Loading...
1// SPDX-License-Identifier: GPL-2.0-only
2/* Kernel module to match L2TP header parameters. */
3
4/* (C) 2013 James Chapman <jchapman@katalix.com>
5 */
6
7#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
8#include <linux/module.h>
9#include <linux/skbuff.h>
10#include <linux/if_ether.h>
11#include <net/ip.h>
12#include <linux/ipv6.h>
13#include <net/ipv6.h>
14#include <net/udp.h>
15#include <linux/l2tp.h>
16
17#include <linux/netfilter_ipv4.h>
18#include <linux/netfilter_ipv6.h>
19#include <linux/netfilter_ipv4/ip_tables.h>
20#include <linux/netfilter_ipv6/ip6_tables.h>
21#include <linux/netfilter/x_tables.h>
22#include <linux/netfilter/xt_tcpudp.h>
23#include <linux/netfilter/xt_l2tp.h>
24
25/* L2TP header masks */
26#define L2TP_HDR_T_BIT 0x8000
27#define L2TP_HDR_L_BIT 0x4000
28#define L2TP_HDR_VER 0x000f
29
30MODULE_LICENSE("GPL");
31MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
32MODULE_DESCRIPTION("Xtables: L2TP header match");
33MODULE_ALIAS("ipt_l2tp");
34MODULE_ALIAS("ip6t_l2tp");
35
36/* The L2TP fields that can be matched */
37struct l2tp_data {
38 u32 tid;
39 u32 sid;
40 u8 type;
41 u8 version;
42};
43
44union l2tp_val {
45 __be16 val16[2];
46 __be32 val32;
47};
48
49static bool l2tp_match(const struct xt_l2tp_info *info, struct l2tp_data *data)
50{
51 if ((info->flags & XT_L2TP_TYPE) && (info->type != data->type))
52 return false;
53
54 if ((info->flags & XT_L2TP_VERSION) && (info->version != data->version))
55 return false;
56
57 /* Check tid only for L2TPv3 control or any L2TPv2 packets */
58 if ((info->flags & XT_L2TP_TID) &&
59 ((data->type == XT_L2TP_TYPE_CONTROL) || (data->version == 2)) &&
60 (info->tid != data->tid))
61 return false;
62
63 /* Check sid only for L2TP data packets */
64 if ((info->flags & XT_L2TP_SID) && (data->type == XT_L2TP_TYPE_DATA) &&
65 (info->sid != data->sid))
66 return false;
67
68 return true;
69}
70
71/* Parse L2TP header fields when UDP encapsulation is used. Handles
72 * L2TPv2 and L2TPv3. Note the L2TPv3 control and data packets have a
73 * different format. See
74 * RFC2661, Section 3.1, L2TPv2 Header Format
75 * RFC3931, Section 3.2.1, L2TPv3 Control Message Header
76 * RFC3931, Section 3.2.2, L2TPv3 Data Message Header
77 * RFC3931, Section 4.1.2.1, L2TPv3 Session Header over UDP
78 */
79static bool l2tp_udp_mt(const struct sk_buff *skb, struct xt_action_param *par, u16 thoff)
80{
81 const struct xt_l2tp_info *info = par->matchinfo;
82 int uhlen = sizeof(struct udphdr);
83 int offs = thoff + uhlen;
84 union l2tp_val *lh;
85 union l2tp_val lhbuf;
86 u16 flags;
87 struct l2tp_data data = { 0, };
88
89 if (par->fragoff != 0)
90 return false;
91
92 /* Extract L2TP header fields. The flags in the first 16 bits
93 * tell us where the other fields are.
94 */
95 lh = skb_header_pointer(skb, offs, 2, &lhbuf);
96 if (lh == NULL)
97 return false;
98
99 flags = ntohs(lh->val16[0]);
100 if (flags & L2TP_HDR_T_BIT)
101 data.type = XT_L2TP_TYPE_CONTROL;
102 else
103 data.type = XT_L2TP_TYPE_DATA;
104 data.version = (u8) flags & L2TP_HDR_VER;
105
106 /* Now extract the L2TP tid/sid. These are in different places
107 * for L2TPv2 (rfc2661) and L2TPv3 (rfc3931). For L2TPv2, we
108 * must also check to see if the length field is present,
109 * since this affects the offsets into the packet of the
110 * tid/sid fields.
