1 /* Kernel module to match IPComp parameters for IPv4 and IPv6
3 * Copyright (C) 2013 WindRiver
6 * Fan Du <fan.du@windriver.com>
9 * net/netfilter/xt_esp.c
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version
14 * 2 of the License, or (at your option) any later version.
17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
19 #include <linux/module.h>
20 #include <linux/skbuff.h>
23 #include <linux/netfilter/xt_ipcomp.h>
24 #include <linux/netfilter/x_tables.h>
26 MODULE_LICENSE("GPL");
27 MODULE_AUTHOR("Fan Du <fan.du@windriver.com>");
28 MODULE_DESCRIPTION("Xtables: IPv4/6 IPsec-IPComp SPI match");
30 /* Returns 1 if the spi is matched by the range, 0 otherwise */
32 spi_match(u_int32_t min
, u_int32_t max
, u_int32_t spi
, bool invert
)
35 pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n",
36 invert
? '!' : ' ', min
, spi
, max
);
37 r
= (spi
>= min
&& spi
<= max
) ^ invert
;
38 pr_debug(" result %s\n", r
? "PASS" : "FAILED");
42 static bool comp_mt(const struct sk_buff
*skb
, struct xt_action_param
*par
)
44 struct ip_comp_hdr _comphdr
;
45 const struct ip_comp_hdr
*chdr
;
46 const struct xt_ipcomp
*compinfo
= par
->matchinfo
;
48 /* Must not be a fragment. */
49 if (par
->fragoff
!= 0)
52 chdr
= skb_header_pointer(skb
, par
->thoff
, sizeof(_comphdr
), &_comphdr
);
54 /* We've been asked to examine this packet, and we
55 * can't. Hence, no choice but to drop.
57 pr_debug("Dropping evil IPComp tinygram.\n");
62 return spi_match(compinfo
->spis
[0], compinfo
->spis
[1],
64 !!(compinfo
->invflags
& XT_IPCOMP_INV_SPI
));
67 static int comp_mt_check(const struct xt_mtchk_param
*par
)
69 const struct xt_ipcomp
*compinfo
= par
->matchinfo
;
71 /* Must specify no unknown invflags */
72 if (compinfo
->invflags
& ~XT_IPCOMP_INV_MASK
) {
73 pr_err("unknown flags %X\n", compinfo
->invflags
);
79 static struct xt_match comp_mt_reg
[] __read_mostly
= {
82 .family
= NFPROTO_IPV4
,
84 .matchsize
= sizeof(struct xt_ipcomp
),
85 .proto
= IPPROTO_COMP
,
86 .checkentry
= comp_mt_check
,
91 .family
= NFPROTO_IPV6
,
93 .matchsize
= sizeof(struct xt_ipcomp
),
94 .proto
= IPPROTO_COMP
,
95 .checkentry
= comp_mt_check
,
100 static int __init
comp_mt_init(void)
102 return xt_register_matches(comp_mt_reg
, ARRAY_SIZE(comp_mt_reg
));
105 static void __exit
comp_mt_exit(void)
107 xt_unregister_matches(comp_mt_reg
, ARRAY_SIZE(comp_mt_reg
));
110 module_init(comp_mt_init
);
111 module_exit(comp_mt_exit
);
This page took 0.041855 seconds and 5 git commands to generate.