1 // SPDX-License-Identifier: GPL-2.0-only
2 /* ipv6header match - matches IPv6 packets based
3 on whether they contain certain headers */
5 /* Original idea: Brad Chapman
6 * Rewritten by: Andras Kis-Szabo <kisza@sch.bme.hu> */
8 /* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
13 #include <linux/ipv6.h>
14 #include <linux/types.h>
15 #include <net/checksum.h>
18 #include <linux/netfilter/x_tables.h>
19 #include <linux/netfilter_ipv6/ip6_tables.h>
20 #include <linux/netfilter_ipv6/ip6t_ipv6header.h>
22 MODULE_LICENSE("GPL");
23 MODULE_DESCRIPTION("Xtables: IPv6 header types match");
24 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
27 ipv6header_mt6(const struct sk_buff
*skb
, struct xt_action_param
*par
)
29 const struct ip6t_ipv6header_info
*info
= par
->matchinfo
;
35 /* Make sure this isn't an evil packet */
37 /* type of the 1st exthdr */
38 nexthdr
= ipv6_hdr(skb
)->nexthdr
;
39 /* pointer to the 1st exthdr */
40 ptr
= sizeof(struct ipv6hdr
);
41 /* available length */
45 while (ip6t_ext_hdr(nexthdr
)) {
46 const struct ipv6_opt_hdr
*hp
;
47 struct ipv6_opt_hdr _hdr
;
50 /* No more exthdr -> evaluate */
51 if (nexthdr
== NEXTHDR_NONE
) {
55 /* Is there enough space for the next ext header? */
56 if (len
< (int)sizeof(struct ipv6_opt_hdr
))
59 if (nexthdr
== NEXTHDR_ESP
) {
64 hp
= skb_header_pointer(skb
, ptr
, sizeof(_hdr
), &_hdr
);
70 /* Calculate the header length */
71 if (nexthdr
== NEXTHDR_FRAGMENT
)
73 else if (nexthdr
== NEXTHDR_AUTH
)
74 hdrlen
= (hp
->hdrlen
+ 2) << 2;
76 hdrlen
= ipv6_optlen(hp
);
86 case NEXTHDR_FRAGMENT
:
87 temp
|= MASK_FRAGMENT
;
99 nexthdr
= hp
->nexthdr
;
106 if (nexthdr
!= NEXTHDR_NONE
&& nexthdr
!= NEXTHDR_ESP
)
110 return !((temp
^ info
->matchflags
^ info
->invflags
)
114 return temp
!= info
->matchflags
;
116 return temp
== info
->matchflags
;
120 static int ipv6header_mt6_check(const struct xt_mtchk_param
*par
)
122 const struct ip6t_ipv6header_info
*info
= par
->matchinfo
;
124 /* invflags is 0 or 0xff in hard mode */
125 if ((!info
->modeflag
) && info
->invflags
!= 0x00 &&
126 info
->invflags
!= 0xFF)
132 static struct xt_match ipv6header_mt6_reg __read_mostly
= {
133 .name
= "ipv6header",
134 .family
= NFPROTO_IPV6
,
135 .match
= ipv6header_mt6
,
136 .matchsize
= sizeof(struct ip6t_ipv6header_info
),
137 .checkentry
= ipv6header_mt6_check
,
142 static int __init
ipv6header_mt6_init(void)
144 return xt_register_match(&ipv6header_mt6_reg
);
147 static void __exit
ipv6header_mt6_exit(void)
149 xt_unregister_match(&ipv6header_mt6_reg
);
152 module_init(ipv6header_mt6_init
);
153 module_exit(ipv6header_mt6_exit
);