1 /* 2 * INET An implementation of the TCP/IP protocol suite for the LINUX 3 * operating system. INET is implemented using the BSD Socket 4 * interface as the means of communication with the user level. 5 * 6 * The options processing module for ip.c 7 * 8 * Authors: A.N.Kuznetsov 9 * 10 */ 11 12 #define pr_fmt(fmt) "IPv4: " fmt 13 14 #include <linux/capability.h> 15 #include <linux/module.h> 16 #include <linux/slab.h> 17 #include <linux/types.h> 18 #include <asm/uaccess.h> 19 #include <asm/unaligned.h> 20 #include <linux/skbuff.h> 21 #include <linux/ip.h> 22 #include <linux/icmp.h> 23 #include <linux/netdevice.h> 24 #include <linux/rtnetlink.h> 25 #include <net/sock.h> 26 #include <net/ip.h> 27 #include <net/icmp.h> 28 #include <net/route.h> 29 #include <net/cipso_ipv4.h> 30 #include <net/ip_fib.h> 31 32 /* 33 * Write options to IP header, record destination address to 34 * source route option, address of outgoing interface 35 * (we should already know it, so that this function is allowed be 36 * called only after routing decision) and timestamp, 37 * if we originate this datagram. 38 * 39 * daddr is real destination address, next hop is recorded in IP header. 40 * saddr is address of outgoing interface. 41 */ 42 43 void ip_options_build(struct sk_buff *skb, struct ip_options *opt, 44 __be32 daddr, struct rtable *rt, int is_frag) 45 { 46 unsigned char *iph = skb_network_header(skb); 47 48 memcpy(&(IPCB(skb)->opt), opt, sizeof(struct ip_options)); 49 memcpy(iph+sizeof(struct iphdr), opt->__data, opt->optlen); 50 opt = &(IPCB(skb)->opt); 51 52 if (opt->srr) 53 memcpy(iph+opt->srr+iph[opt->srr+1]-4, &daddr, 4); 54 55 if (!is_frag) { 56 if (opt->rr_needaddr) 57 ip_rt_get_source(iph+opt->rr+iph[opt->rr+2]-5, skb, rt); 58 if (opt->ts_needaddr) 59 ip_rt_get_source(iph+opt->ts+iph[opt->ts+2]-9, skb, rt); 60 if (opt->ts_needtime) { 61 struct timespec tv; 62 __be32 midtime; 63 getnstimeofday(&tv); 64 midtime = htonl((tv.tv_sec % 86400) * MSEC_PER_SEC + tv.tv_nsec / NSEC_PER_MSEC); 65 memcpy(iph+opt->ts+iph[opt->ts+2]-5, &midtime, 4); 66 } 67 return; 68 } 69 if (opt->rr) { 70 memset(iph+opt->rr, IPOPT_NOP, iph[opt->rr+1]); 71 opt->rr = 0; 72 opt->rr_needaddr = 0; 73 } 74 if (opt->ts) { 75 memset(iph+opt->ts, IPOPT_NOP, iph[opt->ts+1]); 76 opt->ts = 0; 77 opt->ts_needaddr = opt->ts_needtime = 0; 78 } 79 } 80 81 /* 82 * Provided (sopt, skb) points to received options, 83 * build in dopt compiled option set appropriate for answering. 84 * i.e. invert SRR option, copy anothers, 85 * and grab room in RR/TS options. 