1ba4e58ecSGerrit Renker /* Kernel module to match one of a list of TCP/UDP(-Lite)/SCTP/DCCP ports: 2ba4e58ecSGerrit Renker ports are in the same place so we can treat them as equal. */ 3a89ecb6aSYasuyuki Kozakai 4a89ecb6aSYasuyuki Kozakai /* (C) 1999-2001 Paul `Rusty' Russell 5a89ecb6aSYasuyuki Kozakai * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> 6a89ecb6aSYasuyuki Kozakai * 7a89ecb6aSYasuyuki Kozakai * This program is free software; you can redistribute it and/or modify 8a89ecb6aSYasuyuki Kozakai * it under the terms of the GNU General Public License version 2 as 9a89ecb6aSYasuyuki Kozakai * published by the Free Software Foundation. 10a89ecb6aSYasuyuki Kozakai */ 11a89ecb6aSYasuyuki Kozakai 12a89ecb6aSYasuyuki Kozakai #include <linux/module.h> 13a89ecb6aSYasuyuki Kozakai #include <linux/types.h> 14a89ecb6aSYasuyuki Kozakai #include <linux/udp.h> 15a89ecb6aSYasuyuki Kozakai #include <linux/skbuff.h> 16a89ecb6aSYasuyuki Kozakai #include <linux/in.h> 17a89ecb6aSYasuyuki Kozakai 18a89ecb6aSYasuyuki Kozakai #include <linux/netfilter/xt_multiport.h> 19a89ecb6aSYasuyuki Kozakai #include <linux/netfilter/x_tables.h> 20a89ecb6aSYasuyuki Kozakai #include <linux/netfilter_ipv4/ip_tables.h> 21a89ecb6aSYasuyuki Kozakai #include <linux/netfilter_ipv6/ip6_tables.h> 22a89ecb6aSYasuyuki Kozakai 23a89ecb6aSYasuyuki Kozakai MODULE_LICENSE("GPL"); 24a89ecb6aSYasuyuki Kozakai MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); 252ae15b64SJan Engelhardt MODULE_DESCRIPTION("Xtables: multiple port matching for TCP, UDP, UDP-Lite, SCTP and DCCP"); 26a89ecb6aSYasuyuki Kozakai MODULE_ALIAS("ipt_multiport"); 27a89ecb6aSYasuyuki Kozakai MODULE_ALIAS("ip6t_multiport"); 28a89ecb6aSYasuyuki Kozakai 29a89ecb6aSYasuyuki Kozakai #if 0 30a89ecb6aSYasuyuki Kozakai #define duprintf(format, args...) printk(format , ## args) 31a89ecb6aSYasuyuki Kozakai #else 32a89ecb6aSYasuyuki Kozakai #define duprintf(format, args...) 33a89ecb6aSYasuyuki Kozakai #endif 34a89ecb6aSYasuyuki Kozakai 35a89ecb6aSYasuyuki Kozakai /* Returns 1 if the port is matched by the test, 0 otherwise. */ 361d93a9cbSJan Engelhardt static inline bool 37d3c5ee6dSJan Engelhardt ports_match_v0(const u_int16_t *portlist, enum xt_multiport_flags flags, 38a89ecb6aSYasuyuki Kozakai u_int8_t count, u_int16_t src, u_int16_t dst) 39a89ecb6aSYasuyuki Kozakai { 40a89ecb6aSYasuyuki Kozakai unsigned int i; 41a89ecb6aSYasuyuki Kozakai for (i = 0; i < count; i++) { 42a89ecb6aSYasuyuki Kozakai if (flags != XT_MULTIPORT_DESTINATION && portlist[i] == src) 431d93a9cbSJan Engelhardt return true; 44a89ecb6aSYasuyuki Kozakai 45a89ecb6aSYasuyuki Kozakai if (flags != XT_MULTIPORT_SOURCE && portlist[i] == dst) 461d93a9cbSJan Engelhardt return true; 47a89ecb6aSYasuyuki Kozakai } 48a89ecb6aSYasuyuki Kozakai 491d93a9cbSJan Engelhardt return false; 50a89ecb6aSYasuyuki Kozakai } 51a89ecb6aSYasuyuki Kozakai 52a89ecb6aSYasuyuki Kozakai /* Returns 1 if the port is matched by the test, 0 otherwise. */ 531d93a9cbSJan Engelhardt static inline bool 54a89ecb6aSYasuyuki Kozakai ports_match_v1(const struct xt_multiport_v1 *minfo, 55a89ecb6aSYasuyuki Kozakai u_int16_t src, u_int16_t dst) 56a89ecb6aSYasuyuki Kozakai { 57a89ecb6aSYasuyuki Kozakai unsigned int i; 58a89ecb6aSYasuyuki Kozakai u_int16_t s, e; 59a89ecb6aSYasuyuki Kozakai 60a89ecb6aSYasuyuki Kozakai for (i = 0; i < minfo->count; i++) { 61a89ecb6aSYasuyuki Kozakai s = minfo->ports[i]; 62a89ecb6aSYasuyuki Kozakai 63a89ecb6aSYasuyuki Kozakai if (minfo->pflags[i]) { 64a89ecb6aSYasuyuki Kozakai /* range port matching */ 65a89ecb6aSYasuyuki Kozakai e = minfo->ports[++i]; 66a89ecb6aSYasuyuki Kozakai duprintf("src or dst matches with %d-%d?