[deliverable/linux.git] / net / ipv6 / netfilter / ip6t_NPT.c

/*
 * Copyright (c) 2011, 2012 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/ipv6.h>
#include <net/ipv6.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv6.h>
#include <linux/netfilter_ipv6/ip6t_NPT.h>
#include <linux/netfilter/x_tables.h>

static int ip6t_npt_checkentry(const struct xt_tgchk_param *par)
{
	struct ip6t_npt_tginfo *npt = par->targinfo;
	struct in6_addr pfx;
	__wsum src_sum, dst_sum;

	if (npt->src_pfx_len > 64 || npt->dst_pfx_len > 64)
		return -EINVAL;

	/* Ensure that LSB of prefix is zero */
	ipv6_addr_prefix(&pfx, &npt->src_pfx.in6, npt->src_pfx_len);
	if (!ipv6_addr_equal(&pfx, &npt->src_pfx.in6))
		return -EINVAL;
	ipv6_addr_prefix(&pfx, &npt->dst_pfx.in6, npt->dst_pfx_len);
	if (!ipv6_addr_equal(&pfx, &npt->dst_pfx.in6))
		return -EINVAL;

	src_sum = csum_partial(&npt->src_pfx.in6, sizeof(npt->src_pfx.in6), 0);
	dst_sum = csum_partial(&npt->dst_pfx.in6, sizeof(npt->dst_pfx.in6), 0);

	npt->adjustment = ~csum_fold(csum_sub(src_sum, dst_sum));
	return 0;
}

static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
			     struct in6_addr *addr)
{
	unsigned int pfx_len;
	unsigned int i, idx;
	__be32 mask;
	__sum16 sum;

	pfx_len = max(npt->src_pfx_len, npt->dst_pfx_len);
	for (i = 0; i < pfx_len; i += 32) {
		if (pfx_len - i >= 32)
			mask = 0;
		else
			mask = htonl((1 << (i - pfx_len + 32)) - 1);

		idx = i / 32;
		addr->s6_addr32[idx] &= mask;
		addr->s6_addr32[idx] |= ~mask & npt->dst_pfx.in6.s6_addr32[idx];
	}

	if (pfx_len <= 48)
		idx = 3;
	else {
		for (idx = 4; idx < ARRAY_SIZE(addr->s6_addr16); idx++) {
			if ((__force __sum16)addr->s6_addr16[idx] !=
			    CSUM_MANGLED_0)
				break;
		}
		if (idx == ARRAY_SIZE(addr->s6_addr16))
			return false;
	}

	sum = ~csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]),
				  csum_unfold(npt->adjustment)));
	if (sum == CSUM_MANGLED_0)
		sum = 0;
	*(__force __sum16 *)&addr->s6_addr16[idx] = sum;

	return true;
}

static unsigned int
ip6t_snpt_tg(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct ip6t_npt_tginfo *npt = par->targinfo;

	if (!ip6t_npt_map_pfx(npt, &ipv6_hdr(skb)->saddr)) {
		icmpv6_send(skb, ICMPV6_PARAMPROB, ICMPV6_HDR_FIELD,
			    offsetof(struct ipv6hdr, saddr));
		return NF_DROP;
	}
	return XT_CONTINUE;
}

static unsigned int
ip6t_dnpt_tg(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct ip6t_npt_tginfo *npt = par->targinfo;

	if (!ip6t_npt_map_pfx(npt, &ipv6_hdr(skb)->daddr)) {
		icmpv6_send(skb, ICMPV6_PARAMPROB, ICMPV6_HDR_FIELD,
			    offsetof(struct ipv6hdr, daddr));
		return NF_DROP;
	}
	return XT_CONTINUE;
}

