1ba4e58ecSGerrit Renker /* Kernel module to match one of a list of TCP/UDP(-Lite)/SCTP/DCCP ports: 2ba4e58ecSGerrit Renker ports are in the same place so we can treat them as equal. */ 3a89ecb6aSYasuyuki Kozakai 4a89ecb6aSYasuyuki Kozakai /* (C) 1999-2001 Paul `Rusty' Russell 5a89ecb6aSYasuyuki Kozakai * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> 6a89ecb6aSYasuyuki Kozakai * 7a89ecb6aSYasuyuki Kozakai * This program is free software; you can redistribute it and/or modify 8a89ecb6aSYasuyuki Kozakai * it under the terms of the GNU General Public License version 2 as 9a89ecb6aSYasuyuki Kozakai * published by the Free Software Foundation. 10a89ecb6aSYasuyuki Kozakai */ 11be91fd5eSJan Engelhardt #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 12a89ecb6aSYasuyuki Kozakai #include <linux/module.h> 13a89ecb6aSYasuyuki Kozakai #include <linux/types.h> 14a89ecb6aSYasuyuki Kozakai #include <linux/udp.h> 15a89ecb6aSYasuyuki Kozakai #include <linux/skbuff.h> 16a89ecb6aSYasuyuki Kozakai #include <linux/in.h> 17a89ecb6aSYasuyuki Kozakai 18a89ecb6aSYasuyuki Kozakai #include <linux/netfilter/xt_multiport.h> 19a89ecb6aSYasuyuki Kozakai #include <linux/netfilter/x_tables.h> 20a89ecb6aSYasuyuki Kozakai #include <linux/netfilter_ipv4/ip_tables.h> 21a89ecb6aSYasuyuki Kozakai #include <linux/netfilter_ipv6/ip6_tables.h> 22a89ecb6aSYasuyuki Kozakai 23a89ecb6aSYasuyuki Kozakai MODULE_LICENSE("GPL"); 24a89ecb6aSYasuyuki Kozakai MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); 252ae15b64SJan Engelhardt MODULE_DESCRIPTION("Xtables: multiple port matching for TCP, UDP, UDP-Lite, SCTP and DCCP"); 26a89ecb6aSYasuyuki Kozakai MODULE_ALIAS("ipt_multiport"); 27a89ecb6aSYasuyuki Kozakai MODULE_ALIAS("ip6t_multiport"); 28a89ecb6aSYasuyuki Kozakai 29a89ecb6aSYasuyuki Kozakai /* Returns 1 if the port is matched by the test, 0 otherwise. */ 301d93a9cbSJan Engelhardt static inline bool 31d3c5ee6dSJan Engelhardt ports_match_v0(const u_int16_t *portlist, enum xt_multiport_flags flags, 32a89ecb6aSYasuyuki Kozakai u_int8_t count, u_int16_t src, u_int16_t dst) 33a89ecb6aSYasuyuki Kozakai { 34a89ecb6aSYasuyuki Kozakai unsigned int i; 35a89ecb6aSYasuyuki Kozakai for (i = 0; i < count; i++) { 36a89ecb6aSYasuyuki Kozakai if (flags != XT_MULTIPORT_DESTINATION && portlist[i] == src) 371d93a9cbSJan Engelhardt return true; 38a89ecb6aSYasuyuki Kozakai 39a89ecb6aSYasuyuki Kozakai if (flags != XT_MULTIPORT_SOURCE && portlist[i] == dst) 401d93a9cbSJan Engelhardt return true; 41a89ecb6aSYasuyuki Kozakai } 42a89ecb6aSYasuyuki Kozakai 431d93a9cbSJan Engelhardt return false; 44a89ecb6aSYasuyuki Kozakai } 45a89ecb6aSYasuyuki Kozakai 46a89ecb6aSYasuyuki Kozakai /* Returns 1 if the port is matched by the test, 0 otherwise. */ 471d93a9cbSJan Engelhardt static inline bool 48a89ecb6aSYasuyuki Kozakai ports_match_v1(const struct xt_multiport_v1 *minfo, 49a89ecb6aSYasuyuki Kozakai u_int16_t src, u_int16_t dst) 50a89ecb6aSYasuyuki Kozakai { 51a89ecb6aSYasuyuki Kozakai unsigned int i; 52a89ecb6aSYasuyuki Kozakai u_int16_t s, e; 53a89ecb6aSYasuyuki Kozakai 54a89ecb6aSYasuyuki Kozakai for (i = 0; i < minfo->count; i++) { 55a89ecb6aSYasuyuki Kozakai s = minfo->ports[i]; 56a89ecb6aSYasuyuki Kozakai 57a89ecb6aSYasuyuki Kozakai if (minfo->pflags[i]) { 58a89ecb6aSYasuyuki Kozakai /* range port matching */ 59a89ecb6aSYasuyuki Kozakai e = minfo->ports[++i]; 60be91fd5eSJan Engelhardt pr_debug("src or dst matches with %d-%d?