\n", s, e); 67a89ecb6aSYasuyuki Kozakai 68a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_SOURCE 69a89ecb6aSYasuyuki Kozakai && src >= s && src <= e) 701d93a9cbSJan Engelhardt return true ^ minfo->invert; 71a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_DESTINATION 72a89ecb6aSYasuyuki Kozakai && dst >= s && dst <= e) 731d93a9cbSJan Engelhardt return true ^ minfo->invert; 74a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_EITHER 75a89ecb6aSYasuyuki Kozakai && ((dst >= s && dst <= e) 76a89ecb6aSYasuyuki Kozakai || (src >= s && src <= e))) 771d93a9cbSJan Engelhardt return true ^ minfo->invert; 78a89ecb6aSYasuyuki Kozakai } else { 79a89ecb6aSYasuyuki Kozakai /* exact port matching */ 80a89ecb6aSYasuyuki Kozakai duprintf("src or dst matches with %d?\n", s); 81a89ecb6aSYasuyuki Kozakai 82a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_SOURCE 83a89ecb6aSYasuyuki Kozakai && src == s) 841d93a9cbSJan Engelhardt return true ^ minfo->invert; 85a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_DESTINATION 86a89ecb6aSYasuyuki Kozakai && dst == s) 871d93a9cbSJan Engelhardt return true ^ minfo->invert; 88a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_EITHER 89a89ecb6aSYasuyuki Kozakai && (src == s || dst == s)) 901d93a9cbSJan Engelhardt return true ^ minfo->invert; 91a89ecb6aSYasuyuki Kozakai } 92a89ecb6aSYasuyuki Kozakai } 93a89ecb6aSYasuyuki Kozakai 94a89ecb6aSYasuyuki Kozakai return minfo->invert; 95a89ecb6aSYasuyuki Kozakai } 96a89ecb6aSYasuyuki Kozakai 971d93a9cbSJan Engelhardt static bool 98f7108a20SJan Engelhardt multiport_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par) 99a89ecb6aSYasuyuki Kozakai { 1003cf93c96SJan Engelhardt const __be16 *pptr; 1013cf93c96SJan Engelhardt __be16 _ports[2]; 102f7108a20SJan Engelhardt const struct xt_multiport *multiinfo = par->matchinfo; 103a89ecb6aSYasuyuki Kozakai 104f7108a20SJan Engelhardt if (par->fragoff != 0) 1051d93a9cbSJan Engelhardt return false; 106a89ecb6aSYasuyuki Kozakai 107f7108a20SJan Engelhardt pptr = skb_header_pointer(skb, par->thoff, sizeof(_ports), _ports); 108a89ecb6aSYasuyuki Kozakai if (pptr == NULL) { 109a89ecb6aSYasuyuki Kozakai /* We've been asked to examine this packet, and we 110a89ecb6aSYasuyuki Kozakai * can't. Hence, no choice but to drop. 111a89ecb6aSYasuyuki Kozakai */ 112a89ecb6aSYasuyuki Kozakai duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n"); 113f7108a20SJan Engelhardt *par->hotdrop = true; 1141d93a9cbSJan Engelhardt return false; 115a89ecb6aSYasuyuki Kozakai } 116a89ecb6aSYasuyuki Kozakai 117d3c5ee6dSJan Engelhardt return ports_match_v0(multiinfo->ports, multiinfo->flags, 118d3c5ee6dSJan Engelhardt multiinfo->count, ntohs(pptr[0]), ntohs(pptr[1])); 119a89ecb6aSYasuyuki Kozakai } 120a89ecb6aSYasuyuki Kozakai 1211d93a9cbSJan Engelhardt static bool 122f7108a20SJan Engelhardt multiport_mt(const struct sk_buff *skb, const struct xt_match_param *par) 123a89ecb6aSYasuyuki