86 * 87 * NOTE: dopt cannot point to skb. 88 */ 89 90 int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb) 91 { 92 const struct ip_options *sopt; 93 unsigned char *sptr, *dptr; 94 int soffset, doffset; 95 int optlen; 96 97 memset(dopt, 0, sizeof(struct ip_options)); 98 99 sopt = &(IPCB(skb)->opt); 100 101 if (sopt->optlen == 0) 102 return 0; 103 104 sptr = skb_network_header(skb); 105 dptr = dopt->__data; 106 107 if (sopt->rr) { 108 optlen = sptr[sopt->rr+1]; 109 soffset = sptr[sopt->rr+2]; 110 dopt->rr = dopt->optlen + sizeof(struct iphdr); 111 memcpy(dptr, sptr+sopt->rr, optlen); 112 if (sopt->rr_needaddr && soffset <= optlen) { 113 if (soffset + 3 > optlen) 114 return -EINVAL; 115 dptr[2] = soffset + 4; 116 dopt->rr_needaddr = 1; 117 } 118 dptr += optlen; 119 dopt->optlen += optlen; 120 } 121 if (sopt->ts) { 122 optlen = sptr[sopt->ts+1]; 123 soffset = sptr[sopt->ts+2]; 124 dopt->ts = dopt->optlen + sizeof(struct iphdr); 125 memcpy(dptr, sptr+sopt->ts, optlen); 126 if (soffset <= optlen) { 127 if (sopt->ts_needaddr) { 128 if (soffset + 3 > optlen) 129 return -EINVAL; 130 dopt->ts_needaddr = 1; 131 soffset += 4; 132 } 133 if (sopt->ts_needtime) { 134 if (soffset + 3 > optlen) 135 return -EINVAL; 136 if ((dptr[3]&0xF) != IPOPT_TS_PRESPEC) { 137 dopt->ts_needtime = 1; 138 soffset += 4; 139 } else { 140 dopt->ts_needtime = 0; 141 142 if (soffset + 7 <= optlen) { 143 __be32 addr; 144 145 memcpy(&addr, dptr+soffset-1, 4); 146 if (inet_addr_type(dev_net(skb_dst(skb)->dev), addr) != RTN_UNICAST) { 147 dopt->ts_needtime = 1; 148 soffset += 8; 149 } 150 } 151 } 152 } 153 dptr[2] = soffset; 154 } 155 dptr += optlen; 156 dopt->optlen += optlen; 157 } 158 if (sopt->srr) { 159 unsigned char *start = sptr+sopt->srr; 160 __be32 faddr; 161 162 optlen = start[1]; 163 soffset = start[2]; 164 doffset = 0; 165 if (soffset > optlen) 166 soffset = optlen + 1; 167 soffset -= 4; 168 if (soffset > 3) { 169 memcpy(&faddr, &start[soffset-1], 4); 170 for (soffset-=4, doffset=4; soffset > 3; soffset-=4, doffset+=4) 171 memcpy(&dptr[doffset-1], &start[soffset-1], 4); 172 /* 173 * RFC1812 requires to fix illegal source routes. 174 */ 175 if (memcmp(&ip_hdr(skb)->saddr, 176 &start[soffset + 3], 4) == 0) 177 doffset -= 4; 178 } 179 if (doffset > 3) { 180 __be32 daddr = fib_compute_spec_dst(skb); 181 182 memcpy(&start[doffset-1], &daddr, 4); 183 dopt->faddr = faddr; 184 dptr[0] = start[0]; 185 dptr[1] = doffset+3; 186 dptr[2] = 4; 187 dptr += doffset+3; 188 dopt->srr = dopt->optlen + sizeof(struct iphdr); 189 dopt->optlen += doffset+3; 190 dopt->is_strictroute = sopt->is_strictroute; 191 } 192 } 193 if (sopt->cipso) { 194 optlen = sptr[sopt->cipso+1]; 195 dopt->cipso = dopt->optlen+sizeof(struct iphdr); 196 memcpy(dptr, sptr+sopt->cipso, optlen); 197 dptr += optlen; 198 dopt->optlen += optlen; 199 } 200 while (dopt->optlen & 3) { 201 *dptr++ = IPOPT_END; 202 dopt->optlen++; 203 } 204 return 0; 205 } 206 207 /* 208 * Options "fragmenting", just fill options not 209 * allowed in fragments with NOOPs. 