/*

 * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This code has been sponsored by Vyatta Inc. <http://www.vyatta.com>

 */

#include <errno.h>

#include <stdlib.h>

#include <string.h> /* for memcpy */

#include <stdbool.h>

#include <netinet/if_ether.h>

#include <netinet/ip.h>

#include <netinet/tcp.h>

#include "internal.h"

/**

 * \defgroup pktbuff User-space network packet buffer

 *

 * This library provides the user-space network packet buffer. This abstraction

 * is strongly inspired by Linux kernel network buffer, the so-called sk_buff.

 *

 * @{

 */

/**

 * pktb_alloc - allocate a new packet buffer

 * \param family Indicate what family. Currently supported families are

 * AF_BRIDGE, AF_INET & AF_INET6.

 * \param data Pointer to packet data

 * \param len Packet length

 * \param extra Extra memory in the tail to be allocated (for mangling)

 *

 * This function returns a packet buffer that contains the packet data and

 * some extra memory room in the tail (if requested).

 *

 * \return Pointer to a new userspace packet buffer or NULL on failure.

 * \par Errors

 * __ENOMEM__ From __calloc__()

 * \n

 * __EPROTONOSUPPORT__ _family_ was __AF_BRIDGE__ and this is not an IP packet

 * (v4 or v6)

 * \sa __calloc__(3)

 */

EXPORT_SYMBOL

struct pkt_buff *pktb_alloc(int family, void *data, size_t len, size_t extra)

{

	struct pkt_buff *pktb;

	struct ethhdr *ethhdr;

	void *pkt_data;

	pktb = calloc(1, sizeof(struct pkt_buff) + len + extra);

	if (pktb == NULL)

		return NULL;

	/* Better make sure alignment is correct. */

	pkt_data = (uint8_t *)pktb + sizeof(struct pkt_buff);

	memcpy(pkt_data, data, len);

	pktb->len = len;

	pktb->data_len = len + extra;

	pktb->data = pkt_data;

	switch(family) {

	case AF_INET:

	case AF_INET6:

		pktb->network_header = pktb->data;

		break;

	case AF_BRIDGE:

		ethhdr = (struct ethhdr *)pktb->data;

		pktb->mac_header = pktb->data;

		switch(ethhdr->h_proto) {

		case ETH_P_IP:

		case ETH_P_IPV6:

			pktb->network_header = pktb->data + ETH_HLEN;

			break;

		default:

			/* This protocol is unsupported. */

			errno = EPROTONOSUPPORT;

			free(pktb);

			return NULL;

		}

		break;

	}

	return pktb;

}

/**

 * pktb_data - get pointer to network packet

 * \param pktb Pointer to userspace packet buffer

 * \return Pointer to start of network packet data within __pktb__

 * \par

 * It is appropriate to use _pktb_data_ as the second argument of

 * nfq_nlmsg_verdict_put_pkt()

 */

EXPORT_SYMBOL

uint8_t *pktb_data(struct pkt_buff *pktb)

{

	return pktb->data;

}

/**

 * pktb_len - get length of packet buffer

 * \param pktb Pointer to userspace packet buffer

 * \return Length of packet contained within __pktb__

 * \par

 * It is appropriate to use _pktb_len_ as the third argument of

 * nfq_nlmsg_verdict_put_pkt()

 */

EXPORT_SYMBOL

uint32_t pktb_len(struct pkt_buff *pktb)

{

	return pktb->len;

}

/**

 * pktb_free - release packet buffer

 * \param pktb Pointer to userspace packet buffer

 */

EXPORT_SYMBOL

void pktb_free(struct pkt_buff *pktb)

{

	free(pktb);

}

/**

 * \defgroup otherfns Other functions

 *

 * The library provides a number of other functions which many user-space

 * programs will never need. These divide into 2 groups:

 * \n

 * 1. Functions to get values of members of opaque __struct pktbuff__, described

 * below

 * \n

 * 2. Internal functions, described in Module __Internal functions__

 *

 * @{

 */

/**

 * \defgroup uselessfns Internal functions

 *

 * \warning Do not use these functions. Instead, always use the mangle

 * function appropriate to the level at which you are working.

 * \n

 * pktb_mangle() uses all the below functions except _pktb_pull_, which is not

 * used by anything.

 *

 * @{

 */

/**

 * pktb_push - decrement pointer to packet buffer

 * \param pktb Pointer to userspace packet buffer

 * \param len Number of bytes to subtract from packet start address

 */

EXPORT_SYMBOL

void pktb_push(struct pkt_buff *pktb, unsigned int len)

{

	pktb->data -= len;

	pktb->len += len;

}

/**

 * pktb_pull - increment pointer to packet buffer

 * \param pktb Pointer to userspace packet buffer

 * \param len Number of bytes to add to packet start address

 */

EXPORT_SYMBOL

void pktb_pull(struct pkt_buff *pktb, unsigned int len)

{

	pktb->data += len;

	pktb->len -= len;

}

/**

 * pktb_put - add extra bytes to the tail of the packet buffer

 * \param pktb Pointer to userspace packet buffer

 * \param len Number of bytes to add to packet tail (and length)

 */

EXPORT_SYMBOL

void pktb_put(struct pkt_buff *pktb, unsigned int len)

{

	pktb->len += len;

}

/**

 * pktb_trim - set new length for this packet buffer

 * \param pktb Pointer to userspace packet buffer

 * \param len New packet length (tail is adjusted to reflect this)

 */

EXPORT_SYMBOL

void pktb_trim(struct pkt_buff *pktb, unsigned int len)

{

	pktb->len = len;

}

/**

 * @}

 */

/**

 * pktb_tailroom - get room available for packet expansion

 * \param pktb Pointer to userspace packet buffer

 * \return room in bytes after the tail of the packet buffer

 * \n

 * This starts off as the __extra__ argument to pktb_alloc().

