1 /* Kernel module to match ESP parameters. */
3 /* (C) 1999-2000 Yon Uriarte <yon@astaro.de>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
10 #include <linux/module.h>
11 #include <linux/skbuff.h>
15 #include <linux/netfilter/xt_esp.h>
16 #include <linux/netfilter/x_tables.h>
18 #include <linux/netfilter_ipv4/ip_tables.h>
19 #include <linux/netfilter_ipv6/ip6_tables.h>
21 MODULE_LICENSE("GPL");
22 MODULE_AUTHOR("Yon Uriarte <yon@astaro.de>");
23 MODULE_DESCRIPTION("Xtables: IPsec-ESP packet match");
24 MODULE_ALIAS("ipt_esp");
25 MODULE_ALIAS("ip6t_esp");
28 #define duprintf(format, args...) printk(format , ## args)
30 #define duprintf(format, args...)
33 /* Returns 1 if the spi is matched by the range, 0 otherwise */
35 spi_match(u_int32_t min
, u_int32_t max
, u_int32_t spi
, bool invert
)
38 duprintf("esp spi_match:%c 0x%x <= 0x%x <= 0x%x", invert
? '!' : ' ',
40 r
= (spi
>= min
&& spi
<= max
) ^ invert
;
41 duprintf(" result %s\n", r
? "PASS" : "FAILED");
45 static bool esp_mt(const struct sk_buff
*skb
, const struct xt_match_param
*par
)
47 const struct ip_esp_hdr
*eh
;
48 struct ip_esp_hdr _esp
;
49 const struct xt_esp
*espinfo
= par
->matchinfo
;
51 /* Must not be a fragment. */
52 if (par
->fragoff
!= 0)
55 eh
= skb_header_pointer(skb
, par
->thoff
, sizeof(_esp
), &_esp
);
57 /* We've been asked to examine this packet, and we
58 * can't. Hence, no choice but to drop.
60 duprintf("Dropping evil ESP tinygram.\n");
65 return spi_match(espinfo
->spis
[0], espinfo
->spis
[1], ntohl(eh
->spi
),
66 !!(espinfo
->invflags
& XT_ESP_INV_SPI
));
69 static bool esp_mt_check(const struct xt_mtchk_param
*par
)
71 const struct xt_esp
*espinfo
= par
->matchinfo
;
73 if (espinfo
->invflags
& ~XT_ESP_INV_MASK
) {
74 duprintf("xt_esp: unknown flags %X\n", espinfo
->invflags
);
81 static struct xt_match esp_mt_reg
[] __read_mostly
= {
84 .family
= NFPROTO_IPV4
,
85 .checkentry
= esp_mt_check
,
87 .matchsize
= sizeof(struct xt_esp
),
93 .family
= NFPROTO_IPV6
,
94 .checkentry
= esp_mt_check
,
96 .matchsize
= sizeof(struct xt_esp
),
102 static int __init
esp_mt_init(void)
104 return xt_register_matches(esp_mt_reg
, ARRAY_SIZE(esp_mt_reg
));
107 static void __exit
esp_mt_exit(void)
109 xt_unregister_matches(esp_mt_reg
, ARRAY_SIZE(esp_mt_reg
));
112 module_init(esp_mt_init
);
113 module_exit(esp_mt_exit
);
This page took 0.032821 seconds and 5 git commands to generate.