1 /* 2 * INET An implementation of the TCP/IP protocol suite for the LINUX 3 * operating system. INET is implemented using the BSD Socket 4 * interface as the means of communication with the user level. 5 * 6 * The options processing module for ip.c 7 * 8 * Authors: A.N.Kuznetsov 9 * 10 */ 11 12 #define pr_fmt(fmt) "IPv4: " fmt 13 14 #include <linux/capability.h> 15 #include <linux/module.h> 16 #include <linux/slab.h> 17 #include <linux/types.h> 18 #include <asm/uaccess.h> 19 #include <asm/unaligned.h> 20 #include <linux/skbuff.h> 21 #include <linux/ip.h> 22 #include <linux/icmp.h> 23 #include <linux/netdevice.h> 24 #include <linux/rtnetlink.h> 25 #include <net/sock.h> 26 #include <net/ip.h> 27 #include <net/icmp.h> 28 #include <net/route.h> 29 #include <net/cipso_ipv4.h> 30 #include <net/ip_fib.h> 31 32 /* 33 * Write options to IP header, record destination address to 34 * source route option, address of outgoing interface 35 * (we should already know it, so that this function is allowed be 36 * called only after routing decision) and timestamp, 37 * if we originate this datagram. 38 * 39 * daddr is real destination address, next hop is recorded in IP header. 40 * saddr is address of outgoing interface. 41 */ 42 43 void ip_options_build(struct sk_buff *skb, struct ip_options *opt, 44 __be32 daddr, struct rtable *rt, int is_frag) 45 { 46 unsigned char *iph = skb_network_header(skb); 47 48 memcpy(&(IPCB(skb)->opt), opt, sizeof(struct ip_options)); 49 memcpy(iph+sizeof(struct iphdr), opt->__data, opt->optlen); 50 opt = &(IPCB(skb)->opt); 51 52 if (opt->srr) 53 memcpy(iph+opt->srr+iph[opt->srr+1]-4, &daddr, 4); 54 55 if (!is_frag) { 56 if (opt->rr_needaddr) 57 ip_rt_get_source(iph+opt->rr+iph[opt->rr+2]-5, skb, rt); 58 if (opt->ts_needaddr) 59 ip_rt_get_source(iph+opt->ts+iph[opt->ts+2]-9, skb, rt); 60 if (opt->ts_needtime) { 61 struct timespec tv; 62 __be32 midtime; 63 getnstimeofday(&tv); 64 midtime = htonl((tv.tv_sec % 86400) * MSEC_PER_SEC + tv.tv_nsec / NSEC_PER_MSEC); 65 memcpy(iph+opt->ts+iph[opt->ts+2]-5, &midtime, 4); 66 } 67 return; 68 } 69 if (opt->rr) { 70 memset(iph+opt->rr, IPOPT_NOP, iph[opt->rr+1]); 71 opt->rr = 0; 72 opt->rr_needaddr = 0; 73 } 74 if (opt->ts) { 75 memset(iph+opt->ts, IPOPT_NOP, iph[opt->ts+1]); 76 opt->ts = 0; 77 opt->ts_needaddr = opt->ts_needtime = 0; 78 } 79 } 80 81 /* 82 * Provided (sopt, skb) points to received options, 83 * build in dopt compiled option set appropriate for answering. 84 * i.e. invert SRR option, copy anothers, 85 * and grab room in RR/TS options. 