1ba4e58ecSGerrit Renker /* Kernel module to match one of a list of TCP/UDP(-Lite)/SCTP/DCCP ports: 2ba4e58ecSGerrit Renker ports are in the same place so we can treat them as equal. */ 3a89ecb6aSYasuyuki Kozakai 4a89ecb6aSYasuyuki Kozakai /* (C) 1999-2001 Paul `Rusty' Russell 5a89ecb6aSYasuyuki Kozakai * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> 6a89ecb6aSYasuyuki Kozakai * 7a89ecb6aSYasuyuki Kozakai * This program is free software; you can redistribute it and/or modify 8a89ecb6aSYasuyuki Kozakai * it under the terms of the GNU General Public License version 2 as 9a89ecb6aSYasuyuki Kozakai * published by the Free Software Foundation. 10a89ecb6aSYasuyuki Kozakai */ 11be91fd5eSJan Engelhardt #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 12a89ecb6aSYasuyuki Kozakai #include <linux/module.h> 13a89ecb6aSYasuyuki Kozakai #include <linux/types.h> 14a89ecb6aSYasuyuki Kozakai #include <linux/udp.h> 15a89ecb6aSYasuyuki Kozakai #include <linux/skbuff.h> 16a89ecb6aSYasuyuki Kozakai #include <linux/in.h> 17a89ecb6aSYasuyuki Kozakai 18a89ecb6aSYasuyuki Kozakai #include <linux/netfilter/xt_multiport.h> 19a89ecb6aSYasuyuki Kozakai #include <linux/netfilter/x_tables.h> 20a89ecb6aSYasuyuki Kozakai #include <linux/netfilter_ipv4/ip_tables.h> 21a89ecb6aSYasuyuki Kozakai #include <linux/netfilter_ipv6/ip6_tables.h> 22a89ecb6aSYasuyuki Kozakai 23a89ecb6aSYasuyuki Kozakai MODULE_LICENSE("GPL"); 24a89ecb6aSYasuyuki Kozakai MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); 252ae15b64SJan Engelhardt MODULE_DESCRIPTION("Xtables: multiple port matching for TCP, UDP, UDP-Lite, SCTP and DCCP"); 26a89ecb6aSYasuyuki Kozakai MODULE_ALIAS("ipt_multiport"); 27a89ecb6aSYasuyuki Kozakai MODULE_ALIAS("ip6t_multiport"); 28a89ecb6aSYasuyuki Kozakai 29a89ecb6aSYasuyuki Kozakai /* Returns 1 if the port is matched by the test, 0 otherwise. */ 301d93a9cbSJan Engelhardt static inline bool 31a89ecb6aSYasuyuki Kozakai ports_match_v1(const struct xt_multiport_v1 *minfo, 32a89ecb6aSYasuyuki Kozakai u_int16_t src, u_int16_t dst) 33a89ecb6aSYasuyuki Kozakai { 34a89ecb6aSYasuyuki Kozakai unsigned int i; 35a89ecb6aSYasuyuki Kozakai u_int16_t s, e; 36a89ecb6aSYasuyuki Kozakai 37a89ecb6aSYasuyuki Kozakai for (i = 0; i < minfo->count; i++) { 38a89ecb6aSYasuyuki Kozakai s = minfo->ports[i]; 39a89ecb6aSYasuyuki Kozakai 40a89ecb6aSYasuyuki Kozakai if (minfo->pflags[i]) { 41a89ecb6aSYasuyuki Kozakai /* range port matching */ 42a89ecb6aSYasuyuki Kozakai e = minfo->ports[++i]; 43be91fd5eSJan Engelhardt pr_debug("src or dst matches with %d-%d?\n", s, e); 44a89ecb6aSYasuyuki Kozakai 45a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_SOURCE 46a89ecb6aSYasuyuki Kozakai && src >= s && src <= e) 471d93a9cbSJan Engelhardt return true ^ minfo->invert; 48a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_DESTINATION 49a89ecb6aSYasuyuki Kozakai && dst >= s && dst <= e) 501d93a9cbSJan Engelhardt return true ^ minfo->invert; 51a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_EITHER 52a89ecb6aSYasuyuki Kozakai && ((dst >= s && dst <= e) 53a89ecb6aSYasuyuki Kozakai || (src >= s && src <= e))) 541d93a9cbSJan Engelhardt return true ^ minfo->invert; 55a89ecb6aSYasuyuki Kozakai } else { 56a89ecb6aSYasuyuki Kozakai /* exact port matching */ 57be91fd5eSJan Engelhardt pr_debug("src or dst matches with %d?