1 /* ipv6header match - matches IPv6 packets based
2 on whether they contain certain headers */
4 /* Original idea: Brad Chapman
5 * Rewritten by: Andras Kis-Szabo <kisza@sch.bme.hu> */
7 /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2 as
11 * published by the Free Software Foundation.
14 #include <linux/module.h>
15 #include <linux/skbuff.h>
16 #include <linux/ipv6.h>
17 #include <linux/types.h>
18 #include <net/checksum.h>
21 #include <linux/netfilter/x_tables.h>
22 #include <linux/netfilter_ipv6/ip6_tables.h>
23 #include <linux/netfilter_ipv6/ip6t_ipv6header.h>
25 MODULE_LICENSE("GPL");
26 MODULE_DESCRIPTION("IPv6 headers match");
27 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
30 ipv6header_match(const struct sk_buff
*skb
,
31 const struct net_device
*in
,
32 const struct net_device
*out
,
33 const struct xt_match
*match
,
34 const void *matchinfo
,
39 const struct ip6t_ipv6header_info
*info
= matchinfo
;
45 /* Make sure this isn't an evil packet */
47 /* type of the 1st exthdr */
48 nexthdr
= ipv6_hdr(skb
)->nexthdr
;
49 /* pointer to the 1st exthdr */
50 ptr
= sizeof(struct ipv6hdr
);
51 /* available length */
55 while (ip6t_ext_hdr(nexthdr
)) {
56 struct ipv6_opt_hdr _hdr
, *hp
;
59 /* Is there enough space for the next ext header? */
60 if (len
< (int)sizeof(struct ipv6_opt_hdr
))
62 /* No more exthdr -> evaluate */
63 if (nexthdr
== NEXTHDR_NONE
) {
68 if (nexthdr
== NEXTHDR_ESP
) {
73 hp
= skb_header_pointer(skb
, ptr
, sizeof(_hdr
), &_hdr
);
76 /* Calculate the header length */
77 if (nexthdr
== NEXTHDR_FRAGMENT
) {
79 } else if (nexthdr
== NEXTHDR_AUTH
)
80 hdrlen
= (hp
->hdrlen
+ 2) << 2;
82 hdrlen
= ipv6_optlen(hp
);
92 case NEXTHDR_FRAGMENT
:
93 temp
|= MASK_FRAGMENT
;
106 nexthdr
= hp
->nexthdr
;
113 if ((nexthdr
!= NEXTHDR_NONE
) && (nexthdr
!= NEXTHDR_ESP
))
117 return !((temp
^ info
->matchflags
^ info
->invflags
)
121 return temp
!= info
->matchflags
;
123 return temp
== info
->matchflags
;
128 ipv6header_checkentry(const char *tablename
,
130 const struct xt_match
*match
,
132 unsigned int hook_mask
)
134 const struct ip6t_ipv6header_info
*info
= matchinfo
;
136 /* invflags is 0 or 0xff in hard mode */
137 if ((!info
->modeflag
) && info
->invflags
!= 0x00 &&
138 info
->invflags
!= 0xFF)
144 static struct xt_match ip6t_ipv6header_match
= {
145 .name
= "ipv6header",
147 .match
= &ipv6header_match
,
148 .matchsize
= sizeof(struct ip6t_ipv6header_info
),
149 .checkentry
= &ipv6header_checkentry
,
154 static int __init
ipv6header_init(void)
156 return xt_register_match(&ip6t_ipv6header_match
);
159 static void __exit
ipv6header_exit(void)
161 xt_unregister_match(&ip6t_ipv6header_match
);
164 module_init(ipv6header_init
);
165 module_exit(ipv6header_exit
);