.e. invert SRR option, copy anothers, 84 * and grab room in RR/TS options. 85 * 86 * NOTE: dopt cannot point to skb. 87 */ 88 89 int __ip_options_echo(struct net *net, struct ip_options *dopt, 90 struct sk_buff *skb, const struct ip_options *sopt) 91 { 92 unsigned char *sptr, *dptr; 93 int soffset, doffset; 94 int optlen; 95 96 memset(dopt, 0, sizeof(struct ip_options)); 97 98 if (sopt->optlen == 0) 99 return 0; 100 101 sptr = skb_network_header(skb); 102 dptr = dopt->__data; 103 104 if (sopt->rr) { 105 optlen = sptr[sopt->rr+1]; 106 soffset = sptr[sopt->rr+2]; 107 dopt->rr = dopt->optlen + sizeof(struct iphdr); 108 memcpy(dptr, sptr+sopt->rr, optlen); 109 if (sopt->rr_needaddr && soffset <= optlen) { 110 if (soffset + 3 > optlen) 111 return -EINVAL; 112 dptr[2] = soffset + 4; 113 dopt->rr_needaddr = 1; 114 } 115 dptr += optlen; 116 dopt->optlen += optlen; 117 } 118 if (sopt->ts) { 119 optlen = sptr[sopt->ts+1]; 120 soffset = sptr[sopt->ts+2]; 121 dopt->ts = dopt->optlen + sizeof(struct iphdr); 122 memcpy(dptr, sptr+sopt->ts, optlen); 123 if (soffset <= optlen) { 124 if (sopt->ts_needaddr) { 125 if (soffset + 3 > optlen) 126 return -EINVAL; 127 dopt->ts_needaddr = 1; 128 soffset += 4; 129 } 130 if (sopt->ts_needtime) { 131 if (soffset + 3 > optlen) 132 return -EINVAL; 133 if ((dptr[3]&0xF) != IPOPT_TS_PRESPEC) { 134 dopt->ts_needtime = 1; 135 soffset += 4; 136 } else { 137 dopt->ts_needtime = 0; 138 139 if (soffset + 7 <= optlen) { 140 __be32 addr; 141 142 memcpy(&addr, dptr+soffset-1, 4); 143 if (inet_addr_type(net, addr) != RTN_UNICAST) { 144 dopt->ts_needtime = 1; 145 soffset += 8; 146 } 147 } 148 } 149 } 150 dptr[2] = soffset; 151 } 152 dptr += optlen; 153 dopt->optlen += optlen; 154 } 155 if (sopt->srr) { 156 unsigned char *start = sptr+sopt->srr; 157 __be32 faddr; 158 159 optlen = start[1]; 160 soffset = start[2]; 161 doffset = 0; 162 if (soffset > optlen) 163 soffset = optlen + 1; 164 soffset -= 4; 165 if (soffset > 3) { 166 memcpy(&faddr, &start[soffset-1], 4); 167 for (soffset -= 4, doffset = 4; soffset > 3; soffset -= 4, doffset += 4) 168 memcpy(&dptr[doffset-1], &start[soffset-1], 4); 169 /* 170 * RFC1812 requires to fix illegal source routes. 171 */ 172 if (memcmp(&ip_hdr(skb)->saddr, 173 &start[soffset + 3], 4) == 0) 174 doffset -= 4; 175 } 176 if (doffset > 3) { 177 dopt->faddr = faddr; 178 dptr[0] = start[0]; 179 dptr[1] = doffset+3; 180 dptr[2] = 4; 181 dptr += doffset+3; 182 dopt->srr = dopt->optlen + sizeof(struct iphdr); 183 dopt->optlen += doffset+3; 184 dopt->is_strictroute = sopt->is_strictroute; 185 } 186 } 187 if (sopt->cipso) { 188 optlen = sptr[sopt->cipso+1]; 189 dopt->cipso = dopt->optlen+sizeof(struct iphdr); 190 memcpy(dptr, sptr+sopt->cipso, optlen); 191 dptr += optlen; 192 dopt->optlen += optlen; 193 } 194 while (dopt->optlen & 3) { 195 *dptr++ = IPOPT_END; 196 dopt->optlen++; 197 } 198 return 0; 199 } 200 201 /* 202 * Options "fragmenting", just fill options not 203 * allowed in fragments with NOOPs. 