111 */
112 if (data.version == 3) {
113 lh = skb_header_pointer(skb, offs + 4, 4, &lhbuf);
114 if (lh == NULL)
115 return false;
116 if (data.type == XT_L2TP_TYPE_CONTROL)
117 data.tid = ntohl(lh->val32);
118 else
119 data.sid = ntohl(lh->val32);
120 } else if (data.version == 2) {
121 if (flags & L2TP_HDR_L_BIT)
122 offs += 2;
123 lh = skb_header_pointer(skb, offs + 2, 4, &lhbuf);
124 if (lh == NULL)
125 return false;
126 data.tid = (u32) ntohs(lh->val16[0]);
127 data.sid = (u32) ntohs(lh->val16[1]);
128 } else
129 return false;
130
131 return l2tp_match(info, &data);
132}
133
134/* Parse L2TP header fields for IP encapsulation (no UDP header).
135 * L2TPv3 data packets have a different form with IP encap. See
136 * RC3931, Section 4.1.1.1, L2TPv3 Session Header over IP.
137 * RC3931, Section 4.1.1.2, L2TPv3 Control and Data Traffic over IP.
138 */
139static bool l2tp_ip_mt(const struct sk_buff *skb, struct xt_action_param *par, u16 thoff)
140{
141 const struct xt_l2tp_info *info = par->matchinfo;
142 union l2tp_val *lh;
143 union l2tp_val lhbuf;
144 struct l2tp_data data = { 0, };
145
146 /* For IP encap, the L2TP sid is the first 32-bits. */
147 lh = skb_header_pointer(skb, thoff, sizeof(lhbuf), &lhbuf);
148 if (lh == NULL)
149 return false;
150 if (lh->val32 == 0) {
151 /* Must be a control packet. The L2TP tid is further
152 * into the packet.
153 */
154 data.type = XT_L2TP_TYPE_CONTROL;
155 lh = skb_header_pointer(skb, thoff + 8, sizeof(lhbuf),
156 &lhbuf);
157 if (lh == NULL)
158 return false;
159 data.tid = ntohl(lh->val32);
160 } else {
161 data.sid = ntohl(lh->val32);
162 data.type = XT_L2TP_TYPE_DATA;
163 }
164
165 data.version = 3;
166
167 return l2tp_match(info, &data);
168}
169
170static bool l2tp_mt4(const struct sk_buff *skb, struct xt_action_param *par)
171{
172 struct iphdr *iph = ip_hdr(skb);
173 u8 ipproto = iph->protocol;
174
175 /* l2tp_mt_check4 already restricts the transport protocol */
176 switch (ipproto) {
177 case IPPROTO_UDP:
178 return l2tp_udp_mt(skb, par, par->thoff);
179 case IPPROTO_L2TP:
180 return l2tp_ip_mt(skb, par, par->thoff);
181 }
182
183 return false;
184}
185
186#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
187static bool l2tp_mt6(const struct sk_buff *skb, struct xt_action_param *par)
188{
189 unsigned int thoff = 0;
190 unsigned short fragoff = 0;
191 int ipproto;
192
193 ipproto = ipv6_find_hdr(skb, &thoff, -1, &fragoff, NULL);
194 if (fragoff != 0)
195 return false;
196
197 /* l2tp_mt_check6 already restricts the transport protocol */
198 switch (ipproto) {
199 case IPPROTO_UDP:
200 return l2tp_udp_mt(skb, par, thoff);
201 case IPPROTO_L2TP:
202 return l2tp_ip_mt(skb, par, thoff);
203 }
204
205 return false;
206}
207#endif
208
209static int l2tp_mt_check(const struct xt_mtchk_param *par)
210{
211 const struct xt_l2tp_info *info = par->matchinfo;
212
213 /* Check for invalid flags */
214 if (info->flags & ~(XT_L2TP_TID | XT_L2TP_SID | XT_L2TP_VERSION |
215 XT_L2TP_TYPE)) {
216 pr_info_ratelimited("unknown flags: %x\n", info->flags);
217 return -EINVAL;
218 }
219
220 /* At least one of tid, sid or type=control must be specified */
221 if ((!(info->flags & XT_L2TP_TID)) &&
222 (!(info->flags & XT_L2TP_SID)) &&
223 ((!(info->flags & XT_L2TP_TYPE)) ||
224 (info->type != XT_L2TP_TYPE_CONTROL))) {
