xt_esp.c 3.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126
  1. /* Kernel module to match ESP parameters. */
  2. /* (C) 1999-2000 Yon Uriarte <yon@astaro.de>
  3. *
  4. * This program is free software; you can redistribute it and/or modify
  5. * it under the terms of the GNU General Public License version 2 as
  6. * published by the Free Software Foundation.
  7. */
  8. #include <linux/module.h>
  9. #include <linux/skbuff.h>
  10. #include <linux/in.h>
  11. #include <linux/ip.h>
  12. #include <linux/netfilter/xt_esp.h>
  13. #include <linux/netfilter/x_tables.h>
  14. #include <linux/netfilter_ipv4/ip_tables.h>
  15. #include <linux/netfilter_ipv6/ip6_tables.h>
  16. MODULE_LICENSE("GPL");
  17. MODULE_AUTHOR("Yon Uriarte <yon@astaro.de>");
  18. MODULE_DESCRIPTION("x_tables ESP SPI match module");
  19. MODULE_ALIAS("ipt_esp");
  20. MODULE_ALIAS("ip6t_esp");
  21. #if 0
  22. #define duprintf(format, args...) printk(format , ## args)
  23. #else
  24. #define duprintf(format, args...)
  25. #endif
  26. /* Returns 1 if the spi is matched by the range, 0 otherwise */
  27. static inline int
  28. spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, int invert)
  29. {
  30. int r = 0;
  31. duprintf("esp spi_match:%c 0x%x <= 0x%x <= 0x%x", invert ? '!' : ' ',
  32. min, spi, max);
  33. r = (spi >= min && spi <= max) ^ invert;
  34. duprintf(" result %s\n", r ? "PASS" : "FAILED");
  35. return r;
  36. }
  37. static int
  38. match(const struct sk_buff *skb,
  39. const struct net_device *in,
  40. const struct net_device *out,
  41. const struct xt_match *match,
  42. const void *matchinfo,
  43. int offset,
  44. unsigned int protoff,
  45. int *hotdrop)
  46. {
  47. struct ip_esp_hdr _esp, *eh;
  48. const struct xt_esp *espinfo = matchinfo;
  49. /* Must not be a fragment. */
  50. if (offset)
  51. return 0;
  52. eh = skb_header_pointer(skb, protoff, sizeof(_esp), &_esp);
  53. if (eh == NULL) {
  54. /* We've been asked to examine this packet, and we
  55. * can't. Hence, no choice but to drop.
  56. */
  57. duprintf("Dropping evil ESP tinygram.\n");
  58. *hotdrop = 1;
  59. return 0;
  60. }
  61. return spi_match(espinfo->spis[0], espinfo->spis[1], ntohl(eh->spi),
  62. !!(espinfo->invflags & XT_ESP_INV_SPI));
  63. }
  64. /* Called when user tries to insert an entry of this type. */
  65. static int
  66. checkentry(const char *tablename,
  67. const void *ip_void,
  68. const struct xt_match *match,
  69. void *matchinfo,
  70. unsigned int hook_mask)
  71. {
  72. const struct xt_esp *espinfo = matchinfo;
  73. if (espinfo->invflags & ~XT_ESP_INV_MASK) {
  74. duprintf("xt_esp: unknown flags %X\n", espinfo->invflags);
  75. return 0;
  76. }
  77. return 1;
  78. }
  79. static struct xt_match xt_esp_match[] = {
  80. {
  81. .name = "esp",
  82. .family = AF_INET,
  83. .checkentry = checkentry,
  84. .match = match,
  85. .matchsize = sizeof(struct xt_esp),
  86. .proto = IPPROTO_ESP,
  87. .me = THIS_MODULE,
  88. },
  89. {
  90. .name = "esp",
  91. .family = AF_INET6,
  92. .checkentry = checkentry,
  93. .match = match,
  94. .matchsize = sizeof(struct xt_esp),
  95. .proto = IPPROTO_ESP,
  96. .me = THIS_MODULE,
  97. },
  98. };
  99. static int __init xt_esp_init(void)
  100. {
  101. return xt_register_matches(xt_esp_match, ARRAY_SIZE(xt_esp_match));
  102. }
  103. static void __exit xt_esp_cleanup(void)
  104. {
  105. xt_unregister_matches(xt_esp_match, ARRAY_SIZE(xt_esp_match));
  106. }
  107. module_init(xt_esp_init);
  108. module_exit(xt_esp_cleanup);