[linux.git] / net / netfilter / xt_iprange.c

/*
 *	xt_iprange - Netfilter module to match IP address ranges
 *
 *	(C) 2003 Jozsef Kadlecsik <[email protected]>
 *	(C) CC Computer Consultants GmbH, 2008
 *
 *	This program is free software; you can redistribute it and/or modify
 *	it under the terms of the GNU General Public License version 2 as
 *	published by the Free Software Foundation.
 */
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_iprange.h>
#include <linux/netfilter_ipv4/ipt_iprange.h>

static bool
iprange_mt_v0(const struct sk_buff *skb, const struct net_device *in,
              const struct net_device *out, const struct xt_match *match,
              const void *matchinfo, int offset, unsigned int protoff,
              bool *hotdrop)
{
	const struct ipt_iprange_info *info = matchinfo;
	const struct iphdr *iph = ip_hdr(skb);

	if (info->flags & IPRANGE_SRC) {
		if ((ntohl(iph->saddr) < ntohl(info->src.min_ip)
			  || ntohl(iph->saddr) > ntohl(info->src.max_ip))
			 ^ !!(info->flags & IPRANGE_SRC_INV)) {
			pr_debug("src IP %u.%u.%u.%u NOT in range %s"
				 "%u.%u.%u.%u-%u.%u.%u.%u\n",
				 NIPQUAD(iph->saddr),
				 info->flags & IPRANGE_SRC_INV ? "(INV) " : "",
				 NIPQUAD(info->src.min_ip),
				 NIPQUAD(info->src.max_ip));
			return false;
		}
	}
	if (info->flags & IPRANGE_DST) {
		if ((ntohl(iph->daddr) < ntohl(info->dst.min_ip)
			  || ntohl(iph->daddr) > ntohl(info->dst.max_ip))
			 ^ !!(info->flags & IPRANGE_DST_INV)) {
			pr_debug("dst IP %u.%u.%u.%u NOT in range %s"
				 "%u.%u.%u.%u-%u.%u.%u.%u\n",
				 NIPQUAD(iph->daddr),
				 info->flags & IPRANGE_DST_INV ? "(INV) " : "",
				 NIPQUAD(info->dst.min_ip),
				 NIPQUAD(info->dst.max_ip));
			return false;
		}
	}
	return true;
}

static bool
iprange_mt4(const struct sk_buff *skb, const struct net_device *in,
            const struct net_device *out, const struct xt_match *match,
            const void *matchinfo, int offset, unsigned int protoff,
            bool *hotdrop)
{
	const struct xt_iprange_mtinfo *info = matchinfo;
	const struct iphdr *iph = ip_hdr(skb);
	bool m;

	if (info->flags & IPRANGE_SRC) {
		m  = ntohl(iph->saddr) < ntohl(info->src_min.ip);
		m |= ntohl(iph->saddr) > ntohl(info->src_max.ip);
		m ^= info->flags & IPRANGE_SRC_INV;
		if (m) {
			pr_debug("src IP " NIPQUAD_FMT " NOT in range %s"
			         NIPQUAD_FMT "-" NIPQUAD_FMT "\n",
			         NIPQUAD(iph->saddr),
			         (info->flags & IPRANGE_SRC_INV) ? "(INV) " : "",
			         NIPQUAD(info->src_max.ip),
			         NIPQUAD(info->src_max.ip));
			return false;
		}
	}
	if (info->flags & IPRANGE_DST) {
		m  = ntohl(iph->daddr) < ntohl(info->dst_min.ip);
		m |= ntohl(iph->daddr) > ntohl(info->dst_max.ip);
		m ^= info->flags & IPRANGE_DST_INV;
		if (m) {
			pr_debug("dst IP " NIPQUAD_FMT " NOT in range %s"
			         NIPQUAD_FMT "-" NIPQUAD_FMT "\n",
			         NIPQUAD(iph->daddr),
			         (info->flags & IPRANGE_DST_INV) ? "(INV) " : "",
			         NIPQUAD(info->dst_min.ip),
			         NIPQUAD(info->dst_max.ip));
			return false;
		}
	}
	return true;
}