Kozakai { 1243cf93c96SJan Engelhardt const __be16 *pptr; 1253cf93c96SJan Engelhardt __be16 _ports[2]; 126f7108a20SJan Engelhardt const struct xt_multiport_v1 *multiinfo = par->matchinfo; 127a89ecb6aSYasuyuki Kozakai 128f7108a20SJan Engelhardt if (par->fragoff != 0) 1291d93a9cbSJan Engelhardt return false; 130a89ecb6aSYasuyuki Kozakai 131f7108a20SJan Engelhardt pptr = skb_header_pointer(skb, par->thoff, sizeof(_ports), _ports); 132a89ecb6aSYasuyuki Kozakai if (pptr == NULL) { 133a89ecb6aSYasuyuki Kozakai /* We've been asked to examine this packet, and we 134a89ecb6aSYasuyuki Kozakai * can't. Hence, no choice but to drop. 135a89ecb6aSYasuyuki Kozakai */ 136a89ecb6aSYasuyuki Kozakai duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n"); 137f7108a20SJan Engelhardt *par->hotdrop = true; 1381d93a9cbSJan Engelhardt return false; 139a89ecb6aSYasuyuki Kozakai } 140a89ecb6aSYasuyuki Kozakai 141a89ecb6aSYasuyuki Kozakai return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1])); 142a89ecb6aSYasuyuki Kozakai } 143a89ecb6aSYasuyuki Kozakai 144ccb79bdcSJan Engelhardt static inline bool 145a89ecb6aSYasuyuki Kozakai check(u_int16_t proto, 146a89ecb6aSYasuyuki Kozakai u_int8_t ip_invflags, 147a89ecb6aSYasuyuki Kozakai u_int8_t match_flags, 148a89ecb6aSYasuyuki Kozakai u_int8_t count) 149a89ecb6aSYasuyuki Kozakai { 150957dc80aSPatrick McHardy /* Must specify supported protocol, no unknown flags or bad count */ 151957dc80aSPatrick McHardy return (proto == IPPROTO_TCP || proto == IPPROTO_UDP 152ba4e58ecSGerrit Renker || proto == IPPROTO_UDPLITE 153957dc80aSPatrick McHardy || proto == IPPROTO_SCTP || proto == IPPROTO_DCCP) 154a89ecb6aSYasuyuki Kozakai && !(ip_invflags & XT_INV_PROTO) 155a89ecb6aSYasuyuki Kozakai && (match_flags == XT_MULTIPORT_SOURCE 156a89ecb6aSYasuyuki Kozakai || match_flags == XT_MULTIPORT_DESTINATION 157a89ecb6aSYasuyuki Kozakai || match_flags == XT_MULTIPORT_EITHER) 158a89ecb6aSYasuyuki Kozakai && count <= XT_MULTI_PORTS; 159a89ecb6aSYasuyuki Kozakai } 160a89ecb6aSYasuyuki Kozakai 1619b4fce7aSJan Engelhardt static bool multiport_mt_check_v0(const struct xt_mtchk_param *par) 162a89ecb6aSYasuyuki Kozakai { 1639b4fce7aSJan Engelhardt const struct ipt_ip *ip = par->entryinfo; 1649b4fce7aSJan Engelhardt const struct xt_multiport *multiinfo = par->matchinfo; 165a89ecb6aSYasuyuki Kozakai 166a89ecb6aSYasuyuki Kozakai return check(ip->proto, ip->invflags, multiinfo->flags, 167a89ecb6aSYasuyuki Kozakai multiinfo->count); 168a89ecb6aSYasuyuki Kozakai } 169a89ecb6aSYasuyuki Kozakai 1709b4fce7aSJan Engelhardt static bool multiport_mt_check(const struct xt_mtchk_param *par) 171a89ecb6aSYasuyuki Kozakai { 1729b4fce7aSJan Engelhardt const struct ipt_ip *ip = par->entryinfo; 1739b4fce7aSJan Engelhardt const struct xt_multiport_v1 *multiinfo = par->matchinfo; 174a89ecb6aSYasuyuki Kozakai 175a89ecb6aSYasuyuki Kozakai return check(ip->proto, ip->invflags, multiinfo->flags, 176a89ecb6aSYasuyuki Kozakai multiinfo->count); 177a89ecb6aSYasuyuki Kozakai } 178a89ecb6aSYasuyuki Kozakai 1799b4fce7aSJan Engelhardt static bool multiport_mt6_check_v0(const struct xt_mtchk_param *par) 180a89ecb6aSYasuyuki Kozakai { 1819b4fce7aSJan Engelhardt const struct ip6t_ip6 *ip = par->entryinfo; 1829b4fce7aSJan Engelhardt const struct xt_multiport *multiinfo = par->matchinfo; 