[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / netfilter / xt_iprange.c

/*
 *	xt_iprange - Netfilter module to match IP address ranges
 *
 *	(C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
 *	(C) CC Computer Consultants GmbH, 2008
 *
 *	This program is free software; you can redistribute it and/or modify
 *	it under the terms of the GNU General Public License version 2 as
 *	published by the Free Software Foundation.
 */
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_iprange.h>
#include <linux/netfilter_ipv4/ipt_iprange.h>

static bool
iprange_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
{
	const struct ipt_iprange_info *info = par->matchinfo;
	const struct iphdr *iph = ip_hdr(skb);

	if (info->flags & IPRANGE_SRC) {
		if ((ntohl(iph->saddr) < ntohl(info->src.min_ip)
			  || ntohl(iph->saddr) > ntohl(info->src.max_ip))
			 ^ !!(info->flags & IPRANGE_SRC_INV)) {
			pr_debug("src IP %u.%u.%u.%u NOT in range %s"
				 "%u.%u.%u.%u-%u.%u.%u.%u\n",
				 NIPQUAD(iph->saddr),
				 info->flags & IPRANGE_SRC_INV ? "(INV) " : "",
				 NIPQUAD(info->src.min_ip),
				 NIPQUAD(info->src.max_ip));
			return false;
		}
	}
	if (info->flags & IPRANGE_DST) {
		if ((ntohl(iph->daddr) < ntohl(info->dst.min_ip)
			  || ntohl(iph->daddr) > ntohl(info->dst.max_ip))
			 ^ !!(info->flags & IPRANGE_DST_INV)) {
			pr_debug("dst IP %u.%u.%u.%u NOT in range %s"
				 "%u.%u.%u.%u-%u.%u.%u.%u\n",
				 NIPQUAD(iph->daddr),
				 info->flags & IPRANGE_DST_INV ? "(INV) " : "",
				 NIPQUAD(info->dst.min_ip),
				 NIPQUAD(info->dst.max_ip));
			return false;
		}
	}
	return true;
}

static bool
iprange_mt4(const struct sk_buff *skb, const struct xt_match_param *par)
{
	const struct xt_iprange_mtinfo *info = par->matchinfo;
	const struct iphdr *iph = ip_hdr(skb);
	bool m;

	if (info->flags & IPRANGE_SRC) {
		m  = ntohl(iph->saddr) < ntohl(info->src_min.ip);
		m |= ntohl(iph->saddr) > ntohl(info->src_max.ip);
		m ^= info->flags & IPRANGE_SRC_INV;
		if (m) {
			pr_debug("src IP " NIPQUAD_FMT " NOT in range %s"
			         NIPQUAD_FMT "-" NIPQUAD_FMT "\n",
			         NIPQUAD(iph->saddr),
			         (info->flags & IPRANGE_SRC_INV) ? "(INV) " : "",
			         NIPQUAD(info->src_max.ip),
			         NIPQUAD(info->src_max.ip));
			return false;
		}
	}
	if (info->flags & IPRANGE_DST) {
		m  = ntohl(iph->daddr) < ntohl(info->dst_min.ip);
		m |= ntohl(iph->daddr) > ntohl(info->dst_max.ip);
		m ^= info->flags & IPRANGE_DST_INV;
		if (m) {
			pr_debug("dst IP " NIPQUAD_FMT " NOT in range %s"
			         NIPQUAD_FMT "-" NIPQUAD_FMT "\n",
			         NIPQUAD(iph->daddr),
			         (info->flags & IPRANGE_DST_INV) ? "(INV) " : "",
			         NIPQUAD(info->dst_min.ip),
			         NIPQUAD(info->dst_max.ip));
			return false;
		}
	}
	return true;
}

static inline int
iprange_ipv6_sub(const struct in6_addr *a, const struct in6_addr *b)
{
	unsigned int i;
	int r;

	for (i = 0; i < 4; ++i) {
		r = ntohl(a->s6_addr32[i]) - ntohl(b->s6_addr32[i]);
		if (r != 0)
			return r;
	}

	return 0;
}

static bool
iprange_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
{
	const struct xt_iprange_mtinfo *info = par->matchinfo;
	const struct ipv6hdr *iph = ipv6_hdr(skb);
	bool m;

	if (info->flags & IPRANGE_SRC) {
		m  = iprange_ipv6_sub(&iph->saddr, &info->src_min.in6) < 0;
		m |= iprange_ipv6_sub(&iph->saddr, &info->src_max.in6) > 0;
		m ^= info->flags & IPRANGE_SRC_INV;
		if (m)
			return false;
	}
	if (info->flags & IPRANGE_DST) {
		m  = iprange_ipv6_sub(&iph->daddr, &info->dst_min.in6) < 0;
		m |= iprange_ipv6_sub(&iph->daddr, &info->dst_max.in6) > 0;
		m ^= info->flags & IPRANGE_DST_INV;
		if (m)
			return false;
	}
	return true;
}

