Blame view
net/netfilter/xt_multiport.c
4.55 KB
ba4e58eca [NET]: Supporting... |
1 2 |
/* Kernel module to match one of a list of TCP/UDP(-Lite)/SCTP/DCCP ports: ports are in the same place so we can treat them as equal. */ |
a89ecb6a2 [NETFILTER]: x_ta... |
3 4 5 6 7 8 9 10 |
/* (C) 1999-2001 Paul `Rusty' Russell * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. */ |
be91fd5e3 netfilter: xtable... |
11 |
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
a89ecb6a2 [NETFILTER]: x_ta... |
12 13 14 15 16 17 18 19 20 21 22 23 24 |
#include <linux/module.h> #include <linux/types.h> #include <linux/udp.h> #include <linux/skbuff.h> #include <linux/in.h> #include <linux/netfilter/xt_multiport.h> #include <linux/netfilter/x_tables.h> #include <linux/netfilter_ipv4/ip_tables.h> #include <linux/netfilter_ipv6/ip6_tables.h> MODULE_LICENSE("GPL"); MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); |
2ae15b64e [NETFILTER]: Upda... |
25 |
MODULE_DESCRIPTION("Xtables: multiple port matching for TCP, UDP, UDP-Lite, SCTP and DCCP"); |
a89ecb6a2 [NETFILTER]: x_ta... |
26 27 |
MODULE_ALIAS("ipt_multiport"); MODULE_ALIAS("ip6t_multiport"); |
a89ecb6a2 [NETFILTER]: x_ta... |
28 |
/* Returns 1 if the port is matched by the test, 0 otherwise. */ |
1d93a9cba [NETFILTER]: x_ta... |
29 |
static inline bool |
a89ecb6a2 [NETFILTER]: x_ta... |
30 31 32 33 34 35 36 37 38 39 40 41 |
ports_match_v1(const struct xt_multiport_v1 *minfo, u_int16_t src, u_int16_t dst) { unsigned int i; u_int16_t s, e; for (i = 0; i < minfo->count; i++) { s = minfo->ports[i]; if (minfo->pflags[i]) { /* range port matching */ e = minfo->ports[++i]; |
be91fd5e3 netfilter: xtable... |
42 43 |
pr_debug("src or dst matches with %d-%d? ", s, e); |
a89ecb6a2 [NETFILTER]: x_ta... |
44 45 46 |
if (minfo->flags == XT_MULTIPORT_SOURCE && src >= s && src <= e) |
1d93a9cba [NETFILTER]: x_ta... |
47 |
return true ^ minfo->invert; |
a89ecb6a2 [NETFILTER]: x_ta... |
48 49 |
if (minfo->flags == XT_MULTIPORT_DESTINATION && dst >= s && dst <= e) |
1d93a9cba [NETFILTER]: x_ta... |
50 |
return true ^ minfo->invert; |
a89ecb6a2 [NETFILTER]: x_ta... |
51 52 53 |
if (minfo->flags == XT_MULTIPORT_EITHER && ((dst >= s && dst <= e) || (src >= s && src <= e))) |
1d93a9cba [NETFILTER]: x_ta... |
54 |
return true ^ minfo->invert; |
a89ecb6a2 [NETFILTER]: x_ta... |
55 56 |
} else { /* exact port matching */ |
be91fd5e3 netfilter: xtable... |
57 58 |
pr_debug("src or dst matches with %d? ", s); |
a89ecb6a2 [NETFILTER]: x_ta... |
59 60 61 |
if (minfo->flags == XT_MULTIPORT_SOURCE && src == s) |
1d93a9cba [NETFILTER]: x_ta... |
62 |
return true ^ minfo->invert; |
a89ecb6a2 [NETFILTER]: x_ta... |
63 64 |
if (minfo->flags == XT_MULTIPORT_DESTINATION && dst == s) |
1d93a9cba [NETFILTER]: x_ta... |
65 |
return true ^ minfo->invert; |
a89ecb6a2 [NETFILTER]: x_ta... |
66 67 |
if (minfo->flags == XT_MULTIPORT_EITHER && (src == s || dst == s)) |
1d93a9cba [NETFILTER]: x_ta... |
68 |
return true ^ minfo->invert; |
a89ecb6a2 [NETFILTER]: x_ta... |
69 70 |
} } |
601e68e10 [NETFILTER]: Fix ... |
71 |
return minfo->invert; |
a89ecb6a2 [NETFILTER]: x_ta... |
72 |
} |
1d93a9cba [NETFILTER]: x_ta... |
73 |
static bool |
62fc80510 netfilter: xtable... |
74 |
multiport_mt(const struct sk_buff *skb, struct xt_action_param *par) |
a89ecb6a2 [NETFILTER]: x_ta... |
75 |
{ |
3cf93c96a [NETFILTER]: anno... |
76 77 |
const __be16 *pptr; __be16 _ports[2]; |
f7108a20d netfilter: xtable... |
78 |
const struct xt_multiport_v1 *multiinfo = par->matchinfo; |
a89ecb6a2 [NETFILTER]: x_ta... |
79 |
|
f7108a20d netfilter: xtable... |
80 |
if (par->fragoff != 0) |
1d93a9cba [NETFILTER]: x_ta... |
81 |
return false; |
a89ecb6a2 [NETFILTER]: x_ta... |
82 |
|
f7108a20d netfilter: xtable... |
83 |
pptr = skb_header_pointer(skb, par->thoff, sizeof(_ports), _ports); |
a89ecb6a2 [NETFILTER]: x_ta... |
