1
2
3
4
5
6
7
8
9
10
11#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12#include <linux/module.h>
13#include <linux/types.h>
14#include <linux/udp.h>
15#include <linux/skbuff.h>
16#include <linux/in.h>
17
18#include <linux/netfilter/xt_multiport.h>
19#include <linux/netfilter/x_tables.h>
20#include <linux/netfilter_ipv4/ip_tables.h>
21#include <linux/netfilter_ipv6/ip6_tables.h>
22
23MODULE_LICENSE("GPL");
24MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
25MODULE_DESCRIPTION("Xtables: multiple port matching for TCP, UDP, UDP-Lite, SCTP and DCCP");
26MODULE_ALIAS("ipt_multiport");
27MODULE_ALIAS("ip6t_multiport");
28
29
30static inline bool
31ports_match_v1(const struct xt_multiport_v1 *minfo,
32 u_int16_t src, u_int16_t dst)
33{
34 unsigned int i;
35 u_int16_t s, e;
36
37 for (i = 0; i < minfo->count; i++) {
38 s = minfo->ports[i];
39
40 if (minfo->pflags[i]) {
41
42 e = minfo->ports[++i];
43 pr_debug("src or dst matches with %d-%d?\n", s, e);
44
45 switch (minfo->flags) {
46 case XT_MULTIPORT_SOURCE:
47 if (src >= s && src <= e)
48 return true ^ minfo->invert;
49 break;
50 case XT_MULTIPORT_DESTINATION:
51 if (dst >= s && dst <= e)
52 return true ^ minfo->invert;
53 break;
54 case XT_MULTIPORT_EITHER:
55 if ((dst >= s && dst <= e) ||
56 (src >= s && src <= e))
57 return true ^ minfo->invert;
58 break;
59 default:
60 break;
61 }
62 } else {
63
64 pr_debug("src or dst matches with %d?\n", s);
65
66 switch (minfo->flags) {
67 case XT_MULTIPORT_SOURCE:
68 if (src == s)
69 return true ^ minfo->invert;
70 break;
71 case XT_MULTIPORT_DESTINATION:
72 if (dst == s)
73 return true ^ minfo->invert;
74 break;
75 case XT_MULTIPORT_EITHER:
76 if (src == s || dst == s)
77 return true ^ minfo->invert;
78 break;
79 default:
80 break;
81 }
82 }
83 }
84
85 return minfo->invert;
86}
87
88static bool
89multiport_mt(const struct sk_buff *skb, struct xt_action_param *par)
90{
91 const __be16 *pptr;
92 __be16 _ports[2];
93 const struct xt_multiport_v1 *multiinfo = par->matchinfo;
94
95 if (par->fragoff != 0)
96 return false;
97
98 pptr = skb_header_pointer(skb, par->thoff, sizeof(_ports), _ports);
99 if (pptr == NULL) {
100
101
102
103 pr_debug("Dropping evil offset=0 tinygram.\n");
104 par->hotdrop = true;
105 return false;
106 }
107
108 return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1]));
109}
110
111static inline bool
112check(u_int16_t proto,
113 u_int8_t ip_invflags,
114 u_int8_t match_flags,
115 u_int8_t count)
116{
117
118 return (proto == IPPROTO_TCP || proto == IPPROTO_UDP
119 || proto == IPPROTO_UDPLITE
120 || proto == IPPROTO_SCTP || proto == IPPROTO_DCCP)
121 && !(ip_invflags & XT_INV_PROTO)
122 && (match_flags == XT_MULTIPORT_SOURCE
123 || match_flags == XT_MULTIPORT_DESTINATION
124 || match_flags == XT_MULTIPORT_EITHER)
125 && count <= XT_MULTI_PORTS;
126}
127
128static int multiport_mt_check(const struct xt_mtchk_param *par)
129{
130 const struct ipt_ip *ip = par->entryinfo;
131 const struct xt_multiport_v1 *multiinfo = par->matchinfo;
132
133 return check(ip->proto, ip->invflags, multiinfo->flags,
134 multiinfo->count) ? 0 : -EINVAL;
135}
136
137static int multiport_mt6_check(const struct xt_mtchk_param *par)
138{
139 const struct ip6t_ip6 *ip = par->entryinfo;
140 const struct xt_multiport_v1 *multiinfo = par->matchinfo;
141
142 return check(ip->proto, ip->invflags, multiinfo->flags,
143 multiinfo->count) ? 0 : -EINVAL;
144}
145
146static struct xt_match multiport_mt_reg[] __read_mostly = {
147 {
148 .name = "multiport",
149 .family = NFPROTO_IPV4,
150 .revision = 1,
151 .checkentry = multiport_mt_check,
152 .match = multiport_mt,
153 .matchsize = sizeof(struct xt_multiport_v1),
154 .me = THIS_MODULE,
155 },
156 {
157 .name = "multiport",
158 .family = NFPROTO_IPV6,
159 .revision = 1,
160 .checkentry = multiport_mt6_check,
161 .match = multiport_mt,
162 .matchsize = sizeof(struct xt_multiport_v1),
163 .me = THIS_MODULE,
164 },
165};
166
167static int __init multiport_mt_init(void)
168{
169 return xt_register_matches(multiport_mt_reg,
170 ARRAY_SIZE(multiport_mt_reg));
171}
172
173static void __exit multiport_mt_exit(void)
174{
175 xt_unregister_matches(multiport_mt_reg, ARRAY_SIZE(multiport_mt_reg));
176}
177
178module_init(multiport_mt_init);
179module_exit(multiport_mt_exit);
180
