Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * IP tables module for matching the value of the TTL
4 * (C) 2000,2001 by Harald Welte <laforge@netfilter.org>
5 *
6 * Hop Limit matching module
7 * (C) 2001-2002 Maciej Soltysiak <solt@dns.toxicfilms.tv>
8 */
9#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
10
11#include <linux/ip.h>
12#include <linux/ipv6.h>
13#include <linux/module.h>
14#include <linux/skbuff.h>
15
16#include <linux/netfilter/x_tables.h>
17#include <linux/netfilter_ipv4/ipt_ttl.h>
18#include <linux/netfilter_ipv6/ip6t_hl.h>
19
20MODULE_AUTHOR("Maciej Soltysiak <solt@dns.toxicfilms.tv>");
21MODULE_DESCRIPTION("Xtables: Hoplimit/TTL field match");
22MODULE_LICENSE("GPL");
23MODULE_ALIAS("ipt_ttl");
24MODULE_ALIAS("ip6t_hl");
25
26static int ttl_mt_check(const struct xt_mtchk_param *par)
27{
28 const struct ipt_ttl_info *info = par->matchinfo;
29
30 if (info->mode > IPT_TTL_GT) {
31 pr_err("Unknown TTL match mode: %d\n", info->mode);
32 return -EINVAL;
33 }
34
35 return 0;
36}
37
38static bool ttl_mt(const struct sk_buff *skb, struct xt_action_param *par)
39{
40 const struct ipt_ttl_info *info = par->matchinfo;
41 const u8 ttl = ip_hdr(skb)->ttl;
42
43 switch (info->mode) {
44 case IPT_TTL_EQ:
45 return ttl == info->ttl;
46 case IPT_TTL_NE:
47 return ttl != info->ttl;
48 case IPT_TTL_LT:
49 return ttl < info->ttl;
50 case IPT_TTL_GT:
51 return ttl > info->ttl;
52 }
53
54 return false;
55}
56
57static int hl_mt6_check(const struct xt_mtchk_param *par)
58{
59 const struct ip6t_hl_info *info = par->matchinfo;
60
61 if (info->mode > IP6T_HL_GT) {
62 pr_err("Unknown Hop Limit match mode: %d\n", info->mode);
63 return -EINVAL;
64 }
65
66 return 0;
67}
68
69static bool hl_mt6(const struct sk_buff *skb, struct xt_action_param *par)
70{
71 const struct ip6t_hl_info *info = par->matchinfo;
72 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
73
74 switch (info->mode) {
75 case IP6T_HL_EQ:
76 return ip6h->hop_limit == info->hop_limit;
77 case IP6T_HL_NE:
78 return ip6h->hop_limit != info->hop_limit;
79 case IP6T_HL_LT:
80 return ip6h->hop_limit < info->hop_limit;
81 case IP6T_HL_GT:
82 return ip6h->hop_limit > info->hop_limit;
83 }
84
85 return false;
86}
87
88static struct xt_match hl_mt_reg[] __read_mostly = {
89 {
90 .name = "ttl",
91 .revision = 0,
92 .family = NFPROTO_IPV4,
93 .checkentry = ttl_mt_check,
94 .match = ttl_mt,
95 .matchsize = sizeof(struct ipt_ttl_info),
96 .me = THIS_MODULE,
97 },
98 {
99 .name = "hl",
100 .revision = 0,
101 .family = NFPROTO_IPV6,
102 .checkentry = hl_mt6_check,
103 .match = hl_mt6,
104 .matchsize = sizeof(struct ip6t_hl_info),
105 .me = THIS_MODULE,
106 },
107};
108
109static int __init hl_mt_init(void)
110{
111 return xt_register_matches(hl_mt_reg, ARRAY_SIZE(hl_mt_reg));
112}
113
114static void __exit hl_mt_exit(void)
115{
116 xt_unregister_matches(hl_mt_reg, ARRAY_SIZE(hl_mt_reg));
117}
118
119module_init(hl_mt_init);
120module_exit(hl_mt_exit);