204 * Simple and stupid 8), but the most efficient way. 205 */ 206 207 void ip_options_fragment(struct sk_buff *skb) 208 { 209 unsigned char *optptr = skb_network_header(skb) + sizeof(struct iphdr); 210 struct ip_options *opt = &(IPCB(skb)->opt); 211 int l = opt->optlen; 212 int optlen; 213 214 while (l > 0) { 215 switch (*optptr) { 216 case IPOPT_END: 217 return; 218 case IPOPT_NOOP: 219 l--; 220 optptr++; 221 continue; 222 } 223 optlen = optptr[1]; 224 if (optlen < 2 || optlen > l) 225 return; 226 if (!IPOPT_COPIED(*optptr)) 227 memset(optptr, IPOPT_NOOP, optlen); 228 l -= optlen; 229 optptr += optlen; 230 } 231 opt->ts = 0; 232 opt->rr = 0; 233 opt->rr_needaddr = 0; 234 opt->ts_needaddr = 0; 235 opt->ts_needtime = 0; 236 } 237 238 /* helper used by ip_options_compile() to call fib_compute_spec_dst() 239 * at most one time. 240 */ 241 static void spec_dst_fill(__be32 *spec_dst, struct sk_buff *skb) 242 { 243 if (*spec_dst == htonl(INADDR_ANY)) 244 *spec_dst = fib_compute_spec_dst(skb); 245 } 246 247 /* 248 * Verify options and fill pointers in struct options. 249 * Caller should clear *opt, and set opt->data. 250 * If opt == NULL, then skb->data should point to IP header. 251 */ 252 253 int ip_options_compile(struct net *net, 254 struct ip_options *opt, struct sk_buff *skb) 255 { 256 __be32 spec_dst = htonl(INADDR_ANY); 257 unsigned char *pp_ptr = NULL; 258 struct rtable *rt = NULL; 259 unsigned char *optptr; 260 unsigned char *iph; 261 int optlen, l; 262 263 if (skb) { 264 rt = skb_rtable(skb); 265 optptr = (unsigned char *)&(ip_hdr(skb)[1]); 266 } else 267 optptr = opt->__data; 268 iph = optptr - sizeof(struct iphdr); 269 270 for (l = opt->optlen; l > 0; ) { 271 switch (*optptr) { 272 case IPOPT_END: 273 for (optptr++, l--; l > 0; optptr++, l--) { 274 if (*optptr != IPOPT_END) { 275 *optptr = IPOPT_END; 276 opt->is_changed = 1; 277 } 278 } 279 goto eol; 280 case IPOPT_NOOP: 281 l--; 282 optptr++; 283 continue; 284 } 285 if (unlikely(l < 2)) { 286 pp_ptr = optptr; 287 goto error; 288 } 289 optlen = optptr[1]; 290 if (optlen < 2 || optlen > l) { 291 pp_ptr = optptr; 292 goto error; 293 } 294 switch (*optptr) { 295 case IPOPT_SSRR: 296 case IPOPT_LSRR: 297 if (optlen < 3) { 298 pp_ptr = optptr + 1; 299 goto error; 300 } 301 if (optptr[2] < 4) { 302 pp_ptr = optptr + 2; 303 goto error; 304 } 305 /* NB: cf RFC-1812 5.2.4.1 */ 306 if (opt->srr) { 307 pp_ptr = optptr; 308 goto error; 309 } 310 if (!skb) { 311 if (optptr[2] != 4 || optlen < 7 || ((optlen-3) & 3)) { 312 pp_ptr = optptr + 1; 313 goto error; 314 } 315 memcpy(&opt->faddr, &optptr[3], 4); 316 if (optlen > 7) 317 memmove(&optptr[3], &optptr[7], optlen-7); 318 } 319 opt->is_strictroute = (optptr[0] == IPOPT_SSRR); 320 opt->srr = optptr - iph; 321 break; 322 case IPOPT_RR: 323 if (opt->rr) { 324 pp_ptr = optptr; 325 goto error; 326 } 327 if (optlen < 3) { 328 pp_ptr = optptr + 1; 329 goto error; 330 } 331 if (optptr[2] < 4) { 332 pp_ptr = optptr + 2; 333 goto error; 334 } 335 if (optptr[2] <= optlen) { 336 if (optptr[2]+3 > optlen) { 337 pp_ptr = optptr + 2; 338 goto error; 339 } 340 if (rt) { 341 spec_dst_fill(&spec_dst, skb); 342 memcpy(&optptr[optptr[2]-1], &spec_dst, 4); 343 opt->is_changed = 1; 344 } 345 optptr[2] += 4; 346 opt->rr_needaddr = 1; 347 } 348 opt->rr = optptr - iph; 349 break; 350 case IPOPT_TIMESTAMP: 351 if (opt->ts) { 352 pp_ptr = optptr; 353 goto error; 354 } 355 if (optlen < 4) { 356 pp_ptr = optptr + 1; 357 goto error; 358 } 359 if (optptr[2] < 5) { 360 pp_ptr = optptr + 2; 361 goto error; 362 } 363 if (optptr[2] <= optlen) { 364 unsigned char *timeptr = NULL; 365 if (optptr[2]+3 > optlen) { 366 pp_ptr = optptr + 2; 367 goto error; 368 } 369 switch (optptr[3]&0xF) { 370 case IPOPT_TS_TSONLY: 371 if (skb) 372 timeptr = &optptr[optptr[2]-1]; 373 opt->ts_needtime = 1; 374 optptr[2] += 4; 375 break; 376 case IPOPT_TS_TSANDADDR: 377 if (optptr[2]+7 > optlen) { 378 pp_ptr = optptr + 2; 379 goto error; 380 } 381 if (rt) { 382 spec_dst_fill(&spec_dst, skb); 383 memcpy(&optptr[optptr[2]-1], &spec_dst, 4); 384 timeptr = &optptr[optptr[2]+3]; 385 } 386 opt->ts_needaddr = 1; 387 opt->ts_needtime = 1; 388 optptr[2] += 8; 389 break; 390 case IPOPT_TS_PRESPEC: 391 if (optptr[2]+7 > optlen) { 392 pp_ptr = optptr + 2; 393 goto error; 394 } 395 { 396 __be32 addr; 397 memcpy(&addr, &optptr[optptr[2]-1], 4); 398 if (inet_addr_type(net, addr) == RTN_UNICAST) 399 break; 400 if (skb) 401 timeptr = &optptr[optptr[2]+3]; 402 } 403 opt->ts_needtime = 1; 404 optptr[2] += 8; 405 break; 406 default: 407 if (!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) { 408 pp_ptr = optptr + 3; 409 goto error; 410 } 411 break; 412 } 413 if (timeptr) { 414 __be32 midtime; 415 416 midtime = inet_current_timestamp(); 417 memcpy(timeptr, &midtime, 4); 418 opt->is_changed = 1; 419 } 420 } else if ((optptr[3]&0xF) != IPOPT_TS_PRESPEC) { 421 unsigned int overflow = optptr[3]>>4; 422 if (overflow == 15) { 423 pp_ptr = optptr + 3; 424 goto error; 425 } 426 if (skb) { 427 optptr[3] = (optptr[3]&0xF)|((overflow+1)<<4); 428 opt->is_changed = 1; 429 } 430 } 431 opt->ts = optptr - iph; 432 break; 433 case IPOPT_RA: 434 if (optlen < 4) { 435 pp_ptr = optptr + 1; 436 goto error; 437 } 438 if (optptr[2] == 0 && optptr[3] == 0) 439 opt->router_alert = optptr - iph; 440 break; 441 case IPOPT_CIPSO: 442 if ((!