[NETFILTER]: Add ipt_policy/ip6t_policy matches (e16a8f0b) · Commits · e / devices / android_kernel_fairphone_FP3

include/linux/netfilter_ipv4/ipt_policy.h

0 → 100644

+52 −0

Original line number	Diff line number	Diff line
		#ifndef _IPT_POLICY_H
		#define _IPT_POLICY_H

		#define IPT_POLICY_MAX_ELEM 4

		enum ipt_policy_flags
		{
		IPT_POLICY_MATCH_IN = 0x1,
		IPT_POLICY_MATCH_OUT = 0x2,
		IPT_POLICY_MATCH_NONE = 0x4,
		IPT_POLICY_MATCH_STRICT = 0x8,
		};

		enum ipt_policy_modes
		{
		IPT_POLICY_MODE_TRANSPORT,
		IPT_POLICY_MODE_TUNNEL
		};

		struct ipt_policy_spec
		{
		u_int8_t saddr:1,
		daddr:1,
		proto:1,
		mode:1,
		spi:1,
		reqid:1;
		};

		struct ipt_policy_elem
		{
		u_int32_t saddr;
		u_int32_t smask;
		u_int32_t daddr;
		u_int32_t dmask;
		u_int32_t spi;
		u_int32_t reqid;
		u_int8_t proto;
		u_int8_t mode;

		struct ipt_policy_spec match;
		struct ipt_policy_spec invert;
		};

		struct ipt_policy_info
		{
		struct ipt_policy_elem pol[IPT_POLICY_MAX_ELEM];
		u_int16_t flags;
		u_int16_t len;
		};

		#endif /* _IPT_POLICY_H */

include/linux/netfilter_ipv6/ip6t_policy.h

0 → 100644

+52 −0

Original line number	Diff line number	Diff line
		#ifndef _IP6T_POLICY_H
		#define _IP6T_POLICY_H

		#define IP6T_POLICY_MAX_ELEM 4

		enum ip6t_policy_flags
		{
		IP6T_POLICY_MATCH_IN = 0x1,
		IP6T_POLICY_MATCH_OUT = 0x2,
		IP6T_POLICY_MATCH_NONE = 0x4,
		IP6T_POLICY_MATCH_STRICT = 0x8,
		};

		enum ip6t_policy_modes
		{
		IP6T_POLICY_MODE_TRANSPORT,
		IP6T_POLICY_MODE_TUNNEL
		};

		struct ip6t_policy_spec
		{
		u_int8_t saddr:1,
		daddr:1,
		proto:1,
		mode:1,
		spi:1,
		reqid:1;
		};

		struct ip6t_policy_elem
		{
		struct in6_addr saddr;
		struct in6_addr smask;
		struct in6_addr daddr;
		struct in6_addr dmask;
		u_int32_t spi;
		u_int32_t reqid;
		u_int8_t proto;
		u_int8_t mode;

		struct ip6t_policy_spec match;
		struct ip6t_policy_spec invert;
		};

		struct ip6t_policy_info
		{
		struct ip6t_policy_elem pol[IP6T_POLICY_MAX_ELEM];
		u_int16_t flags;
		u_int16_t len;
		};

		#endif /* _IP6T_POLICY_H */

net/ipv4/netfilter/Kconfig

+10 −0

Original line number	Diff line number	Diff line
		@@ -487,6 +487,16 @@ config IP_NF_MATCH_STRING

		To compile it as a module, choose M here. If unsure, say N.

		config IP_NF_MATCH_POLICY
		tristate "IPsec policy match support"
		depends on IP_NF_IPTABLES && XFRM
		help
		Policy matching allows you to match packets based on the
		IPsec policy that was used during decapsulation/will
		be used during encapsulation.

		To compile it as a module, choose M here. If unsure, say N.

		# `filter', generic and specific targets
		config IP_NF_FILTER
		tristate "Packet filtering"

net/ipv4/netfilter/Makefile

+1 −0

Original line number	Diff line number	Diff line
		@@ -72,6 +72,7 @@ obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
		obj-$(CONFIG_IP_NF_MATCH_REALM) += ipt_realm.o
		obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o
		obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o
		obj-$(CONFIG_IP_NF_MATCH_POLICY) += ipt_policy.o
		obj-$(CONFIG_IP_NF_MATCH_COMMENT) += ipt_comment.o
		obj-$(CONFIG_IP_NF_MATCH_STRING) += ipt_string.o

net/ipv4/netfilter/ipt_policy.c

0 → 100644

+170 −0

Original line number	Diff line number	Diff line
		/* IP tables module for matching IPsec policy
		*
		* Copyright (c) 2004,2005 Patrick McHardy, <kaber@trash.net>
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 as
		* published by the Free Software Foundation.
		*/

		#include <linux/kernel.h>
		#include <linux/config.h>
		#include <linux/module.h>
		#include <linux/skbuff.h>
		#include <linux/init.h>
		#include <net/xfrm.h>