\n", s); 58a89ecb6aSYasuyuki Kozakai 59a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_SOURCE 60a89ecb6aSYasuyuki Kozakai && src == s) 611d93a9cbSJan Engelhardt return true ^ minfo->invert; 62a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_DESTINATION 63a89ecb6aSYasuyuki Kozakai && dst == s) 641d93a9cbSJan Engelhardt return true ^ minfo->invert; 65a89ecb6aSYasuyuki Kozakai if (minfo->flags == XT_MULTIPORT_EITHER 66a89ecb6aSYasuyuki Kozakai && (src == s || dst == s)) 671d93a9cbSJan Engelhardt return true ^ minfo->invert; 68a89ecb6aSYasuyuki Kozakai } 69a89ecb6aSYasuyuki Kozakai } 70a89ecb6aSYasuyuki Kozakai 71a89ecb6aSYasuyuki Kozakai return minfo->invert; 72a89ecb6aSYasuyuki Kozakai } 73a89ecb6aSYasuyuki Kozakai 741d93a9cbSJan Engelhardt static bool 7562fc8051SJan Engelhardt multiport_mt(const struct sk_buff *skb, struct xt_action_param *par) 76a89ecb6aSYasuyuki Kozakai { 773cf93c96SJan Engelhardt const __be16 *pptr; 783cf93c96SJan Engelhardt __be16 _ports[2]; 79f7108a20SJan Engelhardt const struct xt_multiport_v1 *multiinfo = par->matchinfo; 80a89ecb6aSYasuyuki Kozakai 81f7108a20SJan Engelhardt if (par->fragoff != 0) 821d93a9cbSJan Engelhardt return false; 83a89ecb6aSYasuyuki Kozakai 84f7108a20SJan Engelhardt pptr = skb_header_pointer(skb, par->thoff, sizeof(_ports), _ports); 85a89ecb6aSYasuyuki Kozakai if (pptr == NULL) { 86a89ecb6aSYasuyuki Kozakai /* We've been asked to examine this packet, and we 87a89ecb6aSYasuyuki Kozakai * can't. Hence, no choice but to drop. 88a89ecb6aSYasuyuki Kozakai */ 89be91fd5eSJan Engelhardt pr_debug("Dropping evil offset=0 tinygram.\n"); 90b4ba2611SJan Engelhardt par->hotdrop = true; 911d93a9cbSJan Engelhardt return false; 92a89ecb6aSYasuyuki Kozakai } 93a89ecb6aSYasuyuki Kozakai 94a89ecb6aSYasuyuki Kozakai return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1])); 95a89ecb6aSYasuyuki Kozakai } 96a89ecb6aSYasuyuki Kozakai 97ccb79bdcSJan Engelhardt static inline bool 98a89ecb6aSYasuyuki Kozakai check(u_int16_t proto, 99a89ecb6aSYasuyuki Kozakai u_int8_t ip_invflags, 100a89ecb6aSYasuyuki Kozakai u_int8_t match_flags, 101a89ecb6aSYasuyuki Kozakai u_int8_t count) 102a89ecb6aSYasuyuki Kozakai { 103957dc80aSPatrick McHardy /* Must specify supported protocol, no unknown flags or bad count */ 104957dc80aSPatrick McHardy return (proto == IPPROTO_TCP || proto == IPPROTO_UDP 105ba4e58ecSGerrit Renker || proto == IPPROTO_UDPLITE 106957dc80aSPatrick McHardy || proto == IPPROTO_SCTP || proto == IPPROTO_DCCP) 107a89ecb6aSYasuyuki Kozakai && !