[linux-2.6-block.git] / net / netfilter / xt_multiport.c

/* Kernel module to match one of a list of TCP/UDP(-Lite)/SCTP/DCCP ports:
   ports are in the same place so we can treat them as equal. */

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/types.h>
#include <linux/udp.h>
#include <linux/skbuff.h>
#include <linux/in.h>

#include <linux/netfilter/xt_multiport.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
MODULE_DESCRIPTION("x_tables multiple port match module");
MODULE_ALIAS("ipt_multiport");
MODULE_ALIAS("ip6t_multiport");

#if 0
#define duprintf(format, args...) printk(format , ## args)
#else
#define duprintf(format, args...)
#endif

/* Returns 1 if the port is matched by the test, 0 otherwise. */
static inline int
ports_match(const u_int16_t *portlist, enum xt_multiport_flags flags,
	    u_int8_t count, u_int16_t src, u_int16_t dst)
{
	unsigned int i;
	for (i = 0; i < count; i++) {
		if (flags != XT_MULTIPORT_DESTINATION && portlist[i] == src)
			return 1;

		if (flags != XT_MULTIPORT_SOURCE && portlist[i] == dst)
			return 1;
	}

	return 0;
}

/* Returns 1 if the port is matched by the test, 0 otherwise. */
static inline int
ports_match_v1(const struct xt_multiport_v1 *minfo,
	       u_int16_t src, u_int16_t dst)
{
	unsigned int i;
	u_int16_t s, e;

	for (i = 0; i < minfo->count; i++) {
		s = minfo->ports[i];

		if (minfo->pflags[i]) {
			/* range port matching */
			e = minfo->ports[++i];
			duprintf("src or dst matches with %d-%d?\n", s, e);

			if (minfo->flags == XT_MULTIPORT_SOURCE
			    && src >= s && src <= e)
				return 1 ^ minfo->invert;
			if (minfo->flags == XT_MULTIPORT_DESTINATION
			    && dst >= s && dst <= e)
				return 1 ^ minfo->invert;
			if (minfo->flags == XT_MULTIPORT_EITHER
			    && ((dst >= s && dst <= e)
				|| (src >= s && src <= e)))
				return 1 ^ minfo->invert;
		} else {
			/* exact port matching */
			duprintf("src or dst matches with %d?\n", s);

			if (minfo->flags == XT_MULTIPORT_SOURCE
			    && src == s)
				return 1 ^ minfo->invert;
			if (minfo->flags == XT_MULTIPORT_DESTINATION
			    && dst == s)
				return 1 ^ minfo->invert;
			if (minfo->flags == XT_MULTIPORT_EITHER
			    && (src == s || dst == s))
				return 1 ^ minfo->invert;
		}
	}

	return minfo->invert;
}

static int
match(const struct sk_buff *skb,
      const struct net_device *in,
      const struct net_device *out,
      const struct xt_match *match,
      const void *matchinfo,
      int offset,
      unsigned int protoff,
      int *hotdrop)
{
	__be16 _ports[2], *pptr;
	const struct xt_multiport *multiinfo = matchinfo;

	if (offset)
		return 0;

	pptr = skb_header_pointer(skb, protoff, sizeof(_ports), _ports);
	if (pptr == NULL) {
		/* We've been asked to examine this packet, and we
		 * can't.  Hence, no choice but to drop.
		 */
		duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n");
		*hotdrop = 1;
		return 0;
	}

	return ports_match(multiinfo->ports,
			   multiinfo->flags, multiinfo->count,
			   ntohs(pptr[0]), ntohs(pptr[1]));
}

static int
match_v1(const struct sk_buff *skb,
	 const struct net_device *in,
	 const struct net_device *out,
	 const struct xt_match *match,
	 const void *matchinfo,
	 int offset,
	 unsigned int protoff,
	 int *hotdrop)
{
	__be16 _ports[2], *pptr;
	const struct xt_multiport_v1 *multiinfo = matchinfo;

	if (offset)
		return 0;

	pptr = skb_header_pointer(skb, protoff, sizeof(_ports), _ports);
	if (pptr == NULL) {
		/* We've been asked to examine this packet, and we
		 * can't.  Hence, no choice but to drop.
		 */
		duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n");
		*hotdrop = 1;
		return 0;
	}

	return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1]));
}

static inline int
check(u_int16_t proto,
      u_int8_t ip_invflags,
      u_int8_t match_flags,
      u_int8_t count)
{
	/* Must specify supported protocol, no unknown flags or bad count */
	return (proto == IPPROTO_TCP || proto == IPPROTO_UDP
		|| proto == IPPROTO_UDPLITE
		|| proto == IPPROTO_SCTP || proto == IPPROTO_DCCP)
		&& !(ip_invflags & XT_INV_PROTO)
		&& (match_flags == XT_MULTIPORT_SOURCE
		    || match_flags == XT_MULTIPORT_DESTINATION
		    || match_flags == XT_MULTIPORT_EITHER)
		&& count <= XT_MULTI_PORTS;
}

