5 * Manohar Castelino <manohar.r.castelino@intel.com>
6 * Kuo-Lang Tseng <kuo-lang.tseng@intel.com>
7 * Jan Engelhardt <jengelh@computergmbh.de>
10 * This is just a modification of the IPv4 code written by
11 * Bart De Schuymer <bdschuym@pandora.be>
12 * with the changes required to support IPv6
17 #include <linux/netfilter_bridge/ebtables.h>
18 #include <linux/netfilter_bridge/ebt_ip6.h>
19 #include <linux/ipv6.h>
22 #include <linux/module.h>
23 #include <net/dsfield.h>
36 static int ebt_filter_ip6(const struct sk_buff
*skb
,
37 const struct net_device
*in
,
38 const struct net_device
*out
, const void *data
,
41 const struct ebt_ip6_info
*info
= (struct ebt_ip6_info
*)data
;
44 const union pkthdr
*pptr
;
46 struct in6_addr tmp_addr
;
49 ih6
= skb_header_pointer(skb
, 0, sizeof(_ip6h
), &_ip6h
);
52 if (info
->bitmask
& EBT_IP6_TCLASS
&&
53 FWINV(info
->tclass
!= ipv6_get_dsfield(ih6
), EBT_IP6_TCLASS
))
55 for (i
= 0; i
< 4; i
++)
56 tmp_addr
.in6_u
.u6_addr32
[i
] = ih6
->saddr
.in6_u
.u6_addr32
[i
] &
57 info
->smsk
.in6_u
.u6_addr32
[i
];
58 if (info
->bitmask
& EBT_IP6_SOURCE
&&
59 FWINV((ipv6_addr_cmp(&tmp_addr
, &info
->saddr
) != 0),
62 for (i
= 0; i
< 4; i
++)
63 tmp_addr
.in6_u
.u6_addr32
[i
] = ih6
->daddr
.in6_u
.u6_addr32
[i
] &
64 info
->dmsk
.in6_u
.u6_addr32
[i
];
65 if (info
->bitmask
& EBT_IP6_DEST
&&
66 FWINV((ipv6_addr_cmp(&tmp_addr
, &info
->daddr
) != 0), EBT_IP6_DEST
))
68 if (info
->bitmask
& EBT_IP6_PROTO
) {
69 uint8_t nexthdr
= ih6
->nexthdr
;
72 offset_ph
= ipv6_skip_exthdr(skb
, sizeof(_ip6h
), &nexthdr
);
75 if (FWINV(info
->protocol
!= nexthdr
, EBT_IP6_PROTO
))
77 if (!(info
->bitmask
& ( EBT_IP6_DPORT
|
78 EBT_IP6_SPORT
| EBT_IP6_ICMP6
)))
81 /* min icmpv6 headersize is 4, so sizeof(_pkthdr) is ok. */
82 pptr
= skb_header_pointer(skb
, offset_ph
, sizeof(_pkthdr
),
86 if (info
->bitmask
& EBT_IP6_DPORT
) {
87 u16 dst
= ntohs(pptr
->tcpudphdr
.dst
);
88 if (FWINV(dst
< info
->dport
[0] ||
89 dst
> info
->dport
[1], EBT_IP6_DPORT
))
92 if (info
->bitmask
& EBT_IP6_SPORT
) {
93 u16 src
= ntohs(pptr
->tcpudphdr
.src
);
94 if (FWINV(src
< info
->sport
[0] ||
95 src
> info
->sport
[1], EBT_IP6_SPORT
))
98 if ((info
->bitmask
& EBT_IP6_ICMP6
) &&
99 FWINV(pptr
->icmphdr
.type
< info
->icmpv6_type
[0] ||
100 pptr
->icmphdr
.type
> info
->icmpv6_type
[1] ||
101 pptr
->icmphdr
.code
< info
->icmpv6_code
[0] ||
102 pptr
->icmphdr
.code
> info
->icmpv6_code
[1],
109 static int ebt_ip6_check(const char *tablename
, unsigned int hookmask
,
110 const struct ebt_entry
*e
, void *data
, unsigned int datalen
)
112 struct ebt_ip6_info
*info
= (struct ebt_ip6_info
*)data
;
114 if (datalen
!= EBT_ALIGN(sizeof(struct ebt_ip6_info
)))
116 if (e
->ethproto
!= htons(ETH_P_IPV6
) || e
->invflags
& EBT_IPROTO
)
118 if (info
->bitmask
& ~EBT_IP6_MASK
|| info
->invflags
& ~EBT_IP6_MASK
)
120 if (info
->bitmask
& (EBT_IP6_DPORT
| EBT_IP6_SPORT
)) {
121 if (info
->invflags
& EBT_IP6_PROTO
)
123 if (info
->protocol
!= IPPROTO_TCP
&&
124 info
->protocol
!= IPPROTO_UDP
&&
125 info
->protocol
!= IPPROTO_UDPLITE
&&
126 info
->protocol
!= IPPROTO_SCTP
&&
127 info
->protocol
!= IPPROTO_DCCP
)
130 if (info
->bitmask
& EBT_IP6_DPORT
&& info
->dport
[0] > info
->dport
[1])
132 if (info
->bitmask
& EBT_IP6_SPORT
&& info
->sport
[0] > info
->sport
[1])
134 if (info
->bitmask
& EBT_IP6_ICMP6
) {
135 if ((info
->invflags
& EBT_IP6_PROTO
) ||
136 info
->protocol
!= IPPROTO_ICMPV6
)
138 if (info
->icmpv6_type
[0] > info
->icmpv6_type
[1] ||
139 info
->icmpv6_code
[0] > info
->icmpv6_code
[1])
145 static struct ebt_match filter_ip6
=
147 .name
= EBT_IP6_MATCH
,
148 .match
= ebt_filter_ip6
,
149 .check
= ebt_ip6_check
,
153 static int __init
ebt_ip6_init(void)
155 return ebt_register_match(&filter_ip6
);
158 static void __exit
ebt_ip6_fini(void)
160 ebt_unregister_match(&filter_ip6
);
163 module_init(ebt_ip6_init
);
164 module_exit(ebt_ip6_fini
);
165 MODULE_DESCRIPTION("Ebtables: IPv6 protocol packet match");
166 MODULE_LICENSE("GPL");