(ip_invflags & XT_INV_PROTO) 108a89ecb6aSYasuyuki Kozakai && (match_flags == XT_MULTIPORT_SOURCE 109a89ecb6aSYasuyuki Kozakai || match_flags == XT_MULTIPORT_DESTINATION 110a89ecb6aSYasuyuki Kozakai || match_flags == XT_MULTIPORT_EITHER) 111a89ecb6aSYasuyuki Kozakai && count <= XT_MULTI_PORTS; 112a89ecb6aSYasuyuki Kozakai } 113a89ecb6aSYasuyuki Kozakai 114b0f38452SJan Engelhardt static int multiport_mt_check(const struct xt_mtchk_param *par) 115a89ecb6aSYasuyuki Kozakai { 1169b4fce7aSJan Engelhardt const struct ipt_ip *ip = par->entryinfo; 1179b4fce7aSJan Engelhardt const struct xt_multiport_v1 *multiinfo = par->matchinfo; 118a89ecb6aSYasuyuki Kozakai 119a89ecb6aSYasuyuki Kozakai return check(ip->proto, ip->invflags, multiinfo->flags, 120c29c9492SJan Engelhardt multiinfo->count) ? 0 : -EINVAL; 121a89ecb6aSYasuyuki Kozakai } 122a89ecb6aSYasuyuki Kozakai 123b0f38452SJan Engelhardt static int multiport_mt6_check(const struct xt_mtchk_param *par) 124a89ecb6aSYasuyuki Kozakai { 1259b4fce7aSJan Engelhardt const struct ip6t_ip6 *ip = par->entryinfo; 1269b4fce7aSJan Engelhardt const struct xt_multiport_v1 *multiinfo = par->matchinfo; 127a89ecb6aSYasuyuki Kozakai 128a89ecb6aSYasuyuki Kozakai return check(ip->proto, ip->invflags, multiinfo->flags, 129c29c9492SJan Engelhardt multiinfo->count) ? 0 : -EINVAL; 130a89ecb6aSYasuyuki Kozakai } 131a89ecb6aSYasuyuki Kozakai 132d3c5ee6dSJan Engelhardt static struct xt_match multiport_mt_reg[] __read_mostly = { 1334470bbc7SPatrick McHardy { 134a89ecb6aSYasuyuki Kozakai .name = "multiport", 135ee999d8bSJan Engelhardt .family = NFPROTO_IPV4, 136a89ecb6aSYasuyuki Kozakai .revision = 1, 137d3c5ee6dSJan Engelhardt .checkentry = multiport_mt_check, 138d3c5ee6dSJan Engelhardt .match = multiport_mt, 139a89ecb6aSYasuyuki Kozakai .matchsize = sizeof(struct xt_multiport_v1), 140a89ecb6aSYasuyuki Kozakai .me = THIS_MODULE, 1414470bbc7SPatrick McHardy }, 1424470bbc7SPatrick McHardy { 1434470bbc7SPatrick McHardy .name = "multiport", 144ee999d8bSJan Engelhardt .family = NFPROTO_IPV6, 1454470bbc7SPatrick McHardy .revision = 1, 146d3c5ee6dSJan Engelhardt .checkentry = multiport_mt6_check, 147d3c5ee6dSJan Engelhardt .match = multiport_mt, 1484470bbc7SPatrick McHardy .matchsize = sizeof(struct xt_multiport_v1), 1494470bbc7SPatrick McHardy .me = THIS_MODULE, 1504470bbc7SPatrick McHardy }, 151a89ecb6aSYasuyuki Kozakai }; 152a89ecb6aSYasuyuki Kozakai 153d3c5ee6dSJan Engelhardt static int __init multiport_mt_init(void) 154a89ecb6aSYasuyuki Kozakai { 155d3c5ee6dSJan Engelhardt return xt_register_matches(multiport_mt_reg, 156d3c5ee6dSJan Engelhardt ARRAY_SIZE(multiport_mt_reg)); 157a89ecb6aSYasuyuki Kozakai } 158a89ecb6aSYasuyuki Kozakai 159d3c5ee6dSJan Engelhardt static void __exit multiport_mt_exit(void) 160a89ecb6aSYasuyuki Kozakai { 161d3c5ee6dSJan Engelhardt xt_unregister_matches(multiport_mt_reg, ARRAY_SIZE(multiport_mt_reg)); 162a89ecb6aSYasuyuki Kozakai } 163a89ecb6aSYasuyuki Kozakai 164d3c5ee6dSJan Engelhardt module_init(multiport_mt_init); 165d3c5ee6dSJan Engelhardt module_exit(multiport_mt_exit); 166