\n", s, e); 61a89ecb6aSYasuyuki Kozakai 62a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_SOURCE 63a89ecb6aSYasuyuki Kozakai && src >= s && src <= e) 641d93a9cbSJan Engelhardt return true ^ minfo->invert; 65a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_DESTINATION 66a89ecb6aSYasuyuki Kozakai && dst >= s && dst <= e) 671d93a9cbSJan Engelhardt return true ^ minfo->invert; 68a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_EITHER 69a89ecb6aSYasuyuki Kozakai && ((dst >= s && dst <= e) 70a89ecb6aSYasuyuki Kozakai || (src >= s && src <= e))) 711d93a9cbSJan Engelhardt return true ^ minfo->invert; 72a89ecb6aSYasuyuki Kozakai } else { 73a89ecb6aSYasuyuki Kozakai /* exact port matching */ 74be91fd5eSJan Engelhardt pr_debug("src or dst matches with %d?\n", s); 75a89ecb6aSYasuyuki Kozakai 76a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_SOURCE 77a89ecb6aSYasuyuki Kozakai && src == s) 781d93a9cbSJan Engelhardt return true ^ minfo->invert; 79a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_DESTINATION 80a89ecb6aSYasuyuki Kozakai && dst == s) 811d93a9cbSJan Engelhardt return true ^ minfo->invert; 82a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_EITHER 83a89ecb6aSYasuyuki Kozakai && (src == s || dst == s)) 841d93a9cbSJan Engelhardt return true ^ minfo->invert; 85a89ecb6aSYasuyuki Kozakai } 86a89ecb6aSYasuyuki Kozakai } 87a89ecb6aSYasuyuki Kozakai 88a89ecb6aSYasuyuki Kozakai return minfo->invert; 89a89ecb6aSYasuyuki Kozakai } 90a89ecb6aSYasuyuki Kozakai 911d93a9cbSJan Engelhardt static bool 92f7108a20SJan Engelhardt multiport_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par) 93a89ecb6aSYasuyuki Kozakai { 943cf93c96SJan Engelhardt const __be16 *pptr; 953cf93c96SJan Engelhardt __be16 _ports[2]; 96f7108a20SJan Engelhardt const struct xt_multiport *multiinfo = par->matchinfo; 97a89ecb6aSYasuyuki Kozakai 98f7108a20SJan Engelhardt if (par->fragoff != 0) 991d93a9cbSJan Engelhardt return false; 100a89ecb6aSYasuyuki Kozakai 101f7108a20SJan Engelhardt pptr = skb_header_pointer(skb, par->thoff, sizeof(_ports), _ports); 102a89ecb6aSYasuyuki Kozakai if (pptr == NULL) { 103a89ecb6aSYasuyuki Kozakai /* We've been asked to examine this packet, and we 104a89ecb6aSYasuyuki Kozakai * can't. Hence, no choice but to drop. 105a89ecb6aSYasuyuki Kozakai */ 106be91fd5eSJan Engelhardt pr_debug("Dropping evil offset=0 tinygram.\n"); 107f7108a20SJan Engelhardt *par->hotdrop = true; 1081d93a9cbSJan Engelhardt return false; 109a89ecb6aSYasuyuki Kozakai } 110a89ecb6aSYasuyuki Kozakai 111d3c5ee6dSJan Engelhardt return ports_match_v0(multiinfo->ports, multiinfo->flags, 112d3c5ee6dSJan Engelhardt multiinfo->count, ntohs(pptr[0]), ntohs(pptr[1])); 113a89ecb6aSYasuyuki Kozakai } 114a89ecb6aSYasuyuki Kozakai 1151d93a9cbSJan Engelhardt static bool 116f7108a20SJan Engelhardt multiport_mt(const struct sk_buff *skb, const struct xt_match_param *par) 117a89ecb6aSYasuyuki Kozakai { 1183cf93c96SJan Engelhardt const __be16 *pptr; 1193cf93c96SJan Engelhardt __be16 _ports[2]; 120f7108a20SJan