1 #include <linux/types.h>
2 #include <linux/module.h>
7 #include <linux/netfilter/x_tables.h>
8 #include <linux/netfilter/xt_tcpudp.h>
9 #include <linux/netfilter_ipv4/ip_tables.h>
10 #include <linux/netfilter_ipv6/ip6_tables.h>
12 MODULE_DESCRIPTION("x_tables match for TCP and UDP, supports IPv4 and IPv6");
13 MODULE_LICENSE("GPL");
14 MODULE_ALIAS("xt_tcp");
15 MODULE_ALIAS("xt_udp");
16 MODULE_ALIAS("ipt_udp");
17 MODULE_ALIAS("ipt_tcp");
18 MODULE_ALIAS("ip6t_udp");
19 MODULE_ALIAS("ip6t_tcp");
21 #ifdef DEBUG_IP_FIREWALL_USER
22 #define duprintf(format, args...) printk(format , ## args)
24 #define duprintf(format, args...)
28 /* Returns 1 if the port is matched by the range, 0 otherwise */
30 port_match(u_int16_t min, u_int16_t max, u_int16_t port, int invert)
34 ret = (port >= min && port <= max) ^ invert;
39 tcp_find_option(u_int8_t option,
40 const struct sk_buff *skb,
46 /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
47 u_int8_t _opt[60 - sizeof(struct tcphdr)], *op;
50 duprintf("tcp_match: finding option\n");
55 /* If we don't have the whole header, drop packet. */
56 op = skb_header_pointer(skb, protoff + sizeof(struct tcphdr),
63 for (i = 0; i < optlen; ) {
64 if (op[i] == option) return !invert;
73 tcp_match(const struct sk_buff *skb,
74 const struct net_device *in,
75 const struct net_device *out,
76 const void *matchinfo,
81 struct tcphdr _tcph, *th;
82 const struct xt_tcp *tcpinfo = matchinfo;
87 Don't allow a fragment of TCP 8 bytes in. Nobody normal
88 causes this. Its a cracker trying to break in by doing a
89 flag overwrite to pass the direction checks.
92 duprintf("Dropping evil TCP offset=1 frag.\n");
95 /* Must not be a fragment. */
99 #define FWINVTCP(bool,invflg) ((bool) ^ !!(tcpinfo->invflags & invflg))
101 th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
103 /* We've been asked to examine this packet, and we
104 can't. Hence, no choice but to drop. */
105 duprintf("Dropping evil TCP offset=0 tinygram.\n");
110 if (!port_match(tcpinfo->spts[0], tcpinfo->spts[1],
112 !!(tcpinfo->invflags & XT_TCP_INV_SRCPT)))
114 if (!port_match(tcpinfo->dpts[0], tcpinfo->dpts[1],
116 !!(tcpinfo->invflags & XT_TCP_INV_DSTPT)))
118 if (!FWINVTCP((((unsigned char *)th)[13] & tcpinfo->flg_mask)
122 if (tcpinfo->option) {
123 if (th->doff * 4 < sizeof(_tcph)) {
127 if (!tcp_find_option(tcpinfo->option, skb, protoff,
128 th->doff*4 - sizeof(_tcph),
129 tcpinfo->invflags & XT_TCP_INV_OPTION,
136 /* Called when user tries to insert an entry of this type. */
138 tcp_checkentry(const char *tablename,
141 unsigned int matchsize,
142 unsigned int hook_mask)
144 const struct ipt_ip *ip = info;
145 const struct xt_tcp *tcpinfo = matchinfo;
147 /* Must specify proto == TCP, and no unknown invflags */
148 return ip->proto == IPPROTO_TCP
149 && !(ip->invflags & XT_INV_PROTO)
150 && matchsize == XT_ALIGN(sizeof(struct xt_tcp))
151 && !(tcpinfo->invflags & ~XT_TCP_INV_MASK);
154 /* Called when user tries to insert an entry of this type. */
156 tcp6_checkentry(const char *tablename,
159 unsigned int matchsize,
160 unsigned int hook_mask)
162 const struct ip6t_ip6 *ipv6 = entry;
163 const struct xt_tcp *tcpinfo = matchinfo;
165 /* Must specify proto == TCP, and no unknown invflags */
