1 /* Kernel module to match AH parameters. */
2 /* (C) 1999-2000 Yon Uriarte <yon@astaro.de>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
9 #include <linux/module.h>
10 #include <linux/skbuff.h>
13 #include <linux/netfilter_ipv4/ipt_ah.h>
14 #include <linux/netfilter_ipv4/ip_tables.h>
16 MODULE_LICENSE("GPL");
17 MODULE_AUTHOR("Yon Uriarte <yon@astaro.de>");
18 MODULE_DESCRIPTION("iptables AH SPI match module");
20 #ifdef DEBUG_CONNTRACK
21 #define duprintf(format, args...) printk(format , ## args)
23 #define duprintf(format, args...)
26 /* Returns 1 if the spi is matched by the range, 0 otherwise */
28 spi_match(u_int32_t min
, u_int32_t max
, u_int32_t spi
, int invert
)
31 duprintf("ah spi_match:%c 0x%x <= 0x%x <= 0x%x",invert
? '!':' ',
33 r
=(spi
>= min
&& spi
<= max
) ^ invert
;
34 duprintf(" result %s\n",r
? "PASS" : "FAILED");
39 match(const struct sk_buff
*skb
,
40 const struct net_device
*in
,
41 const struct net_device
*out
,
42 const struct xt_match
*match
,
43 const void *matchinfo
,
48 struct ip_auth_hdr _ahdr
, *ah
;
49 const struct ipt_ah
*ahinfo
= matchinfo
;
51 /* Must not be a fragment. */
55 ah
= skb_header_pointer(skb
, protoff
,
56 sizeof(_ahdr
), &_ahdr
);
58 /* We've been asked to examine this packet, and we
59 * can't. Hence, no choice but to drop.
61 duprintf("Dropping evil AH tinygram.\n");
66 return spi_match(ahinfo
->spis
[0], ahinfo
->spis
[1],
68 !!(ahinfo
->invflags
& IPT_AH_INV_SPI
));
71 /* Called when user tries to insert an entry of this type. */
73 checkentry(const char *tablename
,
75 const struct xt_match
*match
,
77 unsigned int matchinfosize
,
78 unsigned int hook_mask
)
80 const struct ipt_ah
*ahinfo
= matchinfo
;
82 /* Must specify no unknown invflags */
83 if (ahinfo
->invflags
& ~IPT_AH_INV_MASK
) {
84 duprintf("ipt_ah: unknown flags %X\n", ahinfo
->invflags
);
90 static struct ipt_match ah_match
= {
93 .matchsize
= sizeof(struct ipt_ah
),
95 .checkentry
= checkentry
,
99 static int __init
init(void)
101 return ipt_register_match(&ah_match
);
104 static void __exit
cleanup(void)
106 ipt_unregister_match(&ah_match
);
110 module_exit(cleanup
);