1 /* Kernel module to match ROUTING parameters. */
3 /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
10 #include <linux/module.h>
11 #include <linux/skbuff.h>
12 #include <linux/ipv6.h>
13 #include <linux/types.h>
14 #include <net/checksum.h>
17 #include <asm/byteorder.h>
19 #include <linux/netfilter_ipv6/ip6_tables.h>
20 #include <linux/netfilter_ipv6/ip6t_rt.h>
22 MODULE_LICENSE("GPL");
23 MODULE_DESCRIPTION("IPv6 RT match");
24 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
29 #define DEBUGP(format, args...)
32 /* Returns 1 if the id is matched by the range, 0 otherwise */
34 segsleft_match(u_int32_t min, u_int32_t max, u_int32_t id, int invert)
37 DEBUGP("rt segsleft_match:%c 0x%x <= 0x%x <= 0x%x",invert? '!':' ',
39 r=(id >= min && id <= max) ^ invert;
40 DEBUGP(" result %s\n",r? "PASS" : "FAILED");
45 match(const struct sk_buff *skb,
46 const struct net_device *in,
47 const struct net_device *out,
48 const void *matchinfo,
54 struct ipv6_rt_hdr *route = NULL;
55 const struct ip6t_rt *rtinfo = matchinfo;
60 unsigned int hdrlen = 0;
63 /* type of the 1st exthdr */
64 nexthdr = skb->nh.ipv6h->nexthdr;
65 /* pointer to the 1st exthdr */
66 ptr = sizeof(struct ipv6hdr);
67 /* available length */
71 while (ip6t_ext_hdr(nexthdr)) {
72 struct ipv6_opt_hdr *hdr;
74 DEBUGP("ipv6_rt header iteration \n");
76 /* Is there enough space for the next ext header? */
77 if (len < (int)sizeof(struct ipv6_opt_hdr))
79 /* No more exthdr -> evaluate */
80 if (nexthdr == NEXTHDR_NONE) {
84 if (nexthdr == NEXTHDR_ESP) {
88 hdr=(struct ipv6_opt_hdr *)skb->data+ptr;
90 /* Calculate the header length */
91 if (nexthdr == NEXTHDR_FRAGMENT) {
93 } else if (nexthdr == NEXTHDR_AUTH)
94 hdrlen = (hdr->hdrlen+2)<<2;
96 hdrlen = ipv6_optlen(hdr);
98 /* ROUTING -> evaluate */
99 if (nexthdr == NEXTHDR_ROUTING) {
100 temp |= MASK_ROUTING;
108 case NEXTHDR_ROUTING:
109 case NEXTHDR_FRAGMENT:
114 DEBUGP("ipv6_rt match: unknown nextheader %u\n",nexthdr);
119 nexthdr = hdr->nexthdr;
122 if ( ptr > skb->len ) {
123 DEBUGP("ipv6_rt: new pointer is too large! \n");
128 /* ROUTING header not found */
129 if ( temp != MASK_ROUTING ) return 0;
131 if (len < (int)sizeof(struct ipv6_rt_hdr)){
137 /* Pcket smaller than its length field */
141 route = (struct ipv6_rt_hdr *) (skb->data + ptr);
143 DEBUGP("IPv6 RT LEN %u %u ", hdrlen, route->hdrlen);
144 DEBUGP("TYPE %04X ", route->type);
145 DEBUGP("SGS_LEFT %u %08X\n", ntohl(route->segments_left), ntohl(route->segments_left));
147 DEBUGP("IPv6 RT segsleft %02X ",
148 (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
149 ntohl(route->segments_left),
150 !!(rtinfo->invflags & IP6T_RT_INV_SGS))));
151 DEBUGP("type %02X %02X %02X ",
152 rtinfo->rt_type, route->type,
153 (!(rtinfo->flags & IP6T_RT_TYP) ||
154 ((rtinfo->rt_type == route->type) ^
155 !!(rtinfo->invflags & IP6T_RT_INV_TYP))));
156 DEBUGP("len %02X %04X %02X ",
157 rtinfo->hdrlen, hdrlen,
158 (!(rtinfo->flags & IP6T_RT_LEN) ||
159 ((rtinfo->hdrlen == hdrlen) ^
160 !!(rtinfo->invflags & IP6T_RT_INV_LEN))));
161 DEBUGP("res %02X %02X %02X ",
162 (rtinfo->flags & IP6T_RT_RES), ((struct rt0_hdr *)route)->bitmap,
163 !((rtinfo->flags & IP6T_RT_RES) && (((struct rt0_hdr *)route)->bitmap)));
