[mirror_ubuntu-artful-kernel.git] / net / netfilter / xt_tcpudp.c

#include <linux/types.h>
#include <linux/module.h>
#include <net/ip.h>
#include <linux/ipv6.h>
#include <net/ipv6.h>
#include <net/tcp.h>
#include <net/udp.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_tcpudp.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>

MODULE_DESCRIPTION("Xtables: TCP, UDP and UDP-Lite match");
MODULE_LICENSE("GPL");
MODULE_ALIAS("xt_tcp");
MODULE_ALIAS("xt_udp");
MODULE_ALIAS("ipt_udp");
MODULE_ALIAS("ipt_tcp");
MODULE_ALIAS("ip6t_udp");
MODULE_ALIAS("ip6t_tcp");

#ifdef DEBUG_IP_FIREWALL_USER
#define duprintf(format, args...) printk(format , ## args)
#else
#define duprintf(format, args...)
#endif


/* Returns 1 if the port is matched by the range, 0 otherwise */
static inline bool
port_match(u_int16_t min, u_int16_t max, u_int16_t port, bool invert)
{
	return (port >= min && port <= max) ^ invert;
}

static bool
tcp_find_option(u_int8_t option,
		const struct sk_buff *skb,
		unsigned int protoff,
		unsigned int optlen,
		bool invert,
		bool *hotdrop)
{
	/* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
	u_int8_t _opt[60 - sizeof(struct tcphdr)], *op;
	unsigned int i;

	duprintf("tcp_match: finding option\n");

	if (!optlen)
		return invert;

	/* If we don't have the whole header, drop packet. */
	op = skb_header_pointer(skb, protoff + sizeof(struct tcphdr),
				optlen, _opt);
	if (op == NULL) {
		*hotdrop = true;
		return false;
	}

	for (i = 0; i < optlen; ) {
		if (op[i] == option) return !invert;
		if (op[i] < 2) i++;
		else i += op[i+1]?:1;
	}

	return invert;
}

static bool
tcp_mt(const struct sk_buff *skb, const struct net_device *in,
       const struct net_device *out, const struct xt_match *match,
       const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{
	struct tcphdr _tcph, *th;
	const struct xt_tcp *tcpinfo = matchinfo;

	if (offset) {
		/* To quote Alan:

		   Don't allow a fragment of TCP 8 bytes in. Nobody normal
		   causes this. Its a cracker trying to break in by doing a
		   flag overwrite to pass the direction checks.
		*/
		if (offset == 1) {
			duprintf("Dropping evil TCP offset=1 frag.\n");
			*hotdrop = true;
		}
		/* Must not be a fragment. */
		return false;
	}

#define FWINVTCP(bool, invflg) ((bool) ^ !!(tcpinfo->invflags & (invflg)))

	th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
	if (th == NULL) {
		/* We've been asked to examine this packet, and we
		   can't.  Hence, no choice but to drop. */
		duprintf("Dropping evil TCP offset=0 tinygram.\n");
		*hotdrop = true;
		return false;
	}

	if (!port_match(tcpinfo->spts[0], tcpinfo->spts[1],
			ntohs(th->source),
			!!(tcpinfo->invflags & XT_TCP_INV_SRCPT)))
		return false;
	if (!port_match(tcpinfo->dpts[0], tcpinfo->dpts[1],
			ntohs(th->dest),
			!!(tcpinfo->invflags & XT_TCP_INV_DSTPT)))
		return false;
	if (!FWINVTCP((((unsigned char *)th)[13] & tcpinfo->flg_mask)
		      == tcpinfo->flg_cmp,
		      XT_TCP_INV_FLAGS))
		return false;
	if (tcpinfo->option) {
		if (th->doff * 4 < sizeof(_tcph)) {
			*hotdrop = true;
			return false;
		}
		if (!tcp_find_option(tcpinfo->option, skb, protoff,
				     th->doff*4 - sizeof(_tcph),
				     tcpinfo->invflags & XT_TCP_INV_OPTION,
				     hotdrop))
			return false;
	}
	return true;
}

