5 * Manohar Castelino <manohar.r.castelino@intel.com>
6 * Kuo-Lang Tseng <kuo-lang.tseng@intel.com>
7 * Jan Engelhardt <jengelh@medozas.de>
10 * This is just a modification of the IPv4 code written by
11 * Bart De Schuymer <bdschuym@pandora.be>
12 * with the changes required to support IPv6
16 #include <linux/ipv6.h>
19 #include <linux/module.h>
20 #include <net/dsfield.h>
21 #include <linux/netfilter/x_tables.h>
22 #include <linux/netfilter_bridge/ebtables.h>
23 #include <linux/netfilter_bridge/ebt_ip6.h>
37 ebt_ip6_mt(const struct sk_buff
*skb
, struct xt_action_param
*par
)
39 const struct ebt_ip6_info
*info
= par
->matchinfo
;
40 const struct ipv6hdr
*ih6
;
42 const union pkthdr
*pptr
;
45 ih6
= skb_header_pointer(skb
, 0, sizeof(_ip6h
), &_ip6h
);
48 if (info
->bitmask
& EBT_IP6_TCLASS
&&
49 FWINV(info
->tclass
!= ipv6_get_dsfield(ih6
), EBT_IP6_TCLASS
))
51 if ((info
->bitmask
& EBT_IP6_SOURCE
&&
52 FWINV(ipv6_masked_addr_cmp(&ih6
->saddr
, &info
->smsk
,
53 &info
->saddr
), EBT_IP6_SOURCE
)) ||
54 (info
->bitmask
& EBT_IP6_DEST
&&
55 FWINV(ipv6_masked_addr_cmp(&ih6
->daddr
, &info
->dmsk
,
56 &info
->daddr
), EBT_IP6_DEST
)))
58 if (info
->bitmask
& EBT_IP6_PROTO
) {
59 uint8_t nexthdr
= ih6
->nexthdr
;
63 offset_ph
= ipv6_skip_exthdr(skb
, sizeof(_ip6h
), &nexthdr
, &frag_off
);
66 if (FWINV(info
->protocol
!= nexthdr
, EBT_IP6_PROTO
))
68 if (!(info
->bitmask
& (EBT_IP6_DPORT
|
69 EBT_IP6_SPORT
| EBT_IP6_ICMP6
)))
72 /* min icmpv6 headersize is 4, so sizeof(_pkthdr) is ok. */
73 pptr
= skb_header_pointer(skb
, offset_ph
, sizeof(_pkthdr
),
77 if (info
->bitmask
& EBT_IP6_DPORT
) {
78 u16 dst
= ntohs(pptr
->tcpudphdr
.dst
);
79 if (FWINV(dst
< info
->dport
[0] ||
80 dst
> info
->dport
[1], EBT_IP6_DPORT
))
83 if (info
->bitmask
& EBT_IP6_SPORT
) {
84 u16 src
= ntohs(pptr
->tcpudphdr
.src
);
85 if (FWINV(src
< info
->sport
[0] ||
86 src
> info
->sport
[1], EBT_IP6_SPORT
))
89 if ((info
->bitmask
& EBT_IP6_ICMP6
) &&
90 FWINV(pptr
->icmphdr
.type
< info
->icmpv6_type
[0] ||
91 pptr
->icmphdr
.type
> info
->icmpv6_type
[1] ||
92 pptr
->icmphdr
.code
< info
->icmpv6_code
[0] ||
93 pptr
->icmphdr
.code
> info
->icmpv6_code
[1],
100 static int ebt_ip6_mt_check(const struct xt_mtchk_param
*par
)
102 const struct ebt_entry
*e
= par
->entryinfo
;
103 struct ebt_ip6_info
*info
= par
->matchinfo
;
105 if (e
->ethproto
!= htons(ETH_P_IPV6
) || e
->invflags
& EBT_IPROTO
)
107 if (info
->bitmask
& ~EBT_IP6_MASK
|| info
->invflags
& ~EBT_IP6_MASK
)
109 if (info
->bitmask
& (EBT_IP6_DPORT
| EBT_IP6_SPORT
)) {
110 if (info
->invflags
& EBT_IP6_PROTO
)
112 if (info
->protocol
!= IPPROTO_TCP
&&
113 info
->protocol
!= IPPROTO_UDP
&&
114 info
->protocol
!= IPPROTO_UDPLITE
&&
115 info
->protocol
!= IPPROTO_SCTP
&&
116 info
->protocol
!= IPPROTO_DCCP
)
119 if (info
->bitmask
& EBT_IP6_DPORT
&& info
->dport
[0] > info
->dport
[1])
121 if (info
->bitmask
& EBT_IP6_SPORT
&& info
->sport
[0] > info
->sport
[1])
123 if (info
->bitmask
& EBT_IP6_ICMP6
) {
124 if ((info
->invflags
& EBT_IP6_PROTO
) ||
125 info
->protocol
!= IPPROTO_ICMPV6
)
127 if (info
->icmpv6_type
[0] > info
->icmpv6_type
[1] ||
128 info
->icmpv6_code
[0] > info
->icmpv6_code
[1])
134 static struct xt_match ebt_ip6_mt_reg __read_mostly
= {
137 .family
= NFPROTO_BRIDGE
,
139 .checkentry
= ebt_ip6_mt_check
,
140 .matchsize
= sizeof(struct ebt_ip6_info
),
144 static int __init
ebt_ip6_init(void)
146 return xt_register_match(&ebt_ip6_mt_reg
);
149 static void __exit
ebt_ip6_fini(void)
151 xt_unregister_match(&ebt_ip6_mt_reg
);
154 module_init(ebt_ip6_init
);
155 module_exit(ebt_ip6_fini
);
156 MODULE_DESCRIPTION("Ebtables: IPv6 protocol packet match");
157 MODULE_AUTHOR("Kuo-Lang Tseng <kuo-lang.tseng@intel.com>");
158 MODULE_LICENSE("GPL");