1d2912cb1SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
2ba4e58ecSGerrit Renker /* Kernel module to match one of a list of TCP/UDP(-Lite)/SCTP/DCCP ports:
3ba4e58ecSGerrit Renker ports are in the same place so we can treat them as equal. */
4a89ecb6aSYasuyuki Kozakai
5a89ecb6aSYasuyuki Kozakai /* (C) 1999-2001 Paul `Rusty' Russell
6a89ecb6aSYasuyuki Kozakai * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
7a89ecb6aSYasuyuki Kozakai */
8be91fd5eSJan Engelhardt #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9a89ecb6aSYasuyuki Kozakai #include <linux/module.h>
10a89ecb6aSYasuyuki Kozakai #include <linux/types.h>
11a89ecb6aSYasuyuki Kozakai #include <linux/udp.h>
12a89ecb6aSYasuyuki Kozakai #include <linux/skbuff.h>
13a89ecb6aSYasuyuki Kozakai #include <linux/in.h>
14a89ecb6aSYasuyuki Kozakai
15a89ecb6aSYasuyuki Kozakai #include <linux/netfilter/xt_multiport.h>
16a89ecb6aSYasuyuki Kozakai #include <linux/netfilter/x_tables.h>
17a89ecb6aSYasuyuki Kozakai #include <linux/netfilter_ipv4/ip_tables.h>
18a89ecb6aSYasuyuki Kozakai #include <linux/netfilter_ipv6/ip6_tables.h>
19a89ecb6aSYasuyuki Kozakai
20a89ecb6aSYasuyuki Kozakai MODULE_LICENSE("GPL");
21a89ecb6aSYasuyuki Kozakai MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
222ae15b64SJan Engelhardt MODULE_DESCRIPTION("Xtables: multiple port matching for TCP, UDP, UDP-Lite, SCTP and DCCP");
23a89ecb6aSYasuyuki Kozakai MODULE_ALIAS("ipt_multiport");
24a89ecb6aSYasuyuki Kozakai MODULE_ALIAS("ip6t_multiport");
25a89ecb6aSYasuyuki Kozakai
26a89ecb6aSYasuyuki Kozakai /* Returns 1 if the port is matched by the test, 0 otherwise. */
271d93a9cbSJan Engelhardt static inline bool
ports_match_v1(const struct xt_multiport_v1 * minfo,u_int16_t src,u_int16_t dst)28a89ecb6aSYasuyuki Kozakai ports_match_v1(const struct xt_multiport_v1 *minfo,
29a89ecb6aSYasuyuki Kozakai u_int16_t src, u_int16_t dst)
30a89ecb6aSYasuyuki Kozakai {
31a89ecb6aSYasuyuki Kozakai unsigned int i;
32a89ecb6aSYasuyuki Kozakai u_int16_t s, e;
33a89ecb6aSYasuyuki Kozakai
34a89ecb6aSYasuyuki Kozakai for (i = 0; i < minfo->count; i++) {
35a89ecb6aSYasuyuki Kozakai s = minfo->ports[i];
36a89ecb6aSYasuyuki Kozakai
37a89ecb6aSYasuyuki Kozakai if (minfo->pflags[i]) {
38a89ecb6aSYasuyuki Kozakai /* range port matching */
39a89ecb6aSYasuyuki Kozakai e = minfo->ports[++i];
40be91fd5eSJan Engelhardt pr_debug("src or dst matches with %d-%d?\n", s, e);
41a89ecb6aSYasuyuki Kozakai
42dd2602d0SGao Feng switch (minfo->flags) {
43dd2602d0SGao Feng case XT_MULTIPORT_SOURCE:
441ed9887eSGao Feng if (src >= s && src <= e)
451ed9887eSGao Feng return true ^ minfo->invert;
461ed9887eSGao Feng break;
47dd2602d0SGao Feng case XT_MULTIPORT_DESTINATION:
481ed9887eSGao Feng if (dst >= s && dst <= e)
491ed9887eSGao Feng return true ^ minfo->invert;
501ed9887eSGao Feng break;
51dd2602d0SGao Feng case XT_MULTIPORT_EITHER:
521ed9887eSGao Feng if ((dst >= s && dst <= e) ||
531ed9887eSGao Feng (src >= s && src <= e))
541ed9887eSGao Feng return true ^ minfo->invert;
551ed9887eSGao Feng break;
56dd2602d0SGao Feng default:
57dd2602d0SGao Feng break;