static inline int
iprange_ipv6_sub(const struct in6_addr *a, const struct in6_addr *b)
{
	unsigned int i;
	int r;

	for (i = 0; i < 4; ++i) {
		r = ntohl(a->s6_addr32[i]) - ntohl(b->s6_addr32[i]);
		if (r != 0)
			return r;
	}

	return 0;
}

static bool
iprange_mt6(const struct sk_buff *skb, const struct net_device *in,
            const struct net_device *out, const struct xt_match *match,
            const void *matchinfo, int offset, unsigned int protoff,
            bool *hotdrop)
{
	const struct xt_iprange_mtinfo *info = matchinfo;
	const struct ipv6hdr *iph = ipv6_hdr(skb);
	bool m;

	if (info->flags & IPRANGE_SRC) {
		m  = iprange_ipv6_sub(&iph->saddr, &info->src_min.in6) < 0;
		m |= iprange_ipv6_sub(&iph->saddr, &info->src_max.in6) > 0;
		m ^= info->flags & IPRANGE_SRC_INV;
		if (m)
			return false;
	}
	if (info->flags & IPRANGE_DST) {
		m  = iprange_ipv6_sub(&iph->daddr, &info->dst_min.in6) < 0;
		m |= iprange_ipv6_sub(&iph->daddr, &info->dst_max.in6) > 0;
		m ^= info->flags & IPRANGE_DST_INV;
		if (m)
			return false;
	}
	return true;
}

static struct xt_match iprange_mt_reg[] __read_mostly = {
	{
		.name      = "iprange",
		.revision  = 0,
		.family    = AF_INET,
		.match     = iprange_mt_v0,
		.matchsize = sizeof(struct ipt_iprange_info),
		.me        = THIS_MODULE,
	},
	{
		.name      = "iprange",
		.revision  = 1,
		.family    = AF_INET,
		.match     = iprange_mt4,
		.matchsize = sizeof(struct xt_iprange_mtinfo),
		.me        = THIS_MODULE,
	},
	{
		.name      = "iprange",
		.revision  = 1,
		.family    = AF_INET6,
		.match     = iprange_mt6,
		.matchsize = sizeof(struct xt_iprange_mtinfo),
		.me        = THIS_MODULE,
	},
};

static int __init iprange_mt_init(void)
{
	return xt_register_matches(iprange_mt_reg, ARRAY_SIZE(iprange_mt_reg));
}

static void __exit iprange_mt_exit(void)
{
	xt_unregister_matches(iprange_mt_reg, ARRAY_SIZE(iprange_mt_reg));
}

