[deliverable/linux.git] / net / netfilter / xt_addrtype.c

/*
 *  iptables module to match inet_addr_type() of an ip.
 *
 *  Copyright (c) 2004 Patrick McHardy <kaber@trash.net>
 *  (C) 2007 Laszlo Attila Toth <panther@balabit.hu>
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License version 2 as
 *  published by the Free Software Foundation.
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/ip.h>
#include <net/route.h>

#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
#include <net/ipv6.h>
#include <net/ip6_route.h>
#include <net/ip6_fib.h>
#endif

#include <linux/netfilter/xt_addrtype.h>
#include <linux/netfilter/x_tables.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_DESCRIPTION("Xtables: address type match");
MODULE_ALIAS("ipt_addrtype");
MODULE_ALIAS("ip6t_addrtype");

#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
static u32 xt_addrtype_rt6_to_type(const struct rt6_info *rt)
{
	u32 ret;

	if (!rt)
		return XT_ADDRTYPE_UNREACHABLE;

	if (rt->rt6i_flags & RTF_REJECT)
		ret = XT_ADDRTYPE_UNREACHABLE;
	else
		ret = 0;

	if (rt->rt6i_flags & RTF_LOCAL)
		ret |= XT_ADDRTYPE_LOCAL;
	if (rt->rt6i_flags & RTF_ANYCAST)
		ret |= XT_ADDRTYPE_ANYCAST;
	return ret;
}

static bool match_type6(struct net *net, const struct net_device *dev,
				const struct in6_addr *addr, u16 mask)
{
	int addr_type = ipv6_addr_type(addr);

	if ((mask & XT_ADDRTYPE_MULTICAST) &&
	    !(addr_type & IPV6_ADDR_MULTICAST))
		return false;
	if ((mask & XT_ADDRTYPE_UNICAST) && !(addr_type & IPV6_ADDR_UNICAST))
		return false;
	if ((mask & XT_ADDRTYPE_UNSPEC) && addr_type != IPV6_ADDR_ANY)
		return false;

	if ((XT_ADDRTYPE_LOCAL | XT_ADDRTYPE_ANYCAST |
	     XT_ADDRTYPE_UNREACHABLE) & mask) {
		struct rt6_info *rt;
		u32 type;
		int ifindex = dev ? dev->ifindex : 0;

		rt = rt6_lookup(net, addr, NULL, ifindex, !!dev);

		type = xt_addrtype_rt6_to_type(rt);

		dst_release(&rt->dst);
		return !!(mask & type);
	}
	return true;
}

static bool
addrtype_mt6(struct net *net, const struct net_device *dev,
	const struct sk_buff *skb, const struct xt_addrtype_info_v1 *info)
{
	const struct ipv6hdr *iph = ipv6_hdr(skb);
	bool ret = true;

	if (info->source)
		ret &= match_type6(net, dev, &iph->saddr, info->source) ^
		       (info->flags & XT_ADDRTYPE_INVERT_SOURCE);
	if (ret && info->dest)
		ret &= match_type6(net, dev, &iph->daddr, info->dest) ^
		       !!(info->flags & XT_ADDRTYPE_INVERT_DEST);
	return ret;
}
#endif

static inline bool match_type(struct net *net, const struct net_device *dev,
			      __be32 addr, u_int16_t mask)
{
	return !!(mask & (1 << inet_dev_addr_type(net, dev, addr)));
}

static bool
addrtype_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)
{
	struct net *net = dev_net(par->in ? par->in : par->out);
	const struct xt_addrtype_info *info = par->matchinfo;
	const struct iphdr *iph = ip_hdr(skb);
	bool ret = true;

	if (info->source)
		ret &= match_type(net, NULL, iph->saddr, info->source) ^
		       info->invert_source;
	if (info->dest)
		ret &= match_type(net, NULL, iph->daddr, info->dest) ^
		       info->invert_dest;

	return ret;
}

static bool
addrtype_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
{
	struct net *net = dev_net(par->in ? par->in : par->out);
	const struct xt_addrtype_info_v1 *info = par->matchinfo;
	const struct iphdr *iph;
	const struct net_device *dev = NULL;
	bool ret = true;

	if (info->flags & XT_ADDRTYPE_LIMIT_IFACE_IN)
		dev = par->in;
	else if (info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT)
		dev = par->out;