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) || opt->cipso) { 443 pp_ptr = optptr; 444 goto error; 445 } 446 opt->cipso = optptr - iph; 447 if (cipso_v4_validate(skb, &optptr)) { 448 pp_ptr = optptr; 449 goto error; 450 } 451 break; 452 case IPOPT_SEC: 453 case IPOPT_SID: 454 default: 455 if (!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) { 456 pp_ptr = optptr; 457 goto error; 458 } 459 break; 460 } 461 l -= optlen; 462 optptr += optlen; 463 } 464 465 eol: 466 if (!pp_ptr) 467 return 0; 468 469 error: 470 if (skb) { 471 icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((pp_ptr-iph)<<24)); 472 } 473 return -EINVAL; 474 } 475 EXPORT_SYMBOL(ip_options_compile); 476 477 /* 478 * Undo all the changes done by ip_options_compile(). 479 */ 480 481 void ip_options_undo(struct ip_options *opt) 482 { 483 if (opt->srr) { 484 unsigned char *optptr = opt->__data+opt->srr-sizeof(struct iphdr); 485 memmove(optptr+7, optptr+3, optptr[1]-7); 486 memcpy(optptr+3, &opt->faddr, 4); 487 } 488 if (opt->rr_needaddr) { 489 unsigned char *optptr = opt->__data+opt->rr-sizeof(struct iphdr); 490 optptr[2] -= 4; 491 memset(&optptr[optptr[2]-1], 0, 4); 492 } 493 if (opt->ts) { 494 unsigned char *optptr = opt->__data+opt->ts-sizeof(struct iphdr); 495 if (opt->ts_needtime) { 496 optptr[2] -= 4; 497 memset(&optptr[optptr[2]-1], 0, 4); 498 if ((optptr[3]&0xF) == IPOPT_TS_PRESPEC) 499 optptr[2] -= 4; 500 } 501 if (opt->ts_needaddr) { 502 optptr[2] -= 4; 503 memset(&optptr[optptr[2]-1], 0, 4); 504 } 505 } 506 } 507 508 static struct ip_options_rcu *ip_options_get_alloc(const int optlen) 509 { 510 return kzalloc(sizeof(struct ip_options_rcu) + ((optlen + 3) & ~3), 511 GFP_KERNEL); 512 } 513 514 static int ip_options_get_finish(struct net *net, struct ip_options_rcu **optp, 515 struct ip_options_rcu *opt, int optlen) 516 { 517 while (optlen & 3) 518 opt->opt.__data[optlen++] = IPOPT_END; 519 opt->opt.optlen = optlen; 520 if (optlen && ip_options_compile(net, &opt->opt, NULL)) { 521 kfree(opt); 522 return -EINVAL; 523 } 524 kfree(*optp); 525 *optp = opt; 526 return 0; 527 } 528 529 int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp, 530 unsigned char __user *data, int optlen) 531 { 532 struct ip_options_rcu *opt = ip_options_get_alloc(optlen); 533 534 if (!opt) 535 return -ENOMEM; 536 if (optlen && copy_from_user(opt->opt.__data, data, optlen)) { 537 kfree(opt); 538 return -EFAULT; 539 } 540 return ip_options_get_finish(net, optp, opt, optlen); 541 } 542 543 int ip_options_get(struct net *net, struct ip_options_rcu **optp, 544 unsigned char *data, int optlen) 545 { 546 struct ip_options_rcu *opt = ip_options_get_alloc(optlen); 547 548 if (!opt) 549 return -ENOMEM; 550 if (optlen) 551 memcpy(opt->opt.