1 /* Kernel module to match one of a list of TCP/UDP(-Lite)/SCTP/DCCP ports: 2 ports are in the same place so we can treat them as equal. */ 3 4 /* (C) 1999-2001 Paul `Rusty' Russell 5 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 12 #include <linux/module.h> 13 #include <linux/types.h> 14 #include <linux/udp.h> 15 #include <linux/skbuff.h> 16 #include <linux/in.h> 17 18 #include <linux/netfilter/xt_multiport.h> 19 #include <linux/netfilter/x_tables.h> 20 #include <linux/netfilter_ipv4/ip_tables.h> 21 #include <linux/netfilter_ipv6/ip6_tables.h> 22 23 MODULE_LICENSE("GPL"); 24 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); 25 MODULE_DESCRIPTION("Xtables: multiple port matching for TCP, UDP, UDP-Lite, SCTP and DCCP"); 26 MODULE_ALIAS("ipt_multiport"); 27 MODULE_ALIAS("ip6t_multiport"); 28 29 /* Returns 1 if the port is matched by the test, 0 otherwise. */ 30 static inline bool 31 ports_match_v1(const struct xt_multiport_v1 *minfo, 32 u_int16_t src, u_int16_t dst) 33 { 34 unsigned int i; 35 u_int16_t s, e; 36 37 for (i = 0; i < minfo->count; i++) { 38 s = minfo->ports[i]; 39 40 if (minfo->pflags[i]) { 41 /* range port matching */ 42 e = minfo->ports[++i]; 43 pr_debug("src or dst matches with %d-%d?\n", s, e); 44 45 switch (minfo->flags) { 46 case XT_MULTIPORT_SOURCE: 47 if (src >= s && src <= e) 48 return true ^ minfo->invert; 49 break; 50 case XT_MULTIPORT_DESTINATION: 51 if (dst >= s && dst <= e) 52 return true ^ minfo->invert; 53 break; 54 case XT_MULTIPORT_EITHER: 55 if ((dst >= s && dst <= e) || 56 (src >= s && src <= e)) 57 return true ^ minfo->invert; 58 break; 59 default: 60 break; 61 } 62 } else { 63 /* exact port matching */ 64 pr_debug("src or dst matches with %d?\n", s); 65 66 switch (minfo->flags) { 67 case XT_MULTIPORT_SOURCE: 68 if (src == s) 69 return true ^ minfo->invert; 70 break; 71 case XT_MULTIPORT_DESTINATION: 72 if (dst == s) 73 return true ^ minfo->invert; 74 break; 75 case XT_MULTIPORT_EITHER: 76 if (src == s || dst == s) 77 return true ^ minfo->invert; 78 break; 79 default: 80 break; 81 } 82 } 83 } 84 85 return minfo->invert; 86 } 87 88 static bool 89 multiport_mt(const struct sk_buff *skb, struct xt_action_param *par) 90 { 91 const __be16 *pptr; 92 __be16 _ports[2]; 93 const struct xt_multiport_v1 *multiinfo = par->matchinfo; 94 95 if (par->fragoff != 0) 96 return false; 97 98 pptr = skb_header_pointer(skb, par->thoff, sizeof(_ports), _ports); 99 if (pptr == NULL) { 100 /* We've been asked to examine this packet, and we 101 * can't. Hence, no choice but to drop. 102 */ 103 pr_debug("Dropping evil offset=0 tinygram.\n"); 104 par->hotdrop = true; 105 return false; 106 } 107 108 return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1])); 109 } 110 111 static inline bool 112 check(u_int16_t proto, 113 u_int8_t ip_invflags, 114 u_int8_t match_flags, 115 u_int8_t count) 116 { 117 /* Must specify supported protocol, no unknown flags or bad count */ 118 return (proto == IPPROTO_TCP || proto == IPPROTO_UDP 119 || proto == IPPROTO_UDPLITE 120 || proto == IPPROTO_SCTP || proto == IPPROTO_DCCP) 121 && !(ip_invflags & XT_INV_PROTO) 122 && (match_flags == XT_MULTIPORT_SOURCE 123 || match_flags == XT_MULTIPORT_DESTINATION 124 || match_flags == XT_MULTIPORT_EITHER) 125 && count <= XT_MULTI_PORTS; 126 } 127 128 static int multiport_mt_check(const struct xt_mtchk_param *par) 129 { 130 const struct ipt_ip *ip = par->entryinfo; 131 const struct xt_multiport_v1 *multiinfo = par->matchinfo; 132 133 return check(ip->proto, ip->invflags, multiinfo->flags, 134 multiinfo->count) ? 0 : -EINVAL; 135 } 136 137 static int multiport_mt6_check(const struct xt_mtchk_param *par) 138 { 139 const struct ip6t_ip6 *ip = par->entryinfo; 140 const struct xt_multiport_v1 *multiinfo = par->matchinfo; 141 142 return check(ip->proto, ip->invflags, multiinfo->flags, 143 multiinfo->count) ? 0 : -EINVAL; 144 } 145 146 static struct xt_match multiport_mt_reg[] __read_mostly = { 147 { 148 .name = "multiport", 149 .family = NFPROTO_IPV4, 150 .revision = 1, 151 .checkentry = multiport_mt_check, 152 .match = multiport_mt, 153 .matchsize = sizeof(struct xt_multiport_v1), 154 .me = THIS_MODULE, 155 }, 156 { 157 .name = "multiport", 158 .family = NFPROTO_IPV6, 159 .revision = 1, 160 .checkentry = multiport_mt6_check, 161 .match = multiport_mt, 162 .matchsize = sizeof(struct xt_multiport_v1), 163 .me = THIS_MODULE, 164 }, 165 }; 166 167 static int __init multiport_mt_init(void) 168 { 169 return xt_register_matches(multiport_mt_reg, 170 ARRAY_SIZE(multiport_mt_reg)); 171 } 172 173 static void __exit multiport_mt_exit(void) 174 { 175 xt_unregister_matches(multiport_mt_reg, ARRAY_SIZE(multiport_mt_reg)); 176 } 177 178 module_init(multiport_mt_init); 179 module_exit(multiport_mt_exit); 180