1 /* Kernel module to match one of a list of TCP/UDP(-Lite)/SCTP/DCCP ports:
2 ports are in the same place so we can treat them as equal. */
3
4 /* (C) 1999-2001 Paul `Rusty' Russell
5 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11
12 #include <linux/module.h>
13 #include <linux/types.h>
14 #include <linux/udp.h>
15 #include <linux/skbuff.h>
16 #include <linux/in.h>
17
18 #include <linux/netfilter/xt_multiport.h>
19 #include <linux/netfilter/x_tables.h>
20 #include <linux/netfilter_ipv4/ip_tables.h>
21 #include <linux/netfilter_ipv6/ip6_tables.h>
22
23 MODULE_LICENSE("GPL");
24 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
25 MODULE_DESCRIPTION("Xtables: multiple port matching for TCP, UDP, UDP-Lite, SCTP and DCCP");
26 MODULE_ALIAS("ipt_multiport");
27 MODULE_ALIAS("ip6t_multiport");
28
29 #if 0
30 #define duprintf(format, args...) printk(format , ## args)
31 #else
32 #define duprintf(format, args...)
33 #endif
34
35 /* Returns 1 if the port is matched by the test, 0 otherwise. */
36 static inline bool
37 ports_match_v0(const u_int16_t *portlist, enum xt_multiport_flags flags,
38 u_int8_t count, u_int16_t src, u_int16_t dst)
39 {
40 unsigned int i;
41 for (i = 0; i < count; i++) {
42 if (flags != XT_MULTIPORT_DESTINATION && portlist[i] == src)
43 return true;
44
45 if (flags != XT_MULTIPORT_SOURCE && portlist[i] == dst)
46 return true;
47 }
48
49 return false;
50 }
51
52 /* Returns 1 if the port is matched by the test, 0 otherwise. */
53 static inline bool
54 ports_match_v1(const struct xt_multiport_v1 *minfo,
55 u_int16_t src, u_int16_t dst)
56 {
57 unsigned int i;
58 u_int16_t s, e;
59
60 for (i = 0; i < minfo->count; i++) {
61 s = minfo->ports[i];
62
63 if (minfo->pflags[i]) {
64 /* range port matching */
65 e = minfo->ports[++i];
66 duprintf("src or dst matches with %d-%d?\n", s, e);
67
68 if (minfo->flags == XT_MULTIPORT_SOURCE
69 && src >= s && src <= e)
70 return true ^ minfo->invert;
71 if (minfo->flags == XT_MULTIPORT_DESTINATION
72 && dst >= s && dst <= e)
73 return true ^ minfo->invert;
74 if (minfo->flags == XT_MULTIPORT_EITHER
75 && ((dst >= s && dst <= e)
76 || (src >= s && src <= e)))
77 return true ^ minfo->invert;
78 } else {
79 /* exact port matching */
80 duprintf("src or dst matches with %d?\n", s);
81
82 if (minfo->flags == XT_MULTIPORT_SOURCE
83 && src == s)
84 return true ^ minfo->invert;
85 if (minfo->flags == XT_MULTIPORT_DESTINATION
86 && dst == s)
87 return true ^ minfo->invert;
88 if (minfo->flags == XT_MULTIPORT_EITHER
89 && (src == s || dst == s))
90 return true ^ minfo->invert;
91 }
92 }
93
94 return minfo->invert;
95 }
96
97 static bool
98 multiport_mt_v0(const struct sk_buff *skb, const struct net_device *in,
99 const struct net_device *out, const struct xt_match *match,
100 const void *matchinfo, int offset, unsigned int protoff,
101 bool *hotdrop)
102 {
103 __be16 _ports[2], *pptr;
104 const struct xt_multiport *multiinfo = matchinfo;
105
106 if (offset)
107 return false;
108
109 pptr = skb_header_pointer(skb, protoff, sizeof(_ports), _ports);
110 if (pptr == NULL) {
111 /* We've been asked to examine this packet, and we
112 * can't. Hence, no choice but to drop.
113 */
114 duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n");
115 *hotdrop = true;
116 return false;
117 }
118
119 return ports_match_v0(multiinfo->ports, multiinfo->flags,
120 multiinfo->count, ntohs(pptr[0]), ntohs(pptr[1]));
121 }
122
123 static bool
124 multiport_mt(const struct sk_buff *skb, const struct net_device *in,
125 const struct net_device *out, const struct xt_match *match,
126 const void *matchinfo, int offset, unsigned int protoff,
127 bool *hotdrop)
128 {
129 __be16 _ports[2], *pptr;
130 const struct xt_multiport_v1 *multiinfo = matchinfo;
131
132 if (offset)
133 return false;
134
135 pptr = skb_header_pointer(skb, protoff, sizeof(_ports), _ports);
136 if (pptr == NULL) {
137 /* We've been asked to examine this packet, and we
138 * can't. Hence, no choice but to drop.