86 * 87 * NOTE: dopt cannot point to skb. 88 */ 89 90 int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb) 91 { 92 const struct ip_options *sopt; 93 unsigned char *sptr, *dptr; 94 int soffset, doffset; 95 int optlen; 96 __be32 daddr; 97 98 memset(dopt, 0, sizeof(struct ip_options)); 99 100 sopt = &(IPCB(skb)->opt); 101 102 if (sopt->optlen == 0) 103 return 0; 104 105 sptr = skb_network_header(skb); 106 dptr = dopt->__data; 107 108 daddr = fib_compute_spec_dst(skb); 109 110 if (sopt->rr) { 111 optlen = sptr[sopt->rr+1]; 112 soffset = sptr[sopt->rr+2]; 113 dopt->rr = dopt->optlen + sizeof(struct iphdr); 114 memcpy(dptr, sptr+sopt->rr, optlen); 115 if (sopt->rr_needaddr && soffset <= optlen) { 116 if (soffset + 3 > optlen) 117 return -EINVAL; 118 dptr[2] = soffset + 4; 119 dopt->rr_needaddr = 1; 120 } 121 dptr += optlen; 122 dopt->optlen += optlen; 123 } 124 if (sopt->ts) { 125 optlen = sptr[sopt->ts+1]; 126 soffset = sptr[sopt->ts+2]; 127 dopt->ts = dopt->optlen + sizeof(struct iphdr); 128 memcpy(dptr, sptr+sopt->ts, optlen); 129 if (soffset <= optlen) { 130 if (sopt->ts_needaddr) { 131 if (soffset + 3 > optlen) 132 return -EINVAL; 133 dopt->ts_needaddr = 1; 134 soffset += 4; 135 } 136 if (sopt->ts_needtime) { 137 if (soffset + 3 > optlen) 138 return -EINVAL; 139 if ((dptr[3]&0xF) != IPOPT_TS_PRESPEC) { 140 dopt->ts_needtime = 1; 141 soffset += 4; 142 } else { 143 dopt->ts_needtime = 0; 144 145 if (soffset + 7 <= optlen) { 146 __be32 addr; 147 148 memcpy(&addr, dptr+soffset-1, 4); 149 if (inet_addr_type(dev_net(skb_dst(skb)->dev), addr) != RTN_UNICAST) { 150 dopt->ts_needtime = 1; 151 soffset += 8; 152 } 153 } 154 } 155 } 156 dptr[2] = soffset; 157 } 158 dptr += optlen; 159 dopt->optlen += optlen; 160 } 161 if (sopt->srr) { 162 unsigned char *start = sptr+sopt->srr; 163 __be32 faddr; 164 165 optlen = start[1]; 166 soffset = start[2]; 167 doffset = 0; 168 if (soffset > optlen) 169 soffset = optlen + 1; 170 soffset -= 4; 171 if (soffset > 3) { 172 memcpy(&faddr, &start[soffset-1], 4); 173 for (soffset-=4, doffset=4; soffset > 3; soffset-=4, doffset+=4) 174 memcpy(&dptr[doffset-1], &start[soffset-1], 4); 175 /* 176 * RFC1812 requires to fix illegal source routes. 177 */ 178 if (memcmp(&ip_hdr(skb)->saddr, 179 &start[soffset + 3], 4) == 0) 180 doffset -= 4; 181 } 182 if (doffset > 3) { 183 memcpy(&start[doffset-1], &daddr, 4); 184 dopt->faddr = faddr; 185 dptr[0] = start[0]; 186 dptr[1] = doffset+3; 187 dptr[2] = 4; 188 dptr += doffset+3; 189 dopt->srr = dopt->optlen + sizeof(struct iphdr); 190 dopt->optlen += doffset+3; 191 dopt->is_strictroute = sopt->is_strictroute; 192 } 193 } 194 if (sopt->cipso) { 195 optlen = sptr[sopt->cipso+1]; 196 dopt->cipso = dopt->optlen+sizeof(struct iphdr); 197 memcpy(dptr, sptr+sopt->cipso, optlen); 198 dptr += optlen; 199 dopt->optlen += optlen; 200 } 201 while (dopt->optlen & 3) { 202 *dptr++ = IPOPT_END; 203 dopt->optlen++; 204 } 205 return 0; 206 } 207 208 /* 209 * Options "fragmenting", just fill options not 210 * allowed in fragments with NOOPs. 