bridge/netfilter/ebt_ip.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  *  ebt_ip
0004  *
0005  *  Authors:
0006  *  Bart De Schuymer <bdschuym@pandora.be>
0007  *
0008  *  April, 2002
0009  *
0010  *  Changes:
0011  *    added ip-sport and ip-dport
0012  *    Innominate Security Technologies AG <mhopf@innominate.com>
0013  *    September, 2002
0014  */
0015 #include <linux/ip.h>
0016 #include <net/ip.h>
0017 #include <linux/in.h>
0018 #include <linux/module.h>
0019 #include <linux/netfilter/x_tables.h>
0020 #include <linux/netfilter_bridge/ebtables.h>
0021 #include <linux/netfilter_bridge/ebt_ip.h>
0022
0023 union pkthdr {
0024     struct {
0025         __be16 src;
0026         __be16 dst;
0027     } tcpudphdr;
0028     struct {
0029         u8 type;
0030         u8 code;
0031     } icmphdr;
0032     struct {
0033         u8 type;
0034     } igmphdr;
0035 };
0036
0037 static bool
0038 ebt_ip_mt(const struct sk_buff *skb, struct xt_action_param *par)
0039 {
0040     const struct ebt_ip_info *info = par->matchinfo;
0041     const struct iphdr *ih;
0042     struct iphdr _iph;
0043     const union pkthdr *pptr;
0044     union pkthdr _pkthdr;
0045
0046     ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
0047     if (ih == NULL)
0048         return false;
0049     if ((info->bitmask & EBT_IP_TOS) &&
0050         NF_INVF(info, EBT_IP_TOS, info->tos != ih->tos))
0051         return false;
0052     if ((info->bitmask & EBT_IP_SOURCE) &&
0053         NF_INVF(info, EBT_IP_SOURCE,
0054             (ih->saddr & info->smsk) != info->saddr))
0055         return false;
0056     if ((info->bitmask & EBT_IP_DEST) &&
0057         NF_INVF(info, EBT_IP_DEST,
0058             (ih->daddr & info->dmsk) != info->daddr))
0059         return false;
0060     if (info->bitmask & EBT_IP_PROTO) {
0061         if (NF_INVF(info, EBT_IP_PROTO, info->protocol != ih->protocol))
0062             return false;
0063         if (!(info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT |
0064                        EBT_IP_ICMP | EBT_IP_IGMP)))
0065             return true;
0066         if (ntohs(ih->frag_off) & IP_OFFSET)
0067             return false;
0068
0069         /* min icmp/igmp headersize is 4, so sizeof(_pkthdr) is ok. */
0070         pptr = skb_header_pointer(skb, ih->ihl*4,
0071                       sizeof(_pkthdr), &_pkthdr);
0072         if (pptr == NULL)
0073             return false;
0074         if (info->bitmask & EBT_IP_DPORT) {
0075             u32 dst = ntohs(pptr->tcpudphdr.dst);
0076             if (NF_INVF(info, EBT_IP_DPORT,
0077                     dst < info->dport[0] ||
0078                     dst > info->dport[1]))
0079                 return false;
0080         }
0081         if (info->bitmask & EBT_IP_SPORT) {
0082             u32 src = ntohs(pptr->tcpudphdr.src);
0083             if (NF_INVF(info, EBT_IP_SPORT,
0084                     src < info->sport[0] ||
0085                     src > info->sport[1]))
0086                 return false;
0087         }
0088         if ((info->bitmask & EBT_IP_ICMP) &&
0089             NF_INVF(info, EBT_IP_ICMP,
0090                 pptr->icmphdr.type < info->icmp_type[0] ||
0091                 pptr->icmphdr.type > info->icmp_type[1] ||
0092                 pptr->icmphdr.code < info->icmp_code[0] ||
0093                 pptr->icmphdr.code > info->icmp_code[1]))
0094             return false;
0095         if ((info->bitmask & EBT_IP_IGMP) &&
0096             NF_INVF(info, EBT_IP_IGMP,
0097                 pptr->igmphdr.type < info->igmp_type[0] ||
0098                 pptr->igmphdr.type > info->igmp_type[1]))
0099             return false;
0100     }
0101     return true;
0102 }
0103
0104 static int ebt_ip_mt_check(const struct xt_mtchk_param *par)
0105 {
0106     const struct ebt_ip_info *info = par->matchinfo;
0107     const struct ebt_entry *e = par->entryinfo;
0108
0109     if (e->ethproto != htons(ETH_P_IP) ||
0110        e->invflags & EBT_IPROTO)
0111         return -EINVAL;
0112     if (info->bitmask & ~EBT_IP_MASK || info->invflags & ~EBT_IP_MASK)
0113         return -EINVAL;
0114     if (info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT)) {
0115         if (info->invflags & EBT_IP_PROTO)
0116             return -EINVAL;
0117         if (info->protocol != IPPROTO_TCP &&
0118             info->protocol != IPPROTO_UDP &&
0119             info->protocol != IPPROTO_UDPLITE &&
0120             info->protocol != IPPROTO_SCTP &&
0121             info->protocol != IPPROTO_DCCP)
0122              return -EINVAL;
0123     }
0124     if (info->bitmask & EBT_IP_DPORT && info->dport[0] > info->dport[1])
0125         return -EINVAL;
0126     if (info->bitmask & EBT_IP_SPORT && info->sport[0] > info->sport[1])
0127         return -EINVAL;
0128     if (info->bitmask & EBT_IP_ICMP) {
0129         if ((info->invflags & EBT_IP_PROTO) ||
0130             info->protocol != IPPROTO_ICMP)
0131             return -EINVAL;
0132         if (info->icmp_type[0] > info->icmp_type[1] ||
0133             info->icmp_code[0] > info->icmp_code[1])
0134             return -EINVAL;
0135     }
0136     if (info->bitmask & EBT_IP_IGMP) {
0137         if ((info->invflags & EBT_IP_PROTO) ||
0138             info->protocol != IPPROTO_IGMP)
0139             return -EINVAL;
0140         if (info->igmp_type[0] > info->igmp_type[1])
0141             return -EINVAL;
0142     }
0143     return 0;
0144 }
0145
0146 static struct xt_match ebt_ip_mt_reg __read_mostly = {
0147     .name       = "ip",
0148     .revision   = 0,
0149     .family     = NFPROTO_BRIDGE,
0150     .match      = ebt_ip_mt,
0151     .checkentry = ebt_ip_mt_check,
0152     .matchsize  = sizeof(struct ebt_ip_info),
0153     .me     = THIS_MODULE,
0154 };
0155
0156 static int __init ebt_ip_init(void)
0157 {
0158     return xt_register_match(&ebt_ip_mt_reg);
0159 }
0160
0161 static void __exit ebt_ip_fini(void)
0162 {
0163     xt_unregister_match(&ebt_ip_mt_reg);
0164 }
0165
0166 module_init(ebt_ip_init);
0167 module_exit(ebt_ip_fini);
0168 MODULE_DESCRIPTION("Ebtables: IPv4 protocol packet match");
0169 MODULE_LICENSE("GPL");