/* Called when user tries to insert an entry of this type. */
static bool
tcp_mt_check(const char *tablename, const void *info,
             const struct xt_match *match, void *matchinfo,
             unsigned int hook_mask)
{
	const struct xt_tcp *tcpinfo = matchinfo;

	/* Must specify no unknown invflags */
	return !(tcpinfo->invflags & ~XT_TCP_INV_MASK);
}

static bool
udp_mt(const struct sk_buff *skb, const struct net_device *in,
       const struct net_device *out, const struct xt_match *match,
       const void *matchinfo, int offset, unsigned int protoff, bool *hotdrop)
{
	struct udphdr _udph, *uh;
	const struct xt_udp *udpinfo = matchinfo;

	/* Must not be a fragment. */
	if (offset)
		return false;

	uh = skb_header_pointer(skb, protoff, sizeof(_udph), &_udph);
	if (uh == NULL) {
		/* We've been asked to examine this packet, and we
		   can't.  Hence, no choice but to drop. */
		duprintf("Dropping evil UDP tinygram.\n");
		*hotdrop = true;
		return false;
	}

	return port_match(udpinfo->spts[0], udpinfo->spts[1],
			  ntohs(uh->source),
			  !!(udpinfo->invflags & XT_UDP_INV_SRCPT))
		&& port_match(udpinfo->dpts[0], udpinfo->dpts[1],
			      ntohs(uh->dest),
			      !!(udpinfo->invflags & XT_UDP_INV_DSTPT));
}

/* Called when user tries to insert an entry of this type. */
static bool
udp_mt_check(const char *tablename, const void *info,
             const struct xt_match *match, void *matchinfo,
             unsigned int hook_mask)
{
	const struct xt_udp *udpinfo = matchinfo;

	/* Must specify no unknown invflags */
	return !(udpinfo->invflags & ~XT_UDP_INV_MASK);
}

static struct xt_match tcpudp_mt_reg[] __read_mostly = {
	{
		.name		= "tcp",
		.family		= AF_INET,
		.checkentry	= tcp_mt_check,
		.match		= tcp_mt,
		.matchsize	= sizeof(struct xt_tcp),
		.proto		= IPPROTO_TCP,
		.me		= THIS_MODULE,
	},
	{
		.name		= "tcp",
		.family		= AF_INET6,
		.checkentry	= tcp_mt_check,
		.match		= tcp_mt,
		.matchsize	= sizeof(struct xt_tcp),
		.proto		= IPPROTO_TCP,
		.me		= THIS_MODULE,
	},
	{
		.name		= "udp",
		.family		= AF_INET,
		.checkentry	= udp_mt_check,
		.match		= udp_mt,
		.matchsize	= sizeof(struct xt_udp),
		.proto		= IPPROTO_UDP,
		.me		= THIS_MODULE,
	},
	{
		.name		= "udp",
		.family		= AF_INET6,
		.checkentry	= udp_mt_check,
		.match		= udp_mt,
		.matchsize	= sizeof(struct xt_udp),
		.proto		= IPPROTO_UDP,
		.me		= THIS_MODULE,
	},
	{
		.name		= "udplite",
		.family		= AF_INET,
		.checkentry	= udp_mt_check,
		.match		= udp_mt,
		.matchsize	= sizeof(struct xt_udp),
		.proto		= IPPROTO_UDPLITE,
		.me		= THIS_MODULE,
	},
	{
		.name		= "udplite",
		.family		= AF_INET6,
		.checkentry	= udp_mt_check,
		.match		= udp_mt,
		.matchsize	= sizeof(struct xt_udp),
		.proto		= IPPROTO_UDPLITE,
		.me		= THIS_MODULE,
	},
};

static int __init tcpudp_mt_init(void)
{
	return xt_register_matches(tcpudp_mt_reg, ARRAY_SIZE(tcpudp_mt_reg));
}

static void __exit tcpudp_mt_exit(void)
{
	xt_unregister_matches(tcpudp_mt_reg, ARRAY_SIZE(tcpudp_mt_reg));
}

