]>
Commit | Line | Data |
---|---|---|
6a649f33 | 1 | /* Kernel module to match IPComp parameters for IPv4 and IPv6 |
2 | * | |
3 | * Copyright (C) 2013 WindRiver | |
4 | * | |
5 | * Author: | |
6 | * Fan Du <fan.du@windriver.com> | |
7 | * | |
8 | * Based on: | |
9 | * net/netfilter/xt_esp.c | |
10 | * | |
11 | * This program is free software; you can redistribute it and/or | |
12 | * modify it under the terms of the GNU General Public License | |
13 | * as published by the Free Software Foundation; either version | |
14 | * 2 of the License, or (at your option) any later version. | |
15 | */ | |
16 | ||
17 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt | |
18 | #include <linux/in.h> | |
19 | #include <linux/module.h> | |
20 | #include <linux/skbuff.h> | |
21 | #include <linux/ip.h> | |
22 | ||
23 | #include <linux/netfilter/xt_ipcomp.h> | |
24 | #include <linux/netfilter/x_tables.h> | |
25 | ||
26 | MODULE_LICENSE("GPL"); | |
27 | MODULE_AUTHOR("Fan Du <fan.du@windriver.com>"); | |
28 | MODULE_DESCRIPTION("Xtables: IPv4/6 IPsec-IPComp SPI match"); | |
f434ed0a LZ |
29 | MODULE_ALIAS("ipt_ipcomp"); |
30 | MODULE_ALIAS("ip6t_ipcomp"); | |
6a649f33 | 31 | |
32 | /* Returns 1 if the spi is matched by the range, 0 otherwise */ | |
33 | static inline bool | |
34 | spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert) | |
35 | { | |
36 | bool r; | |
37 | pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n", | |
38 | invert ? '!' : ' ', min, spi, max); | |
39 | r = (spi >= min && spi <= max) ^ invert; | |
40 | pr_debug(" result %s\n", r ? "PASS" : "FAILED"); | |
41 | return r; | |
42 | } | |
43 | ||
44 | static bool comp_mt(const struct sk_buff *skb, struct xt_action_param *par) | |
45 | { | |
46 | struct ip_comp_hdr _comphdr; | |
47 | const struct ip_comp_hdr *chdr; | |
48 | const struct xt_ipcomp *compinfo = par->matchinfo; | |
49 | ||
50 | /* Must not be a fragment. */ | |
51 | if (par->fragoff != 0) | |
52 | return false; | |
53 | ||
54 | chdr = skb_header_pointer(skb, par->thoff, sizeof(_comphdr), &_comphdr); | |
55 | if (chdr == NULL) { | |
56 | /* We've been asked to examine this packet, and we | |
57 | * can't. Hence, no choice but to drop. | |
58 | */ | |
59 | pr_debug("Dropping evil IPComp tinygram.\n"); | |
60 | par->hotdrop = true; | |
61 | return 0; | |
62 | } | |
63 | ||
64 | return spi_match(compinfo->spis[0], compinfo->spis[1], | |
2ba436fc | 65 | ntohs(chdr->cpi), |
6a649f33 | 66 | !!(compinfo->invflags & XT_IPCOMP_INV_SPI)); |
67 | } | |
68 | ||
69 | static int comp_mt_check(const struct xt_mtchk_param *par) | |
70 | { | |
71 | const struct xt_ipcomp *compinfo = par->matchinfo; | |
72 | ||
73 | /* Must specify no unknown invflags */ | |
74 | if (compinfo->invflags & ~XT_IPCOMP_INV_MASK) { | |
75 | pr_err("unknown flags %X\n", compinfo->invflags); | |
76 | return -EINVAL; | |
77 | } | |
78 | return 0; | |
79 | } | |
80 | ||
81 | static struct xt_match comp_mt_reg[] __read_mostly = { | |
82 | { | |
83 | .name = "ipcomp", | |
84 | .family = NFPROTO_IPV4, | |
85 | .match = comp_mt, | |
86 | .matchsize = sizeof(struct xt_ipcomp), | |
87 | .proto = IPPROTO_COMP, | |
88 | .checkentry = comp_mt_check, | |
89 | .me = THIS_MODULE, | |
90 | }, | |
91 | { | |
92 | .name = "ipcomp", | |
93 | .family = NFPROTO_IPV6, | |
94 | .match = comp_mt, | |
95 | .matchsize = sizeof(struct xt_ipcomp), | |
96 | .proto = IPPROTO_COMP, | |
97 | .checkentry = comp_mt_check, | |
98 | .me = THIS_MODULE, | |
99 | }, | |
100 | }; | |
101 | ||
102 | static int __init comp_mt_init(void) | |
103 | { | |
104 | return xt_register_matches(comp_mt_reg, ARRAY_SIZE(comp_mt_reg)); | |
105 | } | |
106 | ||
107 | static void __exit comp_mt_exit(void) | |
108 | { | |
109 | xt_unregister_matches(comp_mt_reg, ARRAY_SIZE(comp_mt_reg)); | |
110 | } | |
111 | ||
112 | module_init(comp_mt_init); | |
113 | module_exit(comp_mt_exit); |