210 * Simple and stupid 8), but the most efficient way. 211 */ 212 213 void ip_options_fragment(struct sk_buff *skb) 214 { 215 unsigned char *optptr = skb_network_header(skb) + sizeof(struct iphdr); 216 struct ip_options *opt = &(IPCB(skb)->opt); 217 int l = opt->optlen; 218 int optlen; 219 220 while (l > 0) { 221 switch (*optptr) { 222 case IPOPT_END: 223 return; 224 case IPOPT_NOOP: 225 l--; 226 optptr++; 227 continue; 228 } 229 optlen = optptr[1]; 230 if (optlen<2 || optlen>l) 231 return; 232 if (!IPOPT_COPIED(*optptr)) 233 memset(optptr, IPOPT_NOOP, optlen); 234 l -= optlen; 235 optptr += optlen; 236 } 237 opt->ts = 0; 238 opt->rr = 0; 239 opt->rr_needaddr = 0; 240 opt->ts_needaddr = 0; 241 opt->ts_needtime = 0; 242 } 243 244 /* helper used by ip_options_compile() to call fib_compute_spec_dst() 245 * at most one time. 246 */ 247 static void spec_dst_fill(__be32 *spec_dst, struct sk_buff *skb) 248 { 249 if (*spec_dst == htonl(INADDR_ANY)) 250 *spec_dst = fib_compute_spec_dst(skb); 251 } 252 253 /* 254 * Verify options and fill pointers in struct options. 255 * Caller should clear *opt, and set opt->data. 256 * If opt == NULL, then skb->data should point to IP header. 257 */ 258 259 int ip_options_compile(struct net *net, 260 struct ip_options *opt, struct sk_buff *skb) 261 { 262 __be32 spec_dst = htonl(INADDR_ANY); 263 unsigned char *pp_ptr = NULL; 264 struct rtable *rt = NULL; 265 unsigned char *optptr; 266 unsigned char *iph; 267 int optlen, l; 268 269 if (skb != NULL) { 270 rt = skb_rtable(skb); 271 optptr = (unsigned char *)&(ip_hdr(skb)[1]); 272 } else 273 optptr = opt->__data; 274 iph = optptr - sizeof(struct iphdr); 275 276 for (l = opt->optlen; l > 0; ) { 277 switch (*optptr) { 278 case IPOPT_END: 279 for (optptr++, l--; l>0; optptr++, l--) { 280 if (*optptr != IPOPT_END) { 281 *optptr = IPOPT_END; 282 opt->is_changed = 1; 283 } 284 } 285 goto eol; 286 case IPOPT_NOOP: 287 l--; 288 optptr++; 289 continue; 290 } 291 optlen = optptr[1]; 292 if (optlen<2 || optlen>l) { 293 pp_ptr = optptr; 294 goto error; 295 } 296 switch (*optptr) { 297 case IPOPT_SSRR: 298 case IPOPT_LSRR: 299 if (optlen < 3) { 300 pp_ptr = optptr + 1; 301 goto error; 302 } 303 if (optptr[2] < 4) { 304 pp_ptr = optptr + 2; 305 goto error; 306 } 307 /* NB: cf RFC-1812 5.2.4.1 */ 308 if (opt->srr) { 309 pp_ptr = optptr; 310 goto error; 311 } 312 if (!skb) { 313 if (optptr[2] != 4 || optlen < 7 || ((optlen-3) & 3)) { 314 pp_ptr = optptr + 1; 315 goto error; 316 } 317 memcpy(&opt->faddr, &optptr[3], 4); 318 if (optlen > 7) 319 memmove(&optptr[3], &optptr[7], optlen-7); 320 } 321 opt->is_strictroute = (optptr[0] == IPOPT_SSRR); 322 opt->srr = optptr - iph; 323 break; 324 case IPOPT_RR: 325 if (opt->rr) { 326 pp_ptr = optptr; 327 goto error; 