You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
230 lines
6.4 KiB
Diff
230 lines
6.4 KiB
Diff
--- a/include/linux/netfilter_ipv4/ipt_multiport.h
|
|
+++ b/include/linux/netfilter_ipv4/ipt_multiport.h
|
|
@@ -11,11 +11,12 @@ enum ipt_multiport_flags
|
|
|
|
#define IPT_MULTI_PORTS 15
|
|
|
|
-/* Must fit inside union ipt_matchinfo: 16 bytes */
|
|
-struct ipt_multiport
|
|
+struct ipt_multiport_v1
|
|
{
|
|
u_int8_t flags; /* Type of comparison */
|
|
u_int8_t count; /* Number of ports */
|
|
u_int16_t ports[IPT_MULTI_PORTS]; /* Ports */
|
|
+ u_int8_t pflags[IPT_MULTI_PORTS]; /* Port flags */
|
|
+ u_int8_t invert; /* Invert flag */
|
|
};
|
|
#endif /*_IPT_MULTIPORT_H*/
|
|
--- a/net/ipv4/netfilter/ipt_multiport.c
|
|
+++ b/net/ipv4/netfilter/ipt_multiport.c
|
|
@@ -1,5 +1,14 @@
|
|
/* Kernel module to match one of a list of TCP/UDP ports: ports are in
|
|
the same place so we can treat them as equal. */
|
|
+
|
|
+/* (C) 1999-2001 Paul `Rusty' Russell
|
|
+ * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
|
|
+ *
|
|
+ * This program is free software; you can redistribute it and/or modify
|
|
+ * it under the terms of the GNU General Public License version 2 as
|
|
+ * published by the Free Software Foundation.
|
|
+ */
|
|
+
|
|
#include <linux/module.h>
|
|
#include <linux/types.h>
|
|
#include <linux/udp.h>
|
|
@@ -8,97 +17,136 @@
|
|
#include <linux/netfilter_ipv4/ipt_multiport.h>
|
|
#include <linux/netfilter_ipv4/ip_tables.h>
|
|
|
|
+MODULE_LICENSE("GPL");
|
|
+MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
|
|
+MODULE_DESCRIPTION("iptables multiple port match module");
|
|
+
|
|
#if 0
|
|
#define duprintf(format, args...) printk(format , ## args)
|
|
#else
|
|
#define duprintf(format, args...)
|
|
#endif
|
|
|
|
+/* from linux 2.6 skbuff.h */
|
|
+static inline void *skb_header_pointer(const struct sk_buff *skb, int offset,
|
|
+ int len, void *buffer)
|
|
+{
|
|
+ int hlen = skb_headlen(skb);
|
|
+
|
|
+ if (hlen - offset >= len)
|
|
+ return skb->data + offset;
|
|
+
|
|
+ if (skb_copy_bits(skb, offset, buffer, len) < 0)
|
|
+ return NULL;
|
|
+
|
|
+ return buffer;
|
|
+}
|
|
+
|
|
+
|
|
/* Returns 1 if the port is matched by the test, 0 otherwise. */
|
|
static inline int
|
|
-ports_match(const u_int16_t *portlist, enum ipt_multiport_flags flags,
|
|
- u_int8_t count, u_int16_t src, u_int16_t dst)
|
|
+ports_match_v1(const struct ipt_multiport_v1 *minfo,
|
|
+ u_int16_t src, u_int16_t dst)
|
|
{
|
|
unsigned int i;
|
|
- for (i=0; i<count; i++) {
|
|
- if (flags != IPT_MULTIPORT_DESTINATION
|
|
- && portlist[i] == src)
|
|
- return 1;
|
|
-
|
|
- if (flags != IPT_MULTIPORT_SOURCE
|
|
- && portlist[i] == dst)
|
|
- return 1;
|
|
- }
|
|
+ u_int16_t s, e;
|
|
|
|
- return 0;
|
|
+ for (i=0; i < minfo->count; i++) {
|
|
+ s = minfo->ports[i];
|
|
+
|
|
+ if (minfo->pflags[i]) {
|
|
+ /* range port matching */
|
|
+ e = minfo->ports[++i];
|
|
+ duprintf("src or dst matches with %d-%d?\n", s, e);
|
|
+
|
|
+ if (minfo->flags == IPT_MULTIPORT_SOURCE
|
|
+ && src >= s && src <= e)
|
|
+ return 1 ^ minfo->invert;
|
|
+ if (minfo->flags == IPT_MULTIPORT_DESTINATION
|
|
+ && dst >= s && dst <= e)
|
|
+ return 1 ^ minfo->invert;
|
|
+ if (minfo->flags == IPT_MULTIPORT_EITHER
|
|
+ && ((dst >= s && dst <= e)
|
|
+ || (src >= s && src <= e)))
|
|
+ return 1 ^ minfo->invert;
|
|
+ } else {
|
|
+ /* exact port matching */
|
|
+ duprintf("src or dst matches with %d?\n", s);
|
|
+
|
|
+ if (minfo->flags == IPT_MULTIPORT_SOURCE
|
|
+ && src == s)
|
|
+ return 1 ^ minfo->invert;
|
|
+ if (minfo->flags == IPT_MULTIPORT_DESTINATION
