1d2912cb1SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
2de81bbeaSFlorian Westphal /*
3de81bbeaSFlorian Westphal * iptables module to match inet_addr_type() of an ip.
4de81bbeaSFlorian Westphal *
5de81bbeaSFlorian Westphal * Copyright (c) 2004 Patrick McHardy <kaber@trash.net>
6de81bbeaSFlorian Westphal * (C) 2007 Laszlo Attila Toth <panther@balabit.hu>
7de81bbeaSFlorian Westphal */
8de81bbeaSFlorian Westphal #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9de81bbeaSFlorian Westphal #include <linux/kernel.h>
10de81bbeaSFlorian Westphal #include <linux/module.h>
11de81bbeaSFlorian Westphal #include <linux/skbuff.h>
12de81bbeaSFlorian Westphal #include <linux/netdevice.h>
13de81bbeaSFlorian Westphal #include <linux/ip.h>
14de81bbeaSFlorian Westphal #include <net/route.h>
15de81bbeaSFlorian Westphal
16c0cd1156SIgor Maravić #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
172f5dc631SFlorian Westphal #include <net/ipv6.h>
182f5dc631SFlorian Westphal #include <net/ip6_route.h>
192f5dc631SFlorian Westphal #include <net/ip6_fib.h>
202f5dc631SFlorian Westphal #endif
212f5dc631SFlorian Westphal
222a7851bfSFlorian Westphal #include <linux/netfilter_ipv6.h>
23de81bbeaSFlorian Westphal #include <linux/netfilter/xt_addrtype.h>
24de81bbeaSFlorian Westphal #include <linux/netfilter/x_tables.h>
25de81bbeaSFlorian Westphal
26de81bbeaSFlorian Westphal MODULE_LICENSE("GPL");
27de81bbeaSFlorian Westphal MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
28de81bbeaSFlorian Westphal MODULE_DESCRIPTION("Xtables: address type match");
29de81bbeaSFlorian Westphal MODULE_ALIAS("ipt_addrtype");
302f5dc631SFlorian Westphal MODULE_ALIAS("ip6t_addrtype");
312f5dc631SFlorian Westphal
32c0cd1156SIgor Maravić #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
match_lookup_rt6(struct net * net,const struct net_device * dev,const struct in6_addr * addr,u16 mask)33b7225041SFlorian Westphal static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,
342a7851bfSFlorian Westphal const struct in6_addr *addr, u16 mask)
352f5dc631SFlorian Westphal {
36b7225041SFlorian Westphal struct flowi6 flow;
37b7225041SFlorian Westphal struct rt6_info *rt;
382a7851bfSFlorian Westphal u32 ret = 0;
39b7225041SFlorian Westphal int route_err;
402f5dc631SFlorian Westphal
41b7225041SFlorian Westphal memset(&flow, 0, sizeof(flow));
424e3fd7a0SAlexey Dobriyan flow.daddr = *addr;
43b7225041SFlorian Westphal if (dev)
44b7225041SFlorian Westphal flow.flowi6_oif = dev->ifindex;
45b7225041SFlorian Westphal
463f87c08cSPablo Neira Ayuso if (dev && (mask & XT_ADDRTYPE_LOCAL)) {
47ac02bcf9SFlorian Westphal if (nf_ipv6_chk_addr(net, addr, dev, true))
482a7851bfSFlorian Westphal ret = XT_ADDRTYPE_LOCAL;
492a7851bfSFlorian Westphal }
50b7225041SFlorian Westphal
51ac02bcf9SFlorian Westphal route_err = nf_ip6_route(net, (struct dst_entry **)&rt,
52ac02bcf9SFlorian Westphal flowi6_to_flowi(&flow), false);
53b7225041SFlorian Westphal if (route_err)
542f5dc631SFlorian Westphal return XT_ADDRTYPE_UNREACHABLE;
552f5dc631SFlorian Westphal
562f5dc631SFlorian Westphal if (rt->rt6i_flags & RTF_REJECT)
572f5dc631SFlorian Westphal ret = XT_ADDRTYPE_UNREACHABLE;
582f5dc631SFlorian Westphal
592a7851bfSFlorian Westphal if (dev == NULL && rt->rt6i_flags & RTF_LOCAL)
602f5dc631SFlorian Westphal ret |= XT_ADDRTYPE_LOCAL;