static struct xt_match iprange_mt_reg[] __read_mostly = {
	{
		.name      = "iprange",
		.revision  = 0,
		.family    = NFPROTO_IPV4,
		.match     = iprange_mt_v0,
		.matchsize = sizeof(struct ipt_iprange_info),
		.me        = THIS_MODULE,
	},
	{
		.name      = "iprange",
		.revision  = 1,
		.family    = NFPROTO_IPV4,
		.match     = iprange_mt4,
		.matchsize = sizeof(struct xt_iprange_mtinfo),
		.me        = THIS_MODULE,
	},
	{
		.name      = "iprange",
		.revision  = 1,
		.family    = NFPROTO_IPV6,
		.match     = iprange_mt6,
		.matchsize = sizeof(struct xt_iprange_mtinfo),
		.me        = THIS_MODULE,
	},
};

static int __init iprange_mt_init(void)
{
	return xt_register_matches(iprange_mt_reg, ARRAY_SIZE(iprange_mt_reg));
}

static void __exit iprange_mt_exit(void)
{
	xt_unregister_matches(iprange_mt_reg, ARRAY_SIZE(iprange_mt_reg));
}

module_init(iprange_mt_init);
module_exit(iprange_mt_exit);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>, Jan Engelhardt <jengelh@computergmbh.de>");
MODULE_DESCRIPTION("Xtables: arbitrary IPv4 range matching");
MODULE_ALIAS("ipt_iprange");
MODULE_ALIAS("ip6t_iprange");
Commit	Line	Data
1da177e4	1	/*
f72e25a8	2	* xt_iprange - Netfilter module to match IP address ranges
1da177e4	3	*
f72e25a8	4	* (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
1a50c5a1	5	* (C) CC Computer Consultants GmbH, 2008
1da177e4	6	*
f72e25a8 JE	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
1da177e4 LT	10	*/
	11	#include <linux/module.h>
	12	#include <linux/skbuff.h>
	13	#include <linux/ip.h>
1a50c5a1	14	#include <linux/ipv6.h>
6709dbbb	15	#include <linux/netfilter/x_tables.h>
5da621f1	16	#include <linux/netfilter/xt_iprange.h>
1da177e4 LT	17	#include <linux/netfilter_ipv4/ipt_iprange.h>
1da177e4 LT	18
1d93a9cb	19	static bool
f7108a20	20	iprange_mt_v0(const struct sk_buff skb, const struct xt_match_param par)
1da177e4	21	{
f7108a20	22	const struct ipt_iprange_info *info = par->matchinfo;
eddc9ec5	23	const struct iphdr *iph = ip_hdr(skb);
1da177e4 LT	24
1da177e4 LT	25	if (info->flags & IPRANGE_SRC) {
7c4e36bc JE	26	if ((ntohl(iph->saddr) < ntohl(info->src.min_ip)
7c4e36bc JE	27	\|\| ntohl(iph->saddr) > ntohl(info->src.max_ip))
1da177e4	28	^ !!(info->flags & IPRANGE_SRC_INV)) {
0d53778e PM	29	pr_debug("src IP %u.%u.%u.%u NOT in range %s"
	30	"%u.%u.%u.%u-%u.%u.%u.%u\n",
	31	NIPQUAD(iph->saddr),
	32	info->flags & IPRANGE_SRC_INV ? "(INV) " : "",
	33	NIPQUAD(info->src.min_ip),
	34	NIPQUAD(info->src.max_ip));
1d93a9cb	35	return false;
1da177e4 LT	36	}
	37	}
	38	if (info->flags & IPRANGE_DST) {
7c4e36bc JE	39	if ((ntohl(iph->daddr) < ntohl(info->dst.min_ip)
7c4e36bc JE	40	\|\| ntohl(iph->daddr) > ntohl(info->dst.max_ip))
1da177e4	41	^ !!(info->flags & IPRANGE_DST_INV)) {
0d53778e PM	42	pr_debug("dst IP %u.%u.%u.%u NOT in range %s"
	43	"%u.%u.%u.%u-%u.%u.%u.%u\n",
	44	NIPQUAD(iph->daddr),
	45	info->flags & IPRANGE_DST_INV ? "(INV) " : "",
	46	NIPQUAD(info->dst.min_ip),
	47	NIPQUAD(info->dst.max_ip));
1d93a9cb	48	return false;
1da177e4 LT	49	}
1da177e4 LT	50	}
1d93a9cb	51	return true;
1da177e4 LT	52	}
1da177e4 LT	53
1a50c5a1	54	static bool
f7108a20	55	iprange_mt4(const struct sk_buff skb, const struct xt_match_param par)
1a50c5a1	56	{
f7108a20	57	const struct xt_iprange_mtinfo *info = par->matchinfo;
1a50c5a1 JE	58	const struct iphdr *iph = ip_hdr(skb);
	59	bool m;
	60
	61	if (info->flags & IPRANGE_SRC) {
	62	m = ntohl(iph->saddr) < ntohl(info->src_min.ip);
