5 * Manohar Castelino <manohar.r.castelino@intel.com>
6 * Kuo-Lang Tseng <kuo-lang.tseng@intel.com>
7 * Jan Engelhardt <jengelh@computergmbh.de>
10 * This is just a modification of the IPv4 code written by
11 * Bart De Schuymer <bdschuym@pandora.be>
12 * with the changes required to support IPv6
16 #include <linux/ipv6.h>
19 #include <linux/module.h>
20 #include <net/dsfield.h>
21 #include <linux/netfilter/x_tables.h>
22 #include <linux/netfilter_bridge/ebtables.h>
23 #include <linux/netfilter_bridge/ebt_ip6.h>
31 ebt_ip6_mt(const struct sk_buff
*skb
, const struct net_device
*in
,
32 const struct net_device
*out
, const struct xt_match
*match
,
33 const void *data
, int offset
, unsigned int protoff
, bool *hotdrop
)
35 const struct ebt_ip6_info
*info
= (struct ebt_ip6_info
*)data
;
36 const struct ipv6hdr
*ih6
;
38 const struct tcpudphdr
*pptr
;
39 struct tcpudphdr _ports
;
40 struct in6_addr tmp_addr
;
43 ih6
= skb_header_pointer(skb
, 0, sizeof(_ip6h
), &_ip6h
);
46 if (info
->bitmask
& EBT_IP6_TCLASS
&&
47 FWINV(info
->tclass
!= ipv6_get_dsfield(ih6
), EBT_IP6_TCLASS
))
49 for (i
= 0; i
< 4; i
++)
50 tmp_addr
.in6_u
.u6_addr32
[i
] = ih6
->saddr
.in6_u
.u6_addr32
[i
] &
51 info
->smsk
.in6_u
.u6_addr32
[i
];
52 if (info
->bitmask
& EBT_IP6_SOURCE
&&
53 FWINV((ipv6_addr_cmp(&tmp_addr
, &info
->saddr
) != 0),
56 for (i
= 0; i
< 4; i
++)
57 tmp_addr
.in6_u
.u6_addr32
[i
] = ih6
->daddr
.in6_u
.u6_addr32
[i
] &
58 info
->dmsk
.in6_u
.u6_addr32
[i
];
59 if (info
->bitmask
& EBT_IP6_DEST
&&
60 FWINV((ipv6_addr_cmp(&tmp_addr
, &info
->daddr
) != 0), EBT_IP6_DEST
))
62 if (info
->bitmask
& EBT_IP6_PROTO
) {
63 uint8_t nexthdr
= ih6
->nexthdr
;
66 offset_ph
= ipv6_skip_exthdr(skb
, sizeof(_ip6h
), &nexthdr
);
69 if (FWINV(info
->protocol
!= nexthdr
, EBT_IP6_PROTO
))
71 if (!(info
->bitmask
& EBT_IP6_DPORT
) &&
72 !(info
->bitmask
& EBT_IP6_SPORT
))
74 pptr
= skb_header_pointer(skb
, offset_ph
, sizeof(_ports
),
78 if (info
->bitmask
& EBT_IP6_DPORT
) {
79 u32 dst
= ntohs(pptr
->dst
);
80 if (FWINV(dst
< info
->dport
[0] ||
81 dst
> info
->dport
[1], EBT_IP6_DPORT
))
84 if (info
->bitmask
& EBT_IP6_SPORT
) {
85 u32 src
= ntohs(pptr
->src
);
86 if (FWINV(src
< info
->sport
[0] ||
87 src
> info
->sport
[1], EBT_IP6_SPORT
))
96 ebt_ip6_mt_check(const char *table
, const void *entry
,
97 const struct xt_match
*match
, void *data
,
98 unsigned int hook_mask
)
100 const struct ebt_entry
*e
= entry
;
101 struct ebt_ip6_info
*info
= (struct ebt_ip6_info
*)data
;
103 if (e
->ethproto
!= htons(ETH_P_IPV6
) || e
->invflags
& EBT_IPROTO
)
105 if (info
->bitmask
& ~EBT_IP6_MASK
|| info
->invflags
& ~EBT_IP6_MASK
)
107 if (info
->bitmask
& (EBT_IP6_DPORT
| EBT_IP6_SPORT
)) {
108 if (info
->invflags
& EBT_IP6_PROTO
)
110 if (info
->protocol
!= IPPROTO_TCP
&&
111 info
->protocol
!= IPPROTO_UDP
&&
112 info
->protocol
!= IPPROTO_UDPLITE
&&
113 info
->protocol
!= IPPROTO_SCTP
&&
114 info
->protocol
!= IPPROTO_DCCP
)
117 if (info
->bitmask
& EBT_IP6_DPORT
&& info
->dport
[0] > info
->dport
[1])
119 if (info
->bitmask
& EBT_IP6_SPORT
&& info
->sport
[0] > info
->sport
[1])
124 static struct xt_match ebt_ip6_mt_reg __read_mostly
= {
127 .family
= NFPROTO_BRIDGE
,
129 .checkentry
= ebt_ip6_mt_check
,
130 .matchsize
= XT_ALIGN(sizeof(struct ebt_ip6_info
)),
134 static int __init
ebt_ip6_init(void)
136 return xt_register_match(&ebt_ip6_mt_reg
);
139 static void __exit
ebt_ip6_fini(void)
141 xt_unregister_match(&ebt_ip6_mt_reg
);
144 module_init(ebt_ip6_init
);
145 module_exit(ebt_ip6_fini
);
146 MODULE_DESCRIPTION("Ebtables: IPv6 protocol packet match");
147 MODULE_LICENSE("GPL");