1#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 2#include <linux/types.h> 3#include <linux/module.h> 4#include <net/ip.h> 5#include <linux/ipv6.h> 6#include <net/ipv6.h> 7#include <net/tcp.h> 8#include <net/udp.h> 9#include <linux/netfilter/x_tables.h> 10#include <linux/netfilter/xt_tcpudp.h> 11#include <linux/netfilter_ipv4/ip_tables.h> 12#include <linux/netfilter_ipv6/ip6_tables.h> 13 14MODULE_DESCRIPTION("Xtables: TCP, UDP and UDP-Lite match"); 15MODULE_LICENSE("GPL"); 16MODULE_ALIAS("xt_tcp"); 17MODULE_ALIAS("xt_udp"); 18MODULE_ALIAS("ipt_udp"); 19MODULE_ALIAS("ipt_tcp"); 20MODULE_ALIAS("ip6t_udp"); 21MODULE_ALIAS("ip6t_tcp"); 22 23/* Returns 1 if the port is matched by the range, 0 otherwise */ 24static inline bool 25port_match(u_int16_t min, u_int16_t max, u_int16_t port, bool invert) 26{ 27 return (port >= min && port <= max) ^ invert; 28} 29 30static bool 31tcp_find_option(u_int8_t option, 32 const struct sk_buff *skb, 33 unsigned int protoff, 34 unsigned int optlen, 35 bool invert, 36 bool *hotdrop) 37{ 38 /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */ 39 const u_int8_t *op; 40 u_int8_t _opt[60 - sizeof(struct tcphdr)]; 41 unsigned int i; 42 43 pr_debug("finding option\n"); 44 45 if (!optlen) 46 return invert; 47 48 /* If we don't have the whole header, drop packet. */ 49 op = skb_header_pointer(skb, protoff + sizeof(struct tcphdr), 50 optlen, _opt); 51 if (op == NULL) { 52 *hotdrop = true; 53 return false; 54 } 55 56 for (i = 0; i < optlen; ) { 57 if (op[i] == option) return !invert; 58 if (op[i] < 2) i++; 59 else i += op[i+1]?:1; 60 } 61 62 return invert; 63} 64 65static bool tcp_mt(const struct sk_buff *skb, struct xt_action_param *par) 66{ 67 const struct tcphdr *th; 68 struct tcphdr _tcph; 69 const struct xt_tcp *tcpinfo = par->matchinfo; 70 71 if (par->fragoff != 0) { 72 /* To quote Alan: 73 74 Don't allow a fragment of TCP 8 bytes in. Nobody normal 75 causes this. Its a cracker trying to break in by doing a 76 flag overwrite to pass the direction checks. 77 */ 78 if (par->fragoff == 1) { 79 pr_debug("Dropping evil TCP offset=1 frag.\n"); 80 par->hotdrop = true; 81 } 82 /* Must not be a fragment. */ 83 return false; 84 } 85 86#define FWINVTCP(bool, invflg) ((bool) ^ !!(tcpinfo->invflags & (invflg))) 87 88 th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph); 89 if (th == NULL) { 90 /* We've been asked to examine this packet, and we 91 can't. Hence, no choice but to drop. */ 92 pr_debug("Dropping evil TCP offset=0 tinygram.\n"); 93 par->hotdrop = true; 94 return false; 95 } 96 97 if (!port_match(tcpinfo->spts[0], tcpinfo->spts[1], 98 ntohs(th->source), 99 !!(tcpinfo->invflags & XT_TCP_INV_SRCPT))) 100 return false; 101 if (!port_match(tcpinfo->dpts[0], tcpinfo->dpts[1], 102 ntohs(th->dest), 103 !!