328 } 329 if (optlen < 3) { 330 pp_ptr = optptr + 1; 331 goto error; 332 } 333 if (optptr[2] < 4) { 334 pp_ptr = optptr + 2; 335 goto error; 336 } 337 if (optptr[2] <= optlen) { 338 if (optptr[2]+3 > optlen) { 339 pp_ptr = optptr + 2; 340 goto error; 341 } 342 if (rt) { 343 spec_dst_fill(&spec_dst, skb); 344 memcpy(&optptr[optptr[2]-1], &spec_dst, 4); 345 opt->is_changed = 1; 346 } 347 optptr[2] += 4; 348 opt->rr_needaddr = 1; 349 } 350 opt->rr = optptr - iph; 351 break; 352 case IPOPT_TIMESTAMP: 353 if (opt->ts) { 354 pp_ptr = optptr; 355 goto error; 356 } 357 if (optlen < 4) { 358 pp_ptr = optptr + 1; 359 goto error; 360 } 361 if (optptr[2] < 5) { 362 pp_ptr = optptr + 2; 363 goto error; 364 } 365 if (optptr[2] <= optlen) { 366 unsigned char *timeptr = NULL; 367 if (optptr[2]+3 > optptr[1]) { 368 pp_ptr = optptr + 2; 369 goto error; 370 } 371 switch (optptr[3]&0xF) { 372 case IPOPT_TS_TSONLY: 373 opt->ts = optptr - iph; 374 if (skb) 375 timeptr = &optptr[optptr[2]-1]; 376 opt->ts_needtime = 1; 377 optptr[2] += 4; 378 break; 379 case IPOPT_TS_TSANDADDR: 380 if (optptr[2]+7 > optptr[1]) { 381 pp_ptr = optptr + 2; 382 goto error; 383 } 384 opt->ts = optptr - iph; 385 if (rt) { 386 spec_dst_fill(&spec_dst, skb); 387 memcpy(&optptr[optptr[2]-1], &spec_dst, 4); 388 timeptr = &optptr[optptr[2]+3]; 389 } 390 opt->ts_needaddr = 1; 391 opt->ts_needtime = 1; 392 optptr[2] += 8; 393 break; 394 case IPOPT_TS_PRESPEC: 395 if (optptr[2]+7 > optptr[1]) { 396 pp_ptr = optptr + 2; 397 goto error; 398 } 399 opt->ts = optptr - iph; 400 { 401 __be32 addr; 402 memcpy(&addr, &optptr[optptr[2]-1], 4); 403 if (inet_addr_type(net, addr) == RTN_UNICAST) 404 break; 405 if (skb) 406 timeptr = &optptr[optptr[2]+3]; 407 } 408 opt->ts_needtime = 1; 409 optptr[2] += 8; 410 break; 411 default: 412 if (!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) { 413 pp_ptr = optptr + 3; 414 goto error; 415 } 416 break; 417 } 418 if (timeptr) { 419 struct timespec tv; 420 u32 midtime; 421 getnstimeofday(&tv); 422 midtime = (tv.tv_sec % 86400) * MSEC_PER_SEC + tv.tv_nsec / NSEC_PER_MSEC; 423 put_unaligned_be32(midtime, timeptr); 424 opt->is_changed = 1; 425 } 426 } else if ((optptr[3]&0xF) != IPOPT_TS_PRESPEC) { 427 unsigned int overflow = optptr[3]>>4; 428 if (overflow == 15) { 429 pp_ptr = optptr + 3; 430 goto error; 431 } 432 opt->ts = optptr - iph; 433 if (skb) { 434 optptr[3] = (optptr[3]&0xF)|((overflow+1)<<4); 435 opt->is_changed = 1; 436 } 437 } 438 break; 439 case IPOPT_RA: 440 if (optlen < 4) { 441 pp_ptr = optptr + 1; 442 goto error; 443 } 444 if (optptr[2] == 0 && optptr[3] == 0) 445 opt->router_alert = optptr - iph; 446 break; 447 case IPOPT_CIPSO: 448 if ((!