]>
git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/netfilter/xt_iprange.c
2 * xt_iprange - Netfilter module to match IP address ranges
4 * (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
5 * (C) CC Computer Consultants GmbH, 2008
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12 #include <linux/module.h>
13 #include <linux/skbuff.h>
15 #include <linux/ipv6.h>
16 #include <linux/netfilter/x_tables.h>
17 #include <linux/netfilter/xt_iprange.h>
20 iprange_mt4(const struct sk_buff
*skb
, struct xt_action_param
*par
)
22 const struct xt_iprange_mtinfo
*info
= par
->matchinfo
;
23 const struct iphdr
*iph
= ip_hdr(skb
);
26 if (info
->flags
& IPRANGE_SRC
) {
27 m
= ntohl(iph
->saddr
) < ntohl(info
->src_min
.ip
);
28 m
|= ntohl(iph
->saddr
) > ntohl(info
->src_max
.ip
);
29 m
^= !!(info
->flags
& IPRANGE_SRC_INV
);
31 pr_debug("src IP %pI4 NOT in range %s%pI4-%pI4\n",
33 (info
->flags
& IPRANGE_SRC_INV
) ? "(INV) " : "",
39 if (info
->flags
& IPRANGE_DST
) {
40 m
= ntohl(iph
->daddr
) < ntohl(info
->dst_min
.ip
);
41 m
|= ntohl(iph
->daddr
) > ntohl(info
->dst_max
.ip
);
42 m
^= !!(info
->flags
& IPRANGE_DST_INV
);
44 pr_debug("dst IP %pI4 NOT in range %s%pI4-%pI4\n",
46 (info
->flags
& IPRANGE_DST_INV
) ? "(INV) " : "",
56 iprange_ipv6_sub(const struct in6_addr
*a
, const struct in6_addr
*b
)
61 for (i
= 0; i
< 4; ++i
) {
62 r
= ntohl(a
->s6_addr32
[i
]) - ntohl(b
->s6_addr32
[i
]);
71 iprange_mt6(const struct sk_buff
*skb
, struct xt_action_param
*par
)
73 const struct xt_iprange_mtinfo
*info
= par
->matchinfo
;
74 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
77 if (info
->flags
& IPRANGE_SRC
) {
78 m
= iprange_ipv6_sub(&iph
->saddr
, &info
->src_min
.in6
) < 0;
79 m
|= iprange_ipv6_sub(&iph
->saddr
, &info
->src_max
.in6
) > 0;
80 m
^= !!(info
->flags
& IPRANGE_SRC_INV
);
84 if (info
->flags
& IPRANGE_DST
) {
85 m
= iprange_ipv6_sub(&iph
->daddr
, &info
->dst_min
.in6
) < 0;
86 m
|= iprange_ipv6_sub(&iph
->daddr
, &info
->dst_max
.in6
) > 0;
87 m
^= !!(info
->flags
& IPRANGE_DST_INV
);
94 static struct xt_match iprange_mt_reg
[] __read_mostly
= {
98 .family
= NFPROTO_IPV4
,
100 .matchsize
= sizeof(struct xt_iprange_mtinfo
),
106 .family
= NFPROTO_IPV6
,
107 .match
= iprange_mt6
,
108 .matchsize
= sizeof(struct xt_iprange_mtinfo
),
113 static int __init
iprange_mt_init(void)
115 return xt_register_matches(iprange_mt_reg
, ARRAY_SIZE(iprange_mt_reg
));
118 static void __exit
iprange_mt_exit(void)
120 xt_unregister_matches(iprange_mt_reg
, ARRAY_SIZE(iprange_mt_reg
));
123 module_init(iprange_mt_init
);
124 module_exit(iprange_mt_exit
);
125 MODULE_LICENSE("GPL");
126 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
127 MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
128 MODULE_DESCRIPTION("Xtables: arbitrary IPv4 range matching");
129 MODULE_ALIAS("ipt_iprange");
130 MODULE_ALIAS("ip6t_iprange");