5 * Manohar Castelino <manohar.r.castelino@intel.com>
6 * Kuo-Lang Tseng <kuo-lang.tseng@intel.com>
7 * Jan Engelhardt <jengelh@medozas.de>
10 * This is just a modification of the IPv4 code written by
11 * Bart De Schuymer <bdschuym@pandora.be>
12 * with the changes required to support IPv6
16 #include <linux/ipv6.h>
19 #include <linux/module.h>
20 #include <net/dsfield.h>
21 #include <linux/netfilter/x_tables.h>
22 #include <linux/netfilter_bridge/ebtables.h>
23 #include <linux/netfilter_bridge/ebt_ip6.h>
37 ebt_ip6_mt(const struct sk_buff
*skb
, struct xt_action_param
*par
)
39 const struct ebt_ip6_info
*info
= par
->matchinfo
;
40 const struct ipv6hdr
*ih6
;
42 const union pkthdr
*pptr
;
45 ih6
= skb_header_pointer(skb
, 0, sizeof(_ip6h
), &_ip6h
);
48 if ((info
->bitmask
& EBT_IP6_TCLASS
) &&
49 NF_INVF(info
, EBT_IP6_TCLASS
,
50 info
->tclass
!= ipv6_get_dsfield(ih6
)))
52 if (((info
->bitmask
& EBT_IP6_SOURCE
) &&
53 NF_INVF(info
, EBT_IP6_SOURCE
,
54 ipv6_masked_addr_cmp(&ih6
->saddr
, &info
->smsk
,
56 ((info
->bitmask
& EBT_IP6_DEST
) &&
57 NF_INVF(info
, EBT_IP6_DEST
,
58 ipv6_masked_addr_cmp(&ih6
->daddr
, &info
->dmsk
,
61 if (info
->bitmask
& EBT_IP6_PROTO
) {
62 uint8_t nexthdr
= ih6
->nexthdr
;
66 offset_ph
= ipv6_skip_exthdr(skb
, sizeof(_ip6h
), &nexthdr
, &frag_off
);
69 if (NF_INVF(info
, EBT_IP6_PROTO
, info
->protocol
!= nexthdr
))
71 if (!(info
->bitmask
& (EBT_IP6_DPORT
|
72 EBT_IP6_SPORT
| EBT_IP6_ICMP6
)))
75 /* min icmpv6 headersize is 4, so sizeof(_pkthdr) is ok. */
76 pptr
= skb_header_pointer(skb
, offset_ph
, sizeof(_pkthdr
),
80 if (info
->bitmask
& EBT_IP6_DPORT
) {
81 u16 dst
= ntohs(pptr
->tcpudphdr
.dst
);
82 if (NF_INVF(info
, EBT_IP6_DPORT
,
83 dst
< info
->dport
[0] ||
84 dst
> info
->dport
[1]))
87 if (info
->bitmask
& EBT_IP6_SPORT
) {
88 u16 src
= ntohs(pptr
->tcpudphdr
.src
);
89 if (NF_INVF(info
, EBT_IP6_SPORT
,
90 src
< info
->sport
[0] ||
91 src
> info
->sport
[1]))
94 if ((info
->bitmask
& EBT_IP6_ICMP6
) &&
95 NF_INVF(info
, EBT_IP6_ICMP6
,
96 pptr
->icmphdr
.type
< info
->icmpv6_type
[0] ||
97 pptr
->icmphdr
.type
> info
->icmpv6_type
[1] ||
98 pptr
->icmphdr
.code
< info
->icmpv6_code
[0] ||
99 pptr
->icmphdr
.code
> info
->icmpv6_code
[1]))
105 static int ebt_ip6_mt_check(const struct xt_mtchk_param
*par
)
107 const struct ebt_entry
*e
= par
->entryinfo
;
108 struct ebt_ip6_info
*info
= par
->matchinfo
;
110 if (e
->ethproto
!= htons(ETH_P_IPV6
) || e
->invflags
& EBT_IPROTO
)
112 if (info
->bitmask
& ~EBT_IP6_MASK
|| info
->invflags
& ~EBT_IP6_MASK
)
114 if (info
->bitmask
& (EBT_IP6_DPORT
| EBT_IP6_SPORT
)) {
115 if (info
->invflags
& EBT_IP6_PROTO
)
117 if (info
->protocol
!= IPPROTO_TCP
&&
118 info
->protocol
!= IPPROTO_UDP
&&
119 info
->protocol
!= IPPROTO_UDPLITE
&&
120 info
->protocol
!= IPPROTO_SCTP
&&
121 info
->protocol
!= IPPROTO_DCCP
)
124 if (info
->bitmask
& EBT_IP6_DPORT
&& info
->dport
[0] > info
->dport
[1])
126 if (info
->bitmask
& EBT_IP6_SPORT
&& info
->sport
[0] > info
->sport
[1])
128 if (info
->bitmask
& EBT_IP6_ICMP6
) {
129 if ((info
->invflags
& EBT_IP6_PROTO
) ||
130 info
->protocol
!= IPPROTO_ICMPV6
)
132 if (info
->icmpv6_type
[0] > info
->icmpv6_type
[1] ||
133 info
->icmpv6_code
[0] > info
->icmpv6_code
[1])
139 static struct xt_match ebt_ip6_mt_reg __read_mostly
= {
142 .family
= NFPROTO_BRIDGE
,
144 .checkentry
= ebt_ip6_mt_check
,
145 .matchsize
= sizeof(struct ebt_ip6_info
),
149 static int __init
ebt_ip6_init(void)
151 return xt_register_match(&ebt_ip6_mt_reg
);
154 static void __exit
ebt_ip6_fini(void)
156 xt_unregister_match(&ebt_ip6_mt_reg
);
159 module_init(ebt_ip6_init
);
160 module_exit(ebt_ip6_fini
);
161 MODULE_DESCRIPTION("Ebtables: IPv6 protocol packet match");
162 MODULE_AUTHOR("Kuo-Lang Tseng <kuo-lang.tseng@intel.com>");
163 MODULE_LICENSE("GPL");