]>
Commit | Line | Data |
---|---|---|
6a649f33 | 1 | /* Kernel module to match IPComp parameters for IPv4 and IPv6 |
2 | * | |
3 | * Copyright (C) 2013 WindRiver | |
4 | * | |
5 | * Author: | |
6 | * Fan Du <fan.du@windriver.com> | |
7 | * | |
8 | * Based on: | |
9 | * net/netfilter/xt_esp.c | |
10 | * | |
11 | * This program is free software; you can redistribute it and/or | |
12 | * modify it under the terms of the GNU General Public License | |
13 | * as published by the Free Software Foundation; either version | |
14 | * 2 of the License, or (at your option) any later version. | |
15 | */ | |
16 | ||
17 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt | |
18 | #include <linux/in.h> | |
19 | #include <linux/module.h> | |
20 | #include <linux/skbuff.h> | |
21 | #include <linux/ip.h> | |
22 | ||
23 | #include <linux/netfilter/xt_ipcomp.h> | |
24 | #include <linux/netfilter/x_tables.h> | |
25 | ||
26 | MODULE_LICENSE("GPL"); | |
27 | MODULE_AUTHOR("Fan Du <fan.du@windriver.com>"); | |
28 | MODULE_DESCRIPTION("Xtables: IPv4/6 IPsec-IPComp SPI match"); | |
29 | ||
30 | /* Returns 1 if the spi is matched by the range, 0 otherwise */ | |
31 | static inline bool | |
32 | spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert) | |
33 | { | |
34 | bool r; | |
35 | pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n", | |
36 | invert ? '!' : ' ', min, spi, max); | |
37 | r = (spi >= min && spi <= max) ^ invert; | |
38 | pr_debug(" result %s\n", r ? "PASS" : "FAILED"); | |
39 | return r; | |
40 | } | |
41 | ||
42 | static bool comp_mt(const struct sk_buff *skb, struct xt_action_param *par) | |
43 | { | |
44 | struct ip_comp_hdr _comphdr; | |
45 | const struct ip_comp_hdr *chdr; | |
46 | const struct xt_ipcomp *compinfo = par->matchinfo; | |
47 | ||
48 | /* Must not be a fragment. */ | |
49 | if (par->fragoff != 0) | |
50 | return false; | |
51 | ||
52 | chdr = skb_header_pointer(skb, par->thoff, sizeof(_comphdr), &_comphdr); | |
53 | if (chdr == NULL) { | |
54 | /* We've been asked to examine this packet, and we | |
55 | * can't. Hence, no choice but to drop. | |
56 | */ | |
57 | pr_debug("Dropping evil IPComp tinygram.\n"); | |
58 | par->hotdrop = true; | |
59 | return 0; | |
60 | } | |
61 | ||
62 | return spi_match(compinfo->spis[0], compinfo->spis[1], | |
2ba436fc | 63 | ntohs(chdr->cpi), |
6a649f33 | 64 | !!(compinfo->invflags & XT_IPCOMP_INV_SPI)); |
65 | } | |
66 | ||
67 | static int comp_mt_check(const struct xt_mtchk_param *par) | |
68 | { | |
69 | const struct xt_ipcomp *compinfo = par->matchinfo; | |
70 | ||
71 | /* Must specify no unknown invflags */ | |
72 | if (compinfo->invflags & ~XT_IPCOMP_INV_MASK) { | |
73 | pr_err("unknown flags %X\n", compinfo->invflags); | |
74 | return -EINVAL; | |
75 | } | |
76 | return 0; | |
77 | } | |
78 | ||
79 | static struct xt_match comp_mt_reg[] __read_mostly = { | |
80 | { | |
81 | .name = "ipcomp", | |
82 | .family = NFPROTO_IPV4, | |
83 | .match = comp_mt, | |
84 | .matchsize = sizeof(struct xt_ipcomp), | |
85 | .proto = IPPROTO_COMP, | |
86 | .checkentry = comp_mt_check, | |
87 | .me = THIS_MODULE, | |
88 | }, | |
89 | { | |
90 | .name = "ipcomp", | |
91 | .family = NFPROTO_IPV6, | |
92 | .match = comp_mt, | |
93 | .matchsize = sizeof(struct xt_ipcomp), | |
94 | .proto = IPPROTO_COMP, | |
95 | .checkentry = comp_mt_check, | |
96 | .me = THIS_MODULE, | |
97 | }, | |
98 | }; | |
99 | ||
100 | static int __init comp_mt_init(void) | |
101 | { | |
102 | return xt_register_matches(comp_mt_reg, ARRAY_SIZE(comp_mt_reg)); | |
103 | } | |
104 | ||
105 | static void __exit comp_mt_exit(void) | |
106 | { | |
107 | xt_unregister_matches(comp_mt_reg, ARRAY_SIZE(comp_mt_reg)); | |
108 | } | |
109 | ||
110 | module_init(comp_mt_init); | |
111 | module_exit(comp_mt_exit); |