1 /* 2 * INET An implementation of the TCP/IP protocol suite for the LINUX 3 * operating system. INET is implemented using the BSD Socket 4 * interface as the means of communication with the user level. 5 * 6 * The options processing module for ip.c 7 * 8 * Authors: A.N.Kuznetsov 9 * 10 */ 11 12 #include <linux/capability.h> 13 #include <linux/module.h> 14 #include <linux/types.h> 15 #include <asm/uaccess.h> 16 #include <linux/skbuff.h> 17 #include <linux/ip.h> 18 #include <linux/icmp.h> 19 #include <linux/netdevice.h> 20 #include <linux/rtnetlink.h> 21 #include <net/sock.h> 22 #include <net/ip.h> 23 #include <net/icmp.h> 24 #include <net/route.h> 25 #include <net/cipso_ipv4.h> 26 27 /* 28 * Write options to IP header, record destination address to 29 * source route option, address of outgoing interface 30 * (we should already know it, so that this function is allowed be 31 * called only after routing decision) and timestamp, 32 * if we originate this datagram. 33 * 34 * daddr is real destination address, next hop is recorded in IP header. 35 * saddr is address of outgoing interface. 36 */ 37 38 void ip_options_build(struct sk_buff * skb, struct ip_options * opt, 39 __be32 daddr, struct rtable *rt, int is_frag) 40 { 41 unsigned char *iph = skb_network_header(skb); 42 43 memcpy(&(IPCB(skb)->opt), opt, sizeof(struct ip_options)); 44 memcpy(iph+sizeof(struct iphdr), opt->__data, opt->optlen); 45 opt = &(IPCB(skb)->opt); 46 47 if (opt->srr) 48 memcpy(iph+opt->srr+iph[opt->srr+1]-4, &daddr, 4); 49 50 if (!is_frag) { 51 if (opt->rr_needaddr) 52 ip_rt_get_source(iph+opt->rr+iph[opt->rr+2]-5, rt); 53 if (opt->ts_needaddr) 54 ip_rt_get_source(iph+opt->ts+iph[opt->ts+2]-9, rt); 55 if (opt->ts_needtime) { 56 struct timespec tv; 57 __be32 midtime; 58 getnstimeofday(&tv); 59 midtime = htonl((tv.tv_sec % 86400) * MSEC_PER_SEC + tv.tv_nsec / NSEC_PER_MSEC); 60 memcpy(iph+opt->ts+iph[opt->ts+2]-5, &midtime, 4); 61 } 62 return; 63 } 64 if (opt->rr) { 65 memset(iph+opt->rr, IPOPT_NOP, iph[opt->rr+1]); 66 opt->rr = 0; 67 opt->rr_needaddr = 0; 68 } 69 if (opt->ts) { 70 memset(iph+opt->ts, IPOPT_NOP, iph[opt->ts+1]); 71 opt->ts = 0; 72 opt->ts_needaddr = opt->ts_needtime = 0; 73 } 74 } 75 76 /* 77 * Provided (sopt, skb) points to received options, 78 * build in dopt compiled option set appropriate for answering. 79 * i.e. invert SRR option, copy anothers, 80 * and grab room in RR/TS options. 81 * 82 * NOTE: dopt cannot point to skb. 83 */ 84 85 int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb) 86 { 87 struct ip_options *sopt; 88 unsigned char *sptr, *dptr; 89 int soffset, doffset; 90 int optlen; 91 __be32 daddr; 92 93 memset(dopt, 0, sizeof(struct ip_options)); 94 95 sopt = &(IPCB(skb)->opt); 96 97 if (sopt->optlen == 0) { 98 dopt->optlen = 0; 99 return 0; 100 } 101 102 sptr = skb_network_header(skb); 103 dptr = dopt->__data; 104 105 daddr = skb_rtable(skb)->rt_spec_dst; 106 107 if (sopt->rr) { 108 optlen = sptr[sopt->rr+1]; 109 soffset = sptr[sopt->rr+2]; 110 dopt->rr = dopt->optlen + sizeof(struct iphdr); 111 memcpy(dptr, sptr+sopt->rr, optlen); 112 if (sopt->rr_needaddr && soffset <= optlen) { 113 if (soffset + 3 > optlen) 114 return -EINVAL; 115 