225 pr_info_ratelimited("invalid flags combination: %x\n",
226 info->flags);
227 return -EINVAL;
228 }
229
230 /* If version 2 is specified, check that incompatible params
231 * are not supplied
232 */
233 if (info->flags & XT_L2TP_VERSION) {
234 if ((info->version < 2) || (info->version > 3)) {
235 pr_info_ratelimited("wrong L2TP version: %u\n",
236 info->version);
237 return -EINVAL;
238 }
239
240 if (info->version == 2) {
241 if ((info->flags & XT_L2TP_TID) &&
242 (info->tid > 0xffff)) {
243 pr_info_ratelimited("v2 tid > 0xffff: %u\n",
244 info->tid);
245 return -EINVAL;
246 }
247 if ((info->flags & XT_L2TP_SID) &&
248 (info->sid > 0xffff)) {
249 pr_info_ratelimited("v2 sid > 0xffff: %u\n",
250 info->sid);
251 return -EINVAL;
252 }
253 }
254 }
255
256 return 0;
257}
258
259static int l2tp_mt_check4(const struct xt_mtchk_param *par)
260{
261 const struct xt_l2tp_info *info = par->matchinfo;
262 const struct ipt_entry *e = par->entryinfo;
263 const struct ipt_ip *ip = &e->ip;
264 int ret;
265
266 ret = l2tp_mt_check(par);
267 if (ret != 0)
268 return ret;
269
270 if ((ip->proto != IPPROTO_UDP) &&
271 (ip->proto != IPPROTO_L2TP)) {
272 pr_info_ratelimited("missing protocol rule (udp|l2tpip)\n");
273 return -EINVAL;
274 }
275
276 if ((ip->proto == IPPROTO_L2TP) &&
277 (info->version == 2)) {
278 pr_info_ratelimited("v2 doesn't support IP mode\n");
279 return -EINVAL;
280 }
281
282 return 0;
283}
284
285#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
286static int l2tp_mt_check6(const struct xt_mtchk_param *par)
287{
288 const struct xt_l2tp_info *info = par->matchinfo;
289 const struct ip6t_entry *e = par->entryinfo;
290 const struct ip6t_ip6 *ip = &e->ipv6;
291 int ret;
292
293 ret = l2tp_mt_check(par);
294 if (ret != 0)
295 return ret;
296
297 if ((ip->proto != IPPROTO_UDP) &&
298 (ip->proto != IPPROTO_L2TP)) {
299 pr_info_ratelimited("missing protocol rule (udp|l2tpip)\n");
300 return -EINVAL;
301 }
302
303 if ((ip->proto == IPPROTO_L2TP) &&
304 (info->version == 2)) {
305 pr_info_ratelimited("v2 doesn't support IP mode\n");
306 return -EINVAL;
307 }
308
309 return 0;
310}
311#endif
312
313static struct xt_match l2tp_mt_reg[] __read_mostly = {
314 {
315 .name = "l2tp",
316 .revision = 0,
317 .family = NFPROTO_IPV4,
318 .match = l2tp_mt4,
319 .matchsize = XT_ALIGN(sizeof(struct xt_l2tp_info)),
320 .checkentry = l2tp_mt_check4,
321 .hooks = ((1 << NF_INET_PRE_ROUTING) |
322 (1 << NF_INET_LOCAL_IN) |
323 (1 << NF_INET_LOCAL_OUT) |
324 (1 << NF_INET_FORWARD)),
325 .me = THIS_MODULE,
326 },
327#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
328 {
329 .name = "l2tp",
330 .revision = 0,
331 .family = NFPROTO_IPV6,
332 .match = l2tp_mt6,
333 .matchsize = XT_ALIGN(sizeof(struct xt_l2tp_info)),
334 .checkentry = l2tp_mt_check6,
335 .hooks = ((1 << NF_INET_PRE_ROUTING) |
336 (1 << NF_INET_LOCAL_IN) |
337 (1 << NF_INET_LOCAL_OUT) |
338 (1 << NF_INET_FORWARD)),
339 .me = THIS_MODULE,
340 },
341#endif
342};
343
344static int __init l2tp_mt_init(void)
345{
346 return xt_register_matches(&l2tp_mt_reg[0], ARRAY_SIZE(l2tp_mt_reg));
347}
348
349static void __exit l2tp_mt_exit(void)
350{
351 xt_unregister_matches(&l2tp_mt_reg[0], ARRAY_SIZE(l2tp_mt_reg));
352}
353
354module_init(l2tp_mt_init);
355module_exit(l2tp_mt_exit);
1/* Kernel module to match L2TP header parameters. */