612647a9b0SMartin KaFai Lau if (ipv6_anycast_destination((struct dst_entry *)rt, addr))
622f5dc631SFlorian Westphal ret |= XT_ADDRTYPE_ANYCAST;
63b7225041SFlorian Westphal
64b7225041SFlorian Westphal dst_release(&rt->dst);
652f5dc631SFlorian Westphal return ret;
662f5dc631SFlorian Westphal }
672f5dc631SFlorian Westphal
match_type6(struct net * net,const struct net_device * dev,const struct in6_addr * addr,u16 mask)682f5dc631SFlorian Westphal static bool match_type6(struct net *net, const struct net_device *dev,
692f5dc631SFlorian Westphal const struct in6_addr *addr, u16 mask)
702f5dc631SFlorian Westphal {
712f5dc631SFlorian Westphal int addr_type = ipv6_addr_type(addr);
722f5dc631SFlorian Westphal
732f5dc631SFlorian Westphal if ((mask & XT_ADDRTYPE_MULTICAST) &&
742f5dc631SFlorian Westphal !(addr_type & IPV6_ADDR_MULTICAST))
752f5dc631SFlorian Westphal return false;
762f5dc631SFlorian Westphal if ((mask & XT_ADDRTYPE_UNICAST) && !(addr_type & IPV6_ADDR_UNICAST))
772f5dc631SFlorian Westphal return false;
782f5dc631SFlorian Westphal if ((mask & XT_ADDRTYPE_UNSPEC) && addr_type != IPV6_ADDR_ANY)
792f5dc631SFlorian Westphal return false;
802f5dc631SFlorian Westphal
812f5dc631SFlorian Westphal if ((XT_ADDRTYPE_LOCAL | XT_ADDRTYPE_ANYCAST |
82b7225041SFlorian Westphal XT_ADDRTYPE_UNREACHABLE) & mask)
832a7851bfSFlorian Westphal return !!(mask & match_lookup_rt6(net, dev, addr, mask));
842f5dc631SFlorian Westphal return true;
852f5dc631SFlorian Westphal }
862f5dc631SFlorian Westphal
872f5dc631SFlorian Westphal static bool
addrtype_mt6(struct net * net,const struct net_device * dev,const struct sk_buff * skb,const struct xt_addrtype_info_v1 * info)882f5dc631SFlorian Westphal addrtype_mt6(struct net *net, const struct net_device *dev,
892f5dc631SFlorian Westphal const struct sk_buff *skb, const struct xt_addrtype_info_v1 *info)
902f5dc631SFlorian Westphal {
912f5dc631SFlorian Westphal const struct ipv6hdr *iph = ipv6_hdr(skb);
922f5dc631SFlorian Westphal bool ret = true;
932f5dc631SFlorian Westphal
942f5dc631SFlorian Westphal if (info->source)
952f5dc631SFlorian Westphal ret &= match_type6(net, dev, &iph->saddr, info->source) ^
962f5dc631SFlorian Westphal (info->flags & XT_ADDRTYPE_INVERT_SOURCE);
972f5dc631SFlorian Westphal if (ret && info->dest)
982f5dc631SFlorian Westphal ret &= match_type6(net, dev, &iph->daddr, info->dest) ^
992f5dc631SFlorian Westphal !!(info->flags & XT_ADDRTYPE_INVERT_DEST);
1002f5dc631SFlorian Westphal return ret;
1012f5dc631SFlorian Westphal }
1022f5dc631SFlorian Westphal #endif
103de81bbeaSFlorian Westphal
match_type(struct net * net,const struct net_device * dev,__be32 addr,u_int16_t mask)104de81bbeaSFlorian Westphal static inline bool match_type(struct net *net, const struct net_device *dev,
105de81bbeaSFlorian Westphal __be32 addr, u_int16_t mask)
106de81bbeaSFlorian Westphal {
107de81bbeaSFlorian Westphal return !!(mask & (1 << inet_dev_addr_type(net, dev, addr)));
108de81bbeaSFlorian Westphal }
109de81bbeaSFlorian Westphal
110de81bbeaSFlorian Westphal static bool
addrtype_mt_v0(const struct sk_buff * skb,struct xt_action_param * par)111de81bbeaSFlorian Westphal addrtype_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)
112de81bbeaSFlorian Westphal {
113613dbd95SPablo Neira Ayuso struct net *net = xt_net(par);
114de81bbeaSFlorian Westphal const struct xt_addrtype_info *info = par->matchinfo;