dptr[2] = soffset + 4; 116 dopt->rr_needaddr = 1; 117 } 118 dptr += optlen; 119 dopt->optlen += optlen; 120 } 121 if (sopt->ts) { 122 optlen = sptr[sopt->ts+1]; 123 soffset = sptr[sopt->ts+2]; 124 dopt->ts = dopt->optlen + sizeof(struct iphdr); 125 memcpy(dptr, sptr+sopt->ts, optlen); 126 if (soffset <= optlen) { 127 if (sopt->ts_needaddr) { 128 if (soffset + 3 > optlen) 129 return -EINVAL; 130 dopt->ts_needaddr = 1; 131 soffset += 4; 132 } 133 if (sopt->ts_needtime) { 134 if (soffset + 3 > optlen) 135 return -EINVAL; 136 if ((dptr[3]&0xF) != IPOPT_TS_PRESPEC) { 137 dopt->ts_needtime = 1; 138 soffset += 4; 139 } else { 140 dopt->ts_needtime = 0; 141 142 if (soffset + 8 <= optlen) { 143 __be32 addr; 144 145 memcpy(&addr, sptr+soffset-1, 4); 146 if (inet_addr_type(dev_net(skb_dst(skb)->dev), addr) != RTN_LOCAL) { 147 dopt->ts_needtime = 1; 148 soffset += 8; 149 } 150 } 151 } 152 } 153 dptr[2] = soffset; 154 } 155 dptr += optlen; 156 dopt->optlen += optlen; 157 } 158 if (sopt->srr) { 159 unsigned char * start = sptr+sopt->srr; 160 __be32 faddr; 161 162 optlen = start[1]; 163 soffset = start[2]; 164 doffset = 0; 165 if (soffset > optlen) 166 soffset = optlen + 1; 167 soffset -= 4; 168 if (soffset > 3) { 169 memcpy(&faddr, &start[soffset-1], 4); 170 for (soffset-=4, doffset=4; soffset > 3; soffset-=4, doffset+=4) 171 memcpy(&dptr[doffset-1], &start[soffset-1], 4); 172 /* 173 * RFC1812 requires to fix illegal source routes. 174 */ 175 if (memcmp(&ip_hdr(skb)->saddr, 176 &start[soffset + 3], 4) == 0) 177 doffset -= 4; 178 } 179 if (doffset > 3) { 180 memcpy(&start[doffset-1], &daddr, 4); 181 dopt->faddr = faddr; 182 dptr[0] = start[0]; 183 dptr[1] = doffset+3; 184 dptr[2] = 4; 185 dptr += doffset+3; 186 dopt->srr = dopt->optlen + sizeof(struct iphdr); 187 dopt->optlen += doffset+3; 188 dopt->is_strictroute = sopt->is_strictroute; 189 } 190 } 191 if (sopt->cipso) { 192 optlen = sptr[sopt->cipso+1]; 193 dopt->cipso = dopt->optlen+sizeof(struct iphdr); 194 memcpy(dptr, sptr+sopt->cipso, optlen); 195 dptr += optlen; 196 dopt->optlen += optlen; 197 } 198 while (dopt->optlen & 3) { 199 *dptr++ = IPOPT_END; 200 dopt->optlen++; 201 } 202 return 0; 203 } 204 205 /* 206 * Options "fragmenting", just fill options not 207 * allowed in fragments with NOOPs. 208 * Simple and stupid 8), but the most efficient way. 209 */ 210 211 void ip_options_fragment(struct sk_buff * skb) 212 { 213 unsigned char *optptr = skb_network_header(skb) + sizeof(struct iphdr); 214 struct ip_options * opt = &(IPCB(skb)->opt); 215 int l = opt->optlen; 216 int optlen; 217 218 while (l > 0) { 219 switch (*optptr) { 220 case IPOPT_END: 221 return; 222 case IPOPT_NOOP: 223 l--; 224 optptr++; 225 continue; 226 } 227 optlen = optptr[1]; 228 if (optlen<2 || optlen>l) 229 return; 230 if (!IPOPT_COPIED(*optptr)) 231 memset(optptr, IPOPT_NOOP, optlen); 232 l -= optlen; 233 optptr += optlen; 234 } 235 opt->ts = 0; 236 opt->rr = 0; 237 opt->rr_needaddr = 0; 238 opt->ts_needaddr = 0; 239 opt->ts_needtime = 0; 240 return; 241 } 242 243 /* 244 * Verify options and fill pointers in struct options. 245 * Caller should clear *opt, and set opt->data. 246 * If opt == NULL, then skb->data should point to IP header. 