211 * Simple and stupid 8), but the most efficient way. 212 */ 213 214 void ip_options_fragment(struct sk_buff *skb) 215 { 216 unsigned char *optptr = skb_network_header(skb) + sizeof(struct iphdr); 217 struct ip_options *opt = &(IPCB(skb)->opt); 218 int l = opt->optlen; 219 int optlen; 220 221 while (l > 0) { 222 switch (*optptr) { 223 case IPOPT_END: 224 return; 225 case IPOPT_NOOP: 226 l--; 227 optptr++; 228 continue; 229 } 230 optlen = optptr[1]; 231 if (optlen<2 || optlen>l) 232 return; 233 if (!IPOPT_COPIED(*optptr)) 234 memset(optptr, IPOPT_NOOP, optlen); 235 l -= optlen; 236 optptr += optlen; 237 } 238 opt->ts = 0; 239 opt->rr = 0; 240 opt->rr_needaddr = 0; 241 opt->ts_needaddr = 0; 242 opt->ts_needtime = 0; 243 } 244 245 /* helper used by ip_options_compile() to call fib_compute_spec_dst() 246 * at most one time. 247 */ 248 static void spec_dst_fill(__be32 *spec_dst, struct sk_buff *skb) 249 { 250 if (*spec_dst == htonl(INADDR_ANY)) 251 *spec_dst = fib_compute_spec_dst(skb); 252 } 253 254 /* 255 * Verify options and fill pointers in struct options. 256 * Caller should clear *opt, and set opt->data. 257 * If opt == NULL, then skb->data should point to IP header. 258 */ 259 260 int ip_options_compile(struct net *net, 261 struct ip_options *opt, struct sk_buff *skb) 262 { 263 __be32 spec_dst = htonl(INADDR_ANY); 264 unsigned char *pp_ptr = NULL; 265 struct rtable *rt = NULL; 266 unsigned char *optptr; 267 unsigned char *iph; 268 int optlen, l; 269 270 if (skb != NULL) { 271 rt = skb_rtable(skb); 272 optptr = (unsigned char *)&(ip_hdr(skb)[1]); 273 } else 274 optptr = opt->__data; 275 iph = optptr - sizeof(struct iphdr); 276 277 for (l = opt->optlen; l > 0; ) { 278 switch (*optptr) { 279 case IPOPT_END: 280 for (optptr++, l--; l>0; optptr++, l--) { 281 if (*optptr != IPOPT_END) { 282 *optptr = IPOPT_END; 283 opt->is_changed = 1; 284 } 285 } 286 goto eol; 287 case IPOPT_NOOP: 288 l--; 289 optptr++; 290 continue; 291 } 292 optlen = optptr[1]; 293 if (optlen<2 || optlen>l) { 294 pp_ptr = optptr; 295 goto error; 296 } 297 switch (*optptr) { 298 case IPOPT_SSRR: 299 case IPOPT_LSRR: 300 if (optlen < 3) { 301 pp_ptr = optptr + 1; 302 goto error; 303 } 304 if (optptr[2] < 4) { 305 pp_ptr = optptr + 2; 306 goto error; 307 } 308 /* NB: cf RFC-1812 5.2.4.1 */ 309 if (opt->srr) { 310 pp_ptr = optptr; 311 goto error; 312 } 313 if (!skb) { 314 if (optptr[2] != 4 || optlen < 7 || ((optlen-3) & 3)) { 315 pp_ptr = optptr + 1; 316 goto error; 317 } 318 memcpy(&opt->faddr, &optptr[3], 4); 319 if (optlen > 7) 320 memmove(&optptr[3], &optptr[7], optlen-7); 321 } 322 opt->is_strictroute = (optptr[0] == IPOPT_SSRR); 323 opt->srr = optptr - iph; 324 break; 325 case