#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
	if (par->family == NFPROTO_IPV6)
		return addrtype_mt6(net, dev, skb, info);
#endif
	iph = ip_hdr(skb);
	if (info->source)
		ret &= match_type(net, dev, iph->saddr, info->source) ^
		       (info->flags & XT_ADDRTYPE_INVERT_SOURCE);
	if (ret && info->dest)
		ret &= match_type(net, dev, iph->daddr, info->dest) ^
		       !!(info->flags & XT_ADDRTYPE_INVERT_DEST);
	return ret;
}

static int addrtype_mt_checkentry_v1(const struct xt_mtchk_param *par)
{
	struct xt_addrtype_info_v1 *info = par->matchinfo;

	if (info->flags & XT_ADDRTYPE_LIMIT_IFACE_IN &&
	    info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT) {
		pr_info("both incoming and outgoing "
			"interface limitation cannot be selected\n");
		return -EINVAL;
	}

	if (par->hook_mask & ((1 << NF_INET_PRE_ROUTING) |
	    (1 << NF_INET_LOCAL_IN)) &&
	    info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT) {
		pr_info("output interface limitation "
			"not valid in PREROUTING and INPUT\n");
		return -EINVAL;
	}

	if (par->hook_mask & ((1 << NF_INET_POST_ROUTING) |
	    (1 << NF_INET_LOCAL_OUT)) &&
	    info->flags & XT_ADDRTYPE_LIMIT_IFACE_IN) {
		pr_info("input interface limitation "
			"not valid in POSTROUTING and OUTPUT\n");
		return -EINVAL;
	}

#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
	if (par->family == NFPROTO_IPV6) {
		if ((info->source | info->dest) & XT_ADDRTYPE_BLACKHOLE) {
			pr_err("ipv6 BLACKHOLE matching not supported\n");
			return -EINVAL;
		}
		if ((info->source | info->dest) >= XT_ADDRTYPE_PROHIBIT) {
			pr_err("ipv6 PROHIBT (THROW, NAT ..) matching not supported\n");
			return -EINVAL;
		}
		if ((info->source | info->dest) & XT_ADDRTYPE_BROADCAST) {
			pr_err("ipv6 does not support BROADCAST matching\n");
			return -EINVAL;
		}
	}
#endif
	return 0;
}

static struct xt_match addrtype_mt_reg[] __read_mostly = {
	{
		.name		= "addrtype",
		.family		= NFPROTO_IPV4,
		.match		= addrtype_mt_v0,
		.matchsize	= sizeof(struct xt_addrtype_info),
		.me		= THIS_MODULE
	},
	{
		.name		= "addrtype",
		.family		= NFPROTO_UNSPEC,
		.revision	= 1,
		.match		= addrtype_mt_v1,
		.checkentry	= addrtype_mt_checkentry_v1,
		.matchsize	= sizeof(struct xt_addrtype_info_v1),
		.me		= THIS_MODULE
	}
};

static int __init addrtype_mt_init(void)
{
	return xt_register_matches(addrtype_mt_reg,
				   ARRAY_SIZE(addrtype_mt_reg));
}

static void __exit addrtype_mt_exit(void)
{
	xt_unregister_matches(addrtype_mt_reg, ARRAY_SIZE(addrtype_mt_reg));
}