(tcpinfo->invflags & XT_TCP_INV_DSTPT))) 104 return false; 105 if (!FWINVTCP((((unsigned char *)th)[13] & tcpinfo->flg_mask) 106 == tcpinfo->flg_cmp, 107 XT_TCP_INV_FLAGS)) 108 return false; 109 if (tcpinfo->option) { 110 if (th->doff * 4 < sizeof(_tcph)) { 111 par->hotdrop = true; 112 return false; 113 } 114 if (!tcp_find_option(tcpinfo->option, skb, par->thoff, 115 th->doff*4 - sizeof(_tcph), 116 tcpinfo->invflags & XT_TCP_INV_OPTION, 117 &par->hotdrop)) 118 return false; 119 } 120 return true; 121} 122 123static int tcp_mt_check(const struct xt_mtchk_param *par) 124{ 125 const struct xt_tcp *tcpinfo = par->matchinfo; 126 127 /* Must specify no unknown invflags */ 128 return (tcpinfo->invflags & ~XT_TCP_INV_MASK) ? -EINVAL : 0; 129} 130 131static bool udp_mt(const struct sk_buff *skb, struct xt_action_param *par) 132{ 133 const struct udphdr *uh; 134 struct udphdr _udph; 135 const struct xt_udp *udpinfo = par->matchinfo; 136 137 /* Must not be a fragment. */ 138 if (par->fragoff != 0) 139 return false; 140 141 uh = skb_header_pointer(skb, par->thoff, sizeof(_udph), &_udph); 142 if (uh == NULL) { 143 /* We've been asked to examine this packet, and we 144 can't. Hence, no choice but to drop. */ 145 pr_debug("Dropping evil UDP tinygram.\n"); 146 par->hotdrop = true; 147 return false; 148 } 149 150 return port_match(udpinfo->spts[0], udpinfo->spts[1], 151 ntohs(uh->source), 152 !!(udpinfo->invflags & XT_UDP_INV_SRCPT)) 153 && port_match(udpinfo->dpts[0], udpinfo->dpts[1], 154 ntohs(uh->dest), 155 !!(udpinfo->invflags & XT_UDP_INV_DSTPT)); 156} 157 158static int udp_mt_check(const struct xt_mtchk_param *par) 159{ 160 const struct xt_udp *udpinfo = par->matchinfo; 161 162 /* Must specify no unknown invflags */ 163 return (udpinfo->invflags & ~XT_UDP_INV_MASK) ? -EINVAL : 0; 164} 165 166static struct xt_match tcpudp_mt_reg[] __read_mostly = { 167 { 168 .name = "tcp", 169 .family = NFPROTO_IPV4, 170 .checkentry = tcp_mt_check, 171 .match = tcp_mt, 172 .matchsize = sizeof(struct xt_tcp), 173 .proto = IPPROTO_TCP, 174 .me = THIS_MODULE, 175 }, 176 { 177 .name = "tcp", 178 .family = NFPROTO_IPV6, 179 .checkentry = tcp_mt_check, 180 .match = tcp_mt, 181 .matchsize = sizeof(struct xt_tcp), 182 .proto = IPPROTO_TCP, 183 .me = THIS_MODULE, 184 }, 185 { 186 .name = "udp", 187 .family = NFPROTO_IPV4, 188 .checkentry = udp_mt_check, 189 .match = udp_mt, 190 .matchsize = sizeof(struct xt_udp), 191 .proto = IPPROTO_UDP, 192 .me = THIS_MODULE, 193 }, 194 { 195 .name = "udp", 196 .family = NFPROTO_IPV6, 197 .checkentry = udp_mt_check, 198 .match = udp_mt, 199 .matchsize = sizeof(struct xt_udp), 200 .proto = IPPROTO_UDP, 201 .me = THIS_MODULE, 202 }, 203 { 204 .name = "udplite", 205 .family = NFPROTO_IPV4, 206 .checkentry = udp_mt_check, 207 .match = udp_mt, 208 .matchsize = sizeof(struct xt_udp), 209 .proto = IPPROTO_UDPLITE, 210 .me = THIS_MODULE, 211 }, 212 { 213 .name = "udplite", 214 .family = NFPROTO_IPV6, 215 .checkentry = udp_mt_check, 216 .match = udp_mt, 217 .matchsize = sizeof(struct xt_udp), 218 .proto = IPPROTO_UDPLITE, 219 .me = THIS_MODULE, 220 }, 221}; 222 223static int __init tcpudp_mt_init(void) 224{ 225 return xt_register_matches(tcpudp_mt_reg, ARRAY_SIZE(tcpudp_mt_reg)); 226} 227 228static void __exit tcpudp_mt_exit(void) 229{ 230 xt_unregister_matches(tcpudp_mt_reg, ARRAY_SIZE(tcpudp_mt_reg)); 231} 232 233module_init(tcpudp_mt_init); 234module_exit(tcpudp_mt_exit); 235