[mirror_ubuntu-bionic-kernel.git] / net / netfilter / xt_esp.c

/* Kernel module to match ESP parameters. */

/* (C) 1999-2000 Yon Uriarte <yon@astaro.de>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/in.h>
#include <linux/ip.h>

#include <linux/netfilter/xt_esp.h>
#include <linux/netfilter/x_tables.h>

#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Yon Uriarte <yon@astaro.de>");
MODULE_DESCRIPTION("x_tables ESP SPI match module");
MODULE_ALIAS("ipt_esp");
MODULE_ALIAS("ip6t_esp");

#if 0
#define duprintf(format, args...) printk(format , ## args)
#else
#define duprintf(format, args...)
#endif

/* Returns 1 if the spi is matched by the range, 0 otherwise */
static inline int
spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, int invert)
{
	int r = 0;
	duprintf("esp spi_match:%c 0x%x <= 0x%x <= 0x%x", invert ? '!' : ' ',
		 min, spi, max);
	r = (spi >= min && spi <= max) ^ invert;
	duprintf(" result %s\n", r ? "PASS" : "FAILED");
	return r;
}

static int
match(const struct sk_buff *skb,
      const struct net_device *in,
      const struct net_device *out,
      const struct xt_match *match,
      const void *matchinfo,
      int offset,
      unsigned int protoff,
      int *hotdrop)
{
	struct ip_esp_hdr _esp, *eh;
	const struct xt_esp *espinfo = matchinfo;

	/* Must not be a fragment. */
	if (offset)
		return 0;

	eh = skb_header_pointer(skb, protoff, sizeof(_esp), &_esp);
	if (eh == NULL) {
		/* We've been asked to examine this packet, and we
		 * can't.  Hence, no choice but to drop.
		 */
		duprintf("Dropping evil ESP tinygram.\n");
		*hotdrop = 1;
		return 0;
	}

	return spi_match(espinfo->spis[0], espinfo->spis[1], ntohl(eh->spi),
			 !!(espinfo->invflags & XT_ESP_INV_SPI));
}

/* Called when user tries to insert an entry of this type. */
static int
checkentry(const char *tablename,
	   const void *ip_void,
	   const struct xt_match *match,
	   void *matchinfo,
	   unsigned int hook_mask)
{
	const struct xt_esp *espinfo = matchinfo;

	if (espinfo->invflags & ~XT_ESP_INV_MASK) {
		duprintf("xt_esp: unknown flags %X\n", espinfo->invflags);
		return 0;
	}

	return 1;
}

static struct xt_match xt_esp_match[] = {
	{
		.name		= "esp",
		.family		= AF_INET,
		.checkentry	= checkentry,
		.match		= match,
		.matchsize	= sizeof(struct xt_esp),
		.proto		= IPPROTO_ESP,
		.me		= THIS_MODULE,
	},
	{
		.name		= "esp",
		.family		= AF_INET6,
		.checkentry	= checkentry,
		.match		= match,
		.matchsize	= sizeof(struct xt_esp),
		.proto		= IPPROTO_ESP,
		.me		= THIS_MODULE,
	},
};

static int __init xt_esp_init(void)
{
	return xt_register_matches(xt_esp_match, ARRAY_SIZE(xt_esp_match));
}

static void __exit xt_esp_cleanup(void)
{
	xt_unregister_matches(xt_esp_match, ARRAY_SIZE(xt_esp_match));
}