module_init(addrtype_mt_init);
module_exit(addrtype_mt_exit);
Commit	Line	Data
1da177e4 LT	1	/*
	2	* iptables module to match inet_addr_type() of an ip.
	3	*
	4	* Copyright (c) 2004 Patrick McHardy <kaber@trash.net>
e2cf5ecb	5	* (C) 2007 Laszlo Attila Toth <panther@balabit.hu>
1da177e4 LT	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
	10	*/
ff67e4e4	11	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
1da177e4 LT	12	#include <linux/kernel.h>
	13	#include <linux/module.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/netdevice.h>
	16	#include <linux/ip.h>
	17	#include <net/route.h>
	18
2f5dc631 FW	19	#if defined(CONFIG_IP6_NF_IPTABLES) \|\| defined(CONFIG_IP6_NF_IPTABLES_MODULE)
	20	#include <net/ipv6.h>
	21	#include <net/ip6_route.h>
	22	#include <net/ip6_fib.h>
	23	#endif
	24
de81bbea	25	#include <linux/netfilter/xt_addrtype.h>
6709dbbb	26	#include <linux/netfilter/x_tables.h>
1da177e4 LT	27
	28	MODULE_LICENSE("GPL");
	29	MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
de81bbea FW	30	MODULE_DESCRIPTION("Xtables: address type match");
de81bbea FW	31	MODULE_ALIAS("ipt_addrtype");
2f5dc631 FW	32	MODULE_ALIAS("ip6t_addrtype");
	33
	34	#if defined(CONFIG_IP6_NF_IPTABLES) \|\| defined(CONFIG_IP6_NF_IPTABLES_MODULE)
	35	static u32 xt_addrtype_rt6_to_type(const struct rt6_info *rt)
	36	{
	37	u32 ret;
	38
	39	if (!rt)
	40	return XT_ADDRTYPE_UNREACHABLE;
	41
	42	if (rt->rt6i_flags & RTF_REJECT)
	43	ret = XT_ADDRTYPE_UNREACHABLE;
	44	else
	45	ret = 0;
	46
	47	if (rt->rt6i_flags & RTF_LOCAL)
	48	ret \|= XT_ADDRTYPE_LOCAL;
	49	if (rt->rt6i_flags & RTF_ANYCAST)
	50	ret \|= XT_ADDRTYPE_ANYCAST;
	51	return ret;
	52	}
	53
	54	static bool match_type6(struct net net, const struct net_device dev,
	55	const struct in6_addr *addr, u16 mask)
	56	{
	57	int addr_type = ipv6_addr_type(addr);
	58
	59	if ((mask & XT_ADDRTYPE_MULTICAST) &&
	60	!(addr_type & IPV6_ADDR_MULTICAST))
	61	return false;
	62	if ((mask & XT_ADDRTYPE_UNICAST) && !(addr_type & IPV6_ADDR_UNICAST))
	63	return false;
	64	if ((mask & XT_ADDRTYPE_UNSPEC) && addr_type != IPV6_ADDR_ANY)
	65	return false;
	66
	67	if ((XT_ADDRTYPE_LOCAL \| XT_ADDRTYPE_ANYCAST \|
	68	XT_ADDRTYPE_UNREACHABLE) & mask) {
	69	struct rt6_info *rt;
	70	u32 type;
	71	int ifindex = dev ? dev->ifindex : 0;
	72
	73	rt = rt6_lookup(net, addr, NULL, ifindex, !!dev);
	74
	75	type = xt_addrtype_rt6_to_type(rt);
	76
	77	dst_release(&rt->dst);
	78	return !!(mask & type);
	79	}
	80	return true;
	81	}
	82
	83	static bool
	84	addrtype_mt6(struct net net, const struct net_device dev,
	85	const struct sk_buff skb, const struct xt_addrtype_info_v1 info)
	86	{
	87	const struct ipv6hdr *iph = ipv6_hdr(skb);
	88	bool ret = true;
