1 /* ipv6header match - matches IPv6 packets based
2 on whether they contain certain headers */
4 /* Original idea: Brad Chapman
5 * Rewritten by: Andras Kis-Szabo <kisza@sch.bme.hu> */
7 /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2 as
11 * published by the Free Software Foundation.
14 #include <linux/module.h>
15 #include <linux/skbuff.h>
16 #include <linux/ipv6.h>
17 #include <linux/types.h>
18 #include <net/checksum.h>
21 #include <linux/netfilter_ipv6/ip6_tables.h>
22 #include <linux/netfilter_ipv6/ip6t_ipv6header.h>
24 MODULE_LICENSE("GPL");
25 MODULE_DESCRIPTION("IPv6 headers match");
26 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
29 ipv6header_match(const struct sk_buff
*skb
,
30 const struct net_device
*in
,
31 const struct net_device
*out
,
32 const struct xt_match
*match
,
33 const void *matchinfo
,
38 const struct ip6t_ipv6header_info
*info
= matchinfo
;
44 /* Make sure this isn't an evil packet */
46 /* type of the 1st exthdr */
47 nexthdr
= skb
->nh
.ipv6h
->nexthdr
;
48 /* pointer to the 1st exthdr */
49 ptr
= sizeof(struct ipv6hdr
);
50 /* available length */
54 while (ip6t_ext_hdr(nexthdr
)) {
55 struct ipv6_opt_hdr _hdr
, *hp
;
58 /* Is there enough space for the next ext header? */
59 if (len
< (int)sizeof(struct ipv6_opt_hdr
))
61 /* No more exthdr -> evaluate */
62 if (nexthdr
== NEXTHDR_NONE
) {
67 if (nexthdr
== NEXTHDR_ESP
) {
72 hp
= skb_header_pointer(skb
, ptr
, sizeof(_hdr
), &_hdr
);
75 /* Calculate the header length */
76 if (nexthdr
== NEXTHDR_FRAGMENT
) {
78 } else if (nexthdr
== NEXTHDR_AUTH
)
79 hdrlen
= (hp
->hdrlen
+ 2) << 2;
81 hdrlen
= ipv6_optlen(hp
);
91 case NEXTHDR_FRAGMENT
:
92 temp
|= MASK_FRAGMENT
;
105 nexthdr
= hp
->nexthdr
;
112 if ((nexthdr
!= NEXTHDR_NONE
) && (nexthdr
!= NEXTHDR_ESP
))
116 return !((temp
^ info
->matchflags
^ info
->invflags
)
120 return temp
!= info
->matchflags
;
122 return temp
== info
->matchflags
;
127 ipv6header_checkentry(const char *tablename
,
129 const struct xt_match
*match
,
131 unsigned int hook_mask
)
133 const struct ip6t_ipv6header_info
*info
= matchinfo
;
135 /* invflags is 0 or 0xff in hard mode */
136 if ((!info
->modeflag
) && info
->invflags
!= 0x00 &&
137 info
->invflags
!= 0xFF)
143 static struct ip6t_match ip6t_ipv6header_match
= {
144 .name
= "ipv6header",
145 .match
= &ipv6header_match
,
146 .matchsize
= sizeof(struct ip6t_ipv6header_info
),
147 .checkentry
= &ipv6header_checkentry
,
152 static int __init
ipv6header_init(void)
154 return ip6t_register_match(&ip6t_ipv6header_match
);
157 static void __exit
ipv6header_exit(void)
159 ip6t_unregister_match(&ip6t_ipv6header_match
);
162 module_init(ipv6header_init
);
163 module_exit(ipv6header_exit
);