1 /* Kernel module to match ROUTING parameters. */
3 /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
10 #include <linux/module.h>
11 #include <linux/skbuff.h>
12 #include <linux/ipv6.h>
13 #include <linux/types.h>
14 #include <net/checksum.h>
17 #include <asm/byteorder.h>
19 #include <linux/netfilter_ipv6/ip6_tables.h>
20 #include <linux/netfilter_ipv6/ip6t_rt.h>
22 MODULE_LICENSE("GPL");
23 MODULE_DESCRIPTION("IPv6 RT match");
24 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
29 #define DEBUGP(format, args...)
32 /* Returns 1 if the id is matched by the range, 0 otherwise */
34 segsleft_match(u_int32_t min, u_int32_t max, u_int32_t id, int invert)
37 DEBUGP("rt segsleft_match:%c 0x%x <= 0x%x <= 0x%x",
38 invert ? '!' : ' ', min, id, max);
39 r = (id >= min && id <= max) ^ invert;
40 DEBUGP(" result %s\n", r ? "PASS" : "FAILED");
45 match(const struct sk_buff *skb,
46 const struct net_device *in,
47 const struct net_device *out,
48 const void *matchinfo,
53 struct ipv6_rt_hdr _route, *rh;
54 const struct ip6t_rt *rtinfo = matchinfo;
57 unsigned int hdrlen = 0;
59 struct in6_addr *ap, _addr;
62 err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL);
69 rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
75 hdrlen = ipv6_optlen(rh);
76 if (skb->len - ptr < hdrlen) {
77 /* Pcket smaller than its length field */
81 DEBUGP("IPv6 RT LEN %u %u ", hdrlen, rh->hdrlen);
82 DEBUGP("TYPE %04X ", rh->type);
83 DEBUGP("SGS_LEFT %u %02X\n", rh->segments_left, rh->segments_left);
85 DEBUGP("IPv6 RT segsleft %02X ",
86 (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
88 !!(rtinfo->invflags & IP6T_RT_INV_SGS))));
89 DEBUGP("type %02X %02X %02X ",
90 rtinfo->rt_type, rh->type,
91 (!(rtinfo->flags & IP6T_RT_TYP) ||
92 ((rtinfo->rt_type == rh->type) ^
93 !!(rtinfo->invflags & IP6T_RT_INV_TYP))));
94 DEBUGP("len %02X %04X %02X ",
95 rtinfo->hdrlen, hdrlen,
96 (!(rtinfo->flags & IP6T_RT_LEN) ||
97 ((rtinfo->hdrlen == hdrlen) ^
98 !!(rtinfo->invflags & IP6T_RT_INV_LEN))));
99 DEBUGP("res %02X %02X %02X ",
100 (rtinfo->flags & IP6T_RT_RES),
101 ((struct rt0_hdr *)rh)->reserved,
102 !((rtinfo->flags & IP6T_RT_RES) &&
103 (((struct rt0_hdr *)rh)->reserved)));
107 (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
109 !!(rtinfo->invflags & IP6T_RT_INV_SGS)))
111 (!(rtinfo->flags & IP6T_RT_LEN) ||
112 ((rtinfo->hdrlen == hdrlen) ^
113 !!(rtinfo->invflags & IP6T_RT_INV_LEN)))
115 (!(rtinfo->flags & IP6T_RT_TYP) ||
116 ((rtinfo->rt_type == rh->type) ^
117 !!(rtinfo->invflags & IP6T_RT_INV_TYP)));
119 if (ret && (rtinfo->flags & IP6T_RT_RES)) {
120 u_int32_t *rp, _reserved;
121 rp = skb_header_pointer(skb,
122 ptr + offsetof(struct rt0_hdr,
130 DEBUGP("#%d ", rtinfo->addrnr);
131 if (!(rtinfo->flags & IP6T_RT_FST)) {
133 } else if (rtinfo->flags & IP6T_RT_FST_NSTRICT) {
134 DEBUGP("Not strict ");
135 if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
136 DEBUGP("There isn't enough space\n");
141 DEBUGP("#%d ", rtinfo->addrnr);
143 temp < (unsigned int)((hdrlen - 8) / 16);
145 ap = skb_header_pointer(skb,
147 + sizeof(struct rt0_hdr)
148 + temp * sizeof(_addr),
154 if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {
155 DEBUGP("i=%d temp=%d;\n", i, temp);
158 if (i == rtinfo->addrnr)
161 DEBUGP("i=%d #%d\n", i, rtinfo->addrnr);
162 if (i == rtinfo->addrnr)
169 if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
170 DEBUGP("There isn't enough space\n");
173 DEBUGP("#%d ", rtinfo->addrnr);
174 for (temp = 0; temp < rtinfo->addrnr; temp++) {
175 ap = skb_header_pointer(skb,
177 + sizeof(struct rt0_hdr)
178 + temp * sizeof(_addr),
183 if (!ipv6_addr_equal(ap, &rtinfo->addrs[temp]))
186 DEBUGP("temp=%d #%d\n", temp, rtinfo->addrnr);
187 if ((temp == rtinfo->addrnr) &&
188 (temp == (unsigned int)((hdrlen - 8) / 16)))
198 /* Called when user tries to insert an entry of this type. */
200 checkentry(const char *tablename,
203 unsigned int matchinfosize,
204 unsigned int hook_mask)
206 const struct ip6t_rt *rtinfo = matchinfo;
208 if (matchinfosize != IP6T_ALIGN(sizeof(struct ip6t_rt))) {
209 DEBUGP("ip6t_rt: matchsize %u != %u\n",
210 matchinfosize, IP6T_ALIGN(sizeof(struct ip6t_rt)));
213 if (rtinfo->invflags & ~IP6T_RT_INV_MASK) {
214 DEBUGP("ip6t_rt: unknown flags %X\n", rtinfo->invflags);
217 if ((rtinfo->flags & (IP6T_RT_RES | IP6T_RT_FST_MASK)) &&
218 (!(rtinfo->flags & IP6T_RT_TYP) ||
219 (rtinfo->rt_type != 0) ||
220 (rtinfo->invflags & IP6T_RT_INV_TYP))) {
221 DEBUGP("`--rt-type 0' required before `--rt-0-*'");
228 static struct ip6t_match rt_match = {
231 .checkentry = &checkentry,
235 static int __init init(void)
237 return ip6t_register_match(&rt_match);
240 static void __exit cleanup(void)
242 ip6t_unregister_match(&rt_match);
246 module_exit(cleanup);