module_init(tcpudp_mt_init);
module_exit(tcpudp_mt_exit);
Commit	Line	Data
2e4e6a17 HW	1	#include <linux/types.h>
	2	#include <linux/module.h>
	3	#include <net/ip.h>
37d8dc82	4	#include <linux/ipv6.h>
2e4e6a17 HW	5	#include <net/ipv6.h>
	6	#include <net/tcp.h>
	7	#include <net/udp.h>
	8	#include <linux/netfilter/x_tables.h>
	9	#include <linux/netfilter/xt_tcpudp.h>
	10	#include <linux/netfilter_ipv4/ip_tables.h>
	11	#include <linux/netfilter_ipv6/ip6_tables.h>
	12
2ae15b64	13	MODULE_DESCRIPTION("Xtables: TCP, UDP and UDP-Lite match");
2e4e6a17 HW	14	MODULE_LICENSE("GPL");
	15	MODULE_ALIAS("xt_tcp");
	16	MODULE_ALIAS("xt_udp");
	17	MODULE_ALIAS("ipt_udp");
	18	MODULE_ALIAS("ipt_tcp");
	19	MODULE_ALIAS("ip6t_udp");
	20	MODULE_ALIAS("ip6t_tcp");
	21
	22	#ifdef DEBUG_IP_FIREWALL_USER
	23	#define duprintf(format, args...) printk(format , ## args)
	24	#else
	25	#define duprintf(format, args...)
	26	#endif
	27
	28
	29	/* Returns 1 if the port is matched by the range, 0 otherwise */
1d93a9cb JE	30	static inline bool
1d93a9cb JE	31	port_match(u_int16_t min, u_int16_t max, u_int16_t port, bool invert)
2e4e6a17	32	{
1d93a9cb	33	return (port >= min && port <= max) ^ invert;
2e4e6a17 HW	34	}
2e4e6a17 HW	35
1d93a9cb	36	static bool
2e4e6a17 HW	37	tcp_find_option(u_int8_t option,
	38	const struct sk_buff *skb,
	39	unsigned int protoff,
	40	unsigned int optlen,
1d93a9cb	41	bool invert,
cff533ac	42	bool *hotdrop)
2e4e6a17 HW	43	{
	44	/* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
	45	u_int8_t _opt[60 - sizeof(struct tcphdr)], *op;
	46	unsigned int i;
	47
	48	duprintf("tcp_match: finding option\n");
	49
	50	if (!optlen)
	51	return invert;
	52
	53	/* If we don't have the whole header, drop packet. */
	54	op = skb_header_pointer(skb, protoff + sizeof(struct tcphdr),
	55	optlen, _opt);
	56	if (op == NULL) {
cff533ac	57	*hotdrop = true;
1d93a9cb	58	return false;
2e4e6a17 HW	59	}
	60
	61	for (i = 0; i < optlen; ) {
	62	if (op[i] == option) return !invert;
	63	if (op[i] < 2) i++;
	64	else i += op[i+1]?:1;
	65	}
	66
	67	return invert;
	68	}
	69
1d93a9cb	70	static bool
d3c5ee6d JE	71	tcp_mt(const struct sk_buff skb, const struct net_device in,
	72	const struct net_device out, const struct xt_match match,
	73	const void matchinfo, int offset, unsigned int protoff, bool hotdrop)
2e4e6a17 HW	74	{
	75	struct tcphdr _tcph, *th;
	76	const struct xt_tcp *tcpinfo = matchinfo;
	77
	78	if (offset) {
	79	/* To quote Alan:
	80
	81	Don't allow a fragment of TCP 8 bytes in. Nobody normal
	82	causes this. Its a cracker trying to break in by doing a
	83	flag overwrite to pass the direction checks.
	84	*/
	85	if (offset == 1) {
	86	duprintf("Dropping evil TCP offset=1 frag.\n");
cff533ac	87	*hotdrop = true;
