6a649f33 |
1 | /* Kernel module to match IPComp parameters for IPv4 and IPv6 |
2 | * |
3 | * Copyright (C) 2013 WindRiver |
4 | * |
5 | * Author: |
6 | * Fan Du <fan.du@windriver.com> |
7 | * |
8 | * Based on: |
9 | * net/netfilter/xt_esp.c |
10 | * |
11 | * This program is free software; you can redistribute it and/or |
12 | * modify it under the terms of the GNU General Public License |
13 | * as published by the Free Software Foundation; either version |
14 | * 2 of the License, or (at your option) any later version. |
15 | */ |
16 | |
17 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
18 | #include <linux/in.h> |
19 | #include <linux/module.h> |
20 | #include <linux/skbuff.h> |
21 | #include <linux/ip.h> |
22 | |
23 | #include <linux/netfilter/xt_ipcomp.h> |
24 | #include <linux/netfilter/x_tables.h> |
25 | |
26 | MODULE_LICENSE("GPL"); |
27 | MODULE_AUTHOR("Fan Du <fan.du@windriver.com>"); |
28 | MODULE_DESCRIPTION("Xtables: IPv4/6 IPsec-IPComp SPI match"); |
29 | |
30 | /* Returns 1 if the spi is matched by the range, 0 otherwise */ |
31 | static inline bool |
32 | spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert) |
33 | { |
34 | bool r; |
35 | pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n", |
36 | invert ? '!' : ' ', min, spi, max); |
37 | r = (spi >= min && spi <= max) ^ invert; |
38 | pr_debug(" result %s\n", r ? "PASS" : "FAILED"); |
39 | return r; |
40 | } |
41 | |
42 | static bool comp_mt(const struct sk_buff *skb, struct xt_action_param *par) |
43 | { |
44 | struct ip_comp_hdr _comphdr; |
45 | const struct ip_comp_hdr *chdr; |
46 | const struct xt_ipcomp *compinfo = par->matchinfo; |
47 | |
48 | /* Must not be a fragment. */ |
49 | if (par->fragoff != 0) |
50 | return false; |
51 | |
52 | chdr = skb_header_pointer(skb, par->thoff, sizeof(_comphdr), &_comphdr); |
53 | if (chdr == NULL) { |
54 | /* We've been asked to examine this packet, and we |
55 | * can't. Hence, no choice but to drop. |
56 | */ |
57 | pr_debug("Dropping evil IPComp tinygram.\n"); |
58 | par->hotdrop = true; |
59 | return 0; |
60 | } |
61 | |
62 | return spi_match(compinfo->spis[0], compinfo->spis[1], |
2ba436fc |
63 | ntohs(chdr->cpi), |
6a649f33 |
64 | !!(compinfo->invflags & XT_IPCOMP_INV_SPI)); |
65 | } |
66 | |
67 | static int comp_mt_check(const struct xt_mtchk_param *par) |
68 | { |
69 | const struct xt_ipcomp *compinfo = par->matchinfo; |
70 | |
71 | /* Must specify no unknown invflags */ |
72 | if (compinfo->invflags & ~XT_IPCOMP_INV_MASK) { |
73 | pr_err("unknown flags %X\n", compinfo->invflags); |
74 | return -EINVAL; |
75 | } |
76 | return 0; |
77 | } |
78 | |
79 | static struct xt_match comp_mt_reg[] __read_mostly = { |
80 | { |
81 | .name = "ipcomp", |
82 | .family = NFPROTO_IPV4, |
83 | .match = comp_mt, |
84 | .matchsize = sizeof(struct xt_ipcomp), |
85 | .proto = IPPROTO_COMP, |
86 | .checkentry = comp_mt_check, |
87 | .me = THIS_MODULE, |
88 | }, |
89 | { |
90 | .name = "ipcomp", |
91 | .family = NFPROTO_IPV6, |
92 | .match = comp_mt, |
93 | .matchsize = sizeof(struct xt_ipcomp), |
94 | .proto = IPPROTO_COMP, |
95 | .checkentry = comp_mt_check, |
96 | .me = THIS_MODULE, |
97 | }, |
98 | }; |
99 | |
100 | static int __init comp_mt_init(void) |
101 | { |
102 | return xt_register_matches(comp_mt_reg, ARRAY_SIZE(comp_mt_reg)); |
103 | } |
104 | |
105 | static void __exit comp_mt_exit(void) |
106 | { |
107 | xt_unregister_matches(comp_mt_reg, ARRAY_SIZE(comp_mt_reg)); |
108 | } |
109 | |
110 | module_init(comp_mt_init); |
111 | module_exit(comp_mt_exit); |