1 /* Kernel module to match one of a list of TCP/UDP(-Lite)/SCTP/DCCP ports: 2 ports are in the same place so we can treat them as equal. */ 3 4 /* (C) 1999-2001 Paul `Rusty' Russell 5 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11 12 #include <linux/module.h> 13 #include <linux/types.h> 14 #include <linux/udp.h> 15 #include <linux/skbuff.h> 16 #include <linux/in.h> 17 18 #include <linux/netfilter/xt_multiport.h> 19 #include <linux/netfilter/x_tables.h> 20 #include <linux/netfilter_ipv4/ip_tables.h> 21 #include <linux/netfilter_ipv6/ip6_tables.h> 22 23 MODULE_LICENSE("GPL"); 24 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); 25 MODULE_DESCRIPTION("Xtables: multiple port matching for TCP, UDP, UDP-Lite, SCTP and DCCP"); 26 MODULE_ALIAS("ipt_multiport"); 27 MODULE_ALIAS("ip6t_multiport"); 28 29 #if 0 30 #define duprintf(format, args...) printk(format , ## args) 31 #else 32 #define duprintf(format, args...) 33 #endif 34 35 /* Returns 1 if the port is matched by the test, 0 otherwise. */ 36 static inline bool 37 ports_match_v0(const u_int16_t *portlist, enum xt_multiport_flags flags, 38 u_int8_t count, u_int16_t src, u_int16_t dst) 39 { 40 unsigned int i; 41 for (i = 0; i < count; i++) { 42 if (flags != XT_MULTIPORT_DESTINATION && portlist[i] == src) 43 return true; 44 45 if (flags != XT_MULTIPORT_SOURCE && portlist[i] == dst) 46 return true; 47 } 48 49 return false; 50 } 51 52 /* Returns 1 if the port is matched by the test, 0 otherwise. */ 53 static inline bool 54 ports_match_v1(const struct xt_multiport_v1 *minfo, 55 u_int16_t src, u_int16_t dst) 56 { 57 unsigned int i; 58 u_int16_t s, e; 59 60 for (i = 0; i < minfo->count; i++) { 61 s = minfo->ports[i]; 62 63 if (minfo->pflags[i]) { 64 /* range port matching */ 65 e = minfo->ports[++i]; 66 duprintf("src or dst matches with %d-%d?\n", s, e); 67 68 if (minfo->flags == XT_MULTIPORT_SOURCE 69 && src >= s && src <= e) 70 return true ^ minfo->invert; 71 if (minfo->flags == XT_MULTIPORT_DESTINATION 72 && dst >= s && dst <= e) 73 return true ^ minfo->invert; 74 if (minfo->flags == XT_MULTIPORT_EITHER 75 && ((dst >= s && dst <= e) 76 || (src >= s && src <= e))) 77 return true ^ minfo->invert; 78 } else { 79 /* exact port matching */ 80 duprintf("src or dst matches with %d?\n", s); 81 82 if (minfo->flags == XT_MULTIPORT_SOURCE 83 && src == s) 84 return true ^ minfo->invert; 85 if (minfo->flags == XT_MULTIPORT_DESTINATION 86 && dst == s) 87 return true ^ minfo->invert; 88 if (minfo->flags == XT_MULTIPORT_EITHER 89 && (src == s || dst == s)) 90 return true ^ minfo->invert; 91 } 92 } 93 94 return minfo->invert; 95 } 96 97 static bool 98 multiport_mt_v0(const struct sk_buff *skb, const struct net_device *in, 99 const struct net_device *out, const struct xt_match *match, 100 const void *matchinfo, int offset, unsigned int protoff, 101 bool *hotdrop) 102 { 103 const __be16 *pptr; 104 __be16 _ports[2]; 105 const struct xt_multiport *multiinfo = matchinfo; 106 107 if (offset) 108 return false; 109 110 pptr = skb_header_pointer(skb, protoff, sizeof(_ports), _ports); 111 if (pptr == NULL) { 112 /* We've been asked to examine this packet, and we 113 * can't. Hence, no choice but to drop. 114 */ 115 duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n"); 116 *hotdrop = true; 117 return false; 118 } 119 120 return ports_match_v0(multiinfo->ports, multiinfo->flags, 121 multiinfo->count, ntohs(pptr[0]), ntohs(pptr[1])); 122 } 123 124 static bool 125 multiport_mt(const struct sk_buff *skb, const struct net_device *in, 126 const struct net_device *out, const struct xt_match *match, 127 const void *matchinfo, int offset, unsigned int protoff, 128 bool *hotdrop) 129 { 130 const __be16 *pptr; 131 __be16 _ports[2]; 132 const struct xt_multiport_v1 *multiinfo = matchinfo; 133 