IPOPT_RR: 326 if (opt->rr) { 327 pp_ptr = optptr; 328 goto error; 329 } 330 if (optlen < 3) { 331 pp_ptr = optptr + 1; 332 goto error; 333 } 334 if (optptr[2] < 4) { 335 pp_ptr = optptr + 2; 336 goto error; 337 } 338 if (optptr[2] <= optlen) { 339 if (optptr[2]+3 > optlen) { 340 pp_ptr = optptr + 2; 341 goto error; 342 } 343 if (rt) { 344 spec_dst_fill(&spec_dst, skb); 345 memcpy(&optptr[optptr[2]-1], &spec_dst, 4); 346 opt->is_changed = 1; 347 } 348 optptr[2] += 4; 349 opt->rr_needaddr = 1; 350 } 351 opt->rr = optptr - iph; 352 break; 353 case IPOPT_TIMESTAMP: 354 if (opt->ts) { 355 pp_ptr = optptr; 356 goto error; 357 } 358 if (optlen < 4) { 359 pp_ptr = optptr + 1; 360 goto error; 361 } 362 if (optptr[2] < 5) { 363 pp_ptr = optptr + 2; 364 goto error; 365 } 366 if (optptr[2] <= optlen) { 367 unsigned char *timeptr = NULL; 368 if (optptr[2]+3 > optptr[1]) { 369 pp_ptr = optptr + 2; 370 goto error; 371 } 372 switch (optptr[3]&0xF) { 373 case IPOPT_TS_TSONLY: 374 opt->ts = optptr - iph; 375 if (skb) 376 timeptr = &optptr[optptr[2]-1]; 377 opt->ts_needtime = 1; 378 optptr[2] += 4; 379 break; 380 case IPOPT_TS_TSANDADDR: 381 if (optptr[2]+7 > optptr[1]) { 382 pp_ptr = optptr + 2; 383 goto error; 384 } 385 opt->ts = optptr - iph; 386 if (rt) { 387 spec_dst_fill(&spec_dst, skb); 388 memcpy(&optptr[optptr[2]-1], &spec_dst, 4); 389 timeptr = &optptr[optptr[2]+3]; 390 } 391 opt->ts_needaddr = 1; 392 opt->ts_needtime = 1; 393 optptr[2] += 8; 394 break; 395 case IPOPT_TS_PRESPEC: 396 if (optptr[2]+7 > optptr[1]) { 397 pp_ptr = optptr + 2; 398 goto error; 399 } 400 opt->ts = optptr - iph; 401 { 402 __be32 addr; 403 memcpy(&addr, &optptr[optptr[2]-1], 4); 404 if (inet_addr_type(net, addr) == RTN_UNICAST) 405 break; 406 if (skb) 407 timeptr = &optptr[optptr[2]+3]; 408 } 409 opt->ts_needtime = 1; 410 optptr[2] += 8; 411 break; 412 default: 413 if (!skb && !capable(CAP_NET_RAW)) { 414 pp_ptr = optptr + 3; 415 goto error; 416 } 417 break; 418 } 419 if (timeptr) { 420 struct timespec tv; 421 u32 midtime; 422 getnstimeofday(&tv); 423 midtime = (tv.tv_sec % 86400) * MSEC_PER_SEC + tv.tv_nsec / NSEC_PER_MSEC; 424 put_unaligned_be32(midtime, timeptr); 425 opt->is_changed = 1; 426 } 427 } else { 428 unsigned int overflow = optptr[3]>>4; 429 if (overflow == 15) { 430 pp_ptr = optptr + 3; 431 goto error; 432 } 433 opt->ts = optptr - iph; 434 if (skb) { 435 optptr[3] = (optptr[3]&0xF)|((overflow+1)<<4); 436 opt->is_changed = 1; 437 } 438 } 439 break; 440 case IPOPT_RA: 441 if (optlen < 4) { 442 pp_ptr = optptr + 1; 443 goto error; 444 } 445 if (optptr[2] == 0 && optptr[3] == 0) 446 opt->router_alert = optptr - iph; 447 break; 448 case IPOPT_CIPSO: 449 if ((!skb && !capable(CAP_NET_RAW)) || opt->cipso) { 450 pp_ptr = optptr; 451 goto