2
3/* (C) 2013 James Chapman <jchapman@katalix.com>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 */
9
10#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
11#include <linux/module.h>
12#include <linux/skbuff.h>
13#include <linux/if_ether.h>
14#include <net/ip.h>
15#include <linux/ipv6.h>
16#include <net/ipv6.h>
17#include <net/udp.h>
18#include <linux/l2tp.h>
19
20#include <linux/netfilter_ipv4.h>
21#include <linux/netfilter_ipv6.h>
22#include <linux/netfilter_ipv4/ip_tables.h>
23#include <linux/netfilter_ipv6/ip6_tables.h>
24#include <linux/netfilter/x_tables.h>
25#include <linux/netfilter/xt_tcpudp.h>
26#include <linux/netfilter/xt_l2tp.h>
27
28/* L2TP header masks */
29#define L2TP_HDR_T_BIT 0x8000
30#define L2TP_HDR_L_BIT 0x4000
31#define L2TP_HDR_VER 0x000f
32
33MODULE_LICENSE("GPL");
34MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
35MODULE_DESCRIPTION("Xtables: L2TP header match");
36MODULE_ALIAS("ipt_l2tp");
37MODULE_ALIAS("ip6t_l2tp");
38
39/* The L2TP fields that can be matched */
40struct l2tp_data {
41 u32 tid;
42 u32 sid;
43 u8 type;
44 u8 version;
45};
46
47union l2tp_val {
48 __be16 val16[2];
49 __be32 val32;
50};
51
52static bool l2tp_match(const struct xt_l2tp_info *info, struct l2tp_data *data)
53{
54 if ((info->flags & XT_L2TP_TYPE) && (info->type != data->type))
55 return false;
56
57 if ((info->flags & XT_L2TP_VERSION) && (info->version != data->version))
58 return false;
59
60 /* Check tid only for L2TPv3 control or any L2TPv2 packets */
61 if ((info->flags & XT_L2TP_TID) &&
62 ((data->type == XT_L2TP_TYPE_CONTROL) || (data->version == 2)) &&
63 (info->tid != data->tid))
64 return false;
65
66 /* Check sid only for L2TP data packets */
67 if ((info->flags & XT_L2TP_SID) && (data->type == XT_L2TP_TYPE_DATA) &&
68 (info->sid != data->sid))
69 return false;
70
71 return true;
72}
73
74/* Parse L2TP header fields when UDP encapsulation is used. Handles
75 * L2TPv2 and L2TPv3. Note the L2TPv3 control and data packets have a
76 * different format. See
77 * RFC2661, Section 3.1, L2TPv2 Header Format
78 * RFC3931, Section 3.2.1, L2TPv3 Control Message Header
79 * RFC3931, Section 3.2.2, L2TPv3 Data Message Header
80 * RFC3931, Section 4.1.2.1, L2TPv3 Session Header over UDP
81 */
82static bool l2tp_udp_mt(const struct sk_buff *skb, struct xt_action_param *par, u16 thoff)
83{
84 const struct xt_l2tp_info *info = par->matchinfo;
85 int uhlen = sizeof(struct udphdr);
86 int offs = thoff + uhlen;
87 union l2tp_val *lh;
88 union l2tp_val lhbuf;
89 u16 flags;
90 struct l2tp_data data = { 0, };
91
92 if (par->fragoff != 0)
93 return false;
94
95 /* Extract L2TP header fields. The flags in the first 16 bits
96 * tell us where the other fields are.
97 */
98 lh = skb_header_pointer(skb, offs, 2, &lhbuf);
99 if (lh == NULL)
100 return false;
101
102 flags = ntohs(lh->val16[0]);
103 if (flags & L2TP_HDR_T_BIT)
104 data.type = XT_L2TP_TYPE_CONTROL;
105 else
106 data.type = XT_L2TP_TYPE_DATA;
107 data.version = (u8) flags & L2TP_HDR_VER;
108
109 /* Now extract the L2TP tid/sid. These are in different places
110 * for L2TPv2 (rfc2661) and L2TPv3 (rfc3931). For L2TPv2, we
111 * must also check to see if the length field is present,
112 * since this affects the offsets into the packet of the
113 * tid/sid fields.