58dd2602d0SGao Feng }
59a89ecb6aSYasuyuki Kozakai } else {
60a89ecb6aSYasuyuki Kozakai /* exact port matching */
61be91fd5eSJan Engelhardt pr_debug("src or dst matches with %d?\n", s);
62a89ecb6aSYasuyuki Kozakai
63dd2602d0SGao Feng switch (minfo->flags) {
64dd2602d0SGao Feng case XT_MULTIPORT_SOURCE:
651ed9887eSGao Feng if (src == s)
661ed9887eSGao Feng return true ^ minfo->invert;
671ed9887eSGao Feng break;
68dd2602d0SGao Feng case XT_MULTIPORT_DESTINATION:
691ed9887eSGao Feng if (dst == s)
701ed9887eSGao Feng return true ^ minfo->invert;
711ed9887eSGao Feng break;
72dd2602d0SGao Feng case XT_MULTIPORT_EITHER:
731ed9887eSGao Feng if (src == s || dst == s)
741ed9887eSGao Feng return true ^ minfo->invert;
751ed9887eSGao Feng break;
76dd2602d0SGao Feng default:
77dd2602d0SGao Feng break;
78dd2602d0SGao Feng }
79a89ecb6aSYasuyuki Kozakai }
80a89ecb6aSYasuyuki Kozakai }
81a89ecb6aSYasuyuki Kozakai
82a89ecb6aSYasuyuki Kozakai return minfo->invert;
83a89ecb6aSYasuyuki Kozakai }
84a89ecb6aSYasuyuki Kozakai
851d93a9cbSJan Engelhardt static bool
multiport_mt(const struct sk_buff * skb,struct xt_action_param * par)8662fc8051SJan Engelhardt multiport_mt(const struct sk_buff *skb, struct xt_action_param *par)
87a89ecb6aSYasuyuki Kozakai {
883cf93c96SJan Engelhardt const __be16 *pptr;
893cf93c96SJan Engelhardt __be16 _ports[2];
90f7108a20SJan Engelhardt const struct xt_multiport_v1 *multiinfo = par->matchinfo;
91a89ecb6aSYasuyuki Kozakai
92f7108a20SJan Engelhardt if (par->fragoff != 0)
931d93a9cbSJan Engelhardt return false;
94a89ecb6aSYasuyuki Kozakai
95f7108a20SJan Engelhardt pptr = skb_header_pointer(skb, par->thoff, sizeof(_ports), _ports);
96a89ecb6aSYasuyuki Kozakai if (pptr == NULL) {
97a89ecb6aSYasuyuki Kozakai /* We've been asked to examine this packet, and we
98a89ecb6aSYasuyuki Kozakai * can't. Hence, no choice but to drop.
99a89ecb6aSYasuyuki Kozakai */
100be91fd5eSJan Engelhardt pr_debug("Dropping evil offset=0 tinygram.\n");
101b4ba2611SJan Engelhardt par->hotdrop = true;
1021d93a9cbSJan Engelhardt return false;
103a89ecb6aSYasuyuki Kozakai }
104a89ecb6aSYasuyuki Kozakai
105a89ecb6aSYasuyuki Kozakai return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1]));
106a89ecb6aSYasuyuki Kozakai }
107a89ecb6aSYasuyuki Kozakai
108ccb79bdcSJan Engelhardt static inline bool
check(u_int16_t proto,u_int8_t ip_invflags,u_int8_t match_flags,u_int8_t count)109a89ecb6aSYasuyuki Kozakai check(u_int16_t proto,
110a89ecb6aSYasuyuki Kozakai u_int8_t ip_invflags,
111a89ecb6aSYasuyuki Kozakai u_int8_t match_flags,
112a89ecb6aSYasuyuki Kozakai u_int8_t count)
113a89ecb6aSYasuyuki Kozakai {
114957dc80aSPatrick McHardy /* Must specify supported protocol, no unknown flags or bad count */
115957dc80aSPatrick McHardy return (proto == IPPROTO_TCP || proto == IPPROTO_UDP
116ba4e58ecSGerrit Renker || proto == IPPROTO_UDPLITE
117957dc80aSPatrick McHardy || proto == IPPROTO_SCTP || proto == IPPROTO_DCCP)
118a89ecb6aSYasuyuki Kozakai && !(ip_invflags & XT_INV_PROTO)
119a89ecb6aSYasuyuki Kozakai && (match_flags == XT_MULTIPORT_SOURCE