115de81bbeaSFlorian Westphal const struct iphdr *iph = ip_hdr(skb);
116de81bbeaSFlorian Westphal bool ret = true;
117de81bbeaSFlorian Westphal
118de81bbeaSFlorian Westphal if (info->source)
119de81bbeaSFlorian Westphal ret &= match_type(net, NULL, iph->saddr, info->source) ^
120de81bbeaSFlorian Westphal info->invert_source;
121de81bbeaSFlorian Westphal if (info->dest)
122de81bbeaSFlorian Westphal ret &= match_type(net, NULL, iph->daddr, info->dest) ^
123de81bbeaSFlorian Westphal info->invert_dest;
124de81bbeaSFlorian Westphal
125de81bbeaSFlorian Westphal return ret;
126de81bbeaSFlorian Westphal }
127de81bbeaSFlorian Westphal
128de81bbeaSFlorian Westphal static bool
addrtype_mt_v1(const struct sk_buff * skb,struct xt_action_param * par)129de81bbeaSFlorian Westphal addrtype_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
130de81bbeaSFlorian Westphal {
131613dbd95SPablo Neira Ayuso struct net *net = xt_net(par);
132de81bbeaSFlorian Westphal const struct xt_addrtype_info_v1 *info = par->matchinfo;
1332f5dc631SFlorian Westphal const struct iphdr *iph;
134de81bbeaSFlorian Westphal const struct net_device *dev = NULL;
135de81bbeaSFlorian Westphal bool ret = true;
136de81bbeaSFlorian Westphal
137de81bbeaSFlorian Westphal if (info->flags & XT_ADDRTYPE_LIMIT_IFACE_IN)
138613dbd95SPablo Neira Ayuso dev = xt_in(par);
139de81bbeaSFlorian Westphal else if (info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT)
140613dbd95SPablo Neira Ayuso dev = xt_out(par);
141de81bbeaSFlorian Westphal
142c0cd1156SIgor Maravić #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
143613dbd95SPablo Neira Ayuso if (xt_family(par) == NFPROTO_IPV6)
1442f5dc631SFlorian Westphal return addrtype_mt6(net, dev, skb, info);
1452f5dc631SFlorian Westphal #endif
1462f5dc631SFlorian Westphal iph = ip_hdr(skb);
147de81bbeaSFlorian Westphal if (info->source)
148de81bbeaSFlorian Westphal ret &= match_type(net, dev, iph->saddr, info->source) ^
149de81bbeaSFlorian Westphal (info->flags & XT_ADDRTYPE_INVERT_SOURCE);
150de81bbeaSFlorian Westphal if (ret && info->dest)
151de81bbeaSFlorian Westphal ret &= match_type(net, dev, iph->daddr, info->dest) ^
152de81bbeaSFlorian Westphal !!(info->flags & XT_ADDRTYPE_INVERT_DEST);
153de81bbeaSFlorian Westphal return ret;
154de81bbeaSFlorian Westphal }
155de81bbeaSFlorian Westphal
addrtype_mt_checkentry_v1(const struct xt_mtchk_param * par)156de81bbeaSFlorian Westphal static int addrtype_mt_checkentry_v1(const struct xt_mtchk_param *par)
157de81bbeaSFlorian Westphal {
158c08e5e1eSFlorian Westphal const char *errmsg = "both incoming and outgoing interface limitation cannot be selected";
159de81bbeaSFlorian Westphal struct xt_addrtype_info_v1 *info = par->matchinfo;
160de81bbeaSFlorian Westphal
161de81bbeaSFlorian Westphal if (info->flags & XT_ADDRTYPE_LIMIT_IFACE_IN &&
162c08e5e1eSFlorian Westphal info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT)
163c08e5e1eSFlorian Westphal goto err;
164de81bbeaSFlorian Westphal
165de81bbeaSFlorian Westphal if (par->hook_mask & ((1 << NF_INET_PRE_ROUTING) |
166de81bbeaSFlorian Westphal (1 << NF_INET_LOCAL_IN)) &&
167de81bbeaSFlorian Westphal info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT) {
168c08e5e1eSFlorian Westphal errmsg = "output interface limitation not valid in PREROUTING and INPUT";
169c08e5e1eSFlorian Westphal goto err;