/* Called when user tries to insert an entry of this type. */
static int
checkentry(const char *tablename,
	   const void *info,
	   const struct xt_match *match,
	   void *matchinfo,
	   unsigned int hook_mask)
{
	const struct ipt_ip *ip = info;
	const struct xt_multiport *multiinfo = matchinfo;

	return check(ip->proto, ip->invflags, multiinfo->flags,
		     multiinfo->count);
}

static int
checkentry_v1(const char *tablename,
	      const void *info,
	      const struct xt_match *match,
	      void *matchinfo,
	      unsigned int hook_mask)
{
	const struct ipt_ip *ip = info;
	const struct xt_multiport_v1 *multiinfo = matchinfo;

	return check(ip->proto, ip->invflags, multiinfo->flags,
		     multiinfo->count);
}

static int
checkentry6(const char *tablename,
	    const void *info,
	    const struct xt_match *match,
	    void *matchinfo,
	    unsigned int hook_mask)
{
	const struct ip6t_ip6 *ip = info;
	const struct xt_multiport *multiinfo = matchinfo;

	return check(ip->proto, ip->invflags, multiinfo->flags,
		     multiinfo->count);
}

static int
checkentry6_v1(const char *tablename,
	       const void *info,
	       const struct xt_match *match,
	       void *matchinfo,
	       unsigned int hook_mask)
{
	const struct ip6t_ip6 *ip = info;
	const struct xt_multiport_v1 *multiinfo = matchinfo;

	return check(ip->proto, ip->invflags, multiinfo->flags,
		     multiinfo->count);
}

static struct xt_match xt_multiport_match[] = {
	{
		.name		= "multiport",
		.family		= AF_INET,
		.revision	= 0,
		.checkentry	= checkentry,
		.match		= match,
		.matchsize	= sizeof(struct xt_multiport),
		.me		= THIS_MODULE,
	},
	{
		.name		= "multiport",
		.family		= AF_INET,
		.revision	= 1,
		.checkentry	= checkentry_v1,
		.match		= match_v1,
		.matchsize	= sizeof(struct xt_multiport_v1),
		.me		= THIS_MODULE,
	},
	{
		.name		= "multiport",
		.family		= AF_INET6,
		.revision	= 0,
		.checkentry	= checkentry6,
		.match		= match,
		.matchsize	= sizeof(struct xt_multiport),
		.me		= THIS_MODULE,
	},
	{
		.name		= "multiport",
		.family		= AF_INET6,
		.revision	= 1,
		.checkentry	= checkentry6_v1,
		.match		= match_v1,
		.matchsize	= sizeof(struct xt_multiport_v1),
		.me		= THIS_MODULE,
	},
};

static int __init xt_multiport_init(void)
{
	return xt_register_matches(xt_multiport_match,
				   ARRAY_SIZE(xt_multiport_match));
}

static void __exit xt_multiport_fini(void)
{
	xt_unregister_matches(xt_multiport_match,
			      ARRAY_SIZE(xt_multiport_match));
}