120a89ecb6aSYasuyuki Kozakai || match_flags == XT_MULTIPORT_DESTINATION
121a89ecb6aSYasuyuki Kozakai || match_flags == XT_MULTIPORT_EITHER)
122a89ecb6aSYasuyuki Kozakai && count <= XT_MULTI_PORTS;
123a89ecb6aSYasuyuki Kozakai }
124a89ecb6aSYasuyuki Kozakai
multiport_mt_check(const struct xt_mtchk_param * par)125b0f38452SJan Engelhardt static int multiport_mt_check(const struct xt_mtchk_param *par)
126a89ecb6aSYasuyuki Kozakai {
1279b4fce7aSJan Engelhardt const struct ipt_ip *ip = par->entryinfo;
1289b4fce7aSJan Engelhardt const struct xt_multiport_v1 *multiinfo = par->matchinfo;
129a89ecb6aSYasuyuki Kozakai
130a89ecb6aSYasuyuki Kozakai return check(ip->proto, ip->invflags, multiinfo->flags,
131c29c9492SJan Engelhardt multiinfo->count) ? 0 : -EINVAL;
132a89ecb6aSYasuyuki Kozakai }
133a89ecb6aSYasuyuki Kozakai
multiport_mt6_check(const struct xt_mtchk_param * par)134b0f38452SJan Engelhardt static int multiport_mt6_check(const struct xt_mtchk_param *par)
135a89ecb6aSYasuyuki Kozakai {
1369b4fce7aSJan Engelhardt const struct ip6t_ip6 *ip = par->entryinfo;
1379b4fce7aSJan Engelhardt const struct xt_multiport_v1 *multiinfo = par->matchinfo;
138a89ecb6aSYasuyuki Kozakai
139a89ecb6aSYasuyuki Kozakai return check(ip->proto, ip->invflags, multiinfo->flags,
140c29c9492SJan Engelhardt multiinfo->count) ? 0 : -EINVAL;
141a89ecb6aSYasuyuki Kozakai }
142a89ecb6aSYasuyuki Kozakai
143d3c5ee6dSJan Engelhardt static struct xt_match multiport_mt_reg[] __read_mostly = {
1444470bbc7SPatrick McHardy {
145a89ecb6aSYasuyuki Kozakai .name = "multiport",
146ee999d8bSJan Engelhardt .family = NFPROTO_IPV4,
147a89ecb6aSYasuyuki Kozakai .revision = 1,
148d3c5ee6dSJan Engelhardt .checkentry = multiport_mt_check,
149d3c5ee6dSJan Engelhardt .match = multiport_mt,
150a89ecb6aSYasuyuki Kozakai .matchsize = sizeof(struct xt_multiport_v1),
151a89ecb6aSYasuyuki Kozakai .me = THIS_MODULE,
1524470bbc7SPatrick McHardy },
1534470bbc7SPatrick McHardy {
1544470bbc7SPatrick McHardy .name = "multiport",
155ee999d8bSJan Engelhardt .family = NFPROTO_IPV6,
1564470bbc7SPatrick McHardy .revision = 1,
157d3c5ee6dSJan Engelhardt .checkentry = multiport_mt6_check,
158d3c5ee6dSJan Engelhardt .match = multiport_mt,
1594470bbc7SPatrick McHardy .matchsize = sizeof(struct xt_multiport_v1),
1604470bbc7SPatrick McHardy .me = THIS_MODULE,
1614470bbc7SPatrick McHardy },
162a89ecb6aSYasuyuki Kozakai };
163a89ecb6aSYasuyuki Kozakai
multiport_mt_init(void)164d3c5ee6dSJan Engelhardt static int __init multiport_mt_init(void)
165a89ecb6aSYasuyuki Kozakai {
166d3c5ee6dSJan Engelhardt return xt_register_matches(multiport_mt_reg,
167d3c5ee6dSJan Engelhardt ARRAY_SIZE(multiport_mt_reg));
168a89ecb6aSYasuyuki Kozakai }
169a89ecb6aSYasuyuki Kozakai
multiport_mt_exit(void)170d3c5ee6dSJan Engelhardt static void __exit multiport_mt_exit(void)
171a89ecb6aSYasuyuki Kozakai {
172d3c5ee6dSJan Engelhardt xt_unregister_matches(multiport_mt_reg, ARRAY_SIZE(multiport_mt_reg));
173a89ecb6aSYasuyuki Kozakai }
174a89ecb6aSYasuyuki Kozakai
175d3c5ee6dSJan Engelhardt module_init(multiport_mt_init);
176d3c5ee6dSJan Engelhardt module_exit(multiport_mt_exit);
177