170de81bbeaSFlorian Westphal }
171de81bbeaSFlorian Westphal
172de81bbeaSFlorian Westphal if (par->hook_mask & ((1 << NF_INET_POST_ROUTING) |
173de81bbeaSFlorian Westphal (1 << NF_INET_LOCAL_OUT)) &&
174de81bbeaSFlorian Westphal info->flags & XT_ADDRTYPE_LIMIT_IFACE_IN) {
175c08e5e1eSFlorian Westphal errmsg = "input interface limitation not valid in POSTROUTING and OUTPUT";
176c08e5e1eSFlorian Westphal goto err;
177de81bbeaSFlorian Westphal }
178de81bbeaSFlorian Westphal
179c0cd1156SIgor Maravić #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
1802f5dc631SFlorian Westphal if (par->family == NFPROTO_IPV6) {
1812f5dc631SFlorian Westphal if ((info->source | info->dest) & XT_ADDRTYPE_BLACKHOLE) {
182c08e5e1eSFlorian Westphal errmsg = "ipv6 BLACKHOLE matching not supported";
183c08e5e1eSFlorian Westphal goto err;
1842f5dc631SFlorian Westphal }
1852f5dc631SFlorian Westphal if ((info->source | info->dest) >= XT_ADDRTYPE_PROHIBIT) {
186c08e5e1eSFlorian Westphal errmsg = "ipv6 PROHIBIT (THROW, NAT ..) matching not supported";
187c08e5e1eSFlorian Westphal goto err;
1882f5dc631SFlorian Westphal }
1892f5dc631SFlorian Westphal if ((info->source | info->dest) & XT_ADDRTYPE_BROADCAST) {
190c08e5e1eSFlorian Westphal errmsg = "ipv6 does not support BROADCAST matching";
191c08e5e1eSFlorian Westphal goto err;
1922f5dc631SFlorian Westphal }
1932f5dc631SFlorian Westphal }
1942f5dc631SFlorian Westphal #endif
195de81bbeaSFlorian Westphal return 0;
196c08e5e1eSFlorian Westphal err:
197c08e5e1eSFlorian Westphal pr_info_ratelimited("%s\n", errmsg);
198c08e5e1eSFlorian Westphal return -EINVAL;
199de81bbeaSFlorian Westphal }
200de81bbeaSFlorian Westphal
201de81bbeaSFlorian Westphal static struct xt_match addrtype_mt_reg[] __read_mostly = {
202de81bbeaSFlorian Westphal {
203de81bbeaSFlorian Westphal .name = "addrtype",
204de81bbeaSFlorian Westphal .family = NFPROTO_IPV4,
205de81bbeaSFlorian Westphal .match = addrtype_mt_v0,
206de81bbeaSFlorian Westphal .matchsize = sizeof(struct xt_addrtype_info),
207de81bbeaSFlorian Westphal .me = THIS_MODULE
208de81bbeaSFlorian Westphal },
209de81bbeaSFlorian Westphal {
210de81bbeaSFlorian Westphal .name = "addrtype",
2112f5dc631SFlorian Westphal .family = NFPROTO_UNSPEC,
212de81bbeaSFlorian Westphal .revision = 1,
213de81bbeaSFlorian Westphal .match = addrtype_mt_v1,
214de81bbeaSFlorian Westphal .checkentry = addrtype_mt_checkentry_v1,
215de81bbeaSFlorian Westphal .matchsize = sizeof(struct xt_addrtype_info_v1),
216de81bbeaSFlorian Westphal .me = THIS_MODULE
217de81bbeaSFlorian Westphal }
218de81bbeaSFlorian Westphal };
219de81bbeaSFlorian Westphal
addrtype_mt_init(void)220de81bbeaSFlorian Westphal static int __init addrtype_mt_init(void)
221de81bbeaSFlorian Westphal {
222de81bbeaSFlorian Westphal return xt_register_matches(addrtype_mt_reg,
223de81bbeaSFlorian Westphal ARRAY_SIZE(addrtype_mt_reg));
224de81bbeaSFlorian Westphal }
225de81bbeaSFlorian Westphal
addrtype_mt_exit(void)226de81bbeaSFlorian Westphal static void __exit addrtype_mt_exit(void)
227de81bbeaSFlorian Westphal {
228de81bbeaSFlorian Westphal xt_unregister_matches(addrtype_mt_reg, ARRAY_SIZE(addrtype_mt_reg));
229de81bbeaSFlorian Westphal }
230de81bbeaSFlorian Westphal
231de81bbeaSFlorian Westphal module_init(addrtype_mt_init);
232de81bbeaSFlorian Westphal module_exit(addrtype_mt_exit);
233