84 85 86 87 |
if (pptr == NULL) { /* We've been asked to examine this packet, and we * can't. Hence, no choice but to drop. */ |
be91fd5e3 netfilter: xtable... |
88 89 |
pr_debug("Dropping evil offset=0 tinygram. "); |
b4ba26119 netfilter: xtable... |
90 |
par->hotdrop = true; |
1d93a9cba [NETFILTER]: x_ta... |
91 |
return false; |
a89ecb6a2 [NETFILTER]: x_ta... |
92 93 94 95 |
} return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1])); } |
ccb79bdce [NETFILTER]: x_ta... |
96 |
static inline bool |
a89ecb6a2 [NETFILTER]: x_ta... |
97 98 99 100 101 |
check(u_int16_t proto, u_int8_t ip_invflags, u_int8_t match_flags, u_int8_t count) { |
957dc80ac [NETFILTER]: x_ta... |
102 103 |
/* Must specify supported protocol, no unknown flags or bad count */ return (proto == IPPROTO_TCP || proto == IPPROTO_UDP |
ba4e58eca [NET]: Supporting... |
104 |
|| proto == IPPROTO_UDPLITE |
957dc80ac [NETFILTER]: x_ta... |
105 |
|| proto == IPPROTO_SCTP || proto == IPPROTO_DCCP) |
a89ecb6a2 [NETFILTER]: x_ta... |
106 107 108 109 110 111 |
&& !(ip_invflags & XT_INV_PROTO) && (match_flags == XT_MULTIPORT_SOURCE || match_flags == XT_MULTIPORT_DESTINATION || match_flags == XT_MULTIPORT_EITHER) && count <= XT_MULTI_PORTS; } |
b0f38452f netfilter: xtable... |
112 |
static int multiport_mt_check(const struct xt_mtchk_param *par) |
a89ecb6a2 [NETFILTER]: x_ta... |
113 |
{ |
9b4fce7a3 netfilter: xtable... |
114 115 |
const struct ipt_ip *ip = par->entryinfo; const struct xt_multiport_v1 *multiinfo = par->matchinfo; |
a89ecb6a2 [NETFILTER]: x_ta... |
116 117 |
return check(ip->proto, ip->invflags, multiinfo->flags, |
c29c94928 netfilter: xtable... |
118 |
multiinfo->count) ? 0 : -EINVAL; |
a89ecb6a2 [NETFILTER]: x_ta... |
119 |
} |
b0f38452f netfilter: xtable... |
120 |
static int multiport_mt6_check(const struct xt_mtchk_param *par) |
a89ecb6a2 [NETFILTER]: x_ta... |
121 |
{ |
9b4fce7a3 netfilter: xtable... |
122 123 |
const struct ip6t_ip6 *ip = par->entryinfo; const struct xt_multiport_v1 *multiinfo = par->matchinfo; |
a89ecb6a2 [NETFILTER]: x_ta... |
124 125 |
return check(ip->proto, ip->invflags, multiinfo->flags, |
c29c94928 netfilter: xtable... |
126 |
multiinfo->count) ? 0 : -EINVAL; |
a89ecb6a2 [NETFILTER]: x_ta... |
127 |
} |
d3c5ee6d5 [NETFILTER]: x_ta... |
128 |
static struct xt_match multiport_mt_reg[] __read_mostly = { |
4470bbc74 [NETFILTER]: x_ta... |
129 130 |
{ .name = "multiport", |
ee999d8b9 netfilter: x_tabl... |
131 |
.family = NFPROTO_IPV4, |
4470bbc74 [NETFILTER]: x_ta... |
132 |
.revision = 1, |
d3c5ee6d5 [NETFILTER]: x_ta... |
133 134 |
.checkentry = multiport_mt_check, .match = multiport_mt, |
4470bbc74 [NETFILTER]: x_ta... |
135 136 137 138 139 |
.matchsize = sizeof(struct xt_multiport_v1), .me = THIS_MODULE, }, { .name = "multiport", |
ee999d8b9 netfilter: x_tabl... |
140 |
.family = NFPROTO_IPV6, |
4470bbc74 [NETFILTER]: x_ta... |
141 |
.revision = 1, |
d3c5ee6d5 [NETFILTER]: x_ta... |
142 143 |
.checkentry = multiport_mt6_check, .match = multiport_mt, |
4470bbc74 [NETFILTER]: x_ta... |
144 145 146 |
.matchsize = sizeof(struct xt_multiport_v1), .me = THIS_MODULE, }, |
a89ecb6a2 [NETFILTER]: x_ta... |
147 |
}; |
d3c5ee6d5 [NETFILTER]: x_ta... |
148 |
static int __init multiport_mt_init(void) |
a89ecb6a2 [NETFILTER]: x_ta... |
149 |
{ |
d3c5ee6d5 [NETFILTER]: x_ta... |
150 151 |
return xt_register_matches(multiport_mt_reg, ARRAY_SIZE(multiport_mt_reg)); |
a89ecb6a2 [NETFILTER]: x_ta... |
152 |
} |
d3c5ee6d5 [NETFILTER]: x_ta... |
153 |
static void __exit multiport_mt_exit(void) |
a89ecb6a2 [NETFILTER]: x_ta... |
154 |
{ |
d3c5ee6d5 [NETFILTER]: x_ta... |
155 |
xt_unregister_matches(multiport_mt_reg, ARRAY_SIZE(multiport_mt_reg)); |
a89ecb6a2 [NETFILTER]: x_ta... |
156 |
} |
d3c5ee6d5 [NETFILTER]: x_ta... |
157 158 |
module_init(multiport_mt_init); module_exit(multiport_mt_exit); |