1 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
2 #include <linux/types.h>
3 #include <linux/module.h>
5 #include <linux/ipv6.h>
9 #include <linux/netfilter/x_tables.h>
10 #include <linux/netfilter/xt_tcpudp.h>
11 #include <linux/netfilter_ipv4/ip_tables.h>
12 #include <linux/netfilter_ipv6/ip6_tables.h>
14 MODULE_DESCRIPTION("Xtables: TCP, UDP and UDP-Lite match");
15 MODULE_LICENSE("GPL");
16 MODULE_ALIAS("xt_tcp");
17 MODULE_ALIAS("xt_udp");
18 MODULE_ALIAS("ipt_udp");
19 MODULE_ALIAS("ipt_tcp");
20 MODULE_ALIAS("ip6t_udp");
21 MODULE_ALIAS("ip6t_tcp");
23 /* Returns 1 if the port is matched by the range, 0 otherwise */
25 port_match(u_int16_t min
, u_int16_t max
, u_int16_t port
, bool invert
)
27 return (port
>= min
&& port
<= max
) ^ invert
;
31 tcp_find_option(u_int8_t option
,
32 const struct sk_buff
*skb
,
38 /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
40 u_int8_t _opt
[60 - sizeof(struct tcphdr
)];
43 pr_debug("finding option\n");
48 /* If we don't have the whole header, drop packet. */
49 op
= skb_header_pointer(skb
, protoff
+ sizeof(struct tcphdr
),
56 for (i
= 0; i
< optlen
; ) {
57 if (op
[i
] == option
) return !invert
;
65 static bool tcp_mt(const struct sk_buff
*skb
, struct xt_action_param
*par
)
67 const struct tcphdr
*th
;
69 const struct xt_tcp
*tcpinfo
= par
->matchinfo
;
71 if (par
->fragoff
!= 0) {
74 Don't allow a fragment of TCP 8 bytes in. Nobody normal
75 causes this. Its a cracker trying to break in by doing a
76 flag overwrite to pass the direction checks.
78 if (par
->fragoff
== 1) {
79 pr_debug("Dropping evil TCP offset=1 frag.\n");
82 /* Must not be a fragment. */
86 #define FWINVTCP(bool, invflg) ((bool) ^ !!(tcpinfo->invflags & (invflg)))
88 th
= skb_header_pointer(skb
, par
->thoff
, sizeof(_tcph
), &_tcph
);
90 /* We've been asked to examine this packet, and we
91 can't. Hence, no choice but to drop. */
92 pr_debug("Dropping evil TCP offset=0 tinygram.\n");
97 if (!port_match(tcpinfo
->spts
[0], tcpinfo
->spts
[1],
99 !!(tcpinfo
->invflags
& XT_TCP_INV_SRCPT
)))
101 if (!port_match(tcpinfo
->dpts
[0], tcpinfo
->dpts
[1],
103 !!(tcpinfo
->invflags
& XT_TCP_INV_DSTPT
)))
105 if (!FWINVTCP((((unsigned char *)th
)[13] & tcpinfo
->flg_mask
)
109 if (tcpinfo
->option
) {
110 if (th
->doff
* 4 < sizeof(_tcph
)) {
114 if (!tcp_find_option(tcpinfo
->option
, skb
, par
->thoff
,
115 th
->doff
*4 - sizeof(_tcph
),
116 tcpinfo
->invflags
& XT_TCP_INV_OPTION
,
123 static int tcp_mt_check(const struct xt_mtchk_param
*par
)
125 const struct xt_tcp
*tcpinfo
= par
->matchinfo
;
127 /* Must specify no unknown invflags */
128 return (tcpinfo
->invflags
& ~XT_TCP_INV_MASK
) ? -EINVAL
: 0;
131 static bool udp_mt(const struct sk_buff
*skb
, struct xt_action_param
*par
)
133 const struct udphdr
*uh
;
135 const struct xt_udp
*udpinfo
= par
->matchinfo
;
137 /* Must not be a fragment. */
138 if (par
->fragoff
!= 0)
141 uh
= skb_header_pointer(skb
, par
->thoff
, sizeof(_udph
), &_udph
);
143 /* We've been asked to examine this packet, and we
144 can't. Hence, no choice but to drop. */
145 pr_debug("Dropping evil UDP tinygram.\n");
150 return port_match(udpinfo
->spts
[0], udpinfo
->spts
[1],
152 !!(udpinfo
->invflags
& XT_UDP_INV_SRCPT
))
153 && port_match(udpinfo
->dpts
[0], udpinfo
->dpts
[1],
155 !!(udpinfo
->invflags
& XT_UDP_INV_DSTPT
));
158 static int udp_mt_check(const struct xt_mtchk_param
*par
)
160 const struct xt_udp
*udpinfo
= par
->matchinfo
;
162 /* Must specify no unknown invflags */
163 return (udpinfo
->invflags
& ~XT_UDP_INV_MASK
) ? -EINVAL
: 0;
166 static struct xt_match tcpudp_mt_reg
[] __read_mostly
= {
169 .family
= NFPROTO_IPV4
,
170 .checkentry
= tcp_mt_check
,
172 .matchsize
= sizeof(struct xt_tcp
),
173 .proto
= IPPROTO_TCP
,
178 .family
= NFPROTO_IPV6
,
179 .checkentry
= tcp_mt_check
,
181 .matchsize
= sizeof(struct xt_tcp
),
182 .proto
= IPPROTO_TCP
,
187 .family
= NFPROTO_IPV4
,
188 .checkentry
= udp_mt_check
,
190 .matchsize
= sizeof(struct xt_udp
),
191 .proto
= IPPROTO_UDP
,
196 .family
= NFPROTO_IPV6
,
197 .checkentry
= udp_mt_check
,
199 .matchsize
= sizeof(struct xt_udp
),
200 .proto
= IPPROTO_UDP
,
205 .family
= NFPROTO_IPV4
,
206 .checkentry
= udp_mt_check
,
208 .matchsize
= sizeof(struct xt_udp
),
209 .proto
= IPPROTO_UDPLITE
,
214 .family
= NFPROTO_IPV6
,
215 .checkentry
= udp_mt_check
,
217 .matchsize
= sizeof(struct xt_udp
),
218 .proto
= IPPROTO_UDPLITE
,
223 static int __init
tcpudp_mt_init(void)
225 return xt_register_matches(tcpudp_mt_reg
, ARRAY_SIZE(tcpudp_mt_reg
));
228 static void __exit
tcpudp_mt_exit(void)
230 xt_unregister_matches(tcpudp_mt_reg
, ARRAY_SIZE(tcpudp_mt_reg
));
233 module_init(tcpudp_mt_init
);
234 module_exit(tcpudp_mt_exit
);
This page took 0.035952 seconds and 5 git commands to generate.