	63	m \|= ntohl(iph->saddr) > ntohl(info->src_max.ip);
	64	m ^= info->flags & IPRANGE_SRC_INV;
	65	if (m) {
	66	pr_debug("src IP " NIPQUAD_FMT " NOT in range %s"
	67	NIPQUAD_FMT "-" NIPQUAD_FMT "\n",
	68	NIPQUAD(iph->saddr),
	69	(info->flags & IPRANGE_SRC_INV) ? "(INV) " : "",
	70	NIPQUAD(info->src_max.ip),
	71	NIPQUAD(info->src_max.ip));
	72	return false;
	73	}
	74	}
	75	if (info->flags & IPRANGE_DST) {
	76	m = ntohl(iph->daddr) < ntohl(info->dst_min.ip);
	77	m \|= ntohl(iph->daddr) > ntohl(info->dst_max.ip);
	78	m ^= info->flags & IPRANGE_DST_INV;
	79	if (m) {
	80	pr_debug("dst IP " NIPQUAD_FMT " NOT in range %s"
	81	NIPQUAD_FMT "-" NIPQUAD_FMT "\n",
	82	NIPQUAD(iph->daddr),
	83	(info->flags & IPRANGE_DST_INV) ? "(INV) " : "",
	84	NIPQUAD(info->dst_min.ip),
	85	NIPQUAD(info->dst_max.ip));
	86	return false;
	87	}
	88	}
	89	return true;
	90	}
	91
	92	static inline int
	93	iprange_ipv6_sub(const struct in6_addr a, const struct in6_addr b)
	94	{
	95	unsigned int i;
	96	int r;
	97
	98	for (i = 0; i < 4; ++i) {
27ecb1ff	99	r = ntohl(a->s6_addr32[i]) - ntohl(b->s6_addr32[i]);
1a50c5a1 JE	100	if (r != 0)
	101	return r;
	102	}
	103
	104	return 0;
	105	}
	106
	107	static bool
f7108a20	108	iprange_mt6(const struct sk_buff skb, const struct xt_match_param par)
1a50c5a1	109	{
f7108a20	110	const struct xt_iprange_mtinfo *info = par->matchinfo;
1a50c5a1 JE	111	const struct ipv6hdr *iph = ipv6_hdr(skb);
	112	bool m;
	113
	114	if (info->flags & IPRANGE_SRC) {
	115	m = iprange_ipv6_sub(&iph->saddr, &info->src_min.in6) < 0;
	116	m \|= iprange_ipv6_sub(&iph->saddr, &info->src_max.in6) > 0;
	117	m ^= info->flags & IPRANGE_SRC_INV;
	118	if (m)
	119	return false;
	120	}
	121	if (info->flags & IPRANGE_DST) {
	122	m = iprange_ipv6_sub(&iph->daddr, &info->dst_min.in6) < 0;
	123	m \|= iprange_ipv6_sub(&iph->daddr, &info->dst_max.in6) > 0;
	124	m ^= info->flags & IPRANGE_DST_INV;
	125	if (m)
	126	return false;
	127	}
	128	return true;
	129	}
	130
	131	static struct xt_match iprange_mt_reg[] __read_mostly = {
	132	{
	133	.name = "iprange",
	134	.revision = 0,
ee999d8b	135	.family = NFPROTO_IPV4,
1a50c5a1 JE	136	.match = iprange_mt_v0,
	137	.matchsize = sizeof(struct ipt_iprange_info),
	138	.me = THIS_MODULE,
	139	},
	140	{
	141	.name = "iprange",
	142	.revision = 1,
ee999d8b	143	.family = NFPROTO_IPV4,
1a50c5a1 JE	144	.match = iprange_mt4,
	145	.matchsize = sizeof(struct xt_iprange_mtinfo),
	146	.me = THIS_MODULE,
	147	},
	148	{
	149	.name = "iprange",
	150	.revision = 1,
ee999d8b	151	.family = NFPROTO_IPV6,
1a50c5a1 JE	152	.match = iprange_mt6,
	153	.matchsize = sizeof(struct xt_iprange_mtinfo),
	154	.me = THIS_MODULE,
	155	},
1da177e4 LT	156	};
1da177e4 LT	157
d3c5ee6d	158	static int __init iprange_mt_init(void)
1da177e4	159	{
1a50c5a1	160	return xt_register_matches(iprange_mt_reg, ARRAY_SIZE(iprange_mt_reg));
1da177e4 LT	161	}
1da177e4 LT	162
d3c5ee6d	163	static void __exit iprange_mt_exit(void)
1da177e4	164	{
1a50c5a1	165	xt_unregister_matches(iprange_mt_reg, ARRAY_SIZE(iprange_mt_reg));
1da177e4 LT	166	}
1da177e4 LT	167
d3c5ee6d JE	168	module_init(iprange_mt_init);
d3c5ee6d JE	169	module_exit(iprange_mt_exit);
f72e25a8	170	MODULE_LICENSE("GPL");
1a50c5a1	171	MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>, Jan Engelhardt <jengelh@computergmbh.de>");
f72e25a8	172	MODULE_DESCRIPTION("Xtables: arbitrary IPv4 range matching");
01b7a314 PO	173	MODULE_ALIAS("ipt_iprange");
01b7a314 PO	174	MODULE_ALIAS("ip6t_iprange");