1d2912cb1SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
21da177e4SLinus Torvalds /* ipv6header match - matches IPv6 packets based
31da177e4SLinus Torvalds on whether they contain certain headers */
41da177e4SLinus Torvalds
51da177e4SLinus Torvalds /* Original idea: Brad Chapman
61da177e4SLinus Torvalds * Rewritten by: Andras Kis-Szabo <kisza@sch.bme.hu> */
71da177e4SLinus Torvalds
81da177e4SLinus Torvalds /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
91da177e4SLinus Torvalds */
101da177e4SLinus Torvalds
111da177e4SLinus Torvalds #include <linux/module.h>
121da177e4SLinus Torvalds #include <linux/skbuff.h>
131da177e4SLinus Torvalds #include <linux/ipv6.h>
141da177e4SLinus Torvalds #include <linux/types.h>
151da177e4SLinus Torvalds #include <net/checksum.h>
161da177e4SLinus Torvalds #include <net/ipv6.h>
171da177e4SLinus Torvalds
186709dbbbSJan Engelhardt #include <linux/netfilter/x_tables.h>
1944dde236SJeremy Sowden #include <linux/netfilter_ipv6.h>
201da177e4SLinus Torvalds #include <linux/netfilter_ipv6/ip6t_ipv6header.h>
211da177e4SLinus Torvalds
221da177e4SLinus Torvalds MODULE_LICENSE("GPL");
232ae15b64SJan Engelhardt MODULE_DESCRIPTION("Xtables: IPv6 header types match");
241da177e4SLinus Torvalds MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
251da177e4SLinus Torvalds
261d93a9cbSJan Engelhardt static bool
ipv6header_mt6(const struct sk_buff * skb,struct xt_action_param * par)2762fc8051SJan Engelhardt ipv6header_mt6(const struct sk_buff *skb, struct xt_action_param *par)
281da177e4SLinus Torvalds {
29f7108a20SJan Engelhardt const struct ip6t_ipv6header_info *info = par->matchinfo;
301da177e4SLinus Torvalds unsigned int temp;
311da177e4SLinus Torvalds int len;
321da177e4SLinus Torvalds u8 nexthdr;
331da177e4SLinus Torvalds unsigned int ptr;
341da177e4SLinus Torvalds
351da177e4SLinus Torvalds /* Make sure this isn't an evil packet */
361da177e4SLinus Torvalds
371da177e4SLinus Torvalds /* type of the 1st exthdr */
380660e03fSArnaldo Carvalho de Melo nexthdr = ipv6_hdr(skb)->nexthdr;
391da177e4SLinus Torvalds /* pointer to the 1st exthdr */
401da177e4SLinus Torvalds ptr = sizeof(struct ipv6hdr);
411da177e4SLinus Torvalds /* available length */
421da177e4SLinus Torvalds len = skb->len - ptr;
431da177e4SLinus Torvalds temp = 0;
441da177e4SLinus Torvalds
4544dde236SJeremy Sowden while (nf_ip6_ext_hdr(nexthdr)) {
463cf93c96SJan Engelhardt const struct ipv6_opt_hdr *hp;
473cf93c96SJan Engelhardt struct ipv6_opt_hdr _hdr;
481da177e4SLinus Torvalds int hdrlen;
491da177e4SLinus Torvalds
501da177e4SLinus Torvalds /* No more exthdr -> evaluate */
511da177e4SLinus Torvalds if (nexthdr == NEXTHDR_NONE) {
521da177e4SLinus Torvalds temp |= MASK_NONE;
531da177e4SLinus Torvalds break;
541da177e4SLinus Torvalds }
55b98b4947SChristoph Paasch /* Is there enough space for the next ext header? */
56b98b4947SChristoph Paasch if (len < (int)sizeof(struct ipv6_opt_hdr))
57b98b4947SChristoph Paasch return false;
581da177e4SLinus Torvalds /* ESP -> evaluate */
591da177e4SLinus Torvalds if (nexthdr == NEXTHDR_ESP) {
601da177e4SLinus Torvalds temp |= MASK_ESP;
611da177e4SLinus Torvalds break;
621da177e4SLinus Torvalds }
631da177e4SLinus Torvalds
641da177e4SLinus Torvalds hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
6570c0eb1cSFlorian Westphal if (!hp) {
6670c0eb1cSFlorian Westphal par->hotdrop = true;
6770c0eb1cSFlorian Westphal return false;
6870c0eb1cSFlorian Westphal }
691da177e4SLinus Torvalds
701da177e4SLinus Torvalds /* Calculate the header length */
717c4e36bcSJan Engelhardt if (nexthdr == NEXTHDR_FRAGMENT)
721da177e4SLinus Torvalds hdrlen = 8;
737c4e36bcSJan Engelhardt else if (nexthdr == NEXTHDR_AUTH)
74416e8126Syangxingwu hdrlen = ipv6_authlen(hp);