165 ret = (route != NULL)
167 (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
168 ntohl(route->segments_left),
169 !!(rtinfo->invflags & IP6T_RT_INV_SGS)))
171 (!(rtinfo->flags & IP6T_RT_LEN) ||
172 ((rtinfo->hdrlen == hdrlen) ^
173 !!(rtinfo->invflags & IP6T_RT_INV_LEN)))
175 (!(rtinfo->flags & IP6T_RT_TYP) ||
176 ((rtinfo->rt_type == route->type) ^
177 !!(rtinfo->invflags & IP6T_RT_INV_TYP)))
179 !((rtinfo->flags & IP6T_RT_RES) && (((struct rt0_hdr *)route)->bitmap));
181 DEBUGP("#%d ",rtinfo->addrnr);
182 temp = len = ptr = 0;
183 if ( !(rtinfo->flags & IP6T_RT_FST) ){
185 } else if (rtinfo->flags & IP6T_RT_FST_NSTRICT) {
186 DEBUGP("Not strict ");
187 if ( rtinfo->addrnr > (unsigned int)((hdrlen-8)/16) ){
188 DEBUGP("There isn't enough space\n");
191 DEBUGP("#%d ",rtinfo->addrnr);
193 for(temp=0; temp<(unsigned int)((hdrlen-8)/16); temp++){
195 while ((u8)(((struct rt0_hdr *)route)->
196 addr[temp].s6_addr[len]) ==
197 (u8)(rtinfo->addrs[ptr].s6_addr[len])){
199 (u8)(((struct rt0_hdr *)route)->addr[temp].s6_addr[len]),
200 (u8)(rtinfo->addrs[ptr].s6_addr[len]));
202 if ( len == 16 ) break;
205 DEBUGP("ptr=%d temp=%d;\n",ptr,temp);
209 (u8)(((struct rt0_hdr *)route)->addr[temp].s6_addr[len]),
210 (u8)(rtinfo->addrs[ptr].s6_addr[len]));
211 DEBUGP("!ptr=%d temp=%d;\n",ptr,temp);
213 if (ptr==rtinfo->addrnr) break;
215 DEBUGP("ptr=%d len=%d #%d\n",ptr,len, rtinfo->addrnr);
216 if ( (len == 16) && (ptr == rtinfo->addrnr))
222 if ( rtinfo->addrnr > (unsigned int)((hdrlen-8)/16) ){
223 DEBUGP("There isn't enough space\n");
226 DEBUGP("#%d ",rtinfo->addrnr);
227 for(temp=0; temp<rtinfo->addrnr; temp++){
229 while ((u8)(((struct rt0_hdr *)route)->
230 addr[temp].s6_addr[len]) ==
231 (u8)(rtinfo->addrs[temp].s6_addr[len])){
233 (u8)(((struct rt0_hdr *)route)->addr[temp].s6_addr[len]),
234 (u8)(rtinfo->addrs[temp].s6_addr[len]));
236 if ( len == 16 ) break;
240 (u8)(((struct rt0_hdr *)route)->addr[temp].s6_addr[len]),
241 (u8)(rtinfo->addrs[temp].s6_addr[len]));
242 DEBUGP("!len=%d temp=%d;\n",len,temp);
246 DEBUGP("temp=%d len=%d #%d\n",temp,len,rtinfo->addrnr);
247 if ( (len == 16) && (temp == rtinfo->addrnr) && (temp == (unsigned int)((hdrlen-8)/16)))
256 /* Called when user tries to insert an entry of this type. */
258 checkentry(const char *tablename,
259 const struct ip6t_ip6 *ip,
261 unsigned int matchinfosize,
262 unsigned int hook_mask)
264 const struct ip6t_rt *rtinfo = matchinfo;
266 if (matchinfosize != IP6T_ALIGN(sizeof(struct ip6t_rt))) {
267 DEBUGP("ip6t_rt: matchsize %u != %u\n",
268 matchinfosize, IP6T_ALIGN(sizeof(struct ip6t_rt)));
271 if (rtinfo->invflags & ~IP6T_RT_INV_MASK) {
272 DEBUGP("ip6t_rt: unknown flags %X\n",
276 if ( (rtinfo->flags & (IP6T_RT_RES|IP6T_RT_FST_MASK)) &&
277 (!(rtinfo->flags & IP6T_RT_TYP) ||
278 (rtinfo->rt_type != 0) ||
279 (rtinfo->invflags & IP6T_RT_INV_TYP)) ) {
280 DEBUGP("`--rt-type 0' required before `--rt-0-*'");
287 static struct ip6t_match rt_match = {
290 .checkentry = &checkentry,
294 static int __init init(void)
296 return ip6t_register_match(&rt_match);
299 static void __exit cleanup(void)
301 ip6t_unregister_match(&rt_match);
305 module_exit(cleanup);