Blame view
net/netfilter/xt_u32.c
2.69 KB
1b50b8a37 [NETFILTER]: Add ... |
1 2 3 4 |
/* * xt_u32 - kernel module to match u32 packet content * * Original author: Don Cohen <don@isis.cs3-inc.com> |
ba5dc2756 [NETFILTER]: Copy... |
5 |
* (C) CC Computer Consultants GmbH, 2007 |
1b50b8a37 [NETFILTER]: Add ... |
6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
*/ #include <linux/module.h> #include <linux/moduleparam.h> #include <linux/spinlock.h> #include <linux/skbuff.h> #include <linux/types.h> #include <linux/netfilter/x_tables.h> #include <linux/netfilter/xt_u32.h> static bool u32_match_it(const struct xt_u32 *data, const struct sk_buff *skb) { const struct xt_u32_test *ct; unsigned int testind; unsigned int nnums; unsigned int nvals; unsigned int i; |
a34c45896 netfilter endian ... |
24 |
__be32 n; |
1b50b8a37 [NETFILTER]: Add ... |
25 26 27 |
u_int32_t pos; u_int32_t val; u_int32_t at; |
1b50b8a37 [NETFILTER]: Add ... |
28 29 30 31 32 33 34 35 36 |
/* * Small example: "0 >> 28 == 4 && 8 & 0xFF0000 >> 16 = 6, 17" * (=IPv4 and (TCP or UDP)). Outer loop runs over the "&&" operands. */ for (testind = 0; testind < data->ntests; ++testind) { ct = &data->tests[testind]; at = 0; pos = ct->location[0].number; |
35019539d [NETFILTER]: netf... |
37 |
if (skb->len < 4 || pos > skb->len - 4) |
1b50b8a37 [NETFILTER]: Add ... |
38 |
return false; |
f449b3b54 [NETFILTER]: xt_u... |
39 40 |
if (skb_copy_bits(skb, pos, &n, sizeof(n)) < 0) BUG(); |
a34c45896 netfilter endian ... |
41 |
val = ntohl(n); |
1b50b8a37 [NETFILTER]: Add ... |
42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 |
nnums = ct->nnums; /* Inner loop runs over "&", "<<", ">>" and "@" operands */ for (i = 1; i < nnums; ++i) { u_int32_t number = ct->location[i].number; switch (ct->location[i].nextop) { case XT_U32_AND: val &= number; break; case XT_U32_LEFTSH: val <<= number; break; case XT_U32_RIGHTSH: val >>= number; break; case XT_U32_AT: if (at + val < at) return false; at += val; pos = number; if (at + 4 < at || skb->len < at + 4 || pos > skb->len - at - 4) return false; |
f449b3b54 [NETFILTER]: xt_u... |
65 66 67 |
if (skb_copy_bits(skb, at + pos, &n, sizeof(n)) < 0) BUG(); |
a34c45896 netfilter endian ... |
68 |
val = ntohl(n); |
1b50b8a37 [NETFILTER]: Add ... |
69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 |
break; } } /* Run over the "," and ":" operands */ nvals = ct->nvalues; for (i = 0; i < nvals; ++i) if (ct->value[i].min <= val && val <= ct->value[i].max) break; if (i >= ct->nvalues) return false; } return true; } |
62fc80510 netfilter: xtable... |
85 |
static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) |
1b50b8a37 [NETFILTER]: Add ... |
86 |
{ |
f7108a20d netfilter: xtable... |
87 |
const struct xt_u32 *data = par->matchinfo; |
1b50b8a37 [NETFILTER]: Add ... |
88 89 90 91 92 |
bool ret; ret = u32_match_it(data, skb); return ret ^ data->invert; } |
55b69e910 netfilter: implem... |
93 94 95 96 97 98 99 |
static struct xt_match xt_u32_mt_reg __read_mostly = { .name = "u32", .revision = 0, .family = NFPROTO_UNSPEC, .match = u32_mt, .matchsize = sizeof(struct xt_u32), .me = THIS_MODULE, |
1b50b8a37 [NETFILTER]: Add ... |
100 |
}; |
d3c5ee6d5 [NETFILTER]: x_ta... |
101 |
static int __init u32_mt_init(void) |
1b50b8a37 [NETFILTER]: Add ... |
102 |
{ |
55b69e910 netfilter: implem... |
103 |
return xt_register_match(&xt_u32_mt_reg); |
1b50b8a37 [NETFILTER]: Add ... |
104 |
} |
d3c5ee6d5 [NETFILTER]: x_ta... |
105 |
static void __exit u32_mt_exit(void) |
1b50b8a37 [NETFILTER]: Add ... |
106 |
{ |
55b69e910 netfilter: implem... |
107 |
xt_unregister_match(&xt_u32_mt_reg); |
1b50b8a37 [NETFILTER]: Add ... |
108 |
} |
d3c5ee6d5 [NETFILTER]: x_ta... |
109 110 |
module_init(u32_mt_init); module_exit(u32_mt_exit); |
408ffaa4a netfilter: update... |
111 |
MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>"); |
2ae15b64e [NETFILTER]: Upda... |
112 |
MODULE_DESCRIPTION("Xtables: arbitrary byte matching"); |
1b50b8a37 [NETFILTER]: Add ... |
113 114 115 |
MODULE_LICENSE("GPL"); MODULE_ALIAS("ipt_u32"); MODULE_ALIAS("ip6t_u32"); |