module_init(xt_esp_init);
module_exit(xt_esp_cleanup);
Commit	Line	Data
1da177e4 LT	1	/* Kernel module to match ESP parameters. */
	2
	3	/* (C) 1999-2000 Yon Uriarte <yon@astaro.de>
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation.
	8	*/
	9
	10	#include <linux/module.h>
	11	#include <linux/skbuff.h>
dc5ab2fa	12	#include <linux/in.h>
1da177e4 LT	13	#include <linux/ip.h>
1da177e4 LT	14
dc5ab2fa YK	15	#include <linux/netfilter/xt_esp.h>
	16	#include <linux/netfilter/x_tables.h>
	17
1da177e4	18	#include <linux/netfilter_ipv4/ip_tables.h>
dc5ab2fa	19	#include <linux/netfilter_ipv6/ip6_tables.h>
1da177e4 LT	20
	21	MODULE_LICENSE("GPL");
	22	MODULE_AUTHOR("Yon Uriarte <yon@astaro.de>");
dc5ab2fa YK	23	MODULE_DESCRIPTION("x_tables ESP SPI match module");
	24	MODULE_ALIAS("ipt_esp");
	25	MODULE_ALIAS("ip6t_esp");
1da177e4	26
dc5ab2fa	27	#if 0
1da177e4 LT	28	#define duprintf(format, args...) printk(format , ## args)
	29	#else
	30	#define duprintf(format, args...)
	31	#endif
	32
	33	/* Returns 1 if the spi is matched by the range, 0 otherwise */
	34	static inline int
	35	spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, int invert)
	36	{
dc5ab2fa YK	37	int r = 0;
	38	duprintf("esp spi_match:%c 0x%x <= 0x%x <= 0x%x", invert ? '!' : ' ',
	39	min, spi, max);
	40	r = (spi >= min && spi <= max) ^ invert;
	41	duprintf(" result %s\n", r ? "PASS" : "FAILED");
1da177e4 LT	42	return r;
	43	}
	44
	45	static int
	46	match(const struct sk_buff *skb,
	47	const struct net_device *in,
	48	const struct net_device *out,
c4986734	49	const struct xt_match *match,
1da177e4 LT	50	const void *matchinfo,
1da177e4 LT	51	int offset,
2e4e6a17	52	unsigned int protoff,
1da177e4 LT	53	int *hotdrop)
	54	{
	55	struct ip_esp_hdr _esp, *eh;
dc5ab2fa	56	const struct xt_esp *espinfo = matchinfo;
1da177e4 LT	57
	58	/* Must not be a fragment. */
	59	if (offset)
	60	return 0;
	61
dc5ab2fa	62	eh = skb_header_pointer(skb, protoff, sizeof(_esp), &_esp);
1da177e4 LT	63	if (eh == NULL) {
	64	/* We've been asked to examine this packet, and we
	65	* can't. Hence, no choice but to drop.
	66	*/
	67	duprintf("Dropping evil ESP tinygram.\n");
	68	*hotdrop = 1;
	69	return 0;
	70	}
	71
dc5ab2fa YK	72	return spi_match(espinfo->spis[0], espinfo->spis[1], ntohl(eh->spi),
dc5ab2fa YK	73	!!(espinfo->invflags & XT_ESP_INV_SPI));
1da177e4 LT	74	}
	75
	76	/* Called when user tries to insert an entry of this type. */
	77	static int
	78	checkentry(const char *tablename,
2e4e6a17	79	const void *ip_void,
c4986734	80	const struct xt_match *match,
1da177e4	81	void *matchinfo,
1da177e4 LT	82	unsigned int hook_mask)
1da177e4 LT	83	{
dc5ab2fa	84	const struct xt_esp *espinfo = matchinfo;
1da177e4	85
dc5ab2fa YK	86	if (espinfo->invflags & ~XT_ESP_INV_MASK) {
dc5ab2fa YK	87	duprintf("xt_esp: unknown flags %X\n", espinfo->invflags);
1da177e4 LT	88	return 0;
1da177e4 LT	89	}
dc5ab2fa	90
1da177e4 LT	91	return 1;
	92	}
	93
4470bbc7 PM	94	static struct xt_match xt_esp_match[] = {
	95	{
	96	.name = "esp",
	97	.family = AF_INET,
	98	.checkentry = checkentry,
	99	.match = match,
	100	.matchsize = sizeof(struct xt_esp),
	101	.proto = IPPROTO_ESP,
	102	.me = THIS_MODULE,
	103	},
	104	{
	105	.name = "esp",
	106	.family = AF_INET6,
	107	.checkentry = checkentry,
	108	.match = match,
	109	.matchsize = sizeof(struct xt_esp),
	110	.proto = IPPROTO_ESP,
	111	.me = THIS_MODULE,
	112	},
dc5ab2fa YK	113	};
	114
	115	static int __init xt_esp_init(void)
1da177e4	116	{
4470bbc7	117	return xt_register_matches(xt_esp_match, ARRAY_SIZE(xt_esp_match));
1da177e4 LT	118	}
1da177e4 LT	119
dc5ab2fa	120	static void __exit xt_esp_cleanup(void)
1da177e4	121	{
4470bbc7	122	xt_unregister_matches(xt_esp_match, ARRAY_SIZE(xt_esp_match));
1da177e4 LT	123	}
1da177e4 LT	124
dc5ab2fa YK	125	module_init(xt_esp_init);
dc5ab2fa YK	126	module_exit(xt_esp_cleanup);