static struct xt_target ip6t_npt_target_reg[] __read_mostly = {
	{
		.name		= "SNPT",
		.table		= "mangle",
		.target		= ip6t_snpt_tg,
		.targetsize	= sizeof(struct ip6t_npt_tginfo),
		.checkentry	= ip6t_npt_checkentry,
		.family		= NFPROTO_IPV6,
		.hooks		= (1 << NF_INET_LOCAL_IN) |
				  (1 << NF_INET_POST_ROUTING),
		.me		= THIS_MODULE,
	},
	{
		.name		= "DNPT",
		.table		= "mangle",
		.target		= ip6t_dnpt_tg,
		.targetsize	= sizeof(struct ip6t_npt_tginfo),
		.checkentry	= ip6t_npt_checkentry,
		.family		= NFPROTO_IPV6,
		.hooks		= (1 << NF_INET_PRE_ROUTING) |
				  (1 << NF_INET_LOCAL_OUT),
		.me		= THIS_MODULE,
	},
};

static int __init ip6t_npt_init(void)
{
	return xt_register_targets(ip6t_npt_target_reg,
				   ARRAY_SIZE(ip6t_npt_target_reg));
}

static void __exit ip6t_npt_exit(void)
{
	xt_unregister_targets(ip6t_npt_target_reg,
			      ARRAY_SIZE(ip6t_npt_target_reg));
}