183a89ecb6aSYasuyuki Kozakai 184a89ecb6aSYasuyuki Kozakai return check(ip->proto, ip->invflags, multiinfo->flags, 185a89ecb6aSYasuyuki Kozakai multiinfo->count); 186a89ecb6aSYasuyuki Kozakai } 187a89ecb6aSYasuyuki Kozakai 1889b4fce7aSJan Engelhardt static bool multiport_mt6_check(const struct xt_mtchk_param *par) 189a89ecb6aSYasuyuki Kozakai { 1909b4fce7aSJan Engelhardt const struct ip6t_ip6 *ip = par->entryinfo; 1919b4fce7aSJan Engelhardt const struct xt_multiport_v1 *multiinfo = par->matchinfo; 192a89ecb6aSYasuyuki Kozakai 193a89ecb6aSYasuyuki Kozakai return check(ip->proto, ip->invflags, multiinfo->flags, 194a89ecb6aSYasuyuki Kozakai multiinfo->count); 195a89ecb6aSYasuyuki Kozakai } 196a89ecb6aSYasuyuki Kozakai 197d3c5ee6dSJan Engelhardt static struct xt_match multiport_mt_reg[] __read_mostly = { 1984470bbc7SPatrick McHardy { 199a89ecb6aSYasuyuki Kozakai .name = "multiport", 200ee999d8bSJan Engelhardt .family = NFPROTO_IPV4, 201a89ecb6aSYasuyuki Kozakai .revision = 0, 202d3c5ee6dSJan Engelhardt .checkentry = multiport_mt_check_v0, 203d3c5ee6dSJan Engelhardt .match = multiport_mt_v0, 204a89ecb6aSYasuyuki Kozakai .matchsize = sizeof(struct xt_multiport), 205a89ecb6aSYasuyuki Kozakai .me = THIS_MODULE, 2064470bbc7SPatrick McHardy }, 2074470bbc7SPatrick McHardy { 208a89ecb6aSYasuyuki Kozakai .name = "multiport", 209ee999d8bSJan Engelhardt .family = NFPROTO_IPV4, 210a89ecb6aSYasuyuki Kozakai .revision = 1, 211d3c5ee6dSJan Engelhardt .checkentry = multiport_mt_check, 212d3c5ee6dSJan Engelhardt .match = multiport_mt, 213a89ecb6aSYasuyuki Kozakai .matchsize = sizeof(struct xt_multiport_v1), 214a89ecb6aSYasuyuki Kozakai .me = THIS_MODULE, 2154470bbc7SPatrick McHardy }, 2164470bbc7SPatrick McHardy { 2174470bbc7SPatrick McHardy .name = "multiport", 218ee999d8bSJan Engelhardt .family = NFPROTO_IPV6, 2194470bbc7SPatrick McHardy .revision = 0, 220d3c5ee6dSJan Engelhardt .checkentry = multiport_mt6_check_v0, 221d3c5ee6dSJan Engelhardt .match = multiport_mt_v0, 2224470bbc7SPatrick McHardy .matchsize = sizeof(struct xt_multiport), 2234470bbc7SPatrick McHardy .me = THIS_MODULE, 2244470bbc7SPatrick McHardy }, 2254470bbc7SPatrick McHardy { 2264470bbc7SPatrick McHardy .name = "multiport", 227ee999d8bSJan Engelhardt .family = NFPROTO_IPV6, 2284470bbc7SPatrick McHardy .revision = 1, 229d3c5ee6dSJan Engelhardt .checkentry = multiport_mt6_check, 230d3c5ee6dSJan Engelhardt .match = multiport_mt, 2314470bbc7SPatrick McHardy .matchsize = sizeof(struct xt_multiport_v1), 2324470bbc7SPatrick McHardy .me = THIS_MODULE, 2334470bbc7SPatrick McHardy }, 234a89ecb6aSYasuyuki Kozakai }; 235a89ecb6aSYasuyuki Kozakai 236d3c5ee6dSJan Engelhardt static int __init multiport_mt_init(void) 237a89ecb6aSYasuyuki Kozakai { 238d3c5ee6dSJan Engelhardt return xt_register_matches(multiport_mt_reg, 239d3c5ee6dSJan Engelhardt ARRAY_SIZE(multiport_mt_reg)); 240a89ecb6aSYasuyuki Kozakai } 241a89ecb6aSYasuyuki Kozakai 242d3c5ee6dSJan Engelhardt static void __exit multiport_mt_exit(void) 243a89ecb6aSYasuyuki Kozakai { 244d3c5ee6dSJan Engelhardt xt_unregister_matches(multiport_mt_reg, ARRAY_SIZE(multiport_mt_reg)); 245a89ecb6aSYasuyuki Kozakai } 246a89ecb6aSYasuyuki Kozakai 247d3c5ee6dSJan Engelhardt module_init(multiport_mt_init); 248d3c5ee6dSJan Engelhardt module_exit(multiport_mt_exit); 249