__data, data, optlen); 552 return ip_options_get_finish(net, optp, opt, optlen); 553 } 554 555 void ip_forward_options(struct sk_buff *skb) 556 { 557 struct ip_options *opt = &(IPCB(skb)->opt); 558 unsigned char *optptr; 559 struct rtable *rt = skb_rtable(skb); 560 unsigned char *raw = skb_network_header(skb); 561 562 if (opt->rr_needaddr) { 563 optptr = (unsigned char *)raw + opt->rr; 564 ip_rt_get_source(&optptr[optptr[2]-5], skb, rt); 565 opt->is_changed = 1; 566 } 567 if (opt->srr_is_hit) { 568 int srrptr, srrspace; 569 570 optptr = raw + opt->srr; 571 572 for ( srrptr = optptr[2], srrspace = optptr[1]; 573 srrptr <= srrspace; 574 srrptr += 4 575 ) { 576 if (srrptr + 3 > srrspace) 577 break; 578 if (memcmp(&opt->nexthop, &optptr[srrptr-1], 4) == 0) 579 break; 580 } 581 if (srrptr + 3 <= srrspace) { 582 opt->is_changed = 1; 583 ip_hdr(skb)->daddr = opt->nexthop; 584 ip_rt_get_source(&optptr[srrptr-1], skb, rt); 585 optptr[2] = srrptr+4; 586 } else { 587 net_crit_ratelimited("%s(): Argh! Destination lost!\n", 588 __func__); 589 } 590 if (opt->ts_needaddr) { 591 optptr = raw + opt->ts; 592 ip_rt_get_source(&optptr[optptr[2]-9], skb, rt); 593 opt->is_changed = 1; 594 } 595 } 596 if (opt->is_changed) { 597 opt->is_changed = 0; 598 ip_send_check(ip_hdr(skb)); 599 } 600 } 601 602 int ip_options_rcv_srr(struct sk_buff *skb) 603 { 604 struct ip_options *opt = &(IPCB(skb)->opt); 605 int srrspace, srrptr; 606 __be32 nexthop; 607 struct iphdr *iph = ip_hdr(skb); 608 unsigned char *optptr = skb_network_header(skb) + opt->srr; 609 struct rtable *rt = skb_rtable(skb); 610 struct rtable *rt2; 611 unsigned long orefdst; 612 int err; 613 614 if (!rt) 615 return 0; 616 617 if (skb->pkt_type != PACKET_HOST) 618 return -EINVAL; 619 if (rt->rt_type == RTN_UNICAST) { 620 if (!opt->is_strictroute) 621 return 0; 622 icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl(16<<24)); 623 return -EINVAL; 624 } 625 if (rt->rt_type != RTN_LOCAL) 626 return -EINVAL; 627 628 for (srrptr = optptr[2], srrspace = optptr[1]; srrptr <= srrspace; srrptr += 4) { 629 if (srrptr + 3 > srrspace) { 630 icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((opt->srr+2)<<24)); 631 return -EINVAL; 632 } 633 memcpy(&nexthop, &optptr[srrptr-1], 4); 634 635 orefdst = skb->_skb_refdst; 636 skb_dst_set(skb, NULL); 637 err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, skb->dev); 638 rt2 = skb_rtable(skb); 639 if (err || (rt2->rt_type != RTN_UNICAST && rt2->rt_type != RTN_LOCAL)) { 640 skb_dst_drop(skb); 641 skb->_skb_refdst = orefdst; 642 return -EINVAL; 643 } 644 refdst_drop(orefdst); 645 if (rt2->rt_type != RTN_LOCAL) 646 break; 647 /* Superfast 8) loopback forward */ 648 iph->daddr = nexthop; 649 opt->is_changed = 1; 650 } 651 if (srrptr <= srrspace) { 652 opt->srr_is_hit = 1; 653 opt->nexthop = nexthop; 654 opt->is_changed = 1; 655 } 656 return 0; 657 } 658 EXPORT_SYMBOL(ip_options_rcv_srr); 659