134 if (offset) 135 return false; 136 137 pptr = skb_header_pointer(skb, protoff, sizeof(_ports), _ports); 138 if (pptr == NULL) { 139 /* We've been asked to examine this packet, and we 140 * can't. Hence, no choice but to drop. 141 */ 142 duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n"); 143 *hotdrop = true; 144 return false; 145 } 146 147 return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1])); 148 } 149 150 static inline bool 151 check(u_int16_t proto, 152 u_int8_t ip_invflags, 153 u_int8_t match_flags, 154 u_int8_t count) 155 { 156 /* Must specify supported protocol, no unknown flags or bad count */ 157 return (proto == IPPROTO_TCP || proto == IPPROTO_UDP 158 || proto == IPPROTO_UDPLITE 159 || proto == IPPROTO_SCTP || proto == IPPROTO_DCCP) 160 && !(ip_invflags & XT_INV_PROTO) 161 && (match_flags == XT_MULTIPORT_SOURCE 162 || match_flags == XT_MULTIPORT_DESTINATION 163 || match_flags == XT_MULTIPORT_EITHER) 164 && count <= XT_MULTI_PORTS; 165 } 166 167 /* Called when user tries to insert an entry of this type. */ 168 static bool 169 multiport_mt_check_v0(const char *tablename, const void *info, 170 const struct xt_match *match, void *matchinfo, 171 unsigned int hook_mask) 172 { 173 const struct ipt_ip *ip = info; 174 const struct xt_multiport *multiinfo = matchinfo; 175 176 return check(ip->proto, ip->invflags, multiinfo->flags, 177 multiinfo->count); 178 } 179 180 static bool 181 multiport_mt_check(const char *tablename, const void *info, 182 const struct xt_match *match, void *matchinfo, 183 unsigned int hook_mask) 184 { 185 const struct ipt_ip *ip = info; 186 const struct xt_multiport_v1 *multiinfo = matchinfo; 187 188 return check(ip->proto, ip->invflags, multiinfo->flags, 189 multiinfo->count); 190 } 191 192 static bool 193 multiport_mt6_check_v0(const char *tablename, const void *info, 194 const struct xt_match *match, void *matchinfo, 195 unsigned int hook_mask) 196 { 197 const struct ip6t_ip6 *ip = info; 198 const struct xt_multiport *multiinfo = matchinfo; 199 200 return check(ip->proto, ip->invflags, multiinfo->flags, 201 multiinfo->count); 202 } 203 204 static bool 205 multiport_mt6_check(const char *tablename, const void *info, 206 const struct xt_match *match, void *matchinfo, 207 unsigned int hook_mask) 208 { 209 const struct ip6t_ip6 *ip = info; 210 const struct xt_multiport_v1 *multiinfo = matchinfo; 211 212 return check(ip->proto, ip->invflags, multiinfo->flags, 213 multiinfo->count); 214 } 215 216 static struct xt_match multiport_mt_reg[] __read_mostly = { 217 { 218 .name = "multiport", 219 .family = AF_INET, 220 .revision = 0, 221 .checkentry = multiport_mt_check_v0, 222 .match = multiport_mt_v0, 223 .matchsize = sizeof(struct xt_multiport), 224 .me = THIS_MODULE, 225 }, 226 { 227 .name = "multiport", 228 .family = AF_INET, 229 .revision = 1, 230 .checkentry = multiport_mt_check, 231 .match = multiport_mt, 232 .matchsize = sizeof(struct xt_multiport_v1), 233 .me = THIS_MODULE, 234 }, 235 { 236 .name = "multiport", 237 .family = AF_INET6, 238 .revision = 0, 239 .checkentry = multiport_mt6_check_v0, 240 .match = multiport_mt_v0, 241 .matchsize = sizeof(struct xt_multiport), 242 .me = THIS_MODULE, 243 }, 244 { 245 .name = "multiport", 246 .family = AF_INET6, 247 .revision = 1, 248 .checkentry = multiport_mt6_check, 249 .match = multiport_mt, 250 .matchsize = sizeof(struct xt_multiport_v1), 251 .me = THIS_MODULE, 252 }, 253 }; 254 255 static int __init multiport_mt_init(void) 256 { 257 return xt_register_matches(multiport_mt_reg, 258 ARRAY_SIZE(multiport_mt_reg)); 259 } 260 261 static void __exit multiport_mt_exit(void) 262 { 263 xt_unregister_matches(multiport_mt_reg, ARRAY_SIZE(multiport_mt_reg)); 264 } 265 266 module_init(multiport_mt_init); 267 module_exit(multiport_mt_exit); 268