Engelhardt const struct xt_multiport_v1 *multiinfo = par->matchinfo; 121a89ecb6aSYasuyuki Kozakai 122f7108a20SJan Engelhardt if (par->fragoff != 0) 1231d93a9cbSJan Engelhardt return false; 124a89ecb6aSYasuyuki Kozakai 125f7108a20SJan Engelhardt pptr = skb_header_pointer(skb, par->thoff, sizeof(_ports), _ports); 126a89ecb6aSYasuyuki Kozakai if (pptr == NULL) { 127a89ecb6aSYasuyuki Kozakai /* We've been asked to examine this packet, and we 128a89ecb6aSYasuyuki Kozakai * can't. Hence, no choice but to drop. 129a89ecb6aSYasuyuki Kozakai */ 130be91fd5eSJan Engelhardt pr_debug("Dropping evil offset=0 tinygram.\n"); 131f7108a20SJan Engelhardt *par->hotdrop = true; 1321d93a9cbSJan Engelhardt return false; 133a89ecb6aSYasuyuki Kozakai } 134a89ecb6aSYasuyuki Kozakai 135a89ecb6aSYasuyuki Kozakai return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1])); 136a89ecb6aSYasuyuki Kozakai } 137a89ecb6aSYasuyuki Kozakai 138ccb79bdcSJan Engelhardt static inline bool 139a89ecb6aSYasuyuki Kozakai check(u_int16_t proto, 140a89ecb6aSYasuyuki Kozakai u_int8_t ip_invflags, 141a89ecb6aSYasuyuki Kozakai u_int8_t match_flags, 142a89ecb6aSYasuyuki Kozakai u_int8_t count) 143a89ecb6aSYasuyuki Kozakai { 144957dc80aSPatrick McHardy /* Must specify supported protocol, no unknown flags or bad count */ 145957dc80aSPatrick McHardy return (proto == IPPROTO_TCP || proto == IPPROTO_UDP 146ba4e58ecSGerrit Renker || proto == IPPROTO_UDPLITE 147957dc80aSPatrick McHardy || proto == IPPROTO_SCTP || proto == IPPROTO_DCCP) 148a89ecb6aSYasuyuki Kozakai && !(ip_invflags & XT_INV_PROTO) 149a89ecb6aSYasuyuki Kozakai && (match_flags == XT_MULTIPORT_SOURCE 150a89ecb6aSYasuyuki Kozakai || match_flags == XT_MULTIPORT_DESTINATION 151a89ecb6aSYasuyuki Kozakai || match_flags == XT_MULTIPORT_EITHER) 152a89ecb6aSYasuyuki Kozakai && count <= XT_MULTI_PORTS; 153a89ecb6aSYasuyuki Kozakai } 154a89ecb6aSYasuyuki Kozakai 155b0f38452SJan Engelhardt static int multiport_mt_check_v0(const struct xt_mtchk_param *par) 156a89ecb6aSYasuyuki Kozakai { 1579b4fce7aSJan Engelhardt const struct ipt_ip *ip = par->entryinfo; 1589b4fce7aSJan Engelhardt const struct xt_multiport *multiinfo = par->matchinfo; 159a89ecb6aSYasuyuki Kozakai 160a89ecb6aSYasuyuki Kozakai return check(ip->proto, ip->invflags, multiinfo->flags, 161a89ecb6aSYasuyuki Kozakai multiinfo->count); 162a89ecb6aSYasuyuki Kozakai } 163a89ecb6aSYasuyuki Kozakai 164b0f38452SJan Engelhardt static int multiport_mt_check(const struct xt_mtchk_param *par) 165a89ecb6aSYasuyuki Kozakai { 1669b4fce7aSJan Engelhardt const struct ipt_ip *ip = par->entryinfo; 1679b4fce7aSJan Engelhardt const struct xt_multiport_v1 *multiinfo = par->matchinfo; 168a89ecb6aSYasuyuki Kozakai 169a89ecb6aSYasuyuki Kozakai return check(ip->proto, ip->invflags, multiinfo->flags, 170a89ecb6aSYasuyuki Kozakai multiinfo->count); 171a89ecb6aSYasuyuki Kozakai } 172a89ecb6aSYasuyuki Kozakai 173b0f38452SJan Engelhardt static int multiport_mt6_check_v0(const struct xt_mtchk_param *par) 174a89ecb6aSYasuyuki Kozakai { 1759b4fce7aSJan Engelhardt const struct ip6t_ip6 *ip = par->entryinfo; 1769b4fce7aSJan Engelhardt const struct xt_multiport *multiinfo = par->matchinfo; 177a89ecb6aSYasuyuki Kozakai 178a89ecb6aSYasuyuki Kozakai return