module_init(xt_multiport_init);
module_exit(xt_multiport_fini);
Commit	Line	Data
ba4e58ec GR	1	/* Kernel module to match one of a list of TCP/UDP(-Lite)/SCTP/DCCP ports:
ba4e58ec GR	2	ports are in the same place so we can treat them as equal. */
a89ecb6a YK	3
	4	/* (C) 1999-2001 Paul `Rusty' Russell
	5	* (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
	10	*/
	11
	12	#include <linux/module.h>
	13	#include <linux/types.h>
	14	#include <linux/udp.h>
	15	#include <linux/skbuff.h>
	16	#include <linux/in.h>
	17
	18	#include <linux/netfilter/xt_multiport.h>
	19	#include <linux/netfilter/x_tables.h>
	20	#include <linux/netfilter_ipv4/ip_tables.h>
	21	#include <linux/netfilter_ipv6/ip6_tables.h>
	22
	23	MODULE_LICENSE("GPL");
	24	MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
	25	MODULE_DESCRIPTION("x_tables multiple port match module");
	26	MODULE_ALIAS("ipt_multiport");
	27	MODULE_ALIAS("ip6t_multiport");
	28
	29	#if 0
	30	#define duprintf(format, args...) printk(format , ## args)
	31	#else
	32	#define duprintf(format, args...)
	33	#endif
	34
	35	/* Returns 1 if the port is matched by the test, 0 otherwise. */
	36	static inline int
	37	ports_match(const u_int16_t *portlist, enum xt_multiport_flags flags,
	38	u_int8_t count, u_int16_t src, u_int16_t dst)
	39	{
	40	unsigned int i;
	41	for (i = 0; i < count; i++) {
	42	if (flags != XT_MULTIPORT_DESTINATION && portlist[i] == src)
	43	return 1;
	44
	45	if (flags != XT_MULTIPORT_SOURCE && portlist[i] == dst)
	46	return 1;
	47	}
	48
	49	return 0;
	50	}
	51
	52	/* Returns 1 if the port is matched by the test, 0 otherwise. */
	53	static inline int
	54	ports_match_v1(const struct xt_multiport_v1 *minfo,
	55	u_int16_t src, u_int16_t dst)
	56	{
	57	unsigned int i;
	58	u_int16_t s, e;
	59
	60	for (i = 0; i < minfo->count; i++) {
	61	s = minfo->ports[i];
	62
	63	if (minfo->pflags[i]) {
	64	/* range port matching */
	65	e = minfo->ports[++i];
	66	duprintf("src or dst matches with %d-%d?\n", s, e);
67
68	if (minfo->flags == XT_MULTIPORT_SOURCE
69	&& src >= s && src <= e)
70	return 1 ^ minfo->invert;
71	if (minfo->flags == XT_MULTIPORT_DESTINATION
72	&& dst >= s && dst <= e)
73	return 1 ^ minfo->invert;
74	if (minfo->flags == XT_MULTIPORT_EITHER
75	&& ((dst >= s && dst <= e)
76	\|\| (src >= s && src <= e)))
77	return 1 ^ minfo->invert;
78	} else {
79	/* exact port matching */
80	duprintf("src or dst matches with %d?\n", s);
81
82	if (minfo->flags == XT_MULTIPORT_SOURCE
83	&& src == s)
84	return 1 ^ minfo->invert;
85	if (minfo->flags == XT_MULTIPORT_DESTINATION
86	&& dst == s)
87	return 1 ^ minfo->invert;
88	if (minfo->flags == XT_MULTIPORT_EITHER
89	&& (src == s \|\| dst == s))
90	return 1 ^ minfo->invert;
91	}
92	}
93
601e68e1	94	return minfo->invert;
a89ecb6a YK	95	}
	96
	97	static int
	98	match(const struct sk_buff *skb,
	99	const struct net_device *in,
	100	const struct net_device *out,
	101	const struct xt_match *match,
	102	const void *matchinfo,
	103	int offset,
	104	unsigned int protoff,
	105	int *hotdrop)
	106	{
98a4a861	107	__be16 _ports[2], *pptr;
a89ecb6a YK	108	const struct xt_multiport *multiinfo = matchinfo;
	109
	110	if (offset)
	111	return 0;
	112
	113	pptr = skb_header_pointer(skb, protoff, sizeof(_ports), _ports);
	114	if (pptr == NULL) {
	115	/* We've been asked to examine this packet, and we
	116	* can't. Hence, no choice but to drop.
	117	*/
	118	duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n");
	119	*hotdrop = 1;
	120	return 0;
	121	}
	122
	123	return ports_match(multiinfo->ports,
	124	multiinfo->flags, multiinfo->count,
	125	ntohs(pptr[0]), ntohs(pptr[1]));
	126	}
	127
	128	static int
	129	match_v1(const struct sk_buff *skb,
	130	const struct net_device *in,
	131	const struct net_device *out,
	132	const struct xt_match *match,
	133	const void *matchinfo,
	134	int offset,
	135	unsigned int protoff,
	136	int *hotdrop)
	137	{
98a4a861	138	__be16 _ports[2], *pptr;
a89ecb6a YK	139	const struct xt_multiport_v1 *multiinfo = matchinfo;
	140
	141	if (offset)
	142	return 0;