166 return ipv6->proto == IPPROTO_TCP
167 && !(ipv6->invflags & XT_INV_PROTO)
168 && matchsize == XT_ALIGN(sizeof(struct xt_tcp))
169 && !(tcpinfo->invflags & ~XT_TCP_INV_MASK);
174 udp_match(const struct sk_buff *skb,
175 const struct net_device *in,
176 const struct net_device *out,
177 const void *matchinfo,
179 unsigned int protoff,
182 struct udphdr _udph, *uh;
183 const struct xt_udp *udpinfo = matchinfo;
185 /* Must not be a fragment. */
189 uh = skb_header_pointer(skb, protoff, sizeof(_udph), &_udph);
191 /* We've been asked to examine this packet, and we
192 can't. Hence, no choice but to drop. */
193 duprintf("Dropping evil UDP tinygram.\n");
198 return port_match(udpinfo->spts[0], udpinfo->spts[1],
200 !!(udpinfo->invflags & XT_UDP_INV_SRCPT))
201 && port_match(udpinfo->dpts[0], udpinfo->dpts[1],
203 !!(udpinfo->invflags & XT_UDP_INV_DSTPT));
206 /* Called when user tries to insert an entry of this type. */
208 udp_checkentry(const char *tablename,
211 unsigned int matchinfosize,
212 unsigned int hook_mask)
214 const struct ipt_ip *ip = info;
215 const struct xt_udp *udpinfo = matchinfo;
217 /* Must specify proto == UDP, and no unknown invflags */
218 if (ip->proto != IPPROTO_UDP || (ip->invflags & XT_INV_PROTO)) {
219 duprintf("ipt_udp: Protocol %u != %u\n", ip->proto,
223 if (matchinfosize != XT_ALIGN(sizeof(struct xt_udp))) {
224 duprintf("ipt_udp: matchsize %u != %u\n",
225 matchinfosize, XT_ALIGN(sizeof(struct xt_udp)));
228 if (udpinfo->invflags & ~XT_UDP_INV_MASK) {
229 duprintf("ipt_udp: unknown flags %X\n",
237 /* Called when user tries to insert an entry of this type. */
239 udp6_checkentry(const char *tablename,
242 unsigned int matchinfosize,
243 unsigned int hook_mask)
245 const struct ip6t_ip6 *ipv6 = entry;
246 const struct xt_udp *udpinfo = matchinfo;
248 /* Must specify proto == UDP, and no unknown invflags */
249 if (ipv6->proto != IPPROTO_UDP || (ipv6->invflags & XT_INV_PROTO)) {
250 duprintf("ip6t_udp: Protocol %u != %u\n", ipv6->proto,
254 if (matchinfosize != XT_ALIGN(sizeof(struct xt_udp))) {
255 duprintf("ip6t_udp: matchsize %u != %u\n",
256 matchinfosize, XT_ALIGN(sizeof(struct xt_udp)));
259 if (udpinfo->invflags & ~XT_UDP_INV_MASK) {
260 duprintf("ip6t_udp: unknown flags %X\n",
268 static struct xt_match tcp_matchstruct = {
271 .checkentry = &tcp_checkentry,
274 static struct xt_match tcp6_matchstruct = {
277 .checkentry = &tcp6_checkentry,
281 static struct xt_match udp_matchstruct = {
284 .checkentry = &udp_checkentry,
287 static struct xt_match udp6_matchstruct = {
290 .checkentry = &udp6_checkentry,
294 static int __init init(void)
297 ret = xt_register_match(AF_INET, &tcp_matchstruct);
301 ret = xt_register_match(AF_INET6, &tcp6_matchstruct);
305 ret = xt_register_match(AF_INET, &udp_matchstruct);
309 ret = xt_register_match(AF_INET6, &udp6_matchstruct);
316 xt_unregister_match(AF_INET, &tcp_matchstruct);
318 xt_unregister_match(AF_INET6, &tcp6_matchstruct);
320 xt_unregister_match(AF_INET, &tcp_matchstruct);
324 static void __exit fini(void)
326 xt_unregister_match(AF_INET6, &udp6_matchstruct);
327 xt_unregister_match(AF_INET, &udp_matchstruct);
328 xt_unregister_match(AF_INET6, &tcp6_matchstruct);
329 xt_unregister_match(AF_INET, &tcp_matchstruct);