error; 452 } 453 opt->cipso = optptr - iph; 454 if (cipso_v4_validate(skb, &optptr)) { 455 pp_ptr = optptr; 456 goto error; 457 } 458 break; 459 case IPOPT_SEC: 460 case IPOPT_SID: 461 default: 462 if (!skb && !capable(CAP_NET_RAW)) { 463 pp_ptr = optptr; 464 goto error; 465 } 466 break; 467 } 468 l -= optlen; 469 optptr += optlen; 470 } 471 472 eol: 473 if (!pp_ptr) 474 return 0; 475 476 error: 477 if (skb) { 478 icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((pp_ptr-iph)<<24)); 479 } 480 return -EINVAL; 481 } 482 EXPORT_SYMBOL(ip_options_compile); 483 484 /* 485 * Undo all the changes done by ip_options_compile(). 486 */ 487 488 void ip_options_undo(struct ip_options *opt) 489 { 490 if (opt->srr) { 491 unsigned char *optptr = opt->__data+opt->srr-sizeof(struct iphdr); 492 memmove(optptr+7, optptr+3, optptr[1]-7); 493 memcpy(optptr+3, &opt->faddr, 4); 494 } 495 if (opt->rr_needaddr) { 496 unsigned char *optptr = opt->__data+opt->rr-sizeof(struct iphdr); 497 optptr[2] -= 4; 498 memset(&optptr[optptr[2]-1], 0, 4); 499 } 500 if (opt->ts) { 501 unsigned char *optptr = opt->__data+opt->ts-sizeof(struct iphdr); 502 if (opt->ts_needtime) { 503 optptr[2] -= 4; 504 memset(&optptr[optptr[2]-1], 0, 4); 505 if ((optptr[3]&0xF) == IPOPT_TS_PRESPEC) 506 optptr[2] -= 4; 507 } 508 if (opt->ts_needaddr) { 509 optptr[2] -= 4; 510 memset(&optptr[optptr[2]-1], 0, 4); 511 } 512 } 513 } 514 515 static struct ip_options_rcu *ip_options_get_alloc(const int optlen) 516 { 517 return kzalloc(sizeof(struct ip_options_rcu) + ((optlen + 3) & ~3), 518 GFP_KERNEL); 519 } 520 521 static int ip_options_get_finish(struct net *net, struct ip_options_rcu **optp, 522 struct ip_options_rcu *opt, int optlen) 523 { 524 while (optlen & 3) 525 opt->opt.__data[optlen++] = IPOPT_END; 526 opt->opt.optlen = optlen; 527 if (optlen && ip_options_compile(net, &opt->opt, NULL)) { 528 kfree(opt); 529 return -EINVAL; 530 } 531 kfree(*optp); 532 *optp = opt; 533 return 0; 534 } 535 536 int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp, 537 unsigned char __user *data, int optlen) 538 { 539 struct ip_options_rcu *opt = ip_options_get_alloc(optlen); 540 541 if (!opt) 542 return -ENOMEM; 543 if (optlen && copy_from_user(opt->opt.__data, data, optlen)) { 544 kfree(opt); 545 return -EFAULT; 546 } 547 return ip_options_get_finish(net, optp, opt, optlen); 548 } 549 550 int ip_options_get(struct net *net, struct ip_options_rcu **optp, 551 unsigned char *data, int optlen) 552 { 553 struct ip_options_rcu *opt = ip_options_get_alloc(optlen); 554 555 if (!opt) 556 return -ENOMEM; 557 if (optlen) 558 memcpy(opt->opt.