1 #include <linux/types.h>
2 #include <linux/module.h>
4 #include <linux/ipv6.h>
8 #include <linux/netfilter/x_tables.h>
9 #include <linux/netfilter/xt_tcpudp.h>
10 #include <linux/netfilter_ipv4/ip_tables.h>
11 #include <linux/netfilter_ipv6/ip6_tables.h>
13 MODULE_DESCRIPTION("Xtables: TCP, UDP and UDP-Lite match");
14 MODULE_LICENSE("GPL");
15 MODULE_ALIAS("xt_tcp");
16 MODULE_ALIAS("xt_udp");
17 MODULE_ALIAS("ipt_udp");
18 MODULE_ALIAS("ipt_tcp");
19 MODULE_ALIAS("ip6t_udp");
20 MODULE_ALIAS("ip6t_tcp");
22 #ifdef DEBUG_IP_FIREWALL_USER
23 #define duprintf(format, args...) printk(format , ## args)
25 #define duprintf(format, args...)
29 /* Returns 1 if the port is matched by the range, 0 otherwise */
31 port_match(u_int16_t min, u_int16_t max, u_int16_t port, bool invert)
33 return (port >= min && port <= max) ^ invert;
37 tcp_find_option(u_int8_t option,
38 const struct sk_buff *skb,
44 /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
46 u_int8_t _opt[60 - sizeof(struct tcphdr)];
49 duprintf("tcp_match: finding option\n");
54 /* If we don't have the whole header, drop packet. */
55 op = skb_header_pointer(skb, protoff + sizeof(struct tcphdr),
62 for (i = 0; i < optlen; ) {
63 if (op[i] == option) return !invert;
71 static bool tcp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
73 const struct tcphdr *th;
75 const struct xt_tcp *tcpinfo = par->matchinfo;
77 if (par->fragoff != 0) {
80 Don't allow a fragment of TCP 8 bytes in. Nobody normal
81 causes this. Its a cracker trying to break in by doing a
82 flag overwrite to pass the direction checks.
84 if (par->fragoff == 1) {
85 duprintf("Dropping evil TCP offset=1 frag.\n");
88 /* Must not be a fragment. */
92 #define FWINVTCP(bool, invflg) ((bool) ^ !!(tcpinfo->invflags & (invflg)))
94 th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
96 /* We've been asked to examine this packet, and we
97 can't. Hence, no choice but to drop. */
98 duprintf("Dropping evil TCP offset=0 tinygram.\n");
103 if (!port_match(tcpinfo->spts[0], tcpinfo->spts[1],
105 !!(tcpinfo->invflags & XT_TCP_INV_SRCPT)))
107 if (!port_match(tcpinfo->dpts[0], tcpinfo->dpts[1],
109 !!(tcpinfo->invflags & XT_TCP_INV_DSTPT)))
111 if (!FWINVTCP((((unsigned char *)th)[13] & tcpinfo->flg_mask)
115 if (tcpinfo->option) {
116 if (th->doff * 4 < sizeof(_tcph)) {
117 *par->hotdrop = true;
120 if (!tcp_find_option(tcpinfo->option, skb, par->thoff,
121 th->doff*4 - sizeof(_tcph),
122 tcpinfo->invflags & XT_TCP_INV_OPTION,
129 /* Called when user tries to insert an entry of this type. */
131 tcp_mt_check(const char *tablename, const void *info,
132 const struct xt_match *match, void *matchinfo,
133 unsigned int hook_mask)
135 const struct xt_tcp *tcpinfo = matchinfo;
137 /* Must specify no unknown invflags */
138 return !(tcpinfo->invflags & ~XT_TCP_INV_MASK);
141 static bool udp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
143 const struct udphdr *uh;
145 const struct xt_udp *udpinfo = par->matchinfo;
147 /* Must not be a fragment. */
148 if (par->fragoff != 0)
151 uh = skb_header_pointer(skb, par->thoff, sizeof(_udph), &_udph);
153 /* We've been asked to examine this packet, and we
154 can't. Hence, no choice but to drop. */
155 duprintf("Dropping evil UDP tinygram.\n");
156 *par->hotdrop = true;
160 return port_match(udpinfo->spts[0], udpinfo->spts[1],
162 !!(udpinfo->invflags & XT_UDP_INV_SRCPT))
163 && port_match(udpinfo->dpts[0], udpinfo->dpts[1],
165 !!(udpinfo->invflags & XT_UDP_INV_DSTPT));
168 /* Called when user tries to insert an entry of this type. */
170 udp_mt_check(const char *tablename, const void *info,
171 const struct xt_match *match, void *matchinfo,
172 unsigned int hook_mask)
174 const struct xt_udp *udpinfo = matchinfo;
176 /* Must specify no unknown invflags */
177 return !(udpinfo->invflags & ~XT_UDP_INV_MASK);
180 static struct xt_match tcpudp_mt_reg[] __read_mostly = {
183 .family = NFPROTO_IPV4,
184 .checkentry = tcp_mt_check,
186 .matchsize = sizeof(struct xt_tcp),
187 .proto = IPPROTO_TCP,
192 .family = NFPROTO_IPV6,
193 .checkentry = tcp_mt_check,
195 .matchsize = sizeof(struct xt_tcp),
196 .proto = IPPROTO_TCP,
201 .family = NFPROTO_IPV4,
202 .checkentry = udp_mt_check,
204 .matchsize = sizeof(struct xt_udp),
205 .proto = IPPROTO_UDP,
210 .family = NFPROTO_IPV6,
211 .checkentry = udp_mt_check,
213 .matchsize = sizeof(struct xt_udp),
214 .proto = IPPROTO_UDP,
219 .family = NFPROTO_IPV4,
220 .checkentry = udp_mt_check,
222 .matchsize = sizeof(struct xt_udp),
223 .proto = IPPROTO_UDPLITE,
228 .family = NFPROTO_IPV6,
229 .checkentry = udp_mt_check,
231 .matchsize = sizeof(struct xt_udp),
232 .proto = IPPROTO_UDPLITE,
237 static int __init tcpudp_mt_init(void)
239 return xt_register_matches(tcpudp_mt_reg, ARRAY_SIZE(tcpudp_mt_reg));
242 static void __exit tcpudp_mt_exit(void)
244 xt_unregister_matches(tcpudp_mt_reg, ARRAY_SIZE(tcpudp_mt_reg));
247 module_init(tcpudp_mt_init);
248 module_exit(tcpudp_mt_exit);