	89
	90	if (info->source)
	91	ret &= match_type6(net, dev, &iph->saddr, info->source) ^
	92	(info->flags & XT_ADDRTYPE_INVERT_SOURCE);
	93	if (ret && info->dest)
	94	ret &= match_type6(net, dev, &iph->daddr, info->dest) ^
	95	!!(info->flags & XT_ADDRTYPE_INVERT_DEST);
96	return ret;
97	}
98	#endif
1da177e4	99
d4ec52ba AD	100	static inline bool match_type(struct net net, const struct net_device dev,
d4ec52ba AD	101	__be32 addr, u_int16_t mask)
1da177e4	102	{
d4ec52ba	103	return !!(mask & (1 << inet_dev_addr_type(net, dev, addr)));
1da177e4 LT	104	}
1da177e4 LT	105
d3c5ee6d	106	static bool
62fc8051	107	addrtype_mt_v0(const struct sk_buff skb, struct xt_action_param par)
1da177e4	108	{
d4ec52ba	109	struct net *net = dev_net(par->in ? par->in : par->out);
de81bbea	110	const struct xt_addrtype_info *info = par->matchinfo;
eddc9ec5	111	const struct iphdr *iph = ip_hdr(skb);
1d93a9cb	112	bool ret = true;
1da177e4 LT	113
1da177e4 LT	114	if (info->source)
d4ec52ba	115	ret &= match_type(net, NULL, iph->saddr, info->source) ^
e2cf5ecb	116	info->invert_source;
1da177e4	117	if (info->dest)
d4ec52ba	118	ret &= match_type(net, NULL, iph->daddr, info->dest) ^
e2cf5ecb	119	info->invert_dest;
e905a9ed	120
1da177e4 LT	121	return ret;
	122	}
	123
e2cf5ecb	124	static bool
62fc8051	125	addrtype_mt_v1(const struct sk_buff skb, struct xt_action_param par)
e2cf5ecb	126	{
d4ec52ba	127	struct net *net = dev_net(par->in ? par->in : par->out);
de81bbea	128	const struct xt_addrtype_info_v1 *info = par->matchinfo;
2f5dc631	129	const struct iphdr *iph;
e2cf5ecb LAT	130	const struct net_device *dev = NULL;
	131	bool ret = true;
	132
de81bbea	133	if (info->flags & XT_ADDRTYPE_LIMIT_IFACE_IN)
f7108a20	134	dev = par->in;
de81bbea	135	else if (info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT)
f7108a20	136	dev = par->out;
e2cf5ecb	137
2f5dc631 FW	138	#if defined(CONFIG_IP6_NF_IPTABLES) \|\| defined(CONFIG_IP6_NF_IPTABLES_MODULE)
	139	if (par->family == NFPROTO_IPV6)
	140	return addrtype_mt6(net, dev, skb, info);
	141	#endif
	142	iph = ip_hdr(skb);
e2cf5ecb	143	if (info->source)
d4ec52ba	144	ret &= match_type(net, dev, iph->saddr, info->source) ^
de81bbea	145	(info->flags & XT_ADDRTYPE_INVERT_SOURCE);
e2cf5ecb	146	if (ret && info->dest)
d4ec52ba	147	ret &= match_type(net, dev, iph->daddr, info->dest) ^
de81bbea	148	!!(info->flags & XT_ADDRTYPE_INVERT_DEST);
e2cf5ecb LAT	149	return ret;
	150	}
	151
b0f38452	152	static int addrtype_mt_checkentry_v1(const struct xt_mtchk_param *par)
e2cf5ecb	153	{
de81bbea	154	struct xt_addrtype_info_v1 *info = par->matchinfo;
e2cf5ecb	155
de81bbea FW	156	if (info->flags & XT_ADDRTYPE_LIMIT_IFACE_IN &&