module_init(iprange_mt_init);
module_exit(iprange_mt_exit);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Jozsef Kadlecsik <[email protected]>, Jan Engelhardt <[email protected]>");
MODULE_DESCRIPTION("Xtables: arbitrary IPv4 range matching");
Commit	Line	Data
1da177e4	1	/*
f72e25a8	2	* xt_iprange - Netfilter module to match IP address ranges
1da177e4	3	*
f72e25a8	4	* (C) 2003 Jozsef Kadlecsik <[email protected]>
1a50c5a1	5	* (C) CC Computer Consultants GmbH, 2008
1da177e4	6	*
f72e25a8 JE	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
1da177e4 LT	10	*/
	11	#include <linux/module.h>
	12	#include <linux/skbuff.h>
	13	#include <linux/ip.h>
1a50c5a1	14	#include <linux/ipv6.h>
6709dbbb	15	#include <linux/netfilter/x_tables.h>
5da621f1	16	#include <linux/netfilter/xt_iprange.h>
1da177e4 LT	17	#include <linux/netfilter_ipv4/ipt_iprange.h>
1da177e4 LT	18
1d93a9cb	19	static bool
f72e25a8 JE	20	iprange_mt_v0(const struct sk_buff skb, const struct net_device in,
	21	const struct net_device out, const struct xt_match match,
	22	const void *matchinfo, int offset, unsigned int protoff,
	23	bool *hotdrop)
1da177e4 LT	24	{
1da177e4 LT	25	const struct ipt_iprange_info *info = matchinfo;
eddc9ec5	26	const struct iphdr *iph = ip_hdr(skb);
1da177e4 LT	27
1da177e4 LT	28	if (info->flags & IPRANGE_SRC) {
7c4e36bc JE	29	if ((ntohl(iph->saddr) < ntohl(info->src.min_ip)
7c4e36bc JE	30	\|\| ntohl(iph->saddr) > ntohl(info->src.max_ip))
1da177e4	31	^ !!(info->flags & IPRANGE_SRC_INV)) {
0d53778e PM	32	pr_debug("src IP %u.%u.%u.%u NOT in range %s"
	33	"%u.%u.%u.%u-%u.%u.%u.%u\n",
	34	NIPQUAD(iph->saddr),
	35	info->flags & IPRANGE_SRC_INV ? "(INV) " : "",
	36	NIPQUAD(info->src.min_ip),
	37	NIPQUAD(info->src.max_ip));
1d93a9cb	38	return false;
1da177e4 LT	39	}
	40	}
	41	if (info->flags & IPRANGE_DST) {
7c4e36bc JE	42	if ((ntohl(iph->daddr) < ntohl(info->dst.min_ip)
7c4e36bc JE	43	\|\| ntohl(iph->daddr) > ntohl(info->dst.max_ip))
1da177e4	44	^ !!(info->flags & IPRANGE_DST_INV)) {
0d53778e PM	45	pr_debug("dst IP %u.%u.%u.%u NOT in range %s"
	46	"%u.%u.%u.%u-%u.%u.%u.%u\n",
	47	NIPQUAD(iph->daddr),
	48	info->flags & IPRANGE_DST_INV ? "(INV) " : "",
	49	NIPQUAD(info->dst.min_ip),
	50	NIPQUAD(info->dst.max_ip));
1d93a9cb	51	return false;
1da177e4 LT	52	}
1da177e4 LT	53	}
1d93a9cb	54	return true;
1da177e4 LT	55	}
1da177e4 LT	56
1a50c5a1 JE	57	static bool
	58	iprange_mt4(const struct sk_buff skb, const struct net_device in,
	59	const struct net_device out, const struct xt_match match,
	60	const void *matchinfo, int offset, unsigned int protoff,
	61	bool *hotdrop)
	62	{
	63	const struct xt_iprange_mtinfo *info = matchinfo;
	64	const struct iphdr *iph = ip_hdr(skb);
	65	bool m;
	66
	67	if (info->flags & IPRANGE_SRC) {
	68	m = ntohl(iph->saddr) < ntohl(info->src_min.ip);
	69	m \|= ntohl(iph->saddr) > ntohl(info->src_max.ip);
	70	m ^= info->flags & IPRANGE_SRC_INV;
	71	if (m) {
	72	pr_debug("src IP " NIPQUAD_FMT " NOT in range %s"
	73	NIPQUAD_FMT "-" NIPQUAD_FMT "\n",
	74	NIPQUAD(iph->saddr),
	75	(info->flags & IPRANGE_SRC_INV) ? "(INV) " : "",
	76	NIPQUAD(info->src_max.ip),
