ebt_among.c 6.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * ebt_among
  4. *
  5. * Authors:
  6. * Grzegorz Borowiak <grzes@gnu.univ.gda.pl>
  7. *
  8. * August, 2003
  9. *
  10. */
  11. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  12. #include <linux/ip.h>
  13. #include <linux/if_arp.h>
  14. #include <linux/module.h>
  15. #include <linux/netfilter/x_tables.h>
  16. #include <linux/netfilter_bridge/ebtables.h>
  17. #include <linux/netfilter_bridge/ebt_among.h>
  18. static bool ebt_mac_wormhash_contains(const struct ebt_mac_wormhash *wh,
  19. const char *mac, __be32 ip)
  20. {
  21. /* You may be puzzled as to how this code works.
  22. * Some tricks were used, refer to
  23. * include/linux/netfilter_bridge/ebt_among.h
  24. * as there you can find a solution of this mystery.
  25. */
  26. const struct ebt_mac_wormhash_tuple *p;
  27. int start, limit, i;
  28. uint32_t cmp[2] = { 0, 0 };
  29. int key = ((const unsigned char *)mac)[5];
  30. ether_addr_copy(((char *) cmp) + 2, mac);
  31. start = wh->table[key];
  32. limit = wh->table[key + 1];
  33. if (ip) {
  34. for (i = start; i < limit; i++) {
  35. p = &wh->pool[i];
  36. if (cmp[1] == p->cmp[1] && cmp[0] == p->cmp[0])
  37. if (p->ip == 0 || p->ip == ip)
  38. return true;
  39. }
  40. } else {
  41. for (i = start; i < limit; i++) {
  42. p = &wh->pool[i];
  43. if (cmp[1] == p->cmp[1] && cmp[0] == p->cmp[0])
  44. if (p->ip == 0)
  45. return true;
  46. }
  47. }
  48. return false;
  49. }
  50. static int ebt_mac_wormhash_check_integrity(const struct ebt_mac_wormhash
  51. *wh)
  52. {
  53. int i;
  54. for (i = 0; i < 256; i++) {
  55. if (wh->table[i] > wh->table[i + 1])
  56. return -0x100 - i;
  57. if (wh->table[i] < 0)
  58. return -0x200 - i;
  59. if (wh->table[i] > wh->poolsize)
  60. return -0x300 - i;
  61. }
  62. if (wh->table[256] > wh->poolsize)
  63. return -0xc00;
  64. return 0;
  65. }
  66. static int get_ip_dst(const struct sk_buff *skb, __be32 *addr)
  67. {
  68. if (eth_hdr(skb)->h_proto == htons(ETH_P_IP)) {
  69. const struct iphdr *ih;
  70. struct iphdr _iph;
  71. ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
  72. if (ih == NULL)
  73. return -1;
  74. *addr = ih->daddr;
  75. } else if (eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) {
  76. const struct arphdr *ah;
  77. struct arphdr _arph;
  78. const __be32 *bp;
  79. __be32 buf;
  80. ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
  81. if (ah == NULL ||
  82. ah->ar_pln != sizeof(__be32) ||
  83. ah->ar_hln != ETH_ALEN)
  84. return -1;
  85. bp = skb_header_pointer(skb, sizeof(struct arphdr) +
  86. 2 * ETH_ALEN + sizeof(__be32),
  87. sizeof(__be32), &buf);
  88. if (bp == NULL)
  89. return -1;
  90. *addr = *bp;
  91. }
  92. return 0;
  93. }
  94. static int get_ip_src(const struct sk_buff *skb, __be32 *addr)
  95. {
  96. if (eth_hdr(skb)->h_proto == htons(ETH_P_IP)) {
  97. const struct iphdr *ih;
  98. struct iphdr _iph;
  99. ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
  100. if (ih == NULL)
  101. return -1;
  102. *addr = ih->saddr;
  103. } else if (eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) {
  104. const struct arphdr *ah;
  105. struct arphdr _arph;
  106. const __be32 *bp;
  107. __be32 buf;
  108. ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
  109. if (ah == NULL ||
  110. ah->ar_pln != sizeof(__be32) ||
  111. ah->ar_hln != ETH_ALEN)
  112. return -1;
  113. bp = skb_header_pointer(skb, sizeof(struct arphdr) +
  114. ETH_ALEN, sizeof(__be32), &buf);
  115. if (bp == NULL)
  116. return -1;
  117. *addr = *bp;
  118. }
  119. return 0;
  120. }
  121. static bool
  122. ebt_among_mt(const struct sk_buff *skb, struct xt_action_param *par)
  123. {
  124. const struct ebt_among_info *info = par->matchinfo;
  125. const char *dmac, *smac;
  126. const struct ebt_mac_wormhash *wh_dst, *wh_src;
  127. __be32 dip = 0, sip = 0;
  128. wh_dst = ebt_among_wh_dst(info);
  129. wh_src = ebt_among_wh_src(info);
  130. if (wh_src) {
  131. smac = eth_hdr(skb)->h_source;
  132. if (get_ip_src(skb, &sip))
  133. return false;