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) || opt->cipso) { 449 pp_ptr = optptr; 450 goto error; 451 } 452 opt->cipso = optptr - iph; 453 if (cipso_v4_validate(skb, &optptr)) { 454 pp_ptr = optptr; 455 goto error; 456 } 457 break; 458 case IPOPT_SEC: 459 case IPOPT_SID: 460 default: 461 if (!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) { 462 pp_ptr = optptr; 463 goto error; 464 } 465 break; 466 } 467 l -= optlen; 468 optptr += optlen; 469 } 470 471 eol: 472 if (!pp_ptr) 473 return 0; 474 475 error: 476 if (skb) { 477 icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((pp_ptr-iph)<<24)); 478 } 479 return -EINVAL; 480 } 481 EXPORT_SYMBOL(ip_options_compile); 482 483 /* 484 * Undo all the changes done by ip_options_compile(). 485 */ 486 487 void ip_options_undo(struct ip_options *opt) 488 { 489 if (opt->srr) { 490 unsigned char *optptr = opt->__data+opt->srr-sizeof(struct iphdr); 491 memmove(optptr+7, optptr+3, optptr[1]-7); 492 memcpy(optptr+3, &opt->faddr, 4); 493 } 494 if (opt->rr_needaddr) { 495 unsigned char *optptr = opt->__data+opt->rr-sizeof(struct iphdr); 496 optptr[2] -= 4; 497 memset(&optptr[optptr[2]-1], 0, 4); 498 } 499 if (opt->ts) { 500 unsigned char *optptr = opt->__data+opt->ts-sizeof(struct iphdr); 501 if (opt->ts_needtime) { 502 optptr[2] -= 4; 503 memset(&optptr[optptr[2]-1], 0, 4); 504 if ((optptr[3]&0xF) == IPOPT_TS_PRESPEC) 505 optptr[2] -= 4; 506 } 507 if (opt->ts_needaddr) { 508 optptr[2] -= 4; 509 memset(&optptr[optptr[2]-1], 0, 4); 510 } 511 } 512 } 513 514 static struct ip_options_rcu *ip_options_get_alloc(const int optlen) 515 { 516 return kzalloc(sizeof(struct ip_options_rcu) + ((optlen + 3) & ~3), 517 GFP_KERNEL); 518 } 519 520 static int ip_options_get_finish(struct net *net, struct ip_options_rcu **optp, 521 struct ip_options_rcu *opt, int optlen) 522 { 523 while (optlen & 3) 524 opt->opt.__data[optlen++] = IPOPT_END; 525 opt->opt.optlen = optlen; 526 if (optlen && ip_options_compile(net, &opt->opt, NULL)) { 527 kfree(opt); 528 return -EINVAL; 529 } 530 kfree(*optp); 531 *optp = opt; 532 return 0; 533 } 534 535 int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp, 536 unsigned char __user *data, int optlen) 537 { 538 struct ip_options_rcu *opt = ip_options_get_alloc(optlen); 539 540 if (!opt) 541 return -ENOMEM; 542 if (optlen && copy_from_user(opt->opt.__data, data, optlen)) { 543 kfree(opt); 544 return -EFAULT; 545 } 546 return ip_options_get_finish(net, optp, opt, optlen); 547 } 548 549 int ip_options_get(struct net *net, struct ip_options_rcu **optp, 550 unsigned char *data, int optlen) 551 { 552 struct ip_options_rcu *opt = ip_options_get_alloc(optlen); 553 554 if (!opt) 555 return -ENOMEM; 556 if (optlen) 557 memcpy(opt->opt.