1
2
3
4
5
6
7
8
9
10#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
11#include <linux/module.h>
12#include <linux/skbuff.h>
13#include <linux/if_ether.h>
14#include <net/ip.h>
15#include <linux/ipv6.h>
16#include <net/ipv6.h>
17#include <net/udp.h>
18#include <linux/l2tp.h>
19
20#include <linux/netfilter_ipv4.h>
21#include <linux/netfilter_ipv6.h>
22#include <linux/netfilter_ipv4/ip_tables.h>
23#include <linux/netfilter_ipv6/ip6_tables.h>
24#include <linux/netfilter/x_tables.h>
25#include <linux/netfilter/xt_tcpudp.h>
26#include <linux/netfilter/xt_l2tp.h>
27
28
29#define L2TP_HDR_T_BIT 0x8000
30#define L2TP_HDR_L_BIT 0x4000
31#define L2TP_HDR_VER 0x000f
32
33MODULE_LICENSE("GPL");
34MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
35MODULE_DESCRIPTION("Xtables: L2TP header match");
36MODULE_ALIAS("ipt_l2tp");
37MODULE_ALIAS("ip6t_l2tp");
38
39
40struct l2tp_data {
41 u32 tid;
42 u32 sid;
43 u8 type;
44 u8 version;
45};
46
47union l2tp_val {
48 __be16 val16[2];
49 __be32 val32;
50};
51
52static bool l2tp_match(const struct xt_l2tp_info *info, struct l2tp_data *data)
53{
54 if ((info->flags & XT_L2TP_TYPE) && (info->type != data->type))
55 return false;
56
57 if ((info->flags & XT_L2TP_VERSION) && (info->version != data->version))
58 return false;
59
60
61 if ((info->flags & XT_L2TP_TID) &&
62 ((data->type == XT_L2TP_TYPE_CONTROL) || (data->version == 2)) &&
63 (info->tid != data->tid))
64 return false;
65
66
67 if ((info->flags & XT_L2TP_SID) && (data->type == XT_L2TP_TYPE_DATA) &&
68 (info->sid != data->sid))
69 return false;
70
71 return true;
72}
73
74
75
76
77
78
79
80
81
82static bool l2tp_udp_mt(const struct sk_buff *skb, struct xt_action_param *par, u16 thoff)
83{
84 const struct xt_l2tp_info *info = par->matchinfo;
85 int uhlen = sizeof(struct udphdr);
86 int offs = thoff + uhlen;
87 union l2tp_val *lh;
88 union l2tp_val lhbuf;
89 u16 flags;
90 struct l2tp_data data = { 0, };
91
92 if (par->fragoff != 0)
93 return false;
94
95
96
97
98 lh = skb_header_pointer(skb, offs, 2, &lhbuf);
99 if (lh == NULL)
100 return false;
101
102 flags = ntohs(lh->val16[0]);
103 if (flags & L2TP_HDR_T_BIT)
104 data.type = XT_L2TP_TYPE_CONTROL;
105 else
106 data.type = XT_L2TP_TYPE_DATA;
107 data.version = (u8) flags & L2TP_HDR_VER;
108
109
110
111
112
113
114
115 if (data.version == 3) {
116 lh = skb_header_pointer(skb, offs + 4, 4, &lhbuf);
117 if (lh == NULL)
118 return false;
119 if (data.type == XT_L2TP_TYPE_CONTROL)
120 data.tid = ntohl(lh->val32);
121 else
122 data.sid = ntohl(lh->val32);
123 } else if (data.version == 2) {
124 if (flags & L2TP_HDR_L_BIT)
125 offs += 2;
126 lh = skb_header_pointer(skb, offs + 2, 4, &lhbuf);
127 if (lh == NULL)
128 return false;
129 data.tid = (u32) ntohs(lh->val16[0]);
130 data.sid = (u32) ntohs(lh->val16[1]);
131 } else
132 return false;
133
134 return l2tp_match(info, &data);
135}
136
137
138
139
140
141
142static bool l2tp_ip_mt(const struct sk_buff *skb, struct xt_action_param *par, u16 thoff)
143{
144 const struct xt_l2tp_info *info = par->matchinfo;
145 union l2tp_val *lh;
146 union l2tp_val lhbuf;
147 struct l2tp_data data = { 0, };
148
149
150 lh = skb_header_pointer(skb, thoff, sizeof(lhbuf), &lhbuf);
151 if (lh == NULL)
152 return false;
153 if (lh->val32 == 0) {
154
155
156
157 data.type = XT_L2TP_TYPE_CONTROL;
158 lh = skb_header_pointer(skb, thoff + 8, sizeof(lhbuf),
159 &lhbuf);
160 if (lh == NULL)
161 return false;
162 data.tid = ntohl(lh->val32);
163 } else {
164 data.sid = ntohl(lh->val32);
165 data.type = XT_L2TP_TYPE_DATA;
166 }
167
168 data.version = 3;
169
170 return l2tp_match(info, &data);
171}
172
173static bool l2tp_mt4(const struct sk_buff *skb, struct xt_action_param *par)
174{
175 struct iphdr *iph = ip_hdr(skb);
176 u8 ipproto = iph->protocol;
177
178
179 switch (ipproto) {
180 case IPPROTO_UDP:
181 return l2tp_udp_mt(skb, par, par->thoff);
182 case IPPROTO_L2TP:
183 return l2tp_ip_mt(skb, par, par->thoff);
184 }
185
186 return false;
187}
188
189#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