	143
	144	pptr = skb_header_pointer(skb, protoff, sizeof(_ports), _ports);
	145	if (pptr == NULL) {
	146	/* We've been asked to examine this packet, and we
	147	* can't. Hence, no choice but to drop.
	148	*/
	149	duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n");
	150	*hotdrop = 1;
	151	return 0;
	152	}
	153
	154	return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1]));
	155	}
	156
	157	static inline int
	158	check(u_int16_t proto,
	159	u_int8_t ip_invflags,
	160	u_int8_t match_flags,
	161	u_int8_t count)
	162	{
957dc80a PM	163	/* Must specify supported protocol, no unknown flags or bad count */
957dc80a PM	164	return (proto == IPPROTO_TCP \|\| proto == IPPROTO_UDP
ba4e58ec	165	\|\| proto == IPPROTO_UDPLITE
957dc80a	166	\|\| proto == IPPROTO_SCTP \|\| proto == IPPROTO_DCCP)
a89ecb6a YK	167	&& !(ip_invflags & XT_INV_PROTO)
	168	&& (match_flags == XT_MULTIPORT_SOURCE
	169	\|\| match_flags == XT_MULTIPORT_DESTINATION
	170	\|\| match_flags == XT_MULTIPORT_EITHER)
	171	&& count <= XT_MULTI_PORTS;
	172	}
	173
	174	/* Called when user tries to insert an entry of this type. */
	175	static int
	176	checkentry(const char *tablename,
	177	const void *info,
	178	const struct xt_match *match,
	179	void *matchinfo,
a89ecb6a YK	180	unsigned int hook_mask)
	181	{
	182	const struct ipt_ip *ip = info;
	183	const struct xt_multiport *multiinfo = matchinfo;
	184
	185	return check(ip->proto, ip->invflags, multiinfo->flags,
	186	multiinfo->count);
	187	}
	188
	189	static int
	190	checkentry_v1(const char *tablename,
	191	const void *info,
	192	const struct xt_match *match,
	193	void *matchinfo,
a89ecb6a YK	194	unsigned int hook_mask)
	195	{
	196	const struct ipt_ip *ip = info;
	197	const struct xt_multiport_v1 *multiinfo = matchinfo;
	198
	199	return check(ip->proto, ip->invflags, multiinfo->flags,
	200	multiinfo->count);
	201	}
	202
	203	static int
	204	checkentry6(const char *tablename,
	205	const void *info,
	206	const struct xt_match *match,
	207	void *matchinfo,
a89ecb6a YK	208	unsigned int hook_mask)
	209	{
	210	const struct ip6t_ip6 *ip = info;
	211	const struct xt_multiport *multiinfo = matchinfo;
	212
	213	return check(ip->proto, ip->invflags, multiinfo->flags,
	214	multiinfo->count);
	215	}
	216
	217	static int
	218	checkentry6_v1(const char *tablename,
	219	const void *info,
	220	const struct xt_match *match,
	221	void *matchinfo,
a89ecb6a YK	222	unsigned int hook_mask)
	223	{
	224	const struct ip6t_ip6 *ip = info;
	225	const struct xt_multiport_v1 *multiinfo = matchinfo;
	226
	227	return check(ip->proto, ip->invflags, multiinfo->flags,
	228	multiinfo->count);
	229	}
	230
4470bbc7 PM	231	static struct xt_match xt_multiport_match[] = {
	232	{
	233	.name = "multiport",
	234	.family = AF_INET,
	235	.revision = 0,
	236	.checkentry = checkentry,
	237	.match = match,
	238	.matchsize = sizeof(struct xt_multiport),
	239	.me = THIS_MODULE,
	240	},
	241	{
	242	.name = "multiport",
	243	.family = AF_INET,
	244	.revision = 1,
	245	.checkentry = checkentry_v1,
	246	.match = match_v1,
	247	.matchsize = sizeof(struct xt_multiport_v1),
	248	.me = THIS_MODULE,
	249	},
	250	{
	251	.name = "multiport",
	252	.family = AF_INET6,
	253	.revision = 0,
	254	.checkentry = checkentry6,
	255	.match = match,
	256	.matchsize = sizeof(struct xt_multiport),
	257	.me = THIS_MODULE,
	258	},
	259	{
	260	.name = "multiport",
	261	.family = AF_INET6,
	262	.revision = 1,
	263	.checkentry = checkentry6_v1,
	264	.match = match_v1,
	265	.matchsize = sizeof(struct xt_multiport_v1),
	266	.me = THIS_MODULE,
	267	},
a89ecb6a YK	268	};
	269
	270	static int __init xt_multiport_init(void)
	271	{
4470bbc7 PM	272	return xt_register_matches(xt_multiport_match,
4470bbc7 PM	273	ARRAY_SIZE(xt_multiport_match));
a89ecb6a YK	274	}
	275
	276	static void __exit xt_multiport_fini(void)
	277	{
4470bbc7 PM	278	xt_unregister_matches(xt_multiport_match,
4470bbc7 PM	279	ARRAY_SIZE(xt_multiport_match));
a89ecb6a YK	280	}
	281
	282	module_init(xt_multiport_init);
	283	module_exit(xt_multiport_fini);