 * Programmers should ensure this __extra__ argument is sufficient for any

 * packet mangle, as packet buffers cannot be expanded dynamically.

 */

EXPORT_SYMBOL

unsigned int pktb_tailroom(struct pkt_buff *pktb)

{

	return pktb->data_len - pktb->len;

}

/**

 * pktb_mac_header - get address of layer 2 header (if any)

 * \param pktb Pointer to userspace packet buffer

 * \return Pointer to MAC header or NULL if no such header present.

 * \n

 * Only packet buffers in family __AF_BRIDGE__ have a non-NULL MAC header.

 */

EXPORT_SYMBOL

uint8_t *pktb_mac_header(struct pkt_buff *pktb)

{

	return pktb->mac_header;

}

/**

 * pktb_network_header - get address of layer 3 header

 * \param pktb Pointer to userspace packet buffer

 * \return Pointer to layer 3 header or NULL if the packet buffer was created

 * with an unsupported family

 */

EXPORT_SYMBOL

uint8_t *pktb_network_header(struct pkt_buff *pktb)

{

	return pktb->network_header;

}

/**

 * pktb_transport_header - get address of layer 4 header (if known)

 * \param pktb Pointer to userspace packet buffer

 * \return Pointer to layer 4 header or NULL if not (yet) set

 * \note

 * Unlike the lower-level headers, it is the programmer's responsibility to

 * create the level 4 (transport) header pointer by caling e.g.

 * nfq_ip_set_transport_header()

 */

EXPORT_SYMBOL

uint8_t *pktb_transport_header(struct pkt_buff *pktb)

{

	return pktb->transport_header;

}

/**

 * @}

 */

static int pktb_expand_tail(struct pkt_buff *pktb, int extra)

{

	/* No room in packet, cannot mangle it. We don't support dynamic

	 * reallocation. Instead, increase the size of the extra room in

	 * the tail in pktb_alloc.

	 */

	if (pktb->len + extra > pktb->data_len)

		return 0;

	pktb->len += extra;

	return 1;

}

static int enlarge_pkt(struct pkt_buff *pktb, unsigned int extra)

{

	if (pktb->len + extra > 65535)

		return 0;

	if (!pktb_expand_tail(pktb, extra - pktb_tailroom(pktb)))

		return 0;

	return 1;

}

/**

 * pktb_mangle - adjust contents of a packet

 * \param pktb Pointer to userspace packet buffer

 * \param dataoff Supplementary offset, usually offset from layer 3 (IP) header

 * to the layer 4 (TCP or UDP) header. Specify zero to access the layer 3

 * header. If \b pktb was created in family \b AF_BRIDGE, specify

 * \b -ETH_HLEN (a negative offset) to access the layer 2 (MAC) header.

 * \param match_offset Further offset to content that you want to mangle

 * \param match_len Length of the existing content you want to mangle

 * \param rep_buffer Pointer to data you want to use to replace current content

 * \param rep_len Length of data you want to use to replace current content

 * \returns 1 for success and 0 for failure. Failure will occur if the \b extra

 * argument to the pktb_alloc() call that created \b pktb is less than the

 * excess of \b rep_len over \b match_len

 \warning pktb_mangle does not update any checksums. Developers should use the

 appropriate mangler for the protocol level: nfq_ip_mangle(),

 nfq_tcp_mangle_ipv4() or nfq_udp_mangle_ipv4(). IPv6 versions are planned.

 \n

 It is appropriate to use pktb_mangle to change the MAC header.

 */

EXPORT_SYMBOL

int pktb_mangle(struct pkt_buff *pktb,

		int dataoff,

		unsigned int match_offset,

		unsigned int match_len,

		const char *rep_buffer,

		unsigned int rep_len)

{

	unsigned char *data;

	if (rep_len > match_len &&

	    rep_len - match_len > pktb_tailroom(pktb) &&

	    !enlarge_pkt(pktb, rep_len - match_len))

		return 0;

	data = pktb->network_header + dataoff;

	/* move post-replacement */

	memmove(data + match_offset + rep_len,

		data + match_offset + match_len,

		pktb_tail(pktb) - (pktb->network_header + dataoff +

			     match_offset + match_len));

	/* insert data from buffer */

	memcpy(data + match_offset, rep_buffer, rep_len);

	/* update packet info */

	if (rep_len > match_len)

		pktb_put(pktb, rep_len - match_len);

	else

		pktb_trim(pktb, pktb->len + rep_len - match_len);

	pktb->mangled = true;

	return 1;

}

/**

 * pktb_mangled - test whether packet has been mangled

 * \param pktb Pointer to userspace packet buffer

 * \return __true__ if packet has been mangled (modified), else __false__

 * \par

 * When assembling a verdict, it is not necessary to return the contents of

 * un-modified packets. Use _pktb_mangled_ to decide whether packet contents

 * need to be returned.

 */

EXPORT_SYMBOL

bool pktb_mangled(const struct pkt_buff *pktb)

{

	return pktb->mangled;

}

/**

 * @}

 */