1 /* Kernel module to match ESP parameters. */
3 /* (C) 1999-2000 Yon Uriarte <yon@astaro.de>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
10 #include <linux/module.h>
11 #include <linux/skbuff.h>
15 #include <linux/netfilter/xt_esp.h>
16 #include <linux/netfilter/x_tables.h>
18 #include <linux/netfilter_ipv4/ip_tables.h>
19 #include <linux/netfilter_ipv6/ip6_tables.h>
21 MODULE_LICENSE("GPL");
22 MODULE_AUTHOR("Yon Uriarte <yon@astaro.de>");
23 MODULE_DESCRIPTION("Xtables: IPsec-ESP packet match");
24 MODULE_ALIAS("ipt_esp");
25 MODULE_ALIAS("ip6t_esp");
27 /* Returns 1 if the spi is matched by the range, 0 otherwise */
29 spi_match(u_int32_t min
, u_int32_t max
, u_int32_t spi
, bool invert
)
32 pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n",
33 invert
? '!' : ' ', min
, spi
, max
);
34 r
= (spi
>= min
&& spi
<= max
) ^ invert
;
35 pr_debug(" result %s\n", r
? "PASS" : "FAILED");
39 static bool esp_mt(const struct sk_buff
*skb
, struct xt_action_param
*par
)
41 const struct ip_esp_hdr
*eh
;
42 struct ip_esp_hdr _esp
;
43 const struct xt_esp
*espinfo
= par
->matchinfo
;
45 /* Must not be a fragment. */
46 if (par
->fragoff
!= 0)
49 eh
= skb_header_pointer(skb
, par
->thoff
, sizeof(_esp
), &_esp
);
51 /* We've been asked to examine this packet, and we
52 * can't. Hence, no choice but to drop.
54 pr_debug("Dropping evil ESP tinygram.\n");
59 return spi_match(espinfo
->spis
[0], espinfo
->spis
[1], ntohl(eh
->spi
),
60 !!(espinfo
->invflags
& XT_ESP_INV_SPI
));
63 static int esp_mt_check(const struct xt_mtchk_param
*par
)
65 const struct xt_esp
*espinfo
= par
->matchinfo
;
67 if (espinfo
->invflags
& ~XT_ESP_INV_MASK
) {
68 pr_debug("unknown flags %X\n", espinfo
->invflags
);
75 static struct xt_match esp_mt_reg
[] __read_mostly
= {
78 .family
= NFPROTO_IPV4
,
79 .checkentry
= esp_mt_check
,
81 .matchsize
= sizeof(struct xt_esp
),
87 .family
= NFPROTO_IPV6
,
88 .checkentry
= esp_mt_check
,
90 .matchsize
= sizeof(struct xt_esp
),
96 static int __init
esp_mt_init(void)
98 return xt_register_matches(esp_mt_reg
, ARRAY_SIZE(esp_mt_reg
));
101 static void __exit
esp_mt_exit(void)
103 xt_unregister_matches(esp_mt_reg
, ARRAY_SIZE(esp_mt_reg
));
106 module_init(esp_mt_init
);
107 module_exit(esp_mt_exit
);
This page took 0.031375 seconds and 5 git commands to generate.