247 */ 248 249 int ip_options_compile(struct net *net, 250 struct ip_options * opt, struct sk_buff * skb) 251 { 252 int l; 253 unsigned char * iph; 254 unsigned char * optptr; 255 int optlen; 256 unsigned char * pp_ptr = NULL; 257 struct rtable *rt = NULL; 258 259 if (skb != NULL) { 260 rt = skb_rtable(skb); 261 optptr = (unsigned char *)&(ip_hdr(skb)[1]); 262 } else 263 optptr = opt->__data; 264 iph = optptr - sizeof(struct iphdr); 265 266 for (l = opt->optlen; l > 0; ) { 267 switch (*optptr) { 268 case IPOPT_END: 269 for (optptr++, l--; l>0; optptr++, l--) { 270 if (*optptr != IPOPT_END) { 271 *optptr = IPOPT_END; 272 opt->is_changed = 1; 273 } 274 } 275 goto eol; 276 case IPOPT_NOOP: 277 l--; 278 optptr++; 279 continue; 280 } 281 optlen = optptr[1]; 282 if (optlen<2 || optlen>l) { 283 pp_ptr = optptr; 284 goto error; 285 } 286 switch (*optptr) { 287 case IPOPT_SSRR: 288 case IPOPT_LSRR: 289 if (optlen < 3) { 290 pp_ptr = optptr + 1; 291 goto error; 292 } 293 if (optptr[2] < 4) { 294 pp_ptr = optptr + 2; 295 goto error; 296 } 297 /* NB: cf RFC-1812 5.2.4.1 */ 298 if (opt->srr) { 299 pp_ptr = optptr; 300 goto error; 301 } 302 if (!skb) { 303 if (optptr[2] != 4 || optlen < 7 || ((optlen-3) & 3)) { 304 pp_ptr = optptr + 1; 305 goto error; 306 } 307 memcpy(&opt->faddr, &optptr[3], 4); 308 if (optlen > 7) 309 memmove(&optptr[3], &optptr[7], optlen-7); 310 } 311 opt->is_strictroute = (optptr[0] == IPOPT_SSRR); 312 opt->srr = optptr - iph; 313 break; 314 case IPOPT_RR: 315 if (opt->rr) { 316 pp_ptr = optptr; 317 goto error; 318 } 319 if (optlen < 3) { 320 pp_ptr = optptr + 1; 321 goto error; 322 } 323 if (optptr[2] < 4) { 324 pp_ptr = optptr + 2; 325 goto error; 326 } 327 if (optptr[2] <= optlen) { 328 if (optptr[2]+3 > optlen) { 329 pp_ptr = optptr + 2; 330 goto error; 331 } 332 if (skb) { 333 memcpy(&optptr[optptr[2]-1], &rt->rt_spec_dst, 4); 334 opt->is_changed = 1; 335 } 336 optptr[2] += 4; 337 opt->rr_needaddr = 1; 338 } 339 opt->rr = optptr - iph; 340 break; 341 case IPOPT_TIMESTAMP: 342 if (opt->ts) { 343 pp_ptr = optptr; 344 goto error; 345 } 346 if (optlen < 4) { 347 pp_ptr = optptr + 1; 348 goto error; 349 } 350 if (optptr[2] < 5) { 351 pp_ptr = optptr + 2; 352 goto error; 353 } 354 if (optptr[2] <= optlen) { 355 __be32 *timeptr = NULL; 356 if (optptr[2]+3 > optptr[1]) { 357 pp_ptr = optptr + 2; 358 goto error; 359 } 360 switch (optptr[3]&0xF) { 361 case IPOPT_TS_TSONLY: 362 opt->ts = optptr - iph; 363 if (skb) 364 timeptr = (__be32*)&optptr[optptr[2]-1]; 365 opt->ts_needtime = 1; 366 optptr[2] += 4; 367 break; 368 case IPOPT_TS_TSANDADDR: 369 if (optptr[2]+7 > optptr[1]) { 370 pp_ptr = optptr + 2; 371 goto error; 372 } 373 opt->ts = optptr - iph; 374 if (skb) { 375 memcpy(&optptr[optptr[2]-1], &rt->rt_spec_dst, 4); 376 timeptr = (__be32*)&optptr[optptr[2]+3]; 377 } 378 opt->ts_needaddr = 1; 379 opt->ts_needtime = 1; 380 optptr[2] += 8; 381 break; 382 case IPOPT_TS_PRESPEC: 383 if (optptr[2]+7 > optptr[1]) { 384 pp_ptr = optptr + 2; 385 goto error; 386 } 387 opt->ts = optptr - iph; 388 { 389 __be32 addr; 390 memcpy(&addr, &optptr[optptr[2]-1], 4); 391 if (inet_addr_type(net, addr) == RTN_UNICAST) 392 break; 393 if (skb) 