net/netfilter/xt_iprange.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  *  xt_iprange - Netfilter module to match IP address ranges
0004  *
0005  *  (C) 2003 Jozsef Kadlecsik <kadlec@netfilter.org>
0006  *  (C) CC Computer Consultants GmbH, 2008
0007  */
0008 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
0009 #include <linux/module.h>
0010 #include <linux/skbuff.h>
0011 #include <linux/ip.h>
0012 #include <linux/ipv6.h>
0013 #include <linux/netfilter/x_tables.h>
0014 #include <linux/netfilter/xt_iprange.h>
0015
0016 static bool
0017 iprange_mt4(const struct sk_buff *skb, struct xt_action_param *par)
0018 {
0019     const struct xt_iprange_mtinfo *info = par->matchinfo;
0020     const struct iphdr *iph = ip_hdr(skb);
0021     bool m;
0022
0023     if (info->flags & IPRANGE_SRC) {
0024         m  = ntohl(iph->saddr) < ntohl(info->src_min.ip);
0025         m |= ntohl(iph->saddr) > ntohl(info->src_max.ip);
0026         m ^= !!(info->flags & IPRANGE_SRC_INV);
0027         if (m) {
0028             pr_debug("src IP %pI4 NOT in range %s%pI4-%pI4\n",
0029                      &iph->saddr,
0030                      (info->flags & IPRANGE_SRC_INV) ? "(INV) " : "",
0031                      &info->src_min.ip,
0032                      &info->src_max.ip);
0033             return false;
0034         }
0035     }
0036     if (info->flags & IPRANGE_DST) {
0037         m  = ntohl(iph->daddr) < ntohl(info->dst_min.ip);
0038         m |= ntohl(iph->daddr) > ntohl(info->dst_max.ip);
0039         m ^= !!(info->flags & IPRANGE_DST_INV);
0040         if (m) {
0041             pr_debug("dst IP %pI4 NOT in range %s%pI4-%pI4\n",
0042                      &iph->daddr,
0043                      (info->flags & IPRANGE_DST_INV) ? "(INV) " : "",
0044                      &info->dst_min.ip,
0045                      &info->dst_max.ip);
0046             return false;
0047         }
0048     }
0049     return true;
0050 }
0051
0052 static inline int
0053 iprange_ipv6_lt(const struct in6_addr *a, const struct in6_addr *b)
0054 {
0055     unsigned int i;
0056
0057     for (i = 0; i < 4; ++i) {
0058         if (a->s6_addr32[i] != b->s6_addr32[i])
0059             return ntohl(a->s6_addr32[i]) < ntohl(b->s6_addr32[i]);
0060     }
0061
0062     return 0;
0063 }
0064
0065 static bool
0066 iprange_mt6(const struct sk_buff *skb, struct xt_action_param *par)
0067 {
0068     const struct xt_iprange_mtinfo *info = par->matchinfo;
0069     const struct ipv6hdr *iph = ipv6_hdr(skb);
0070     bool m;
0071
0072     if (info->flags & IPRANGE_SRC) {
0073         m  = iprange_ipv6_lt(&iph->saddr, &info->src_min.in6);
0074         m |= iprange_ipv6_lt(&info->src_max.in6, &iph->saddr);
0075         m ^= !!(info->flags & IPRANGE_SRC_INV);
0076         if (m) {
0077             pr_debug("src IP %pI6 NOT in range %s%pI6-%pI6\n",
0078                  &iph->saddr,
0079                  (info->flags & IPRANGE_SRC_INV) ? "(INV) " : "",
0080                  &info->src_min.in6,
0081                  &info->src_max.in6);
0082             return false;
0083         }
0084     }
0085     if (info->flags & IPRANGE_DST) {
0086         m  = iprange_ipv6_lt(&iph->daddr, &info->dst_min.in6);
0087         m |= iprange_ipv6_lt(&info->dst_max.in6, &iph->daddr);
0088         m ^= !!(info->flags & IPRANGE_DST_INV);
0089         if (m) {
0090             pr_debug("dst IP %pI6 NOT in range %s%pI6-%pI6\n",
0091                  &iph->daddr,
0092                  (info->flags & IPRANGE_DST_INV) ? "(INV) " : "",
0093                  &info->dst_min.in6,
0094                  &info->dst_max.in6);
0095             return false;
0096         }
0097     }
0098     return true;
0099 }
0100
0101 static struct xt_match iprange_mt_reg[] __read_mostly = {
0102     {
0103         .name      = "iprange",
0104         .revision  = 1,
0105         .family    = NFPROTO_IPV4,
0106         .match     = iprange_mt4,
0107         .matchsize = sizeof(struct xt_iprange_mtinfo),
0108         .me        = THIS_MODULE,
0109     },
0110     {
0111         .name      = "iprange",
0112         .revision  = 1,
0113         .family    = NFPROTO_IPV6,
0114         .match     = iprange_mt6,
0115         .matchsize = sizeof(struct xt_iprange_mtinfo),
0116         .me        = THIS_MODULE,
0117     },
0118 };
0119
0120 static int __init iprange_mt_init(void)
0121 {
0122     return xt_register_matches(iprange_mt_reg, ARRAY_SIZE(iprange_mt_reg));
0123 }
0124
0125 static void __exit iprange_mt_exit(void)
0126 {
0127     xt_unregister_matches(iprange_mt_reg, ARRAY_SIZE(iprange_mt_reg));
0128 }
0129
0130 module_init(iprange_mt_init);
0131 module_exit(iprange_mt_exit);
0132 MODULE_LICENSE("GPL");
0133 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
0134 MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
0135 MODULE_DESCRIPTION("Xtables: arbitrary IPv4 range matching");
0136 MODULE_ALIAS("ipt_iprange");
0137 MODULE_ALIAS("ip6t_iprange");