__data, data, optlen); 559 return ip_options_get_finish(net, optp, opt, optlen); 560 } 561 562 void ip_forward_options(struct sk_buff *skb) 563 { 564 struct ip_options *opt = &(IPCB(skb)->opt); 565 unsigned char *optptr; 566 struct rtable *rt = skb_rtable(skb); 567 unsigned char *raw = skb_network_header(skb); 568 569 if (opt->rr_needaddr) { 570 optptr = (unsigned char *)raw + opt->rr; 571 ip_rt_get_source(&optptr[optptr[2]-5], skb, rt); 572 opt->is_changed = 1; 573 } 574 if (opt->srr_is_hit) { 575 int srrptr, srrspace; 576 577 optptr = raw + opt->srr; 578 579 for ( srrptr=optptr[2], srrspace = optptr[1]; 580 srrptr <= srrspace; 581 srrptr += 4 582 ) { 583 if (srrptr + 3 > srrspace) 584 break; 585 if (memcmp(&opt->nexthop, &optptr[srrptr-1], 4) == 0) 586 break; 587 } 588 if (srrptr + 3 <= srrspace) { 589 opt->is_changed = 1; 590 ip_hdr(skb)->daddr = opt->nexthop; 591 ip_rt_get_source(&optptr[srrptr-1], skb, rt); 592 optptr[2] = srrptr+4; 593 } else { 594 net_crit_ratelimited("%s(): Argh! Destination lost!\n", 595 __func__); 596 } 597 if (opt->ts_needaddr) { 598 optptr = raw + opt->ts; 599 ip_rt_get_source(&optptr[optptr[2]-9], skb, rt); 600 opt->is_changed = 1; 601 } 602 } 603 if (opt->is_changed) { 604 opt->is_changed = 0; 605 ip_send_check(ip_hdr(skb)); 606 } 607 } 608 609 int ip_options_rcv_srr(struct sk_buff *skb) 610 { 611 struct ip_options *opt = &(IPCB(skb)->opt); 612 int srrspace, srrptr; 613 __be32 nexthop; 614 struct iphdr *iph = ip_hdr(skb); 615 unsigned char *optptr = skb_network_header(skb) + opt->srr; 616 struct rtable *rt = skb_rtable(skb); 617 struct rtable *rt2; 618 unsigned long orefdst; 619 int err; 620 621 if (!rt) 622 return 0; 623 624 if (skb->pkt_type != PACKET_HOST) 625 return -EINVAL; 626 if (rt->rt_type == RTN_UNICAST) { 627 if (!opt->is_strictroute) 628 return 0; 629 icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl(16<<24)); 630 return -EINVAL; 631 } 632 if (rt->rt_type != RTN_LOCAL) 633 return -EINVAL; 634 635 for (srrptr=optptr[2], srrspace = optptr[1]; srrptr <= srrspace; srrptr += 4) { 636 if (srrptr + 3 > srrspace) { 637 icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((opt->srr+2)<<24)); 638 return -EINVAL; 639 } 640 memcpy(&nexthop, &optptr[srrptr-1], 4); 641 642 orefdst = skb->_skb_refdst; 643 skb_dst_set(skb, NULL); 644 err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, skb->dev); 645 rt2 = skb_rtable(skb); 646 if (err || (rt2->rt_type != RTN_UNICAST && rt2->rt_type != RTN_LOCAL)) { 647 skb_dst_drop(skb); 648 skb->_skb_refdst = orefdst; 649 return -EINVAL; 650 } 651 refdst_drop(orefdst); 652 if (rt2->rt_type != RTN_LOCAL) 653 break; 654 /* Superfast 8) loopback forward */ 655 iph->daddr = nexthop; 656 opt->is_changed = 1; 657 } 658 if (srrptr <= srrspace) { 659 opt->srr_is_hit = 1; 660 opt->nexthop = nexthop; 661 opt->is_changed = 1; 662 } 663 return 0; 664 } 665 EXPORT_SYMBOL(ip_options_rcv_srr); 666