1 #include <linux/types.h>
2 #include <linux/module.h>
4 #include <linux/ipv6.h>
8 #include <linux/netfilter/x_tables.h>
9 #include <linux/netfilter/xt_tcpudp.h>
10 #include <linux/netfilter_ipv4/ip_tables.h>
11 #include <linux/netfilter_ipv6/ip6_tables.h>
13 MODULE_DESCRIPTION("Xtables: TCP, UDP and UDP-Lite match");
14 MODULE_LICENSE("GPL");
15 MODULE_ALIAS("xt_tcp");
16 MODULE_ALIAS("xt_udp");
17 MODULE_ALIAS("ipt_udp");
18 MODULE_ALIAS("ipt_tcp");
19 MODULE_ALIAS("ip6t_udp");
20 MODULE_ALIAS("ip6t_tcp");
22 #ifdef DEBUG_IP_FIREWALL_USER
23 #define duprintf(format, args...) printk(format , ## args)
25 #define duprintf(format, args...)
29 /* Returns 1 if the port is matched by the range, 0 otherwise */
31 port_match(u_int16_t min
, u_int16_t max
, u_int16_t port
, bool invert
)
33 return (port
>= min
&& port
<= max
) ^ invert
;
37 tcp_find_option(u_int8_t option
,
38 const struct sk_buff
*skb
,
44 /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
46 u_int8_t _opt
[60 - sizeof(struct tcphdr
)];
49 duprintf("tcp_match: finding option\n");
54 /* If we don't have the whole header, drop packet. */
55 op
= skb_header_pointer(skb
, protoff
+ sizeof(struct tcphdr
),
62 for (i
= 0; i
< optlen
; ) {
63 if (op
[i
] == option
) return !invert
;
71 static bool tcp_mt(const struct sk_buff
*skb
, const struct xt_match_param
*par
)
73 const struct tcphdr
*th
;
75 const struct xt_tcp
*tcpinfo
= par
->matchinfo
;
77 if (par
->fragoff
!= 0) {
80 Don't allow a fragment of TCP 8 bytes in. Nobody normal
81 causes this. Its a cracker trying to break in by doing a
82 flag overwrite to pass the direction checks.
84 if (par
->fragoff
== 1) {
85 duprintf("Dropping evil TCP offset=1 frag.\n");
88 /* Must not be a fragment. */
92 #define FWINVTCP(bool, invflg) ((bool) ^ !!(tcpinfo->invflags & (invflg)))
94 th
= skb_header_pointer(skb
, par
->thoff
, sizeof(_tcph
), &_tcph
);
96 /* We've been asked to examine this packet, and we
97 can't. Hence, no choice but to drop. */
98 duprintf("Dropping evil TCP offset=0 tinygram.\n");
103 if (!port_match(tcpinfo
->spts
[0], tcpinfo
->spts
[1],
105 !!(tcpinfo
->invflags
& XT_TCP_INV_SRCPT
)))
107 if (!port_match(tcpinfo
->dpts
[0], tcpinfo
->dpts
[1],
109 !!(tcpinfo
->invflags
& XT_TCP_INV_DSTPT
)))
111 if (!FWINVTCP((((unsigned char *)th
)[13] & tcpinfo
->flg_mask
)
115 if (tcpinfo
->option
) {
116 if (th
->doff
* 4 < sizeof(_tcph
)) {
117 *par
->hotdrop
= true;
120 if (!tcp_find_option(tcpinfo
->option
, skb
, par
->thoff
,
121 th
->doff
*4 - sizeof(_tcph
),
122 tcpinfo
->invflags
& XT_TCP_INV_OPTION
,
129 static bool tcp_mt_check(const struct xt_mtchk_param
*par
)
131 const struct xt_tcp
*tcpinfo
= par
->matchinfo
;
133 /* Must specify no unknown invflags */
134 return !(tcpinfo
->invflags
& ~XT_TCP_INV_MASK
);
137 static bool udp_mt(const struct sk_buff
*skb
, const struct xt_match_param
*par
)
139 const struct udphdr
*uh
;
141 const struct xt_udp
*udpinfo
= par
->matchinfo
;
143 /* Must not be a fragment. */
144 if (par
->fragoff
!= 0)
147 uh
= skb_header_pointer(skb
, par
->thoff
, sizeof(_udph
), &_udph
);
149 /* We've been asked to examine this packet, and we
150 can't. Hence, no choice but to drop. */
151 duprintf("Dropping evil UDP tinygram.\n");
152 *par
->hotdrop
= true;
156 return port_match(udpinfo
->spts
[0], udpinfo
->spts
[1],
158 !!(udpinfo
->invflags
& XT_UDP_INV_SRCPT
))
159 && port_match(udpinfo
->dpts
[0], udpinfo
->dpts
[1],
161 !!(udpinfo
->invflags
& XT_UDP_INV_DSTPT
));
164 static bool udp_mt_check(const struct xt_mtchk_param
*par
)
166 const struct xt_udp
*udpinfo
= par
->matchinfo
;
168 /* Must specify no unknown invflags */
169 return !(udpinfo
->invflags
& ~XT_UDP_INV_MASK
);
172 static struct xt_match tcpudp_mt_reg
[] __read_mostly
= {
175 .family
= NFPROTO_IPV4
,
176 .checkentry
= tcp_mt_check
,
178 .matchsize
= sizeof(struct xt_tcp
),
179 .proto
= IPPROTO_TCP
,
184 .family
= NFPROTO_IPV6
,
185 .checkentry
= tcp_mt_check
,
187 .matchsize
= sizeof(struct xt_tcp
),
188 .proto
= IPPROTO_TCP
,
193 .family
= NFPROTO_IPV4
,
194 .checkentry
= udp_mt_check
,
196 .matchsize
= sizeof(struct xt_udp
),
197 .proto
= IPPROTO_UDP
,
202 .family
= NFPROTO_IPV6
,
203 .checkentry
= udp_mt_check
,
205 .matchsize
= sizeof(struct xt_udp
),
206 .proto
= IPPROTO_UDP
,
211 .family
= NFPROTO_IPV4
,
212 .checkentry
= udp_mt_check
,
214 .matchsize
= sizeof(struct xt_udp
),
215 .proto
= IPPROTO_UDPLITE
,
220 .family
= NFPROTO_IPV6
,
221 .checkentry
= udp_mt_check
,
223 .matchsize
= sizeof(struct xt_udp
),
224 .proto
= IPPROTO_UDPLITE
,
229 static int __init
tcpudp_mt_init(void)
231 return xt_register_matches(tcpudp_mt_reg
, ARRAY_SIZE(tcpudp_mt_reg
));
234 static void __exit
tcpudp_mt_exit(void)
236 xt_unregister_matches(tcpudp_mt_reg
, ARRAY_SIZE(tcpudp_mt_reg
));
239 module_init(tcpudp_mt_init
);
240 module_exit(tcpudp_mt_exit
);
This page took 0.035669 seconds and 5 git commands to generate.