751da177e4SLinus Torvalds else
761da177e4SLinus Torvalds hdrlen = ipv6_optlen(hp);
771da177e4SLinus Torvalds
781da177e4SLinus Torvalds /* set the flag */
791da177e4SLinus Torvalds switch (nexthdr) {
801da177e4SLinus Torvalds case NEXTHDR_HOP:
811da177e4SLinus Torvalds temp |= MASK_HOPOPTS;
821da177e4SLinus Torvalds break;
831da177e4SLinus Torvalds case NEXTHDR_ROUTING:
841da177e4SLinus Torvalds temp |= MASK_ROUTING;
851da177e4SLinus Torvalds break;
861da177e4SLinus Torvalds case NEXTHDR_FRAGMENT:
871da177e4SLinus Torvalds temp |= MASK_FRAGMENT;
881da177e4SLinus Torvalds break;
891da177e4SLinus Torvalds case NEXTHDR_AUTH:
901da177e4SLinus Torvalds temp |= MASK_AH;
911da177e4SLinus Torvalds break;
921da177e4SLinus Torvalds case NEXTHDR_DEST:
931da177e4SLinus Torvalds temp |= MASK_DSTOPTS;
941da177e4SLinus Torvalds break;
951da177e4SLinus Torvalds default:
961d93a9cbSJan Engelhardt return false;
971da177e4SLinus Torvalds }
981da177e4SLinus Torvalds
991da177e4SLinus Torvalds nexthdr = hp->nexthdr;
1001da177e4SLinus Torvalds len -= hdrlen;
1011da177e4SLinus Torvalds ptr += hdrlen;
1021da177e4SLinus Torvalds if (ptr > skb->len)
1031da177e4SLinus Torvalds break;
1041da177e4SLinus Torvalds }
1051da177e4SLinus Torvalds
1067c4e36bcSJan Engelhardt if (nexthdr != NEXTHDR_NONE && nexthdr != NEXTHDR_ESP)
1071da177e4SLinus Torvalds temp |= MASK_PROTO;
1081da177e4SLinus Torvalds
1091da177e4SLinus Torvalds if (info->modeflag)
1101da177e4SLinus Torvalds return !((temp ^ info->matchflags ^ info->invflags)
1111da177e4SLinus Torvalds & info->matchflags);
1121da177e4SLinus Torvalds else {
1131da177e4SLinus Torvalds if (info->invflags)
1141da177e4SLinus Torvalds return temp != info->matchflags;
1151da177e4SLinus Torvalds else
1161da177e4SLinus Torvalds return temp == info->matchflags;
1171da177e4SLinus Torvalds }
1181da177e4SLinus Torvalds }
1191da177e4SLinus Torvalds
ipv6header_mt6_check(const struct xt_mtchk_param * par)120b0f38452SJan Engelhardt static int ipv6header_mt6_check(const struct xt_mtchk_param *par)
1211da177e4SLinus Torvalds {
1229b4fce7aSJan Engelhardt const struct ip6t_ipv6header_info *info = par->matchinfo;
1231da177e4SLinus Torvalds
1241da177e4SLinus Torvalds /* invflags is 0 or 0xff in hard mode */
125f0daaa65SYasuyuki Kozakai if ((!info->modeflag) && info->invflags != 0x00 &&
126f0daaa65SYasuyuki Kozakai info->invflags != 0xFF)
127bd414ee6SJan Engelhardt return -EINVAL;
1281da177e4SLinus Torvalds
129bd414ee6SJan Engelhardt return 0;
1301da177e4SLinus Torvalds }
1311da177e4SLinus Torvalds
132d3c5ee6dSJan Engelhardt static struct xt_match ipv6header_mt6_reg __read_mostly = {
1331da177e4SLinus Torvalds .name = "ipv6header",
134ee999d8bSJan Engelhardt .family = NFPROTO_IPV6,
135d3c5ee6dSJan Engelhardt .match = ipv6header_mt6,
1367f939713SPatrick McHardy .matchsize = sizeof(struct ip6t_ipv6header_info),
137d3c5ee6dSJan Engelhardt .checkentry = ipv6header_mt6_check,
1381da177e4SLinus Torvalds .destroy = NULL,
1391da177e4SLinus Torvalds .me = THIS_MODULE,
1401da177e4SLinus Torvalds };
1411da177e4SLinus Torvalds
ipv6header_mt6_init(void)142d3c5ee6dSJan Engelhardt static int __init ipv6header_mt6_init(void)
1431da177e4SLinus Torvalds {
144d3c5ee6dSJan Engelhardt return xt_register_match(&ipv6header_mt6_reg);
1451da177e4SLinus Torvalds }
1461da177e4SLinus Torvalds
ipv6header_mt6_exit(void)147d3c5ee6dSJan Engelhardt static void __exit ipv6header_mt6_exit(void)
1481da177e4SLinus Torvalds {
149d3c5ee6dSJan Engelhardt xt_unregister_match(&ipv6header_mt6_reg);
1501da177e4SLinus Torvalds }
1511da177e4SLinus Torvalds
152d3c5ee6dSJan Engelhardt module_init(ipv6header_mt6_init);
153d3c5ee6dSJan Engelhardt module_exit(ipv6header_mt6_exit);
154