de81bbea FW	157	info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT) {
ff67e4e4 JE	158	pr_info("both incoming and outgoing "
ff67e4e4 JE	159	"interface limitation cannot be selected\n");
bd414ee6	160	return -EINVAL;
e2cf5ecb LAT	161	}
e2cf5ecb LAT	162
9b4fce7a JE	163	if (par->hook_mask & ((1 << NF_INET_PRE_ROUTING) \|
9b4fce7a JE	164	(1 << NF_INET_LOCAL_IN)) &&
de81bbea	165	info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT) {
ff67e4e4 JE	166	pr_info("output interface limitation "
ff67e4e4 JE	167	"not valid in PREROUTING and INPUT\n");
bd414ee6	168	return -EINVAL;
e2cf5ecb LAT	169	}
e2cf5ecb LAT	170
9b4fce7a JE	171	if (par->hook_mask & ((1 << NF_INET_POST_ROUTING) \|
9b4fce7a JE	172	(1 << NF_INET_LOCAL_OUT)) &&
de81bbea	173	info->flags & XT_ADDRTYPE_LIMIT_IFACE_IN) {
ff67e4e4 JE	174	pr_info("input interface limitation "
ff67e4e4 JE	175	"not valid in POSTROUTING and OUTPUT\n");
bd414ee6	176	return -EINVAL;
e2cf5ecb LAT	177	}
e2cf5ecb LAT	178
2f5dc631 FW	179	#if defined(CONFIG_IP6_NF_IPTABLES) \|\| defined(CONFIG_IP6_NF_IPTABLES_MODULE)
	180	if (par->family == NFPROTO_IPV6) {
	181	if ((info->source \| info->dest) & XT_ADDRTYPE_BLACKHOLE) {
	182	pr_err("ipv6 BLACKHOLE matching not supported\n");
	183	return -EINVAL;
	184	}
	185	if ((info->source \| info->dest) >= XT_ADDRTYPE_PROHIBIT) {
	186	pr_err("ipv6 PROHIBT (THROW, NAT ..) matching not supported\n");
	187	return -EINVAL;
	188	}
	189	if ((info->source \| info->dest) & XT_ADDRTYPE_BROADCAST) {
	190	pr_err("ipv6 does not support BROADCAST matching\n");
	191	return -EINVAL;
	192	}
	193	}
	194	#endif
bd414ee6	195	return 0;
e2cf5ecb LAT	196	}
	197
	198	static struct xt_match addrtype_mt_reg[] __read_mostly = {
	199	{
	200	.name = "addrtype",
ee999d8b	201	.family = NFPROTO_IPV4,
e2cf5ecb	202	.match = addrtype_mt_v0,
de81bbea	203	.matchsize = sizeof(struct xt_addrtype_info),
e2cf5ecb LAT	204	.me = THIS_MODULE
	205	},
	206	{
	207	.name = "addrtype",
2f5dc631	208	.family = NFPROTO_UNSPEC,
e2cf5ecb LAT	209	.revision = 1,
	210	.match = addrtype_mt_v1,
	211	.checkentry = addrtype_mt_checkentry_v1,
de81bbea	212	.matchsize = sizeof(struct xt_addrtype_info_v1),
e2cf5ecb LAT	213	.me = THIS_MODULE
e2cf5ecb LAT	214	}
1da177e4 LT	215	};
1da177e4 LT	216
d3c5ee6d	217	static int __init addrtype_mt_init(void)
1da177e4	218	{
e2cf5ecb LAT	219	return xt_register_matches(addrtype_mt_reg,
e2cf5ecb LAT	220	ARRAY_SIZE(addrtype_mt_reg));
1da177e4 LT	221	}
1da177e4 LT	222
d3c5ee6d	223	static void __exit addrtype_mt_exit(void)
1da177e4	224	{
e2cf5ecb	225	xt_unregister_matches(addrtype_mt_reg, ARRAY_SIZE(addrtype_mt_reg));
1da177e4 LT	226	}
1da177e4 LT	227
d3c5ee6d JE	228	module_init(addrtype_mt_init);
d3c5ee6d JE	229	module_exit(addrtype_mt_exit);