139 */
140 duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n");
141 *hotdrop = true;
142 return false;
143 }
144
145 return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1]));
146 }
147
148 static inline bool
149 check(u_int16_t proto,
150 u_int8_t ip_invflags,
151 u_int8_t match_flags,
152 u_int8_t count)
153 {
154 /* Must specify supported protocol, no unknown flags or bad count */
155 return (proto == IPPROTO_TCP || proto == IPPROTO_UDP
156 || proto == IPPROTO_UDPLITE
157 || proto == IPPROTO_SCTP || proto == IPPROTO_DCCP)
158 && !(ip_invflags & XT_INV_PROTO)
159 && (match_flags == XT_MULTIPORT_SOURCE
160 || match_flags == XT_MULTIPORT_DESTINATION
161 || match_flags == XT_MULTIPORT_EITHER)
162 && count <= XT_MULTI_PORTS;
163 }
164
165 /* Called when user tries to insert an entry of this type. */
166 static bool
167 multiport_mt_check_v0(const char *tablename, const void *info,
168 const struct xt_match *match, void *matchinfo,
169 unsigned int hook_mask)
170 {
171 const struct ipt_ip *ip = info;
172 const struct xt_multiport *multiinfo = matchinfo;
173
174 return check(ip->proto, ip->invflags, multiinfo->flags,
175 multiinfo->count);
176 }
177
178 static bool
179 multiport_mt_check(const char *tablename, const void *info,
180 const struct xt_match *match, void *matchinfo,
181 unsigned int hook_mask)
182 {
183 const struct ipt_ip *ip = info;
184 const struct xt_multiport_v1 *multiinfo = matchinfo;
185
186 return check(ip->proto, ip->invflags, multiinfo->flags,
187 multiinfo->count);
188 }
189
190 static bool
191 multiport_mt6_check_v0(const char *tablename, const void *info,
192 const struct xt_match *match, void *matchinfo,
193 unsigned int hook_mask)
194 {
195 const struct ip6t_ip6 *ip = info;
196 const struct xt_multiport *multiinfo = matchinfo;
197
198 return check(ip->proto, ip->invflags, multiinfo->flags,
199 multiinfo->count);
200 }
201
202 static bool
203 multiport_mt6_check(const char *tablename, const void *info,
204 const struct xt_match *match, void *matchinfo,
205 unsigned int hook_mask)
206 {
207 const struct ip6t_ip6 *ip = info;
208 const struct xt_multiport_v1 *multiinfo = matchinfo;
209
210 return check(ip->proto, ip->invflags, multiinfo->flags,
211 multiinfo->count);
212 }
213
214 static struct xt_match multiport_mt_reg[] __read_mostly = {
215 {
216 .name = "multiport",
217 .family = AF_INET,
218 .revision = 0,
219 .checkentry = multiport_mt_check_v0,
220 .match = multiport_mt_v0,
221 .matchsize = sizeof(struct xt_multiport),
222 .me = THIS_MODULE,
223 },
224 {
225 .name = "multiport",
226 .family = AF_INET,
227 .revision = 1,
228 .checkentry = multiport_mt_check,
229 .match = multiport_mt,
230 .matchsize = sizeof(struct xt_multiport_v1),
231 .me = THIS_MODULE,
232 },
233 {
234 .name = "multiport",
235 .family = AF_INET6,
236 .revision = 0,
237 .checkentry = multiport_mt6_check_v0,
238 .match = multiport_mt_v0,
239 .matchsize = sizeof(struct xt_multiport),
240 .me = THIS_MODULE,
241 },
242 {
243 .name = "multiport",
244 .family = AF_INET6,
245 .revision = 1,
246 .checkentry = multiport_mt6_check,
247 .match = multiport_mt,
248 .matchsize = sizeof(struct xt_multiport_v1),
249 .me = THIS_MODULE,
250 },
251 };
252
253 static int __init multiport_mt_init(void)
254 {
255 return xt_register_matches(multiport_mt_reg,
256 ARRAY_SIZE(multiport_mt_reg));
257 }
258
259 static void __exit multiport_mt_exit(void)
260 {
261 xt_unregister_matches(multiport_mt_reg, ARRAY_SIZE(multiport_mt_reg));
262 }
263
264 module_init(multiport_mt_init);
265 module_exit(multiport_mt_exit);
266
|
This page was automatically generated by the
LXR engine.
|