module_init(ip6t_npt_init);
module_exit(ip6t_npt_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("IPv6-to-IPv6 Network Prefix Translation (RFC 6296)");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_ALIAS("ip6t_SNPT");
MODULE_ALIAS("ip6t_DNPT");
Commit	Line	Data
8a91bb0c PM	1	/*
	2	* Copyright (c) 2011, 2012 Patrick McHardy <kaber@trash.net>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
	8
	9	#include <linux/module.h>
	10	#include <linux/skbuff.h>
	11	#include <linux/ipv6.h>
edb27228	12	#include <net/ipv6.h>
8a91bb0c PM	13	#include <linux/netfilter.h>
	14	#include <linux/netfilter_ipv6.h>
	15	#include <linux/netfilter_ipv6/ip6t_NPT.h>
	16	#include <linux/netfilter/x_tables.h>
	17
8a91bb0c PM	18	static int ip6t_npt_checkentry(const struct xt_tgchk_param *par)
	19	{
	20	struct ip6t_npt_tginfo *npt = par->targinfo;
edb27228	21	struct in6_addr pfx;
2d2fd8c5	22	__wsum src_sum, dst_sum;
8a91bb0c PM	23
	24	if (npt->src_pfx_len > 64 \|\| npt->dst_pfx_len > 64)
	25	return -EINVAL;
	26
edb27228 YH	27	/* Ensure that LSB of prefix is zero */
	28	ipv6_addr_prefix(&pfx, &npt->src_pfx.in6, npt->src_pfx_len);
	29	if (!ipv6_addr_equal(&pfx, &npt->src_pfx.in6))
	30	return -EINVAL;
	31	ipv6_addr_prefix(&pfx, &npt->dst_pfx.in6, npt->dst_pfx_len);
	32	if (!ipv6_addr_equal(&pfx, &npt->dst_pfx.in6))
	33	return -EINVAL;
	34
2d2fd8c5 YH	35	src_sum = csum_partial(&npt->src_pfx.in6, sizeof(npt->src_pfx.in6), 0);
2d2fd8c5 YH	36	dst_sum = csum_partial(&npt->dst_pfx.in6, sizeof(npt->dst_pfx.in6), 0);
8a91bb0c	37
f5271fff	38	npt->adjustment = ~csum_fold(csum_sub(src_sum, dst_sum));
8a91bb0c PM	39	return 0;
	40	}
	41
	42	static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
	43	struct in6_addr *addr)
	44	{
	45	unsigned int pfx_len;
	46	unsigned int i, idx;
	47	__be32 mask;
	48	__sum16 sum;
	49
	50	pfx_len = max(npt->src_pfx_len, npt->dst_pfx_len);
	51	for (i = 0; i < pfx_len; i += 32) {
	52	if (pfx_len - i >= 32)
	53	mask = 0;
	54	else
906b1c39	55	mask = htonl((1 << (i - pfx_len + 32)) - 1);
8a91bb0c PM	56
	57	idx = i / 32;
	58	addr->s6_addr32[idx] &= mask;
d4c38fa8	59	addr->s6_addr32[idx] \|= ~mask & npt->dst_pfx.in6.s6_addr32[idx];
8a91bb0c PM	60	}
	61
	62	if (pfx_len <= 48)
	63	idx = 3;
	64	else {
	65	for (idx = 4; idx < ARRAY_SIZE(addr->s6_addr16); idx++) {
	66	if ((__force __sum16)addr->s6_addr16[idx] !=
	67	CSUM_MANGLED_0)
	68	break;
	69	}
	70	if (idx == ARRAY_SIZE(addr->s6_addr16))
	71	return false;
	72	}
	73
f5271fff YH	74	sum = ~csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]),
f5271fff YH	75	csum_unfold(npt->adjustment)));
8a91bb0c PM	76	if (sum == CSUM_MANGLED_0)
	77	sum = 0;
	78	(__force __sum16 )&addr->s6_addr16[idx] = sum;
	79
	80	return true;
	81	}
	82
	83	static unsigned int
	84	ip6t_snpt_tg(struct sk_buff skb, const struct xt_action_param par)
	85	{
	86	const struct ip6t_npt_tginfo *npt = par->targinfo;
	87
	88	if (!ip6t_npt_map_pfx(npt, &ipv6_hdr(skb)->saddr)) {
	89	icmpv6_send(skb, ICMPV6_PARAMPROB, ICMPV6_HDR_FIELD,
	90	offsetof(struct ipv6hdr, saddr));
	91	return NF_DROP;
	92	}
	93	return XT_CONTINUE;
	94	}
	95
	96	static unsigned int
	97	ip6t_dnpt_tg(struct sk_buff skb, const struct xt_action_param par)
	98	{
	99	const struct ip6t_npt_tginfo *npt = par->targinfo;
	100
	101	if (!ip6t_npt_map_pfx(npt, &ipv6_hdr(skb)->daddr)) {
	102	icmpv6_send(skb, ICMPV6_PARAMPROB, ICMPV6_HDR_FIELD,
	103	offsetof(struct ipv6hdr, daddr));
	104	return NF_DROP;
	105	}
	106	return XT_CONTINUE;
	107	}
	108
	109	static struct xt_target ip6t_npt_target_reg[] __read_mostly = {
	110	{
	111	.name = "SNPT",
a82783c9	112	.table = "mangle",
8a91bb0c PM	113	.target = ip6t_snpt_tg,
	114	.targetsize = sizeof(struct ip6t_npt_tginfo),
	115	.checkentry = ip6t_npt_checkentry,
	116	.family = NFPROTO_IPV6,
	117	.hooks = (1 << NF_INET_LOCAL_IN) \|
	118	(1 << NF_INET_POST_ROUTING),
	119	.me = THIS_MODULE,
	120	},
	121	{
	122	.name = "DNPT",
a82783c9	123	.table = "mangle",
8a91bb0c PM	124	.target = ip6t_dnpt_tg,
	125	.targetsize = sizeof(struct ip6t_npt_tginfo),
	126	.checkentry = ip6t_npt_checkentry,
	127	.family = NFPROTO_IPV6,
	128	.hooks = (1 << NF_INET_PRE_ROUTING) \|
	129	(1 << NF_INET_LOCAL_OUT),
	130	.me = THIS_MODULE,
	131	},
	132	};
	133
	134	static int __init ip6t_npt_init(void)
	135	{
	136	return xt_register_targets(ip6t_npt_target_reg,
	137	ARRAY_SIZE(ip6t_npt_target_reg));
	138	}
	139
	140	static void __exit ip6t_npt_exit(void)
	141	{
	142	xt_unregister_targets(ip6t_npt_target_reg,
	143	ARRAY_SIZE(ip6t_npt_target_reg));
	144	}
	145
	146	module_init(ip6t_npt_init);
	147	module_exit(ip6t_npt_exit);
	148
	149	MODULE_LICENSE("GPL");
	150	MODULE_DESCRIPTION("IPv6-to-IPv6 Network Prefix Translation (RFC 6296)");
	151	MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
	152	MODULE_ALIAS("ip6t_SNPT");
	153	MODULE_ALIAS("ip6t_DNPT");