2e4e6a17 HW	88	}
2e4e6a17 HW	89	/* Must not be a fragment. */
1d93a9cb	90	return false;
2e4e6a17 HW	91	}
2e4e6a17 HW	92
7c4e36bc	93	#define FWINVTCP(bool, invflg) ((bool) ^ !!(tcpinfo->invflags & (invflg)))
2e4e6a17 HW	94
	95	th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
	96	if (th == NULL) {
	97	/* We've been asked to examine this packet, and we
	98	can't. Hence, no choice but to drop. */
	99	duprintf("Dropping evil TCP offset=0 tinygram.\n");
cff533ac	100	*hotdrop = true;
1d93a9cb	101	return false;
2e4e6a17 HW	102	}
	103
	104	if (!port_match(tcpinfo->spts[0], tcpinfo->spts[1],
	105	ntohs(th->source),
	106	!!(tcpinfo->invflags & XT_TCP_INV_SRCPT)))
1d93a9cb	107	return false;
2e4e6a17 HW	108	if (!port_match(tcpinfo->dpts[0], tcpinfo->dpts[1],
	109	ntohs(th->dest),
	110	!!(tcpinfo->invflags & XT_TCP_INV_DSTPT)))
1d93a9cb	111	return false;
2e4e6a17 HW	112	if (!FWINVTCP((((unsigned char *)th)[13] & tcpinfo->flg_mask)
	113	== tcpinfo->flg_cmp,
	114	XT_TCP_INV_FLAGS))
1d93a9cb	115	return false;
2e4e6a17 HW	116	if (tcpinfo->option) {
2e4e6a17 HW	117	if (th->doff * 4 < sizeof(_tcph)) {
cff533ac	118	*hotdrop = true;
1d93a9cb	119	return false;
2e4e6a17 HW	120	}
	121	if (!tcp_find_option(tcpinfo->option, skb, protoff,
	122	th->doff*4 - sizeof(_tcph),
	123	tcpinfo->invflags & XT_TCP_INV_OPTION,
	124	hotdrop))
1d93a9cb	125	return false;
2e4e6a17	126	}
1d93a9cb	127	return true;
2e4e6a17 HW	128	}
	129
	130	/* Called when user tries to insert an entry of this type. */
ccb79bdc	131	static bool
d3c5ee6d JE	132	tcp_mt_check(const char tablename, const void info,
	133	const struct xt_match match, void matchinfo,
	134	unsigned int hook_mask)
2e4e6a17	135	{
2e4e6a17 HW	136	const struct xt_tcp *tcpinfo = matchinfo;
2e4e6a17 HW	137
5d04bff0 PM	138	/* Must specify no unknown invflags */
5d04bff0 PM	139	return !(tcpinfo->invflags & ~XT_TCP_INV_MASK);
2e4e6a17 HW	140	}
2e4e6a17 HW	141
1d93a9cb	142	static bool
d3c5ee6d JE	143	udp_mt(const struct sk_buff skb, const struct net_device in,
	144	const struct net_device out, const struct xt_match match,
	145	const void matchinfo, int offset, unsigned int protoff, bool hotdrop)
2e4e6a17 HW	146	{
	147	struct udphdr _udph, *uh;
	148	const struct xt_udp *udpinfo = matchinfo;
	149
	150	/* Must not be a fragment. */
	151	if (offset)
1d93a9cb	152	return false;
2e4e6a17 HW	153
	154	uh = skb_header_pointer(skb, protoff, sizeof(_udph), &_udph);
	155	if (uh == NULL) {
	156	/* We've been asked to examine this packet, and we
	157	can't. Hence, no choice but to drop. */
	158	duprintf("Dropping evil UDP tinygram.\n");
cff533ac	159	*hotdrop = true;
1d93a9cb	160	return false;
2e4e6a17 HW	161	}
	162
	163	return port_match(udpinfo->spts[0], udpinfo->spts[1],
