]>
git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/netfilter/xt_esp.c
1 /* Kernel module to match ESP parameters. */
3 /* (C) 1999-2000 Yon Uriarte <yon@astaro.de>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
10 #include <linux/module.h>
11 #include <linux/skbuff.h>
15 #include <linux/netfilter/xt_esp.h>
16 #include <linux/netfilter/x_tables.h>
18 #include <linux/netfilter_ipv4/ip_tables.h>
19 #include <linux/netfilter_ipv6/ip6_tables.h>
21 MODULE_LICENSE("GPL");
22 MODULE_AUTHOR("Yon Uriarte <yon@astaro.de>");
23 MODULE_DESCRIPTION("Xtables: IPsec-ESP packet match");
24 MODULE_ALIAS("ipt_esp");
25 MODULE_ALIAS("ip6t_esp");
28 #define duprintf(format, args...) printk(format , ## args)
30 #define duprintf(format, args...)
33 /* Returns 1 if the spi is matched by the range, 0 otherwise */
35 spi_match(u_int32_t min
, u_int32_t max
, u_int32_t spi
, bool invert
)
38 duprintf("esp spi_match:%c 0x%x <= 0x%x <= 0x%x", invert
? '!' : ' ',
40 r
= (spi
>= min
&& spi
<= max
) ^ invert
;
41 duprintf(" result %s\n", r
? "PASS" : "FAILED");
45 static bool esp_mt(const struct sk_buff
*skb
, const struct xt_match_param
*par
)
47 const struct ip_esp_hdr
*eh
;
48 struct ip_esp_hdr _esp
;
49 const struct xt_esp
*espinfo
= par
->matchinfo
;
51 /* Must not be a fragment. */
52 if (par
->fragoff
!= 0)
55 eh
= skb_header_pointer(skb
, par
->thoff
, sizeof(_esp
), &_esp
);
57 /* We've been asked to examine this packet, and we
58 * can't. Hence, no choice but to drop.
60 duprintf("Dropping evil ESP tinygram.\n");
65 return spi_match(espinfo
->spis
[0], espinfo
->spis
[1], ntohl(eh
->spi
),
66 !!(espinfo
->invflags
& XT_ESP_INV_SPI
));
69 /* Called when user tries to insert an entry of this type. */
71 esp_mt_check(const char *tablename
, const void *ip_void
,
72 const struct xt_match
*match
, void *matchinfo
,
73 unsigned int hook_mask
)
75 const struct xt_esp
*espinfo
= matchinfo
;
77 if (espinfo
->invflags
& ~XT_ESP_INV_MASK
) {
78 duprintf("xt_esp: unknown flags %X\n", espinfo
->invflags
);
85 static struct xt_match esp_mt_reg
[] __read_mostly
= {
88 .family
= NFPROTO_IPV4
,
89 .checkentry
= esp_mt_check
,
91 .matchsize
= sizeof(struct xt_esp
),
97 .family
= NFPROTO_IPV6
,
98 .checkentry
= esp_mt_check
,
100 .matchsize
= sizeof(struct xt_esp
),
101 .proto
= IPPROTO_ESP
,
106 static int __init
esp_mt_init(void)
108 return xt_register_matches(esp_mt_reg
, ARRAY_SIZE(esp_mt_reg
));
111 static void __exit
esp_mt_exit(void)
113 xt_unregister_matches(esp_mt_reg
, ARRAY_SIZE(esp_mt_reg
));
116 module_init(esp_mt_init
);
117 module_exit(esp_mt_exit
);