__data, data, optlen); 558 return ip_options_get_finish(net, optp, opt, optlen); 559 } 560 561 void ip_forward_options(struct sk_buff *skb) 562 { 563 struct ip_options *opt = &(IPCB(skb)->opt); 564 unsigned char *optptr; 565 struct rtable *rt = skb_rtable(skb); 566 unsigned char *raw = skb_network_header(skb); 567 568 if (opt->rr_needaddr) { 569 optptr = (unsigned char *)raw + opt->rr; 570 ip_rt_get_source(&optptr[optptr[2]-5], skb, rt); 571 opt->is_changed = 1; 572 } 573 if (opt->srr_is_hit) { 574 int srrptr, srrspace; 575 576 optptr = raw + opt->srr; 577 578 for ( srrptr=optptr[2], srrspace = optptr[1]; 579 srrptr <= srrspace; 580 srrptr += 4 581 ) { 582 if (srrptr + 3 > srrspace) 583 break; 584 if (memcmp(&opt->nexthop, &optptr[srrptr-1], 4) == 0) 585 break; 586 } 587 if (srrptr + 3 <= srrspace) { 588 opt->is_changed = 1; 589 ip_hdr(skb)->daddr = opt->nexthop; 590 ip_rt_get_source(&optptr[srrptr-1], skb, rt); 591 optptr[2] = srrptr+4; 592 } else { 593 net_crit_ratelimited("%s(): Argh! Destination lost!\n", 594 __func__); 595 } 596 if (opt->ts_needaddr) { 597 optptr = raw + opt->ts; 598 ip_rt_get_source(&optptr[optptr[2]-9], skb, rt); 599 opt->is_changed = 1; 600 } 601 } 602 if (opt->is_changed) { 603 opt->is_changed = 0; 604 ip_send_check(ip_hdr(skb)); 605 } 606 } 607 608 int ip_options_rcv_srr(struct sk_buff *skb) 609 { 610 struct ip_options *opt = &(IPCB(skb)->opt); 611 int srrspace, srrptr; 612 __be32 nexthop; 613 struct iphdr *iph = ip_hdr(skb); 614 unsigned char *optptr = skb_network_header(skb) + opt->srr; 615 struct rtable *rt = skb_rtable(skb); 616 struct rtable *rt2; 617 unsigned long orefdst; 618 int err; 619 620 if (!rt) 621 return 0; 622 623 if (skb->pkt_type != PACKET_HOST) 624 return -EINVAL; 625 if (rt->rt_type == RTN_UNICAST) { 626 if (!opt->is_strictroute) 627 return 0; 628 icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl(16<<24)); 629 return -EINVAL; 630 } 631 if (rt->rt_type != RTN_LOCAL) 632 return -EINVAL; 633 634 for (srrptr=optptr[2], srrspace = optptr[1]; srrptr <= srrspace; srrptr += 4) { 635 if (srrptr + 3 > srrspace) { 636 icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((opt->srr+2)<<24)); 637 return -EINVAL; 638 } 639 memcpy(&nexthop, &optptr[srrptr-1], 4); 640 641 orefdst = skb->_skb_refdst; 642 skb_dst_set(skb, NULL); 643 err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, skb->dev); 644 rt2 = skb_rtable(skb); 645 if (err || (rt2->rt_type != RTN_UNICAST && rt2->rt_type != RTN_LOCAL)) { 646 skb_dst_drop(skb); 647 skb->_skb_refdst = orefdst; 648 return -EINVAL; 649 } 650 refdst_drop(orefdst); 651 if (rt2->rt_type != RTN_LOCAL) 652 break; 653 /* Superfast 8) loopback forward */ 654 iph->daddr = nexthop; 655 opt->is_changed = 1; 656 } 657 if (srrptr <= srrspace) { 658 opt->srr_is_hit = 1; 659 opt->nexthop = nexthop; 660 opt->is_changed = 1; 661 } 662 return 0; 663 } 664 EXPORT_SYMBOL(ip_options_rcv_srr); 665