1 /* Kernel module to match AH parameters. */
2 /* (C) 1999-2000 Yon Uriarte <yon@astaro.de>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
9 #include <linux/module.h>
10 #include <linux/skbuff.h>
13 #include <linux/netfilter_ipv4/ipt_ah.h>
14 #include <linux/netfilter_ipv4/ip_tables.h>
16 MODULE_LICENSE("GPL");
17 MODULE_AUTHOR("Yon Uriarte <yon@astaro.de>");
18 MODULE_DESCRIPTION("iptables AH SPI match module");
20 #ifdef DEBUG_CONNTRACK
21 #define duprintf(format, args...) printk(format , ## args)
23 #define duprintf(format, args...)
26 /* Returns 1 if the spi is matched by the range, 0 otherwise */
28 spi_match(u_int32_t min
, u_int32_t max
, u_int32_t spi
, int invert
)
31 duprintf("ah spi_match:%c 0x%x <= 0x%x <= 0x%x",invert
? '!':' ',
33 r
=(spi
>= min
&& spi
<= max
) ^ invert
;
34 duprintf(" result %s\n",r
? "PASS" : "FAILED");
39 match(const struct sk_buff
*skb
,
40 const struct net_device
*in
,
41 const struct net_device
*out
,
42 const void *matchinfo
,
46 struct ip_auth_hdr _ahdr
, *ah
;
47 const struct ipt_ah
*ahinfo
= matchinfo
;
49 /* Must not be a fragment. */
53 ah
= skb_header_pointer(skb
, skb
->nh
.iph
->ihl
* 4,
54 sizeof(_ahdr
), &_ahdr
);
56 /* We've been asked to examine this packet, and we
57 * can't. Hence, no choice but to drop.
59 duprintf("Dropping evil AH tinygram.\n");
64 return spi_match(ahinfo
->spis
[0], ahinfo
->spis
[1],
66 !!(ahinfo
->invflags
& IPT_AH_INV_SPI
));
69 /* Called when user tries to insert an entry of this type. */
71 checkentry(const char *tablename
,
72 const struct ipt_ip
*ip
,
74 unsigned int matchinfosize
,
75 unsigned int hook_mask
)
77 const struct ipt_ah
*ahinfo
= matchinfo
;
79 /* Must specify proto == AH, and no unknown invflags */
80 if (ip
->proto
!= IPPROTO_AH
|| (ip
->invflags
& IPT_INV_PROTO
)) {
81 duprintf("ipt_ah: Protocol %u != %u\n", ip
->proto
,
85 if (matchinfosize
!= IPT_ALIGN(sizeof(struct ipt_ah
))) {
86 duprintf("ipt_ah: matchsize %u != %u\n",
87 matchinfosize
, IPT_ALIGN(sizeof(struct ipt_ah
)));
90 if (ahinfo
->invflags
& ~IPT_AH_INV_MASK
) {
91 duprintf("ipt_ah: unknown flags %X\n",
99 static struct ipt_match ah_match
= {
102 .checkentry
= &checkentry
,
106 static int __init
init(void)
108 return ipt_register_match(&ah_match
);
111 static void __exit
cleanup(void)
113 ipt_unregister_match(&ah_match
);
117 module_exit(cleanup
);