1 /* Kernel module to match Hop-by-Hop and Destination parameters. */
3 /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
10 #include <linux/module.h>
11 #include <linux/skbuff.h>
12 #include <linux/ipv6.h>
13 #include <linux/types.h>
14 #include <net/checksum.h>
17 #include <asm/byteorder.h>
19 #include <linux/netfilter/x_tables.h>
20 #include <linux/netfilter_ipv6/ip6_tables.h>
21 #include <linux/netfilter_ipv6/ip6t_opts.h>
23 MODULE_LICENSE("GPL");
24 MODULE_DESCRIPTION("Xtables: IPv6 Hop-By-Hop and Destination Header match");
25 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
26 MODULE_ALIAS("ip6t_dst");
31 * 1 -> must drop the packet
32 * 2 -> send ICMP PARM PROB regardless and drop packet
33 * 3 -> Send ICMP if not a multicast address and drop packet
36 * 1 -> can change the routing
38 * 0 -> Pad1 (only 1 byte!)
39 * 1 -> PadN LENGTH info (total length = length + 2)
40 * C0 | 2 -> JUMBO 4 x x x x ( xxxx > 64k )
45 hbh_mt6(const struct sk_buff *skb, const struct net_device *in,
46 const struct net_device *out, const struct xt_match *match,
47 const void *matchinfo, int offset, unsigned int protoff,
50 struct ipv6_opt_hdr _optsh;
51 const struct ipv6_opt_hdr *oh;
52 const struct ip6t_opts *optinfo = matchinfo;
55 unsigned int hdrlen = 0;
59 const u_int8_t *tp = NULL;
60 const u_int8_t *lp = NULL;
64 err = ipv6_find_hdr(skb, &ptr, match->data, NULL);
71 oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
77 hdrlen = ipv6_optlen(oh);
78 if (skb->len - ptr < hdrlen) {
79 /* Packet smaller than it's length field */
83 pr_debug("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen);
85 pr_debug("len %02X %04X %02X ",
86 optinfo->hdrlen, hdrlen,
87 (!(optinfo->flags & IP6T_OPTS_LEN) ||
88 ((optinfo->hdrlen == hdrlen) ^
89 !!(optinfo->invflags & IP6T_OPTS_INV_LEN))));
92 (!(optinfo->flags & IP6T_OPTS_LEN) ||
93 ((optinfo->hdrlen == hdrlen) ^
94 !!(optinfo->invflags & IP6T_OPTS_INV_LEN)));
98 if (!(optinfo->flags & IP6T_OPTS_OPTS)) {
102 pr_debug("#%d ", optinfo->optsnr);
103 for (temp = 0; temp < optinfo->optsnr; temp++) {
104 /* type field exists ? */
107 tp = skb_header_pointer(skb, ptr, sizeof(_opttype),
113 if (*tp != (optinfo->opts[temp] & 0xFF00) >> 8) {
114 pr_debug("Tbad %02X %02X\n", *tp,
115 (optinfo->opts[temp] & 0xFF00) >> 8);
124 /* length field exists ? */
127 lp = skb_header_pointer(skb, ptr + 1,
132 spec_len = optinfo->opts[temp] & 0x00FF;
134 if (spec_len != 0x00FF && spec_len != *lp) {
135 pr_debug("Lbad %02X %04X\n", *lp,
146 /* Step to the next */
147 pr_debug("len%04X \n", optlen);
149 if ((ptr > skb->len - optlen || hdrlen < optlen) &&
150 temp < optinfo->optsnr - 1) {
151 pr_debug("new pointer is too large! \n");
157 if (temp == optinfo->optsnr)
166 /* Called when user tries to insert an entry of this type. */
168 hbh_mt6_check(const char *tablename, const void *entry,
169 const struct xt_match *match, void *matchinfo,
170 unsigned int hook_mask)
172 const struct ip6t_opts *optsinfo = matchinfo;
174 if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) {
175 pr_debug("ip6t_opts: unknown flags %X\n", optsinfo->invflags);
179 if (optsinfo->flags & IP6T_OPTS_NSTRICT) {
180 pr_debug("ip6t_opts: Not strict - not implemented");
187 static struct xt_match hbh_mt6_reg[] __read_mostly = {
192 .matchsize = sizeof(struct ip6t_opts),
193 .checkentry = hbh_mt6_check,
201 .matchsize = sizeof(struct ip6t_opts),
202 .checkentry = hbh_mt6_check,
204 .data = NEXTHDR_DEST,
208 static int __init hbh_mt6_init(void)
210 return xt_register_matches(hbh_mt6_reg, ARRAY_SIZE(hbh_mt6_reg));
213 static void __exit hbh_mt6_exit(void)
215 xt_unregister_matches(hbh_mt6_reg, ARRAY_SIZE(hbh_mt6_reg));
218 module_init(hbh_mt6_init);
219 module_exit(hbh_mt6_exit);