check(ip->proto, ip->invflags, multiinfo->flags, 179a89ecb6aSYasuyuki Kozakai multiinfo->count); 180a89ecb6aSYasuyuki Kozakai } 181a89ecb6aSYasuyuki Kozakai 182b0f38452SJan Engelhardt static int multiport_mt6_check(const struct xt_mtchk_param *par) 183a89ecb6aSYasuyuki Kozakai { 1849b4fce7aSJan Engelhardt const struct ip6t_ip6 *ip = par->entryinfo; 1859b4fce7aSJan Engelhardt const struct xt_multiport_v1 *multiinfo = par->matchinfo; 186a89ecb6aSYasuyuki Kozakai 187a89ecb6aSYasuyuki Kozakai return check(ip->proto, ip->invflags, multiinfo->flags, 188a89ecb6aSYasuyuki Kozakai multiinfo->count); 189a89ecb6aSYasuyuki Kozakai } 190a89ecb6aSYasuyuki Kozakai 191d3c5ee6dSJan Engelhardt static struct xt_match multiport_mt_reg[] __read_mostly = { 1924470bbc7SPatrick McHardy { 193a89ecb6aSYasuyuki Kozakai .name = "multiport", 194ee999d8bSJan Engelhardt .family = NFPROTO_IPV4, 195a89ecb6aSYasuyuki Kozakai .revision = 0, 196d3c5ee6dSJan Engelhardt .checkentry = multiport_mt_check_v0, 197d3c5ee6dSJan Engelhardt .match = multiport_mt_v0, 198a89ecb6aSYasuyuki Kozakai .matchsize = sizeof(struct xt_multiport), 199a89ecb6aSYasuyuki Kozakai .me = THIS_MODULE, 2004470bbc7SPatrick McHardy }, 2014470bbc7SPatrick McHardy { 202a89ecb6aSYasuyuki Kozakai .name = "multiport", 203ee999d8bSJan Engelhardt .family = NFPROTO_IPV4, 204a89ecb6aSYasuyuki Kozakai .revision = 1, 205d3c5ee6dSJan Engelhardt .checkentry = multiport_mt_check, 206d3c5ee6dSJan Engelhardt .match = multiport_mt, 207a89ecb6aSYasuyuki Kozakai .matchsize = sizeof(struct xt_multiport_v1), 208a89ecb6aSYasuyuki Kozakai .me = THIS_MODULE, 2094470bbc7SPatrick McHardy }, 2104470bbc7SPatrick McHardy { 2114470bbc7SPatrick McHardy .name = "multiport", 212ee999d8bSJan Engelhardt .family = NFPROTO_IPV6, 2134470bbc7SPatrick McHardy .revision = 0, 214d3c5ee6dSJan Engelhardt .checkentry = multiport_mt6_check_v0, 215d3c5ee6dSJan Engelhardt .match = multiport_mt_v0, 2164470bbc7SPatrick McHardy .matchsize = sizeof(struct xt_multiport), 2174470bbc7SPatrick McHardy .me = THIS_MODULE, 2184470bbc7SPatrick McHardy }, 2194470bbc7SPatrick McHardy { 2204470bbc7SPatrick McHardy .name = "multiport", 221ee999d8bSJan Engelhardt .family = NFPROTO_IPV6, 2224470bbc7SPatrick McHardy .revision = 1, 223d3c5ee6dSJan Engelhardt .checkentry = multiport_mt6_check, 224d3c5ee6dSJan Engelhardt .match = multiport_mt, 2254470bbc7SPatrick McHardy .matchsize = sizeof(struct xt_multiport_v1), 2264470bbc7SPatrick McHardy .me = THIS_MODULE, 2274470bbc7SPatrick McHardy }, 228a89ecb6aSYasuyuki Kozakai }; 229a89ecb6aSYasuyuki Kozakai 230d3c5ee6dSJan Engelhardt static int __init multiport_mt_init(void) 231a89ecb6aSYasuyuki Kozakai { 232d3c5ee6dSJan Engelhardt return xt_register_matches(multiport_mt_reg, 233d3c5ee6dSJan Engelhardt ARRAY_SIZE(multiport_mt_reg)); 234a89ecb6aSYasuyuki Kozakai } 235a89ecb6aSYasuyuki Kozakai 236d3c5ee6dSJan Engelhardt static void __exit multiport_mt_exit(void) 237a89ecb6aSYasuyuki Kozakai { 238d3c5ee6dSJan Engelhardt xt_unregister_matches(multiport_mt_reg, ARRAY_SIZE(multiport_mt_reg)); 239a89ecb6aSYasuyuki Kozakai } 240a89ecb6aSYasuyuki Kozakai 241d3c5ee6dSJan Engelhardt module_init(multiport_mt_init); 242d3c5ee6dSJan Engelhardt module_exit(multiport_mt_exit); 243