	164	ntohs(uh->source),
	165	!!(udpinfo->invflags & XT_UDP_INV_SRCPT))
	166	&& port_match(udpinfo->dpts[0], udpinfo->dpts[1],
	167	ntohs(uh->dest),
	168	!!(udpinfo->invflags & XT_UDP_INV_DSTPT));
	169	}
	170
	171	/* Called when user tries to insert an entry of this type. */
ccb79bdc	172	static bool
d3c5ee6d JE	173	udp_mt_check(const char tablename, const void info,
	174	const struct xt_match match, void matchinfo,
	175	unsigned int hook_mask)
2e4e6a17	176	{
a289d70d	177	const struct xt_udp *udpinfo = matchinfo;
2e4e6a17	178
5d04bff0 PM	179	/* Must specify no unknown invflags */
5d04bff0 PM	180	return !(udpinfo->invflags & ~XT_UDP_INV_MASK);
2e4e6a17 HW	181	}
2e4e6a17 HW	182
d3c5ee6d	183	static struct xt_match tcpudp_mt_reg[] __read_mostly = {
4470bbc7 PM	184	{
	185	.name = "tcp",
	186	.family = AF_INET,
d3c5ee6d JE	187	.checkentry = tcp_mt_check,
d3c5ee6d JE	188	.match = tcp_mt,
4470bbc7 PM	189	.matchsize = sizeof(struct xt_tcp),
	190	.proto = IPPROTO_TCP,
	191	.me = THIS_MODULE,
	192	},
	193	{
	194	.name = "tcp",
	195	.family = AF_INET6,
d3c5ee6d JE	196	.checkentry = tcp_mt_check,
d3c5ee6d JE	197	.match = tcp_mt,
4470bbc7 PM	198	.matchsize = sizeof(struct xt_tcp),
	199	.proto = IPPROTO_TCP,
	200	.me = THIS_MODULE,
	201	},
	202	{
	203	.name = "udp",
	204	.family = AF_INET,
d3c5ee6d JE	205	.checkentry = udp_mt_check,
d3c5ee6d JE	206	.match = udp_mt,
4470bbc7 PM	207	.matchsize = sizeof(struct xt_udp),
	208	.proto = IPPROTO_UDP,
	209	.me = THIS_MODULE,
	210	},
	211	{
	212	.name = "udp",
	213	.family = AF_INET6,
d3c5ee6d JE	214	.checkentry = udp_mt_check,
d3c5ee6d JE	215	.match = udp_mt,
4470bbc7 PM	216	.matchsize = sizeof(struct xt_udp),
	217	.proto = IPPROTO_UDP,
	218	.me = THIS_MODULE,
	219	},
ba4e58ec GR	220	{
	221	.name = "udplite",
	222	.family = AF_INET,
d3c5ee6d JE	223	.checkentry = udp_mt_check,
d3c5ee6d JE	224	.match = udp_mt,
ba4e58ec GR	225	.matchsize = sizeof(struct xt_udp),
	226	.proto = IPPROTO_UDPLITE,
	227	.me = THIS_MODULE,
	228	},
	229	{
	230	.name = "udplite",
	231	.family = AF_INET6,
d3c5ee6d JE	232	.checkentry = udp_mt_check,
d3c5ee6d JE	233	.match = udp_mt,
ba4e58ec GR	234	.matchsize = sizeof(struct xt_udp),
	235	.proto = IPPROTO_UDPLITE,
	236	.me = THIS_MODULE,
	237	},
2e4e6a17 HW	238	};
2e4e6a17 HW	239
d3c5ee6d	240	static int __init tcpudp_mt_init(void)
2e4e6a17	241	{
d3c5ee6d	242	return xt_register_matches(tcpudp_mt_reg, ARRAY_SIZE(tcpudp_mt_reg));
2e4e6a17 HW	243	}
2e4e6a17 HW	244
d3c5ee6d	245	static void __exit tcpudp_mt_exit(void)
2e4e6a17	246	{
d3c5ee6d	247	xt_unregister_matches(tcpudp_mt_reg, ARRAY_SIZE(tcpudp_mt_reg));
2e4e6a17 HW	248	}
2e4e6a17 HW	249
d3c5ee6d JE	250	module_init(tcpudp_mt_init);
d3c5ee6d JE	251	module_exit(tcpudp_mt_exit);