|
|
+ && dst == s)
|
|
+ return 1 ^ minfo->invert;
|
|
+ if (minfo->flags == IPT_MULTIPORT_EITHER
|
|
+ && (src == s || dst == s))
|
|
+ return 1 ^ minfo->invert;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ return minfo->invert;
|
|
}
|
|
|
|
static int
|
|
-match(const struct sk_buff *skb,
|
|
- const struct net_device *in,
|
|
- const struct net_device *out,
|
|
- const void *matchinfo,
|
|
- int offset,
|
|
- const void *hdr,
|
|
- u_int16_t datalen,
|
|
- int *hotdrop)
|
|
+match_v1(const struct sk_buff *skb,
|
|
+ const struct net_device *in,
|
|
+ const struct net_device *out,
|
|
+ const void *matchinfo,
|
|
+ int offset,
|
|
+ int *hotdrop)
|
|
{
|
|
- const struct udphdr *udp = hdr;
|
|
- const struct ipt_multiport *multiinfo = matchinfo;
|
|
+ u16 _ports[2], *pptr;
|
|
+ const struct ipt_multiport_v1 *multiinfo = matchinfo;
|
|
+
|
|
+ if (offset)
|
|
+ return 0;
|
|
|
|
- /* Must be big enough to read ports. */
|
|
- if (offset == 0 && datalen < sizeof(struct udphdr)) {
|
|
+ pptr = skb_header_pointer(skb, skb->nh.iph->ihl * 4,
|
|
+ sizeof(_ports), _ports);
|
|
+ if (pptr == NULL) {
|
|
/* We've been asked to examine this packet, and we
|
|
- can't. Hence, no choice but to drop. */
|
|
- duprintf("ipt_multiport:"
|
|
- " Dropping evil offset=0 tinygram.\n");
|
|
- *hotdrop = 1;
|
|
- return 0;
|
|
+ * can't. Hence, no choice but to drop.
|
|
+ */
|
|
+ duprintf("ipt_multiport:"
|
|
+ " Dropping evil offset=0 tinygram.\n");
|
|
+ *hotdrop = 1;
|
|
+ return 0;
|
|
}
|
|
|
|
- /* Must not be a fragment. */
|
|
- return !offset
|
|
- && ports_match(multiinfo->ports,
|
|
- multiinfo->flags, multiinfo->count,
|
|
- ntohs(udp->source), ntohs(udp->dest));
|
|
+ return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1]));
|
|
}
|
|
|
|
-/* Called when user tries to insert an entry of this type. */
|
|
static int
|
|
-checkentry(const char *tablename,
|
|
- const struct ipt_ip *ip,
|
|
- void *matchinfo,
|
|
- unsigned int matchsize,
|
|
- unsigned int hook_mask)
|
|
+checkentry_v1(const char *tablename,
|
|
+ const struct ipt_ip *ip,
|
|
+ void *matchinfo,
|
|
+ unsigned int matchsize,
|
|
+ unsigned int hook_mask)
|
|
{
|
|
- const struct ipt_multiport *multiinfo = matchinfo;
|
|
-
|
|
- if (matchsize != IPT_ALIGN(sizeof(struct ipt_multiport)))
|
|
- return 0;
|
|
-
|
|
- /* Must specify proto == TCP/UDP, no unknown flags or bad count */
|
|
- return (ip->proto == IPPROTO_TCP || ip->proto == IPPROTO_UDP)
|
|
- && !(ip->invflags & IPT_INV_PROTO)
|
|
- && matchsize == IPT_ALIGN(sizeof(struct ipt_multiport))
|
|
- && (multiinfo->flags == IPT_MULTIPORT_SOURCE
|
|
- || multiinfo->flags == IPT_MULTIPORT_DESTINATION
|
|
- || multiinfo->flags == IPT_MULTIPORT_EITHER)
|
|
- && multiinfo->count <= IPT_MULTI_PORTS;
|
|
+ return (matchsize == IPT_ALIGN(sizeof(struct ipt_multiport_v1)));
|
|
}
|
|
|
|
-static struct ipt_match multiport_match
|
|
-= { { NULL, NULL }, "multiport", &match, &checkentry, NULL, THIS_MODULE };
|
|
+static struct ipt_match multiport_match_v1 = {
|
|
+ .name = "multiport",
|
|
+ .match = &match_v1,
|
|
+ .checkentry = &checkentry_v1,
|
|
+ .me = THIS_MODULE,
|
|
+};
|
|
|
|
static int __init init(void)
|
|
{
|
|
- return ipt_register_match(&multiport_match);
|
|
+ int err;
|
|
+
|
|
+ err = ipt_register_match(&multiport_match_v1);
|
|
+
|
|
+ return err;
|
|
}
|
|
|
|
static void __exit fini(void)
|
|
{
|
|
- ipt_unregister_match(&multiport_match);
|
|
+ ipt_unregister_match(&multiport_match_v1);
|
|
}
|
|
|
|
module_init(init);
|
|
module_exit(fini);
|
|
-MODULE_LICENSE("GPL");
|