394 timeptr = (__be32*)&optptr[optptr[2]+3]; 395 } 396 opt->ts_needtime = 1; 397 optptr[2] += 8; 398 break; 399 default: 400 if (!skb && !capable(CAP_NET_RAW)) { 401 pp_ptr = optptr + 3; 402 goto error; 403 } 404 break; 405 } 406 if (timeptr) { 407 struct timespec tv; 408 __be32 midtime; 409 getnstimeofday(&tv); 410 midtime = htonl((tv.tv_sec % 86400) * MSEC_PER_SEC + tv.tv_nsec / NSEC_PER_MSEC); 411 memcpy(timeptr, &midtime, sizeof(__be32)); 412 opt->is_changed = 1; 413 } 414 } else { 415 unsigned overflow = optptr[3]>>4; 416 if (overflow == 15) { 417 pp_ptr = optptr + 3; 418 goto error; 419 } 420 opt->ts = optptr - iph; 421 if (skb) { 422 optptr[3] = (optptr[3]&0xF)|((overflow+1)<<4); 423 opt->is_changed = 1; 424 } 425 } 426 break; 427 case IPOPT_RA: 428 if (optlen < 4) { 429 pp_ptr = optptr + 1; 430 goto error; 431 } 432 if (optptr[2] == 0 && optptr[3] == 0) 433 opt->router_alert = optptr - iph; 434 break; 435 case IPOPT_CIPSO: 436 if ((!skb && !capable(CAP_NET_RAW)) || opt->cipso) { 437 pp_ptr = optptr; 438 goto error; 439 } 440 opt->cipso = optptr - iph; 441 if (cipso_v4_validate(skb, &optptr)) { 442 pp_ptr = optptr; 443 goto error; 444 } 445 break; 446 case IPOPT_SEC: 447 case IPOPT_SID: 448 default: 449 if (!skb && !capable(CAP_NET_RAW)) { 450 pp_ptr = optptr; 451 goto error; 452 } 453 break; 454 } 455 l -= optlen; 456 optptr += optlen; 457 } 458 459 eol: 460 if (!pp_ptr) 461 return 0; 462 463 error: 464 if (skb) { 465 icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((pp_ptr-iph)<<24)); 466 } 467 return -EINVAL; 468 } 469 470 471 /* 472 * Undo all the changes done by ip_options_compile(). 473 */ 474 475 void ip_options_undo(struct ip_options * opt) 476 { 477 if (opt->srr) { 478 unsigned char * optptr = opt->__data+opt->srr-sizeof(struct iphdr); 479 memmove(optptr+7, optptr+3, optptr[1]-7); 480 memcpy(optptr+3, &opt->faddr, 4); 481 } 482 if (opt->rr_needaddr) { 483 unsigned char * optptr = opt->__data+opt->rr-sizeof(struct iphdr); 484 optptr[2] -= 4; 485 memset(&optptr[optptr[2]-1], 0, 4); 486 } 487 if (opt->ts) { 488 unsigned char * optptr = opt->__data+opt->ts-sizeof(struct iphdr); 489 if (opt->ts_needtime) { 490 optptr[2] -= 4; 491 memset(&optptr[optptr[2]-1], 0, 4); 492 if ((optptr[3]&0xF) == IPOPT_TS_PRESPEC) 493 optptr[2] -= 4; 494 } 495 if (opt->ts_needaddr) { 496 optptr[2] -= 4; 497 memset(&optptr[optptr[2]-1], 0, 4); 498 } 499 } 500 } 501 502 static struct ip_options *ip_options_get_alloc(const int optlen) 503 { 504 return kzalloc(sizeof(struct ip_options) + ((optlen + 3) & ~3), 505 GFP_KERNEL); 506 } 507 508 static int ip_options_get_finish(struct net *net, struct ip_options **optp, 509 struct ip_options *opt, int optlen) 510 { 511 while (optlen & 3) 512 opt->__data[optlen++] = IPOPT_END; 513 opt->optlen = optlen; 514 if (optlen && ip_options_compile(net, opt, NULL)) { 515 kfree(opt); 516 return -EINVAL; 517 } 518 kfree(*optp); 519 *optp = opt; 520 return 0; 521 } 522 523 int ip_options_get_from_user(struct net *net, struct ip_options **optp, 524 unsigned char __user *data, int optlen) 525 { 526 struct ip_options *opt = ip_options_get_alloc(optlen); 527 528 if (!opt) 529 return -ENOMEM; 530 if (optlen && copy_from_user(opt->__data, data, optlen)) { 531 kfree(opt); 532 return -EFAULT; 533 } 534 return ip_options_get_finish(net, optp, opt, optlen); 535 } 536 537 int ip_options_get(struct net *net, struct ip_options **optp, 538 unsigned char *data, int optlen) 539 { 540 struct ip_options *opt = ip_options_get_alloc(optlen); 541 542 if (!opt) 543 return -ENOMEM; 544 if (optlen) 545 memcpy(opt->__data, data, optlen); 546 return ip_options_get_finish(net, optp, opt, optlen); 547 } 548 549 void ip_forward_options(struct sk_buff *skb) 550 { 551 struct ip_options * opt = &(IPCB(skb)->opt); 552 unsigned char * optptr; 553 struct rtable *rt = skb_rtable(skb); 554 unsigned char *raw = skb_network_header(skb); 555 556 if (opt->rr_needaddr) { 557 optptr = (unsigned char *)raw + opt->rr; 558 ip_rt_get_source(&optptr[optptr[2]-5], rt); 559 opt->is_changed = 1; 560 } 561 if (opt->srr_is_hit) { 562 int srrptr, srrspace; 563 564 optptr = raw + opt->srr; 565 566 for ( srrptr=optptr[2], srrspace = optptr[1]; 567 srrptr <= srrspace; 568 srrptr += 4 569 ) { 570 if (srrptr + 3 > srrspace) 571 break; 572 if (memcmp(&rt->rt_dst, &optptr[srrptr-1], 4) == 0) 573 break; 574 } 575 if (srrptr + 3 <= srrspace) { 576 opt->is_changed = 1; 577 ip_rt_get_source(&optptr[srrptr-1], rt); 578 ip_hdr(skb)->daddr = rt->rt_dst; 579 optptr[2] = srrptr+4; 580 } else if (net_ratelimit()) 581 printk(KERN_CRIT "ip_forward(): Argh! Destination lost!\n"); 582 if (opt->ts_needaddr) { 583 optptr = raw + opt->ts; 584 ip_rt_get_source(&optptr[optptr[2]-9], rt); 585 opt->is_changed = 1; 586 } 587 } 588 if (opt->is_changed) { 589 opt->is_changed = 0; 590 ip_send_check(ip_hdr(skb)); 591 } 592 } 593 594 int ip_options_rcv_srr(struct sk_buff *skb) 595 { 596 struct ip_options *opt = &(IPCB(skb)->opt); 597 int srrspace, srrptr; 598 __be32 nexthop; 599 struct iphdr *iph = ip_hdr(skb); 600 unsigned char *optptr = skb_network_header(skb) + opt->srr; 601 struct rtable *rt = skb_rtable(skb); 602 struct rtable *rt2; 603 int err; 604 605 if (!opt->srr) 606 return 0; 607 608 if (skb->pkt_type != PACKET_HOST) 609 return -EINVAL; 610 if (rt->rt_type == RTN_UNICAST) { 611 if (!opt->is_strictroute) 612 return 0; 613 icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl(16<<24)); 614 return -EINVAL; 615 } 616 if (rt->rt_type != RTN_LOCAL) 617 return -EINVAL; 618 619 for (srrptr=optptr[2], srrspace = optptr[1]; srrptr <= srrspace; srrptr += 4) { 620 if (srrptr + 3 > srrspace) { 621 icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((opt->srr+2)<<24)); 622 return -EINVAL; 623 } 624 memcpy(&nexthop, &optptr[srrptr-1], 4); 625 626 rt = skb_rtable(skb); 627 skb_dst_set(skb, NULL); 628 err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, skb->dev); 629 rt2 = skb_rtable(skb); 630 if (err || (rt2->rt_type != RTN_UNICAST && rt2->rt_type != RTN_LOCAL)) { 631 ip_rt_put(rt2); 632 skb_dst_set(skb, &rt->u.dst); 633 return -EINVAL; 634 } 635 ip_rt_put(rt); 636 if (rt2->rt_type != RTN_LOCAL) 637 break; 638 /* Superfast 8) loopback forward */ 639 memcpy(&iph->daddr, &optptr[srrptr-1], 4); 640 opt->is_changed = 1; 641 } 642 if (srrptr <= srrspace) { 643 opt->srr_is_hit = 1; 644 opt->is_changed = 1; 645 } 646 return 0; 647 } 648