		#include <linux/netfilter_ipv4.h>
		#include <linux/netfilter_ipv4/ip_tables.h>
		#include <linux/netfilter_ipv4/ipt_policy.h>

		MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
		MODULE_DESCRIPTION("IPtables IPsec policy matching module");
		MODULE_LICENSE("GPL");


		static inline int
		match_xfrm_state(struct xfrm_state x, const struct ipt_policy_elem e)
		{
		#define MATCH(x,y) (!e->match.x \|\| ((e->x == (y)) ^ e->invert.x))

		return MATCH(saddr, x->props.saddr.a4 & e->smask) &&
		MATCH(daddr, x->id.daddr.a4 & e->dmask) &&
		MATCH(proto, x->id.proto) &&
		MATCH(mode, x->props.mode) &&
		MATCH(spi, x->id.spi) &&
		MATCH(reqid, x->props.reqid);
		}

		static int
		match_policy_in(const struct sk_buff skb, const struct ipt_policy_info info)
		{
		const struct ipt_policy_elem *e;
		struct sec_path *sp = skb->sp;
		int strict = info->flags & IPT_POLICY_MATCH_STRICT;
		int i, pos;

		if (sp == NULL)
		return -1;
		if (strict && info->len != sp->len)
		return 0;

		for (i = sp->len - 1; i >= 0; i--) {
		pos = strict ? i - sp->len + 1 : 0;
		if (pos >= info->len)
		return 0;
		e = &info->pol[pos];

		if (match_xfrm_state(sp->x[i].xvec, e)) {
		if (!strict)
		return 1;
		} else if (strict)
		return 0;
		}

		return strict ? 1 : 0;
		}

		static int
		match_policy_out(const struct sk_buff skb, const struct ipt_policy_info info)
		{
		const struct ipt_policy_elem *e;
		struct dst_entry *dst = skb->dst;
		int strict = info->flags & IPT_POLICY_MATCH_STRICT;
		int i, pos;

		if (dst->xfrm == NULL)
		return -1;

		for (i = 0; dst && dst->xfrm; dst = dst->child, i++) {
		pos = strict ? i : 0;
		if (pos >= info->len)
		return 0;
		e = &info->pol[pos];

		if (match_xfrm_state(dst->xfrm, e)) {
		if (!strict)
		return 1;
		} else if (strict)
		return 0;
		}

		return strict ? 1 : 0;
		}

		static int match(const struct sk_buff *skb,
		const struct net_device *in,
		const struct net_device *out,
		const void matchinfo, int offset, int hotdrop)
		{
		const struct ipt_policy_info *info = matchinfo;
		int ret;

		if (info->flags & IPT_POLICY_MATCH_IN)
		ret = match_policy_in(skb, info);
		else
		ret = match_policy_out(skb, info);

		if (ret < 0)
		ret = info->flags & IPT_POLICY_MATCH_NONE ? 1 : 0;
		else if (info->flags & IPT_POLICY_MATCH_NONE)
		ret = 0;

		return ret;
		}

		static int checkentry(const char tablename, const struct ipt_ip ip,
		void *matchinfo, unsigned int matchsize,
		unsigned int hook_mask)
		{
		struct ipt_policy_info *info = matchinfo;

		if (matchsize != IPT_ALIGN(sizeof(*info))) {
		printk(KERN_ERR "ipt_policy: matchsize %u != %zu\n",
		matchsize, IPT_ALIGN(sizeof(*info)));
		return 0;
		}
		if (!(info->flags & (IPT_POLICY_MATCH_IN\|IPT_POLICY_MATCH_OUT))) {
		printk(KERN_ERR "ipt_policy: neither incoming nor "
		"outgoing policy selected\n");
		return 0;
		}
		if (hook_mask & (1 << NF_IP_PRE_ROUTING \| 1 << NF_IP_LOCAL_IN)
		&& info->flags & IPT_POLICY_MATCH_OUT) {
		printk(KERN_ERR "ipt_policy: output policy not valid in "
		"PRE_ROUTING and INPUT\n");
		return 0;
		}
		if (hook_mask & (1 << NF_IP_POST_ROUTING \| 1 << NF_IP_LOCAL_OUT)
		&& info->flags & IPT_POLICY_MATCH_IN) {
		printk(KERN_ERR "ipt_policy: input policy not valid in "
		"POST_ROUTING and OUTPUT\n");
		return 0;
		}
		if (info->len > IPT_POLICY_MAX_ELEM) {
		printk(KERN_ERR "ipt_policy: too many policy elements\n");
		return 0;
		}

		return 1;
		}

		static struct ipt_match policy_match = {
		.name = "policy",
		.match = match,
		.checkentry = checkentry,
		.me = THIS_MODULE,
		};

		static int __init init(void)
		{
		return ipt_register_match(&policy_match);
		}

		static void __exit fini(void)
		{
		ipt_unregister_match(&policy_match);
		}

		module_init(init);
		module_exit(fini);