	77	NIPQUAD(info->src_max.ip));
	78	return false;
	79	}
	80	}
	81	if (info->flags & IPRANGE_DST) {
	82	m = ntohl(iph->daddr) < ntohl(info->dst_min.ip);
	83	m \|= ntohl(iph->daddr) > ntohl(info->dst_max.ip);
	84	m ^= info->flags & IPRANGE_DST_INV;
	85	if (m) {
	86	pr_debug("dst IP " NIPQUAD_FMT " NOT in range %s"
	87	NIPQUAD_FMT "-" NIPQUAD_FMT "\n",
	88	NIPQUAD(iph->daddr),
	89	(info->flags & IPRANGE_DST_INV) ? "(INV) " : "",
	90	NIPQUAD(info->dst_min.ip),
	91	NIPQUAD(info->dst_max.ip));
	92	return false;
	93	}
	94	}
	95	return true;
	96	}
	97
	98	static inline int
	99	iprange_ipv6_sub(const struct in6_addr a, const struct in6_addr b)
	100	{
	101	unsigned int i;
	102	int r;
	103
	104	for (i = 0; i < 4; ++i) {
27ecb1ff	105	r = ntohl(a->s6_addr32[i]) - ntohl(b->s6_addr32[i]);
1a50c5a1 JE	106	if (r != 0)
	107	return r;
	108	}
	109
	110	return 0;
	111	}
	112
	113	static bool
	114	iprange_mt6(const struct sk_buff skb, const struct net_device in,
	115	const struct net_device out, const struct xt_match match,
	116	const void *matchinfo, int offset, unsigned int protoff,
	117	bool *hotdrop)
	118	{
	119	const struct xt_iprange_mtinfo *info = matchinfo;
	120	const struct ipv6hdr *iph = ipv6_hdr(skb);
	121	bool m;
	122
	123	if (info->flags & IPRANGE_SRC) {
	124	m = iprange_ipv6_sub(&iph->saddr, &info->src_min.in6) < 0;
	125	m \|= iprange_ipv6_sub(&iph->saddr, &info->src_max.in6) > 0;
	126	m ^= info->flags & IPRANGE_SRC_INV;
	127	if (m)
	128	return false;
	129	}
	130	if (info->flags & IPRANGE_DST) {
	131	m = iprange_ipv6_sub(&iph->daddr, &info->dst_min.in6) < 0;
	132	m \|= iprange_ipv6_sub(&iph->daddr, &info->dst_max.in6) > 0;
	133	m ^= info->flags & IPRANGE_DST_INV;
	134	if (m)
	135	return false;
	136	}
	137	return true;
	138	}
	139
	140	static struct xt_match iprange_mt_reg[] __read_mostly = {
	141	{
	142	.name = "iprange",
	143	.revision = 0,
	144	.family = AF_INET,
	145	.match = iprange_mt_v0,
	146	.matchsize = sizeof(struct ipt_iprange_info),
	147	.me = THIS_MODULE,
	148	},
	149	{
	150	.name = "iprange",
	151	.revision = 1,
d9d17578	152	.family = AF_INET,
1a50c5a1 JE	153	.match = iprange_mt4,
	154	.matchsize = sizeof(struct xt_iprange_mtinfo),
	155	.me = THIS_MODULE,
	156	},
	157	{
	158	.name = "iprange",
	159	.revision = 1,
	160	.family = AF_INET6,
	161	.match = iprange_mt6,
	162	.matchsize = sizeof(struct xt_iprange_mtinfo),
	163	.me = THIS_MODULE,
	164	},
1da177e4 LT	165	};
1da177e4 LT	166
d3c5ee6d	167	static int __init iprange_mt_init(void)
1da177e4	168	{
1a50c5a1	169	return xt_register_matches(iprange_mt_reg, ARRAY_SIZE(iprange_mt_reg));
1da177e4 LT	170	}
1da177e4 LT	171
d3c5ee6d	172	static void __exit iprange_mt_exit(void)
1da177e4	173	{
1a50c5a1	174	xt_unregister_matches(iprange_mt_reg, ARRAY_SIZE(iprange_mt_reg));
1da177e4 LT	175	}
1da177e4 LT	176
d3c5ee6d JE	177	module_init(iprange_mt_init);
d3c5ee6d JE	178	module_exit(iprange_mt_exit);
f72e25a8	179	MODULE_LICENSE("GPL");
1a50c5a1	180	MODULE_AUTHOR("Jozsef Kadlecsik <[email protected]>, Jan Engelhardt <[email protected]>");
f72e25a8	181	MODULE_DESCRIPTION("Xtables: arbitrary IPv4 range matching");