190static bool l2tp_mt6(const struct sk_buff *skb, struct xt_action_param *par)
191{
192 unsigned int thoff = 0;
193 unsigned short fragoff = 0;
194 int ipproto;
195
196 ipproto = ipv6_find_hdr(skb, &thoff, -1, &fragoff, NULL);
197 if (fragoff != 0)
198 return false;
199
200
201 switch (ipproto) {
202 case IPPROTO_UDP:
203 return l2tp_udp_mt(skb, par, thoff);
204 case IPPROTO_L2TP:
205 return l2tp_ip_mt(skb, par, thoff);
206 }
207
208 return false;
209}
210#endif
211
212static int l2tp_mt_check(const struct xt_mtchk_param *par)
213{
214 const struct xt_l2tp_info *info = par->matchinfo;
215
216
217 if (info->flags & ~(XT_L2TP_TID | XT_L2TP_SID | XT_L2TP_VERSION |
218 XT_L2TP_TYPE)) {
219 pr_info("unknown flags: %x\n", info->flags);
220 return -EINVAL;
221 }
222
223
224 if ((!(info->flags & XT_L2TP_TID)) &&
225 (!(info->flags & XT_L2TP_SID)) &&
226 ((!(info->flags & XT_L2TP_TYPE)) ||
227 (info->type != XT_L2TP_TYPE_CONTROL))) {
228 pr_info("invalid flags combination: %x\n", info->flags);
229 return -EINVAL;
230 }
231
232
233
234
235 if (info->flags & XT_L2TP_VERSION) {
236 if ((info->version < 2) || (info->version > 3)) {
237 pr_info("wrong L2TP version: %u\n", info->version);
238 return -EINVAL;
239 }
240
241 if (info->version == 2) {
242 if ((info->flags & XT_L2TP_TID) &&
243 (info->tid > 0xffff)) {
244 pr_info("v2 tid > 0xffff: %u\n", info->tid);
245 return -EINVAL;
246 }
247 if ((info->flags & XT_L2TP_SID) &&
248 (info->sid > 0xffff)) {
249 pr_info("v2 sid > 0xffff: %u\n", info->sid);
250 return -EINVAL;
251 }
252 }
253 }
254
255 return 0;
256}
257
258static int l2tp_mt_check4(const struct xt_mtchk_param *par)
259{
260 const struct xt_l2tp_info *info = par->matchinfo;
261 const struct ipt_entry *e = par->entryinfo;
262 const struct ipt_ip *ip = &e->ip;
263 int ret;
264
265 ret = l2tp_mt_check(par);
266 if (ret != 0)
267 return ret;
268
269 if ((ip->proto != IPPROTO_UDP) &&
270 (ip->proto != IPPROTO_L2TP)) {
271 pr_info("missing protocol rule (udp|l2tpip)\n");
272 return -EINVAL;
273 }
274
275 if ((ip->proto == IPPROTO_L2TP) &&
276 (info->version == 2)) {
277 pr_info("v2 doesn't support IP mode\n");
278 return -EINVAL;
279 }
280
281 return 0;
282}
283
284#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
285static int l2tp_mt_check6(const struct xt_mtchk_param *par)
286{
287 const struct xt_l2tp_info *info = par->matchinfo;
288 const struct ip6t_entry *e = par->entryinfo;
289 const struct ip6t_ip6 *ip = &e->ipv6;
290 int ret;
291
292 ret = l2tp_mt_check(par);
293 if (ret != 0)
294 return ret;
295
296 if ((ip->proto != IPPROTO_UDP) &&
297 (ip->proto != IPPROTO_L2TP)) {
298 pr_info("missing protocol rule (udp|l2tpip)\n");
299 return -EINVAL;
300 }
301
302 if ((ip->proto == IPPROTO_L2TP) &&
303 (info->version == 2)) {
304 pr_info("v2 doesn't support IP mode\n");
305 return -EINVAL;
306 }
307
308 return 0;
309}
310#endif
311
312static struct xt_match l2tp_mt_reg[] __read_mostly = {
313 {
314 .name = "l2tp",
315 .revision = 0,
316 .family = NFPROTO_IPV4,
317 .match = l2tp_mt4,
318 .matchsize = XT_ALIGN(sizeof(struct xt_l2tp_info)),
319 .checkentry = l2tp_mt_check4,
320 .hooks = ((1 << NF_INET_PRE_ROUTING) |
321 (1 << NF_INET_LOCAL_IN) |
322 (1 << NF_INET_LOCAL_OUT) |
323 (1 << NF_INET_FORWARD)),
324 .me = THIS_MODULE,
325 },
326#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
327 {
328 .name = "l2tp",
329 .revision = 0,
330 .family = NFPROTO_IPV6,
331 .match = l2tp_mt6,
332 .matchsize = XT_ALIGN(sizeof(struct xt_l2tp_info)),
333 .checkentry = l2tp_mt_check6,
334 .hooks = ((1 << NF_INET_PRE_ROUTING) |
335 (1 << NF_INET_LOCAL_IN) |
336 (1 << NF_INET_LOCAL_OUT) |
337 (1 << NF_INET_FORWARD)),
338 .me = THIS_MODULE,
339 },
340#endif
341};
342
343static int __init l2tp_mt_init(void)
344{
345 return xt_register_matches(&l2tp_mt_reg[0], ARRAY_SIZE(l2tp_mt_reg));
346}
347
348static void __exit l2tp_mt_exit(void)
349{
350 xt_unregister_matches(&l2tp_mt_reg[0], ARRAY_SIZE(l2tp_mt_reg));
351}
352
353module_init(l2tp_mt_init);
354module_exit(l2tp_mt_exit);
355