  134. if (!(info->bitmask & EBT_AMONG_SRC_NEG)) {
  135. /* we match only if it contains */
  136. if (!ebt_mac_wormhash_contains(wh_src, smac, sip))
  137. return false;
  138. } else {
  139. /* we match only if it DOES NOT contain */
  140. if (ebt_mac_wormhash_contains(wh_src, smac, sip))
  141. return false;
  142. }
  143. }
  144. if (wh_dst) {
  145. dmac = eth_hdr(skb)->h_dest;
  146. if (get_ip_dst(skb, &dip))
  147. return false;
  148. if (!(info->bitmask & EBT_AMONG_DST_NEG)) {
  149. /* we match only if it contains */
  150. if (!ebt_mac_wormhash_contains(wh_dst, dmac, dip))
  151. return false;
  152. } else {
  153. /* we match only if it DOES NOT contain */
  154. if (ebt_mac_wormhash_contains(wh_dst, dmac, dip))
  155. return false;
  156. }
  157. }
  158. return true;
  159. }
  160. static bool poolsize_invalid(const struct ebt_mac_wormhash *w)
  161. {
  162. return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple));
  163. }
  164. static bool wormhash_offset_invalid(int off, unsigned int len)
  165. {
  166. if (off == 0) /* not present */
  167. return false;
  168. if (off < (int)sizeof(struct ebt_among_info) ||
  169. off % __alignof__(struct ebt_mac_wormhash))
  170. return true;
  171. off += sizeof(struct ebt_mac_wormhash);
  172. return off > len;
  173. }
  174. static bool wormhash_sizes_valid(const struct ebt_mac_wormhash *wh, int a, int b)
  175. {
  176. if (a == 0)
  177. a = sizeof(struct ebt_among_info);
  178. return ebt_mac_wormhash_size(wh) + a == b;
  179. }
  180. static int ebt_among_mt_check(const struct xt_mtchk_param *par)
  181. {
  182. const struct ebt_among_info *info = par->matchinfo;
  183. const struct ebt_entry_match *em =
  184. container_of(par->matchinfo, const struct ebt_entry_match, data);
  185. unsigned int expected_length = sizeof(struct ebt_among_info);
  186. const struct ebt_mac_wormhash *wh_dst, *wh_src;
  187. int err;
  188. if (expected_length > em->match_size)
  189. return -EINVAL;
  190. if (wormhash_offset_invalid(info->wh_dst_ofs, em->match_size) ||
  191. wormhash_offset_invalid(info->wh_src_ofs, em->match_size))
  192. return -EINVAL;
  193. wh_dst = ebt_among_wh_dst(info);
  194. if (poolsize_invalid(wh_dst))
  195. return -EINVAL;
  196. expected_length += ebt_mac_wormhash_size(wh_dst);
  197. if (expected_length > em->match_size)
  198. return -EINVAL;
  199. wh_src = ebt_among_wh_src(info);
  200. if (poolsize_invalid(wh_src))
  201. return -EINVAL;
  202. if (info->wh_src_ofs < info->wh_dst_ofs) {
  203. if (!wormhash_sizes_valid(wh_src, info->wh_src_ofs, info->wh_dst_ofs))
  204. return -EINVAL;
  205. } else {
  206. if (!wormhash_sizes_valid(wh_dst, info->wh_dst_ofs, info->wh_src_ofs))
  207. return -EINVAL;
  208. }
  209. expected_length += ebt_mac_wormhash_size(wh_src);
  210. if (em->match_size != EBT_ALIGN(expected_length)) {
  211. pr_err_ratelimited("wrong size: %d against expected %d, rounded to %zd\n",
  212. em->match_size, expected_length,
  213. EBT_ALIGN(expected_length));
  214. return -EINVAL;
  215. }
  216. if (wh_dst && (err = ebt_mac_wormhash_check_integrity(wh_dst))) {
  217. pr_err_ratelimited("dst integrity fail: %x\n", -err);
  218. return -EINVAL;
  219. }
  220. if (wh_src && (err = ebt_mac_wormhash_check_integrity(wh_src))) {
  221. pr_err_ratelimited("src integrity fail: %x\n", -err);
  222. return -EINVAL;
  223. }
  224. return 0;
  225. }
  226. static struct xt_match ebt_among_mt_reg __read_mostly = {
  227. .name = "among",
  228. .revision = 0,
  229. .family = NFPROTO_BRIDGE,
  230. .match = ebt_among_mt,
  231. .checkentry = ebt_among_mt_check,
  232. .matchsize = -1, /* special case */
  233. .me = THIS_MODULE,
  234. };
  235. static int __init ebt_among_init(void)
  236. {
  237. return xt_register_match(&ebt_among_mt_reg);
  238. }
  239. static void __exit ebt_among_fini(void)
  240. {
  241. xt_unregister_match(&ebt_among_mt_reg);
  242. }
  243. module_init(ebt_among_init);
  244. module_exit(ebt_among_fini);
  245. MODULE_DESCRIPTION("Ebtables: Combined MAC/IP address list matching");
  246. MODULE_LICENSE("GPL");