114 */
115 if (data.version == 3) {
116 lh = skb_header_pointer(skb, offs + 4, 4, &lhbuf);
117 if (lh == NULL)
118 return false;
119 if (data.type == XT_L2TP_TYPE_CONTROL)
120 data.tid = ntohl(lh->val32);
121 else
122 data.sid = ntohl(lh->val32);
123 } else if (data.version == 2) {
124 if (flags & L2TP_HDR_L_BIT)
125 offs += 2;
126 lh = skb_header_pointer(skb, offs + 2, 4, &lhbuf);
127 if (lh == NULL)
128 return false;
129 data.tid = (u32) ntohs(lh->val16[0]);
130 data.sid = (u32) ntohs(lh->val16[1]);
131 } else
132 return false;
133
134 return l2tp_match(info, &data);
135}
136
137/* Parse L2TP header fields for IP encapsulation (no UDP header).
138 * L2TPv3 data packets have a different form with IP encap. See
139 * RC3931, Section 4.1.1.1, L2TPv3 Session Header over IP.
140 * RC3931, Section 4.1.1.2, L2TPv3 Control and Data Traffic over IP.
141 */
142static bool l2tp_ip_mt(const struct sk_buff *skb, struct xt_action_param *par, u16 thoff)
143{
144 const struct xt_l2tp_info *info = par->matchinfo;
145 union l2tp_val *lh;
146 union l2tp_val lhbuf;
147 struct l2tp_data data = { 0, };
148
149 /* For IP encap, the L2TP sid is the first 32-bits. */
150 lh = skb_header_pointer(skb, thoff, sizeof(lhbuf), &lhbuf);
151 if (lh == NULL)
152 return false;
153 if (lh->val32 == 0) {
154 /* Must be a control packet. The L2TP tid is further
155 * into the packet.
156 */
157 data.type = XT_L2TP_TYPE_CONTROL;
158 lh = skb_header_pointer(skb, thoff + 8, sizeof(lhbuf),
159 &lhbuf);
160 if (lh == NULL)
161 return false;
162 data.tid = ntohl(lh->val32);
163 } else {
164 data.sid = ntohl(lh->val32);
165 data.type = XT_L2TP_TYPE_DATA;
166 }
167
168 data.version = 3;
169
170 return l2tp_match(info, &data);
171}
172
173static bool l2tp_mt4(const struct sk_buff *skb, struct xt_action_param *par)
174{
175 struct iphdr *iph = ip_hdr(skb);
176 u8 ipproto = iph->protocol;
177
178 /* l2tp_mt_check4 already restricts the transport protocol */
179 switch (ipproto) {
180 case IPPROTO_UDP:
181 return l2tp_udp_mt(skb, par, par->thoff);
182 case IPPROTO_L2TP:
183 return l2tp_ip_mt(skb, par, par->thoff);
184 }
185
186 return false;
187}
188
189#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
190static bool l2tp_mt6(const struct sk_buff *skb, struct xt_action_param *par)
191{
192 unsigned int thoff = 0;
193 unsigned short fragoff = 0;
194 int ipproto;
195
196 ipproto = ipv6_find_hdr(skb, &thoff, -1, &fragoff, NULL);
197 if (fragoff != 0)
198 return false;
199
200 /* l2tp_mt_check6 already restricts the transport protocol */
201 switch (ipproto) {
202 case IPPROTO_UDP:
203 return l2tp_udp_mt(skb, par, thoff);
204 case IPPROTO_L2TP:
205 return l2tp_ip_mt(skb, par, thoff);
206 }
207
208 return false;
209}
210#endif
211
212static int l2tp_mt_check(const struct xt_mtchk_param *par)
213{
214 const struct xt_l2tp_info *info = par->matchinfo;
215
216 /* Check for invalid flags */
217 if (info->flags & ~(XT_L2TP_TID | XT_L2TP_SID | XT_L2TP_VERSION |
218 XT_L2TP_TYPE)) {
219 pr_info_ratelimited("unknown flags: %x\n", info->flags);
220 return -EINVAL;
221 }
222
223 /* At least one of tid, sid or type=control must be specified */
224 if ((!(info->flags & XT_L2TP_TID)) &&
225 (!(info->flags & XT_L2TP_SID)) &&
226 ((!(info->flags & XT_L2TP_TYPE)) ||
227 (info->type != XT_L2TP_TYPE_CONTROL))) {
228 pr_info_ratelimited("invalid flags combination: %x\n",
229 info->flags);
230 return -EINVAL;
231 }
232
233 /* If version 2 is specified, check that incompatible params
234 * are not supplied
235 */
236 if (info->flags & XT_L2TP_VERSION) {
237 if ((info->version < 2) || (info->version > 3)) {
238 pr_info_ratelimited("wrong L2TP version: %u\n",
239 info->version);
240 return -EINVAL;
241 }
242
243 if (info->version == 2) {
244 if ((info->flags & XT_L2TP_TID) &&
245 (info->tid > 0xffff)) {
246 pr_info_ratelimited("v2 tid > 0xffff: %u\n",
247 info->tid);
248 return -EINVAL;
249 }
250 if ((info->flags & XT_L2TP_SID) &&
251 (info->sid > 0xffff)) {
252 pr_info_ratelimited("v2 sid > 0xffff: %u\n",
253 info->sid);
254 return -EINVAL;
255 }
256 }
257 }
258
259 return 0;
260}
261
262static int l2tp_mt_check4(const struct xt_mtchk_param *par)
263{
264 const struct xt_l2tp_info *info = par->matchinfo;
265 const struct ipt_entry *e = par->entryinfo;
266 const struct ipt_ip *ip = &e->ip;
267 int ret;
268
269 ret = l2tp_mt_check(par);
270 if (ret != 0)
271 return ret;
272
273 if ((ip->proto != IPPROTO_UDP) &&
274 (ip->proto != IPPROTO_L2TP)) {
275 pr_info_ratelimited("missing protocol rule (udp|l2tpip)\n");
276 return -EINVAL;
277 }
278
279 if ((ip->proto == IPPROTO_L2TP) &&
280 (info->version == 2)) {
281 pr_info_ratelimited("v2 doesn't support IP mode\n");
282 return -EINVAL;
283 }
284
285 return 0;
286}
287
288#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
289static int l2tp_mt_check6(const struct xt_mtchk_param *par)
290{
291 const struct xt_l2tp_info *info = par->matchinfo;
292 const struct ip6t_entry *e = par->entryinfo;
293 const struct ip6t_ip6 *ip = &e->ipv6;
294 int ret;
295
296 ret = l2tp_mt_check(par);
297 if (ret != 0)
298 return ret;
299
300 if ((ip->proto != IPPROTO_UDP) &&
301 (ip->proto != IPPROTO_L2TP)) {
302 pr_info_ratelimited("missing protocol rule (udp|l2tpip)\n");
303 return -EINVAL;
304 }
305
306 if ((ip->proto == IPPROTO_L2TP) &&
307 (info->version == 2)) {
308 pr_info_ratelimited("v2 doesn't support IP mode\n");
309 return -EINVAL;
310 }
311
312 return 0;
313}
314#endif
315
316static struct xt_match l2tp_mt_reg[] __read_mostly = {
317 {
318 .name = "l2tp",
319 .revision = 0,
320 .family = NFPROTO_IPV4,
321 .match = l2tp_mt4,
322 .matchsize = XT_ALIGN(sizeof(struct xt_l2tp_info)),
323 .checkentry = l2tp_mt_check4,
324 .hooks = ((1 << NF_INET_PRE_ROUTING) |
325 (1 << NF_INET_LOCAL_IN) |
326 (1 << NF_INET_LOCAL_OUT) |
327 (1 << NF_INET_FORWARD)),
328 .me = THIS_MODULE,
329 },
330#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
331 {
332 .name = "l2tp",
333 .revision = 0,
334 .family = NFPROTO_IPV6,
335 .match = l2tp_mt6,
336 .matchsize = XT_ALIGN(sizeof(struct xt_l2tp_info)),
337 .checkentry = l2tp_mt_check6,
338 .hooks = ((1 << NF_INET_PRE_ROUTING) |
339 (1 << NF_INET_LOCAL_IN) |
340 (1 << NF_INET_LOCAL_OUT) |
341 (1 << NF_INET_FORWARD)),
342 .me = THIS_MODULE,
343 },
344#endif
345};
346
347static int __init l2tp_mt_init(void)
348{
349 return xt_register_matches(&l2tp_mt_reg[0], ARRAY_SIZE(l2tp_mt_reg));
350}
351
352static void __exit l2tp_mt_exit(void)
353{
354 xt_unregister_matches(&l2tp_mt_reg[0], ARRAY_SIZE(l2tp_mt_reg));
355}
356
357module_init(l2tp_mt_init);
358module_exit(l2tp_mt_exit);